Conditional Access Policies in Entra ID

Overviewsection

Conditional Access is Microsoft Entra ID's policy engine that controls who can access what, from where, and under what conditions. It is the foundation of a Zero Trust security model for Microsoft 365. Instead of blanket MFA for everyone, Conditional Access lets you create granular rules: require MFA from untrusted networks, block legacy authentication, and demand device compliance before granting access.

This guide walks through the essential policies every organisation should implement.

Prerequisitessection

• Microsoft Entra ID P1 licence (included in Microsoft 365 Business Premium, E3, E5)
• Global Administrator or Conditional Access Administrator role
• At least one break-glass (emergency access) account excluded from all policies
• MFA registration completed for all users before enforcing MFA policies

Policy 1: Require MFA for All Userssection

This is the single most impactful security control you can implement.

Configurationsection

1. Go to the Microsoft Entra admin center (entra.microsoft.com) > Protection > Conditional Access > Create new policy
2. Name: Require MFA — All Users
3. Assignments:
   • Users: All users
   • Exclude: Break-glass accounts, service accounts that cannot support MFA
4. Target resources: All cloud apps
5. Conditions: None (apply to all conditions)
6. Grant: Require multi-factor authentication
7. Session: Not configured
8. Enable policy: Report-only (test first, then switch to On)

Policy 2: Block Legacy Authenticationsection

Legacy protocols (POP3, IMAP, SMTP AUTH, older Exchange ActiveSync) do not support MFA and are the most common entry point for credential-stuffing attacks.

Configurationsection

1. Name: Block Legacy Authentication
2. Users: All users (exclude break-glass accounts)
3. Target resources: All cloud apps
4. Conditions > Client apps: Select only Exchange ActiveSync clients and Other clients
5. Grant: Block access
6. Enable: Report-only first

Verify before enforcingsection

Check the Microsoft Entra sign-in logs filtered by Client app = "Other clients" and "Exchange ActiveSync". If users are still using legacy mail clients, migrate them first.

Policy 3: Require Compliant Device for Desktop Appssection

If your devices are managed by Intune, you can require that only compliant devices can access company data.

Configurationsection

1. Name: Require Compliant Device — Desktop Apps
2. Users: All users (exclude break-glass accounts)
3. Target resources: Office 365 (or specific apps like Exchange Online, SharePoint)
4. Conditions > Device platforms: Windows, macOS
5. Grant: Require device to be marked as compliant
6. Enable: Report-only first

Policy 4: Block Access from High-Risk Countriessection

If your organisation operates in specific countries, block sign-ins from everywhere else.

Step 1 — Create a named locationsection

1. Go to Protection > Conditional Access > Named locations
2. Click Countries location
3. Name it "Allowed Countries" and select the countries where your staff operate

Step 2 — Create the policysection

1. Name: Block Sign-In — Unapproved Countries
2. Users: All users (exclude break-glass accounts)
3. Target resources: All cloud apps
4. Conditions > Locations: Include Any location, Exclude Allowed Countries
5. Grant: Block access

Policy 5: Require MFA for Risky Sign-Inssection

If you have Microsoft Entra ID P2, you can use Microsoft Entra ID Protection (formerly Azure AD Identity Protection) risk signals to require MFA only when a sign-in looks suspicious.

Configurationsection

1. Name: Require MFA — Risky Sign-Ins
2. Users: All users
3. Target resources: All cloud apps
4. Conditions > Sign-in risk: Medium and High
5. Grant: Require multi-factor authentication

This reduces MFA friction for normal logins while catching suspicious ones.

Recommended Policy Set Summarysection

Testing Policiessection

Report-only modesection

Every policy should run in report-only mode for at least one week before enforcement. Review results at:

Microsoft Entra admin center > Sign-in logs > add filter Conditional Access = "Report-only: Failure"

This shows which sign-ins would have been blocked if the policy were active.

What-If toolsection

Use the built-in What-If tool to simulate policies:

1. Go to entra.microsoft.com > Protection > Conditional Access > What If
2. Select a user, an application, and conditions (location, device platform)
3. Click What If to see which policies would apply and what the result would be

Troubleshootingsection

Next Stepssection

• Enable Microsoft Entra ID Protection for user and sign-in risk policies
• Configure Microsoft Entra Privileged Identity Management (PIM) to enforce just-in-time access for admin roles
• Configure session controls (sign-in frequency, persistent browser sessions) for sensitive apps
• Explore authentication strengths to require phishing-resistant MFA (passkeys, FIDO2) for privileged operations
• Audit policies quarterly and remove any in report-only mode that have been validated

Need help managing Conditional Access?section

Explore managed IT support for ongoing Microsoft 365 administration, or use on-demand support to discuss a specific policy problem.