Conditional Access

What it is

Microsoft calls Conditional Access its Zero Trust policy engine. Each policy brings together signals about a sign-in and makes a decision. The signals include who the user is, where they are signing in from, which device they are using, which app they want and how risky the sign-in looks. The decision is to block access, or to grant it only if conditions are met, such as:

• completing multi-factor authentication
• meeting a stronger authentication strength, such as a passkey
• using a device marked as compliant
• using an approved app or app protection policy

Policies run after the password (first factor) has been checked.

Why it matters for a UK small or regulated business

MFA confirms the right person is signing in. Conditional Access lets you decide what else has to be true, for example that client files can only be opened on company laptops. For firms handling client money or personal data, that is often the difference between a lost password being a nuisance and being a breach.

How it works in Microsoft 365

Conditional Access needs Microsoft Entra ID P1, which comes with Microsoft 365 Business Premium. Business Basic and Standard use Security Defaults instead, which is on or off with no customisation. If you move to Conditional Access, you switch Security Defaults off and replace it with policies.

Common starting policies are requiring MFA for everyone, requiring MFA for admin roles, blocking legacy authentication, and requiring managed devices for sensitive apps. Microsoft also provides templates.

Policies can be set to report-only mode for testing. In that state they are evaluated and logged but not enforced: users are not prompted for MFA or blocked. That makes report-only mode useful before a rollout, and risky if a policy is left in it by mistake, a common form of configuration drift. Emergency break-glass accounts should be excluded from policies that block or restrict sign-in.

How &DEV helps: the Microsoft 365 MOT designs and rolls out your Conditional Access policies, and our managed service keeps them enforced afterwards.