Conditional Access lets an admin say things like "finance staff can only sign in from company laptops" or "ask for MFA again from a new country." It is one of the main ways to narrow who can sign in and from where.
It is only as good as its rules. Gaps, exceptions and old policies are common, and it acts at sign-in, so a session stolen after sign-in needs watching too.
How Centeye handles it
Centeye Gatewatch watches the sign-ins and sessions that get through, across every client tenant.
Gatewatch: identity protection (ITDR) →Go deeper: Token theft in Microsoft 365