Defend
Conditional access
A password alone opens nothing: conditional access checks who is signing in, from where and on which device, and asks again when something doesn’t fit.
A password alone opens nothing.
Attackers rarely crack a file. They sign in, with a password from a phishing mail or one reused somewhere else. Conditional access is the rule set in Microsoft Entra ID that decides, at every sign-in, whether that sign-in fits your firm: a known person, a second factor, a managed device, a place you work from. What doesn’t fit is asked again, or stopped.
What we set up
Rules written for how your firm works.
The rules are decided with you and written down, so nobody goes looking for workarounds and nobody is locked out on a deadline day.
-
A second factor for everyone
Every sign-in needs more than a password. No exception for leadership or admins: those are exactly the accounts attackers want.
-
Managed devices only
Confidential files open on devices we manage and keep to the documented baseline. A private laptop or an unknown phone gets as far as the sign-in page, and no further.
-
The place
Sign-ins from countries your firm doesn’t work from are stopped. When a colleague travels, the rule is widened for that trip and narrowed again afterwards.
-
Admin roles, protected harder
Admin accounts get the strictest rules and are never used for everyday work.
-
Exceptions with a date
A rule that would stop real work gets an exception: decided deliberately by your TechPilot, written down with a date, and reviewed. Instead of a policy someone quietly switches off.
-
Report first, then enforce
A new rule runs in report-only mode first. We see what it would have stopped before it stops anyone.
By platform
Where it runs.
Conditional access is a feature of Microsoft Entra ID; the policies we set are on the Microsoft 365 page.
On record
In your evidence file.
- The rules in force: who they apply to and what they require
- The exceptions, each with its reason, its owner and its date
- When the rules were last reviewed
- The sign-in report, for the day an insurer or a client asks how sign-in is protected
Ready for your insurer’s questionnaire and a client’s security questions, on the day they come.
What usually goes wrong without it.
-
A second factor for most, not for all
The one account without a second factor is the one that gets taken over. Usually it’s a shared mailbox, a former colleague or an admin.
-
Rules nobody reviews
A rule written for last year’s office quietly stays, or quietly gets switched off after one complaint. Nobody notices until the questionnaire asks.
-
The lockout on deadline day
A rule written without your firm’s rhythm locks out the one person who has to file something at five to midnight. The rules have to know how your firm works.
Also under Defend
- Email security Spam, phishing and malware filtered out before a mail reaches anyone, with long-term archiving.
- Multi-factor sign-in A second factor for every account, so a stolen password on its own opens nothing.
- Device protection Managed protection and threat detection on every laptop, workstation and server, to a documented baseline.
- Patching and vulnerability management Updates rolled out from one place, and the gaps that remain found and closed.
- Admin access Admin rights for few, by name; passwords in a vault; every use logged. Our own keys first.
- Backups and restore tests Backed up, restored on purpose before you need it, dated, and kept for the years you’re bound.
- Security monitoring Devices, sign-ins and systems watched centrally; what the monitoring found, reviewed by our engineers, and what we changed.
- Access reviews Who can open what, reviewed with you, so access that made sense last year doesn’t quietly stay.
- Incident response When someone clicks, or a server shows a ransom note: the same sequence every time, ending in the record.
- The evidence file What protects your firm, written down as it is, ready on the day an insurer, a client or an auditor asks.
- Insurer and client questionnaires Your insurer’s and your clients’ security questionnaires, answered with what’s true today, the gaps closed before renewal.
- Changing provider The old provider’s software and access removed, with a written check that nobody keeps a way in.
Questions we get
Will conditional access slow my people down?
Once a device is enrolled and the second factor is set up, a normal working day asks for nothing extra. The rules only step in when something doesn’t fit: a new device, a new country, a sign-in at an odd hour.
What about a colleague working from abroad?
Tell us before the trip. The rule is widened for that person and that period, and narrowed again afterwards. It goes on record.
Do we need particular Microsoft licences?
Conditional access needs the Entra ID licence tier that includes it; many Microsoft 365 business plans do. We check your licences before anything is switched on and size them to the people you actually have.
Can you show an insurer that it’s in place?
Yes. The rules and their exceptions are in your evidence file, as they’re set up, with the date they were last reviewed.
Start
Who can sign in to your firm today?
In a first call we go through who can sign in from where, which accounts have a second factor, and what your sign-in rules would look like written down.
- No first level
- No surprises
- Pilot before you buy