A password and MFA are good, but they’re the same for every sign-in. Conditional Access adds context.

The idea

Conditional Access evaluates each sign-in using signals such as:

– Who the user is and which group they’re in

– Which device they’re using, and whether it’s managed and compliant

– Where they’re signing in from

– Which application they’re accessing

– Whether the sign-in looks risky

Then it decides: allow, require extra verification, or block.

Practical policies for small businesses

1. Require MFA for all users, and for all admins always

2. Block legacy authentication, which can’t use MFA

3. Require compliant devices for access to sensitive data

4. Block sign-ins from countries where you have no staff or customers

5. Require MFA when risk is detected (with Entra ID P2)

6. Limit access on unmanaged devices to browser-only, with no downloads

Before you turn it on

– Start in report-only mode to see the effect

– Exclude a “break-glass” emergency admin account, secured and monitored

– Communicate changes to staff

– Roll out in stages

Licensing

Conditional Access requires Entra ID P1, included in Microsoft 365 Business Premium. Without it, “security defaults” provide basic MFA protection.

Common mistakes

– Locking out all admins

– Policies so strict that staff find workarounds

– Never reviewing sign-in logs

DBR Soft designs and tests Conditional Access policies for you. Contact us for more information.