Conditional Access for Microsoft Entra ID
Conditional Access decides at every sign-in who reaches your data and under which conditions. I set up these policies so that they protect without locking anyone out, and document them so that your team can carry them forward.
Typical starting point
Microsoft 365 can be reached from anywhere
Anyone with a user name and password gets in from any device in the world. The question is not whether that is enough, but how to change it without disturbing operations.
Too many administrative rights without control
Permanent admin roles, grown over time, with no strong sign-in and no log. These accounts need the strictest rules of all.
Policies nobody can explain any more
Some rules already exist, with unclear names and exceptions whose reason nobody remembers. Nobody dares to touch them.
What I implement
- Break-glass accounts: two cloud-only accounts, excluded from all policies, sign-ins monitored
- MFA for all users and strong, phishing-resistant MFA for administrators
- Blocking legacy authentication and the device code flow
- Access only from compliant devices, once the devices are managed in Intune
- Consistent naming, for example CA01-MFA-AllUsers, and justified exceptions
- Analysis in the sign-in log: who would have been blocked, and why
Approach
1. Understand
Export and back up existing policies, check licences and admin roles, record special cases such as scan-to-mail or service accounts.
2. Design
Define the policy set, names, target groups and exceptions. In a grown tenant, device compliance comes last, because it requires all devices to be managed and compliant already.
3. Implement
Break-glass accounts first, then each policy in report-only mode. For every hit in the sign-in log there is a decision: exception, change, or deliberately block. Then a pilot group, then rollout in waves.
4. Hand over
A runbook with the way back for each policy: set to “off”, it stops applying from the next token request. Your team knows what each rule is for and how to treat new cases.
What you get
- Documented policies with consistent names
- A list of exceptions, each with its reason
- Break-glass accounts with sign-in monitoring
- Handover runbook with the way back and the procedure for new applications
“Conditional Access baseline” package
- One Microsoft 365 tenant with Business Premium or Entra ID P1, up to 150 users.
- Break-glass accounts, a pilot group and five policies: MFA for all, block legacy authentication, strong MFA for admins, block device code flow, compliant device. All are tested in report-only mode first. The first four are enforced after your approval; “compliant device” stays in report-only mode until after the Intune rollout (follow-up work).
- Documented policies with consistent names, justified exceptions, handover runbook.
- 3–4 person-days. Fixed price on request. Also available as white-label delivery for system integrators.
Link to regulations
MFA, access control and logging are typical requirements of ISO 27001 and NIS2. The implementation provides technical evidence for them: policies, sign-in logs and runbooks. It does not replace compliance advice and does not by itself make a company compliant.
Backed by
The rollout procedure and the compliance policies for Windows and macOS are documented in the lab. The policies there were evaluated in report-only mode and were no longer enforced in the now closed test tenant.
Common questions
Can a policy lock us out?
A wrongly enforced policy can, even for admins. That is why break-glass accounts come first, then report-only mode and the pilot group, and the way back is documented for every policy.
Which licence do we need?
Conditional Access requires Entra ID P1, which is included in Microsoft 365 Business Premium, for example. Checking whether your tenant has it is my first step.
Have you implemented this for clients?
My Entra experience comes from my own test tenants, the procedure is publicly documented, and the SC-300 certification can be verified with the issuer. I cannot yet name a client reference for Conditional Access.