Picture this: an employee types their password into a fake Microsoft sign-in page. Minutes later, an attacker overseas signs in to your Microsoft 365 tenant with perfectly valid credentials. Your firewall never sees a thing, because the attacker is not breaking in. They are simply signing in.
Microsoft’s threat reporting puts identity attacks at roughly 600 million a day, mostly password-based. Conditional Access is how you fight back.
What Is Conditional Access?
It is the policy engine in Microsoft Entra ID that decides, at every sign-in, whether to let someone in, ask for more proof, or block them. Instead of checking only a password, it weighs who is signing in, where from, on what device, and to which app.
For example: if a user signs in from an unfamiliar country, then require MFA or block the attempt.
Do You Already Own It?
| Plan | Entra | Conditional Access? |
|---|---|---|
| Business Basic | Entra ID Free | No. Security Defaults only. |
| Business Standard | Entra ID Free | No. Security Defaults only. |
| Business Premium | Entra ID P1 | Yes, plus Intune for device compliance. |
On Basic or Standard? Add Entra ID P1 as a paid add-on. Risk-based policies need Entra ID P2.
Five Baseline Policies for SMEs
| Policy | What it does | Why it matters |
|---|---|---|
| 1. MFA for all users | Requires a second factor at sign-in (break-glass accounts excluded). | MFA cuts account compromise risk by over 99%. |
| 2. Stronger admin protection | Requires MFA on every admin portal sign-in, ideally from a compliant device. | One admin account can expose the whole tenant. |
| 3. Block legacy authentication | Turns off old protocols (POP, IMAP, basic SMTP) that cannot do MFA. | Attackers use them to sidestep MFA. |
| 4. Managed devices only | Allows email and files only from compliant or app-protected devices. | Keeps data off unmanaged personal devices. |
| 5. Risky locations | Blocks or challenges sign-ins from countries you do not operate in. | Cuts password-spray noise. Use only if it suits your staff. |
For admins and high-risk users, move towards phishing-resistant MFA such as passkeys or FIDO2 keys. Microsoft’s research found authenticator apps beat SMS codes.
A Safe Rollout
- Create two break-glass admin accounts, excluded from all policies, as your way back in.
- Start in report-only mode to see what each policy would do before it blocks anyone.
- Pilot, then phase: IT first, then one department, then everyone.
- Govern exceptions: every exclusion needs an owner, a reason and a review date.
THE BOTTOM LINE
Start small: protect admins, require MFA, block legacy authentication, and test everything first. A few well-governed policies beat a complicated rule set nobody maintains.
Top 5 FAQs
Yes. Basic MFA treats every sign-in the same. Conditional Access adds context: it blocks legacy protocols, hardens admin access and restricts unmanaged devices.
Entra ID P1, included in Microsoft 365 Business Premium and E3. Risk-based policies need Entra ID P2. Device-compliance policies rely on Intune, also in Business Premium.
Only if rolled out carelessly. Use report-only mode, pilot with a small group, and keep two break-glass accounts excluded as a safety net.
Security Defaults is a free, all-or-nothing baseline. It switches off once you create Conditional Access policies, so plan a handover to avoid a protection gap.
Around five to ten clear, documented policies suit most SMEs. Review quarterly, and whenever apps, vendors or devices change.
Author
Brina Teo
Cybersecurity Practitioner
Brina Teo is a cybersecurity practitioner specializing in Security Information and Event Management (SIEM), endpoint security, and Microsoft 365 security assessments. Her expertise includes Wazuh SIEM deployment, security monitoring, threat detection, incident investigation, and Sophos Endpoint Security administration. Brina holds a Diploma in Cybersecurity and Digital Forensics from Temasek Polytechnic and is passionate about security operations, cloud security, and cyber threat management.
