ZERO TRUST ACCESS POLICY
Conditional Access for Microsoft 365
IT Systems deploys Microsoft Entra Conditional Access so businesses can control Microsoft 365 access according to users, applications, devices, locations and risk. Policies follow Zero Trust principles, are tested first and are expanded in controlled phases.
Do not enable broad enforcement on the first attempt. Review licensing, emergency-access accounts, exclusions, report-only results and a pilot group first.
Conditional Access follows if–then logic
Microsoft Entra combines access signals to allow access, require additional controls or block the request. Multiple policies can apply simultaneously, and users must satisfy every applicable requirement.
Signals
User or group, application, device platform, location, device state and risk.
Decision
Evaluate the defined scope, including inclusions, exclusions and conditions.
Controls
Require MFA, authentication strength, a compliant device, an approved app or block access.
Policies businesses commonly prioritize
Protect administrator accounts
- Require strong MFA.
- Control sessions and devices.
MFA for users
- Scope by group and application.
- Plan authentication registration.
Block legacy authentication
- Review legacy applications first.
- Monitor business impact.
Require compliant devices
- Integrate with Microsoft Intune.
- Prioritize sensitive data.
Location controls
- Named locations and IP ranges.
- Do not rely on location alone.
Sign-in risk
- Risk-based policies.
- Eligible licensing and response procedures.
REPORT-ONLY → PILOT → ENFORCE
Deploy in phases to avoid locking out legitimate users
Conditional Access directly affects sign-in. Review sign-in logs, run policies in report-only mode, pilot with representative users and validate dependencies before broad enforcement.
- Maintain appropriate emergency-access accounts outside the policy scope.
- Document every exclusion with an owner and review date.
- Use What If and sign-in logs to validate policy evaluation.
- Prepare user communications, support procedures and rollback.
Conditional Access deployment process
1. Discovery
Review users, apps, devices, locations, authentication methods, legacy protocols and licensing.
2. Design
Build the policy matrix, inclusions, exclusions, controls, emergency access and naming standards.
3. Report-only and pilot
Analyze sign-in impact, resolve exceptions and confirm helpdesk readiness.
4. Enforce and operate
Expand in phases, monitor failures, review exclusions and maintain policies.
Scope and acceptance criteria
Workstream
Activities
Validation criteria
Baseline
Collect user, application, device, location, authentication and sign-in patterns.
An inventory and prioritized risks are available.
Policy matrix
Define scope, exclusions, signals, grant controls and session controls.
Every policy has an owner and rationale.
Report-only
Review simulated outcomes in sign-in logs.
Unresolved business impact has been addressed.
Pilot
Apply to representative departments, devices and locations.
Business use cases and support scenarios pass.
Rollout
Enforce in phases and track failures and exceptions.
Evidence, runbooks and rollback procedures are complete.
Related solutions
Frequently asked questions about Conditional Access
Is Conditional Access a firewall?
No. It is the Microsoft Entra policy engine that uses identity and contextual signals to control token issuance and access.
Does Conditional Access replace MFA?
No. Conditional Access can require MFA in specific situations; MFA is one of the available access controls.
Should we enforce a policy for all users immediately?
No. A broad scope may be appropriate, but exclusions, report-only analysis, a pilot and emergency access should be prepared before enforcement.
Why are emergency-access accounts required?
They provide administrative recovery when configuration, authentication services or policies interrupt normal access. These accounts need separate protection and monitoring.
Which license is required?
Conditional Access generally requires Microsoft Entra ID P1 or an eligible Microsoft 365 license. Risk-based policies may require P2.
What happens after deployment?
Monitor sign-ins, review exceptions, update application and device dependencies, identify policy conflicts and perform periodic assessments.
Need a Conditional Access rollout with a controlled pilot and clear rollback?
IT Systems reviews your tenant, licensing, users, applications, devices, locations and sign-in patterns, then builds an appropriate policy matrix and phased rollout plan.
Discovery • Report-only • Pilot • Enforce