Group related Conditional Access policies into policy plans and define users, apps and conditions once for every rule in the plan. Add a rule for each requirement, like phishing-resistant MFA or compliant devices, and keep the shared scope in one place.
Build a plan around a user group, like headquarters staff, or a shared condition, like high agent risk, and start fro...