Entra ID Conditional Access Setup

Before you write a single policy, create two emergency administrator accounts and exclude them from every Conditional Access policy. A misconfigured policy can lock every normal admin out of the tenant, and these accounts are how you get back in. Give them long, unique passwords, store them somewhere very safe, and monitor them for use.

Conditional Access has a report only mode that shows what a policy would have done without actually enforcing it. Use it for every new policy. Review the sign in logs to see who would have been blocked or prompted, fix the surprises, and only then switch the policy on. This habit prevents almost every self inflicted lockout.

Administrator accounts are the highest value targets in your tenant, so protect them first. Create a policy that requires multi factor authentication for all administrative roles, on every sign in. Once that is stable, extend MFA to all users, because an ordinary account is often just the first step towards an admin one.

Legacy authentication protocols cannot enforce MFA, so they undermine everything else you set up. Build a policy that blocks them, testing in report only mode first to catch any older application that still depends on them. Move those apps onto modern authentication, then enforce the block across the tenant.

Tighten access based on context. Require that devices reaching sensitive applications are managed and compliant, so a healthy, encrypted, patched device is a condition of entry. You can also treat sign ins from unexpected countries as higher risk, prompting for extra verification or blocking them outright where that suits the business.

With Entra ID P2, Identity Protection scores each sign in and each user for risk, using signals Microsoft sees across its estate. Create policies that step up verification or block access when the risk is high, for example forcing a secure password reset on a risky sign in. Review your policies every few months, because tenants and threats both move on.