A Conditional Access baseline for small and mid-sized businesses

Most account takeovers we hear about aren't sophisticated. A password gets reused or phished, and nothing stands between that password and the mailbox. Conditional Access is the part of Microsoft Entra ID that puts something in the way.

It's included with Microsoft Entra ID P1, which comes with Microsoft 365 Business Premium. Organisations without it can still use security defaults, a simpler fixed set of protections. This guide covers the handful of policies we'd expect any business on Business Premium to have, and the order to introduce them in.

Before you build anything: emergency access

A badly written policy can lock every administrator out of the tenant. Microsoft's guidance is to create two or more emergency access accounts first:

• cloud-only accounts on the .onmicrosoft.com domain, not synchronised from an on-premises directory;
• protected by phishing-resistant sign-in, such as a FIDO2 security key, that differs from what your everyday admin accounts use;
• kept in a dedicated group that's excluded from any policy that blocks or restricts sign-in;
• monitored, so any use of them raises an alert.

Store the credentials somewhere secure and separate, and write down who's allowed to use them.

Policy 1: block legacy authentication

Older protocols such as POP, IMAP and basic SMTP authentication can't do multi-factor authentication, so they're a way around it. Microsoft reports that more than 97 percent of credential stuffing attacks and more than 99 percent of password spray attacks use legacy authentication.

The policy targets all users and the client app types "Exchange ActiveSync clients" and "Other clients", and blocks access. Before switching it on, filter the sign-in logs by client app to find anything still using these protocols. Old scanners and line-of-business apps that send email are the usual culprits.

Policy 2: require MFA for everyone

Every user, every cloud app, with only the emergency access group excluded. Microsoft's current template uses an authentication strength rather than a plain MFA tick box, which lets you require stronger methods over time. Guest users can be handled by their own policy if you prefer.

Policy 3: stronger sign-in for administrators

Admin accounts deserve more than an approval prompt on a phone. Business Premium lets you require phishing-resistant methods such as passkeys (FIDO2) or Windows Hello for Business for admin roles through Conditional Access authentication strengths. Keep admin work on separate accounts from day-to-day email.

Policy 4: require a compliant device

Once laptops are enrolled in Intune and compliance policies are reporting cleanly, access to company data can require a device that Intune marks as compliant: encrypted, patched, protected. This is the policy that turns device management into security, and it's the one to introduce last, because it depends on everything else being in order.

Switch them on in report-only mode first

Every new policy should start in report-only mode. In that state, Conditional Access evaluates the policy at each sign-in and records what would have happened, without enforcing anything. The results appear in the sign-in logs, so you can see who would have been blocked before anyone actually is.

One quirk: report-only policies that check device compliance can prompt Mac, iOS and Android users to pick a certificate. Microsoft suggests excluding those platforms from report-only compliance policies to avoid confusing prompts.

A sensible order

1. Emergency access accounts, tested.
2. Block legacy authentication, report-only, then on.
3. MFA for all users, report-only, then on.
4. Stronger authentication for admins.
5. Require compliant devices, after Intune enrolment is complete.

Each step is small, and each one is reversible if the sign-in logs show a problem.

How we handle it

Conditional Access with enforced MFA and legacy authentication blocked is part of the baseline on every tenant we manage, alongside Defender for Endpoint P2 and a 24/7 cybersecurity remediation SOC. If you'd like to know where your tenant stands, our read-only assessment checks it. See cyber security services.

Sources

Checked October 2026.

• Microsoft Learn: Block legacy authentication with Conditional Access
• Microsoft Learn: Require MFA for all users
• Microsoft Learn: Manage emergency access accounts in Microsoft Entra ID
• Microsoft Learn: Conditional Access report-only mode
• Microsoft Learn: Set up multifactor authentication for users (Microsoft 365 for business)
• Microsoft Learn: Admin account security in Microsoft 365 for business