Conditional Access and Entra ID, designed around how you work
Conditional Access decides, at every sign-in, whether to let someone in, ask for more proof or block them. We design the policies, test them before they can lock anyone out, and keep them maintained.
The policies we put in place
- Emergency access accounts first: at least two, excluded from blocking policies, stored safely and tested.
- Multi-factor authentication enforced for every user, not just offered.
- Legacy authentication blocked, because older protocols can't do MFA and a stolen password works on them regardless.
- Stronger rules for admin accounts, kept separate from everyday email accounts.
- Compliant devices required for company data, once Intune compliance reports are clean.
- Location rules that block sign-ins from places your team never works from.
Tested before it is enforced
Every policy starts in report-only mode, which logs what it would have done without blocking anyone. We review the results over at least a working week, so travellers, part-time staff and monthly processes show up before the policy goes live. Each exclusion is documented with its reason. The Conditional Access baseline guide sets out the policies in order, and the compliance policies guide covers the device side.
Why identity comes first
Most breaches we get called about are not clever. A stolen password and a missing MFA policy are enough. Conditional Access is the layer that decides who can sign in, from where and on what, so it is the first thing we check in every tenant assessment. Identity alerts are watched by our 24/7 cybersecurity remediation SOC alongside endpoint alerts.
Book a free tenant review.
Read-only, no obligation, and you keep the findings either way. We usually respond same day.