Tenant setup 07 — Conditional Access Policies, part 2

📘 Complete tenant-setup cookbook in one PDF This article is part of the series. Full series + screenshots in one document: download PDF . (PDF is currently in Czech.

In today's article we'll cover more CAP policies that I recommend as a baseline for any Business Premium tenant. CAP is creative — if you need to allow or block something specific, CAP can almost always do it. The next policy is Require MFA for all users. This one can be tricky if your employees aren't the most tech-savvy, but it's enormously important and blocks almost every attack. With more employees, roll it out in waves. From experience, 5 at once is fine, 50 absolutely is not.

First create a security group you'll add users to manually. Yes, it's a chore, but rolling everyone out at once is worse. Create the group in Entra → Identity → Groups. Use your naming convention. Add the first wave of users.

Open CAP → New policy from template → Require multifactor authentication for all users. Open the policy → Users → Select users and groups → Users and groups and pick the security group. Exclude your break-glass. Done.

Last for today: a TAP-required device-join policy. There's no template for this one — create from scratch. Target all users (exclude break-glass). Target resources → User actions → Register or join devices. Grant → Require authentication strength → pick the TAP strength you created earlier. Save in Report-only.