Conditional Access
MFA, device trust, and risk-based access control — structured, staged, documented. The access foundation every Microsoft 365 tenant needs.
Every User, Every Device, Everywhere — and Nothing Stops Them
Passwords alone are no longer a control. One phished credential gives an attacker the same reach as your CFO. Security Defaults close the worst gaps, but they are a blunt instrument — all or nothing, no exceptions, no device trust, no risk scoring.
This is not a failure of your IT team. Conditional Access has 40+ settings per policy, interacts with licenses, device compliance, and legacy protocols. Without a structured rollout, the first enforced policy locks out the CEO or breaks the MFP on floor 3.
Traditional consulting for a CA project? Two months, five figures. The consultant leaves. Your team is back where it started the next time a policy needs to change.
ACTIVITIES IN DETAIL
DELIVERABLES
Gather specific requirements: user groups, use cases, device management state, authenticator app readiness
Define recommended Conditional Access policies per user segment: administrators, knowledge workers, service accounts, external guests
Outline the implementation and provide PowerShell scripts for each rollout phase: Report-only, evaluation and fine-tuning, pilot group, Go-Live
Create and validate two Break Glass accounts — excluded from every policy, credential-sealed
Configure MFA registration policy and combined registration (MFA + SSPR) 1–2 weeks ahead of enforcement
Block legacy authentication (IMAP, POP3, SMTP basic auth) — Microsoft's number-one recommended policy
Build baseline policies: MFA for admins, MFA for all users, block high-risk sign-ins (Entra ID P2)
Define Change Management actions: end-user information material, how-to guides, helpdesk briefing
Implement an Azure subscription for extended and long-term Conditional Access sign-in analysis (90 days of logs via Log Analytics)
Staged Go-Live driven by the scripts: one policy at a time, starting with the least impactful
Next steps after Conditional Access
A cleanly configured tenant is the foundation. These blueprints build directly on it
