← Back to writing
CloudJul 13, 2026· 2 min

A Conditional Access baseline that won't lock you out of Microsoft 365

Turning on Conditional Access is one of the highest-leverage things you can do to secure a Microsoft 365 tenant. It's also the fastest way to lock every user — including yourself — out of everything. Here's a baseline I trust: enough policy to stop the attacks that actually happen, structured so a mistake never becomes a lockout.

Before any policy: two break-glass accounts

If a Conditional Access policy misfires, the only thing that saves you is an account those policies can't touch. Create two cloud-only global admin accounts (break-glass-1@yourtenant.onmicrosoft.com), give them long random passphrases stored offline, and exclude them from every Conditional Access policy you ever write.

Two, not one, so a single forgotten password isn't a catastrophe. Monitor sign-ins on them with an alert — they should almost never be used.

Build every policy in report-only first

Entra lets you set a policy to Report-only. It evaluates the policy on real sign-ins and logs what would have happened, without enforcing anything. Never flip a new policy straight to On. Run it report-only for a few days, check Sign-in logs → Conditional Access for surprises, then enforce.

The baseline, four policies

1. Require MFA for all users. The single most important control. Target all users, all cloud apps, grant = require multifactor authentication. Exclude your break-glass accounts. This alone stops the overwhelming majority of account-takeover attempts.

2. Block legacy authentication. Legacy protocols — IMAP, POP, SMTP AUTH, older Office clients — can't do MFA, so attackers love them. One policy targeting "Other clients" with grant = Block closes the door. Check sign-in logs for legacy auth before enforcing so you know what breaks.

3. Require compliant or hybrid-joined devices for admins. Privileged roles are worth extra friction. Scope this to your directory roles (Global Admin, Exchange Admin, etc.) and require a managed, compliant device. Attackers with a stolen password still can't get in from their own laptop.

4. Require MFA to register security info. A subtle gap: if a user hasn't set up MFA yet, an attacker who phishes their password can register their own authenticator. Use the "Register security information" user action with a trusted-network or MFA condition to close it.

What to leave out at first

Resist the urge to boil the ocean. Country/location blocks, session-lifetime tweaks, and app-specific policies all have their place, but they generate support tickets and false positives. Get the four above solid and report-clean first.

The order that keeps you safe

  1. Create two break-glass accounts, exclude them from everything.
  2. Write each policy in report-only.
  3. Read the sign-in logs for a few days.
  4. Enforce one policy at a time, not all at once.
  5. Keep a documented rollback: which policy, how to disable it, from where.

Conditional Access isn't a set-and-forget checkbox — it's a small system you roll out deliberately. Do it in that order and you get the security without the 2 a.m. lockout.