Tenant setup 06 β Conditional Access Policies
π Complete tenant-setup cookbook in one PDF This article is part of the series. Full series + screenshots in one document: download PDF . (PDF is currently in Czech.
This article is part of the series. Full series + screenshots in one document: download PDF. (PDF is currently in Czech.)
Conditional Access Policies (CAP) are your main protection layer after strong, unique passwords. If you have the option, definitely configure them.
Today we'll look at the first few; the rest in the next article. Important: be careful when implementing CAP and always keep at least one account excluded from every policy that is a Global Administrator. The first thing you must do before configuring CAP is turn off Security Defaults. You can disable them at Tenant overview β Properties β Manage security defaults.
On to CAP. The first policy we'll set up is Require MFA for admins, using Microsoft's pre-built template. Open Entra β Protection β Conditional Access and click New policy from template. Pick Require multifactor authentication for admins. Leave it in Report Only mode β it makes troubleshooting easier. Use a naming convention with a policy number; future-you will thank you.
Open the policy β Users β Exclude your break-glass Global Administrator account. Target resources: All cloud apps. Access controls β Grant: MFA enforced. One critical detail β policies can target users OR devices, never both at the same time. Don't mix them.
Second policy: Block Legacy Authentication. Same template flow. Target everyone except your break-glass and any explicitly excluded service accounts. Under Conditions β Client apps, select the legacy auth clients (Exchange ActiveSync, other clients β SMTP, POP, IMAP). If any device authenticates via these protocols, exclude it.