Security in modern enterprise environments no longer relies on traditional network perimeters. With remote work and cloud-first infrastructure, identity is your new security boundary. Conditional Access in Microsoft Entra ID (formerly Azure AD) allows organization administrators to enforce zero-trust access controls based on user signals, location, device health, and risk.
In this guide, we will cover the core fundamentals of Conditional Access and walk through setting up an essential baseline policy: Requiring Multi-Factor Authentication (MFA) for All Users.
What is Conditional Access?
At its simplest, Conditional Access is an if-then statement engine for identity security:
- IF a user meets specific conditions (e.g., logging in from an untrusted location or unmanaged device)…
- THEN enforce controls (e.g., require MFA, block access, or require a compliant device).
Key Signals Evaluated:
- User or Group Membership: Target specific departments or administrative roles.
- IP Location Information: Differentiate between trusted corporate networks and untrusted locations.
- Device Platform & Status: Check if the device is running Windows, iOS, Android, or macOS, and whether it is marked as compliant in Microsoft Intune.
- Client Apps: Identify whether access is attempted via modern browser, desktop app, or legacy authentication protocols.
Prerequisites
Before configuring Conditional Access policies, ensure you have:
- A Microsoft Entra ID P1 or P2 license (or Microsoft 365 Business Premium / E3 / E5).
- An account with the Conditional Access Administrator or Global Administrator role.
- A designated Break-Glass (Emergency Access) Account excluded from policies to prevent accidental lockout.
Step-by-Step: Creating a Baseline MFA Policy
Step 1: Access Microsoft Entra Admin Center
- Navigate to entra.microsoft.com and sign in.
- In the left menu, expand Protection and click Conditional Access.
- Select Policies > New policy.
Step 2: Define Name and Target Users
- Name: Enter
[Baseline] Require MFA for All Users. - Under Assignments, select Users:
- Under Include, select All users.
- Under Exclude, select Users and groups and add your Break-Glass Account.
💡 Best Practice: Always exclude at least one dedicated emergency administrative account from global access policies to avoid locking yourself out of the tenant.
Step 3: Select Target Resources
- Under Target resources, select Cloud apps.
- Select Include > All cloud apps.
Step 4: Configure Grant Controls
- Under Access controls, select Grant.
- Select Grant access.
- Check Require multifactor authentication.
- Click Select.
Step 5: Enable in Report-Only Mode
- At the bottom of the page, set Enable policy to Report-only.
- Click Create.
Testing & Verification
Running a policy in Report-only mode lets you monitor its impact in the Entra ID Sign-in logs without impacting production end users.
- Go to Entra ID > Monitoring & health > Sign-in logs.
- Filter logs by your policy name under the Report-Only tab.
- Once satisfied that user traffic is matching as expected, return to the policy settings, change Enable policy to On, and save.
Summary & Next Steps
Enforcing Conditional Access is one of the most effective ways to stop identity-based attacks across your organization. Once your baseline MFA policy is live, the logical next step is pairing Conditional Access with Microsoft Intune to enforce compliance requirements on enrolled devices.