Defend · Conditional access
Microsoft 365
In Microsoft 365, conditional access is a set of policies in Microsoft Entra ID. These are the ones we set, and the order we switch them on.
Policies, not one switch.
Microsoft 365 ships with security defaults: a second factor for everyone, for admin roles on every sign-in, and legacy sign-in blocked. What they can’t do is set conditions: nothing by device, place or app, no exceptions, and no report-only mode that shows what a rule would stop before it stops anyone. Conditional access in Microsoft Entra ID replaces the defaults with named policies, each saying who it applies to, under which conditions and what it requires. The rules themselves are on the conditional access page; this page is what they look like in Entra ID, and the order they go on.
The policies
The set we start from.
Five policies, and the order they go on. What your firm needs beyond them is decided with you and goes on record.
-
Five policies, as Entra ID names them
Multi-factor authentication for all users; for admin roles on every sign-in; legacy authentication blocked; a compliant device for company data; sign-in only from named locations. Each is exported as it is set, with the date, and the export goes into your evidence file.
-
Legacy sign-in blocked across the tenant
The block covers the older protocols that can’t ask for a second factor, so a password alone opens nothing, whichever app it’s typed into. Before it goes on, the sign-in log shows which devices and mailboxes still use them, and those are moved first.
-
Named locations
Your offices and the countries your people work from are named locations in Entra ID, by address range or by country, and the place policy points at them. A trip is an entry with a start and an end date, not a policy switched off.
-
The licence tier it needs
Conditional access belongs to an Entra ID tier that not every Microsoft 365 plan includes. We check which plan your seats are on before the first policy goes on, so no rule fails on a licence.
-
Emergency access first, and out of every rule
Before the first policy goes on, an emergency access account is set up: excluded from every rule, its credentials in the vault, every sign-in to it raising an alert. It’s how we get back in if a policy ever locks everyone else out.
-
The switch-on order
Each policy runs in report-only mode first. We read what it would have stopped, then switch it on: admins first, then everyone, and device rules only once every laptop is enrolled.
On record
On record for Microsoft 365.
- Each policy, exported as it is set, with the date
- The named locations and the device rules
- The exceptions, each with its reason, owner and review date
- The sign-in report Entra ID keeps, for an insurer’s or a client’s question
What we find in tenants we take over.
-
Security defaults off, nothing in their place
Someone switched the defaults off to make an exception, and the second factor went with them.
-
Policies in report-only mode for a year
Set up once, never switched on. The report shows what should have been stopped.
-
A policy that excludes everyone who matters
So many exclusions that the people with the most access are the ones the policy doesn’t cover.
Questions we get
We already have security defaults on. Isn’t that enough?
Security defaults give everyone a second factor, ask admins for it on every sign-in and block legacy sign-in, and that’s a good start. They can’t set a condition by device, place or app, allow an exception, or run in report-only mode first. Conditional access can, and it replaces the defaults, so the switch is planned, not thrown.
How long does it take to switch on?
The policies themselves are quick. What takes time is the report-only phase and the devices: every laptop has to be enrolled before a device rule goes on, or the rule locks out the people it should protect. We plan that order with you.
Can a policy lock us out of our own tenant?
It can, which is why emergency access is set up before the first policy goes on, kept out of every rule and watched. Admins first, report-only first, then everyone: the order is what keeps the door open.
Start
What do your policies say today?
In a first call we look at your tenant’s policies as they are, what sits in report-only mode, and which accounts fall through.
- No first level
- No surprises
- Pilot before you buy