A stolen Microsoft 365 password should not be enough to expose client files, send fraudulent invoices or lock a team out of its own systems. Conditional access configuration puts practical checks around every sign-in, so access is based on the person, the device, the location and the level of risk – not simply whether a password was entered correctly.
For UK small and medium-sized businesses, this is one of the most effective ways to reduce the risk of phishing, credential theft and business email compromise without making day-to-day work unnecessarily difficult. Done well, it helps staff work securely from home, client sites and the office while giving leadership teams one less thing to worry about.
Why conditional access matters to your business
Microsoft 365 holds far more than email. It may contain customer correspondence, contracts, financial information, HR records, Teams conversations and files that keep operations moving. If an attacker gains access to one account, they may impersonate a director, search mailboxes for payment details, share malicious links internally or download sensitive documents.
Multi-factor authentication (MFA) is a necessary first step, but it does not answer every question. Should an administrator be able to sign in from an unmanaged personal device? Should a user logging in from an unusual country be challenged more strongly? Should older applications that cannot use modern authentication be allowed to connect at all?
Conditional Access in Microsoft Entra ID answers those questions through policies. It applies rules at the point of sign-in and can require MFA, a compliant device, an approved application or a password change. It can also block access where the circumstances do not meet your organisation’s requirements.
The commercial benefit is straightforward. A well-considered policy reduces the chance that a single compromised credential becomes a disruptive, expensive incident. It also supports sensible controls for remote workers, regulated information and cyber insurance expectations without forcing directors to become Microsoft security specialists.
Start with how people actually work
The strongest technical policy can still cause disruption if it is built around assumptions rather than working practices. Before changing settings, identify who accesses Microsoft 365, what they access and from where.
A professional services firm may need partners to reach email and files while travelling, but may insist that case-management information is only opened through managed devices. A logistics business may have office teams using full Microsoft 365 applications, while warehouse or driver-facing staff rely on shared devices and mobile apps. Those situations need different controls.
Consider the accounts that deserve particular attention: directors, finance staff, IT administrators, users with access to sensitive client data, and third parties. Attackers commonly target these groups because a successful sign-in can lead directly to payment fraud, privileged access or valuable data.
It is also worth documenting older systems, multifunction printers, line-of-business applications and external suppliers that send email through Microsoft 365. Some may still rely on legacy authentication methods. Finding them early prevents a security improvement turning into an avoidable operational issue.
Build conditional access configuration in the right order
Conditional access configuration is not one switch to turn on. It is a set of policies that should work together, with a clear purpose for each. Begin with the controls that close the most common routes into an account, then add more targeted restrictions as you understand your environment.
Establish a secure baseline
For most organisations, the starting point is to require MFA for users accessing Microsoft 365. Phishing-resistant methods, such as passkeys or security keys, offer stronger protection for higher-risk accounts than text messages. Microsoft Authenticator can be a practical option for many staff, provided number matching and sensible registration processes are in place.
The next priority is blocking legacy authentication. Older protocols often bypass MFA and are regularly exploited in password-spraying attacks. There can be exceptions for older equipment or applications, but these should be identified, recorded and addressed rather than left open indefinitely.
A sensible initial policy set normally covers four areas:
- Require MFA for all users, with a carefully managed approach for service accounts and shared operational devices.
- Block legacy authentication across the tenant.
- Require stronger sign-in controls for administrator accounts, ideally using managed devices and phishing-resistant MFA.
- Block access from countries or locations where your business has no legitimate reason to operate, where this is appropriate for your workforce.
Location-based blocking can be useful, but it is not a complete defence. Staff may travel, use mobile networks or connect through approved VPNs. Treat location as one useful signal among several, not proof that a sign-in is safe or unsafe.
Protect the accounts attackers value most
Administrative accounts require stricter treatment than standard user accounts. An administrator who can create users, change security policies or access mailboxes should not be protected by the same minimum controls as a basic account.
Require MFA every time or at a short sign-in frequency for privileged roles, restrict access to compliant devices where possible, and limit which staff hold permanent admin rights. Separate administrator accounts from everyday email accounts. This creates a little more administration, but it limits the damage if a normal user account is compromised through a convincing phishing email.
Finance and leadership teams may also benefit from tailored policies. Requiring a managed device for access to sensitive SharePoint sites, or applying stronger authentication when users access high-value applications, can reduce exposure without placing the same burden on every member of staff.
Plan exclusions carefully, especially emergency access
Every conditional access policy needs exclusions, but each exclusion creates a potential gap. The most significant example is the emergency or “break-glass” account. This is a tightly controlled administrator account held for genuine recovery situations, such as an MFA service issue or a badly configured policy that blocks normal administrators.
Keep at least two emergency accounts, exclude them from selected conditional access policies, use long unique passwords stored securely, and monitor any sign-in closely. They are not everyday accounts and should never be used for convenience.
Do not use broad exclusions simply to make a problem disappear. If a user, application or device cannot comply with a policy, establish why. The answer may be an application update, a managed device, a better authentication method or a time-limited exception with an owner and review date.
Service accounts need special care too. Where possible, replace user-name-and-password service accounts with managed identities, application permissions or modern authentication. Where this cannot yet be done, narrow their access, prevent interactive sign-ins and monitor their activity.
Test before enforcing and keep people informed
A rushed rollout can lock out staff at the point they need access most. Use Conditional Access report-only mode first to see how a proposed policy would affect real sign-ins. Review the results with the people who understand your operations, including finance, customer service and any teams working shifts or remotely.
Pilot policies with a small, representative group before extending them to everyone. Test common scenarios: a managed laptop at the office, a home connection, a mobile phone, a new device, travel where applicable, and access to each key Microsoft 365 application. Also test what happens when a user replaces a phone or cannot complete MFA.
Communication matters as much as the setting itself. Staff should know what will change, why they may be asked to verify a sign-in, and how to get fast help if something does not work. Clear support reduces frustration and makes people less likely to seek unsafe workarounds.
Treat policies as an operational control, not a one-off project
Your business changes. New starters arrive, suppliers change, staff travel, applications are adopted and roles develop. A conditional access policy that suited the business a year ago may now be too permissive, too restrictive or full of forgotten exceptions.
Review policies regularly alongside Microsoft Entra sign-in logs, risky sign-in alerts, device compliance reports and user feedback. Look for blocked activity that indicates an attempted attack, but also repeated legitimate failures that could affect productivity. Every policy should have a named owner, a documented business reason and an agreed review point.
Licensing also affects what is possible. Core Conditional Access capabilities generally require Microsoft Entra ID P1, while more advanced identity risk and risk-based controls may require P2. The right choice depends on the sensitivity of your data, your existing Microsoft 365 licences and the level of management your internal team can realistically maintain.
Some businesses prefer to own the policy decisions but ask a specialist to design, deploy and monitor them. Others want ongoing administration and a real person to call when a new system, acquisition or security concern changes the picture. MSnet can help businesses take either approach, combining Microsoft 365 protection with practical support and staff guidance.
The aim is not to put obstacles in front of legitimate work. It is to make an unusual or risky sign-in prove itself before it can become a serious problem – leaving your people free to focus on the work that moves the business forward.