Conditional Access Policies Explained: Essential Policies for Every M365 Tenant

Conditional Access is the policy engine at the heart of Microsoft Entra ID. It lets you define the conditions under which a user is allowed to access a resource - and what they need to prove before they get in. It sits between the user's authentication attempt and the application they're trying to reach, evaluating signals in real time before granting or blocking access.

For any organisation using Microsoft 365, Conditional Access is the single most important security control you can configure. This guide covers what it is, how it works, and the essential policies every environment should have.

How Conditional Access Works

Every Conditional Access policy has three parts:

• Assignments: who the policy applies to (users, groups, roles) and what it applies to (apps, actions, authentication contexts)
• Conditions: when the policy triggers (device platform, location, sign-in risk, client app)
• Grant controls: what the user must satisfy to get through (MFA, compliant device, approved app, etc.)

Policies are evaluated at sign-in time. If any Block policy matches, the user is blocked. If a Grant policy matches, they must satisfy its controls. If no policy matches, access is granted with no additional requirements - which is why having the right policies in place matters.

Essential Policy 1: Require MFA for All Users

The most important policy. Requires multi-factor authentication for all cloud app sign-ins.

Essential Policy 2: Require Compliant Device

Blocks access from devices that are not Intune-enrolled and compliant. This is essential once you have Intune compliance policies deployed - it enforces that devices must meet your standards before accessing corporate data.

Essential Policy 3: Block Legacy Authentication

Legacy authentication protocols (IMAP, POP3, SMTP AUTH, older Office clients) cannot perform MFA. Attackers specifically target these protocols because they bypass modern authentication controls entirely. This policy blocks them outright.

Essential Policy 4: Require MFA for Admins

Privileged accounts are the highest-value target for attackers. This policy requires MFA specifically for users with admin roles - even stricter than the baseline MFA policy, as it can require phishing-resistant MFA methods like FIDO2 keys.

Sign-in Risk Policies

If you have Microsoft Entra ID P2, you can create risk-based policies that automatically respond to suspicious sign-in behaviour detected by Microsoft's threat intelligence. These are some of the most powerful controls available.

Named Locations

Named Locations let you define trusted IP ranges (like your office network) and use them as conditions in policies. For example, you might require MFA only from outside the office, or block sign-ins from countries you don't operate in.

Once created, you can use locations as conditions - for example, blocking access from outside the UK entirely, or only requiring MFA when a user signs in from an unknown location.