Conditional Access: The Most Overlooked Security Control in Microsoft 365
Conditional Access can block 99% of automated identity attacks per Microsoft — yet most SMBs don't have a single policy configured. Learn how to use it.
What is Conditional Access and why it matters
Conditional Access is Azure AD's security decision engine. Every time a user tries to access a Microsoft 365 resource, Conditional Access evaluates a set of conditions and decides: allow access, block it, or require additional verification.
Think of it as an intelligent security guard at your building's entrance. It doesn't just check the badge — it also verifies whether the person is coming from an expected location, whether their device is healthy, whether the time is normal, and whether there's anything suspicious in their recent behavior.
Microsoft reports that Conditional Access can prevent over 99% of identity-based attacks when properly configured. The problem: most SMBs don't have a single active policy.
Why SMBs don't use it
Three main reasons:
1. Requires Azure AD P1 or higher — Business Basic and E1 licenses don't include Conditional Access. You need Business Premium, E3, or Azure AD P1 as an add-on.
2. Fear of locking out legitimate users — Without experience, it's easy to create a policy that blocks your own CEO. This causes many to skip it entirely.
3. Lack of visibility — If you don't know what identity attacks you're receiving today, you don't see the urgency.
The 6 policies every SMB needs
Policy 1: MFA for everyone
What it does: Requires MFA for all access, regardless of location or device.
Why: It's the foundation. Without MFA, all other policies are useless because an attacker with a stolen password walks right in.
Caution: Exclude one emergency (break-glass) account from MFA, stored in a physical safe. If your MFA provider fails, you need a way in.
Policy 2: Block legacy authentication
What it does: Blocks protocols that don't support MFA (POP3, IMAP, basic SMTP, legacy Exchange ActiveSync).
Why: These protocols are the most common MFA bypass. 95% of password spray attacks use legacy authentication.
Caution: Verify you don't have multifunction printers or legacy apps using these protocols before enabling.
Policy 3: Require compliant device for mobile apps
What it does: Only allows access from devices enrolled in Intune that meet your compliance policies.
Why: A user can have MFA but access from a rooted/jailbroken phone without encryption. That's a risk.
Caution: Devices need to be enrolled in Intune first. Roll this out gradually.
Policy 4: Block access from unexpected countries
What it does: Blocks sign-in attempts from countries where your company doesn't operate.
Why: If your company operates only in Mexico and the US, a login from Russia or Nigeria is almost certainly an attack.
Caution: If you have traveling employees, use "require MFA" instead of "block" for unusual countries.
Policy 5: Protect admin actions
What it does: Requires MFA + compliant device + known location for any administrative action.
Why: Admin accounts are the primary target. If an admin is compromised, the attacker controls everything.
Caution: Make sure your admins have enrolled devices before enabling this policy.
Policy 6: Time-limited sessions
What it does: Forces re-authentication every X hours for sensitive applications (email, SharePoint with confidential data).
Why: Limits how long a stolen token is useful.
Caution: Don't set intervals too short (under 1 hour) or you'll frustrate your users into finding workarounds.
How to implement without breaking anything
1. Start in report-only mode — Conditional Access lets you create policies in report-only mode. This shows you which sessions would be affected without blocking anyone.
2. Analyze for 2 weeks — Review Conditional Access logs to identify false positives (legitimate sessions that would be blocked).
3. Enable gradually — First MFA, then legacy auth blocking, then the other controls. Never everything at once.
4. Maintain the break-glass account — One emergency account excluded from all policies, password in a physical safe, monitored with an alert if it's ever used.
Assess your Conditional Access today
Our free scan evaluates the 155 Microsoft Graph rules of the 201-rule library, including Conditional Access configuration, MFA status, legacy authentication, and session policies. In 90 seconds you know exactly what's missing. The 46 Azure Resource Manager controls add on with admin consent.
Is your business protected?
A free Microsoft 365 audit—the automated scan delivers a preview in 90 seconds. Find risks before they become incidents.