Conditional Access Policy vs Azure Policy

Its easier to think in terms of access control: Subject –> Access –> Object.

Conditional Access Policies are for the Subject

Azure Policy is for the Object

Here is a comparison

Feature	Conditional Access Policy	Custom Azure Policy
Primary purpose	Control user sign-in access	Enforce resource compliance
Scope	Identities (users, groups, apps)	Azure resources (VMs, storage, etc.)
Layer	Identity / authentication	Resource governance
Service	Microsoft Entra ID	Azure Policy
Trigger	User login attempt	Resource creation/update
Example action	Require MFA	Deny non-compliant resource
Enforcement	Real-time during login	Real-time + audit/remediation

Azure Policy can be assigned to: TenantRootGroup, ManagementGroup, Subscription, Resource Group and Individual Resource Levels