Conditional access without locking out your own staff

Conditional access decides who can reach what, from where, on which device, and under what conditions. It is the most useful security control most Microsoft 365 tenants are not using properly, and it is also the one most capable of locking an entire business out on a Friday afternoon.

Break-glass accounts first

Before creating any policy, create two emergency access accounts. Cloud-only, excluded from every conditional access policy, with long random passwords stored somewhere physically secure, and alerting configured on any sign-in.

This is not optional. A misconfigured policy that requires a compliant device can lock out every administrator including the one who made it, and without break-glass accounts the recovery route is a support ticket with a vendor and a very long day.

Start in report-only

Every policy supports report-only mode, which evaluates and logs what would have happened without enforcing it. Run each new policy this way for at least a week and read the results.

What you find is always the same category of thing: a service account nobody remembered, a director who travels somewhere you blocked, an application that authenticates in a way you did not anticipate. Better to find those in a log than in a phone call.

Policies worth starting with

Require MFA for all users. The foundation. Exclude only break-glass accounts.

Block legacy authentication. Older protocols cannot do MFA, so leaving them enabled is a documented way around your own control.

Require MFA for administrators, always. No trusted-location exemption for privileged roles.

Require compliant or hybrid-joined devices for company data. This is the policy that turns device management into an access control rather than an inventory.

Block sign-in from countries you do not operate in. Simple, and it removes a large volume of automated attempts. Remember to handle staff who travel.

Require reauthentication for risky sign-ins. If your licensing includes identity protection, this catches credential stuffing and impossible-travel patterns.

Common mistakes

Trusted locations doing too much work. Exempting the office IP from MFA sounds convenient and means an attacker who reaches your network faces no second factor.

Policies that overlap unpredictably. Conditional access evaluates all applicable policies and the most restrictive requirement wins. Several policies written independently produce results nobody intended. Keep the set small and documented.

Excluding groups that grow. An exclusion group created for two service accounts quietly becomes twenty. Review exclusions quarterly.

Forgetting guests. External collaborators reach your data too, and default policies often do not apply to them.

Rolling out without disruption

Report-only for a week. Then enable for IT and a friendly pilot group. Then a department. Then everyone, announced in advance with a clear route to report problems. Keep the break-glass accounts excluded throughout and monitored.

Document every policy and why it exists. In two years somebody will ask, and a policy nobody can explain either gets removed carelessly or kept without understanding.