Securing Microsoft 365 with Conditional Access: a baseline

Conditional Access in Microsoft Entra ID is the policy engine that decides whether a sign-in is allowed, blocked or challenged. A small, well-tested baseline protects most tenants.

A starter baseline

1. Require MFA for all users — with a documented exclusion for emergency access accounts.
2. Block legacy authentication — protocols such as basic auth cannot do MFA.
3. Require MFA for administrators — and prefer phishing-resistant methods.
4. Require compliant or managed devices for access to sensitive apps.
5. Add sign-in risk policies if you have the licensing for Entra ID Protection.

Roll out safely

• Start every policy in report-only mode and review the sign-in logs.
• Keep at least two break-glass accounts excluded from policies and monitored with alerts.
• Roll out to a pilot group first, then widen scope in stages.

Review the results

In the Entra admin center, open the sign-in logs and filter by the Conditional Access tab to see which policies would have applied. Fix the noisy cases (service accounts, shared mailboxes, older clients) before switching a policy to On.

Never lock yourself out: test with a break-glass account before enforcing any tenant-wide policy.