Conditional Access for Small Business: 5 Policies to Turn On

Security defaults vs Conditional Access

Every Microsoft 365 tenant can use security defaults: a free, one-switch package that requires all users to register for MFA, requires admins to use MFA every time, and blocks legacy authentication protocols. Microsoft says these protections stop the vast majority of common identity attacks, and recommends them for tenants on the free tier of Entra ID.

Conditional Access lets you write your own rules instead. Microsoft's overview describes policies as if-then statements built from signals (user, location, device, app, risk) and decisions (block, require MFA, require a compliant device, and more). It requires Microsoft Entra ID P1 licences.

Microsoft's Business Premium guidance lists Business Premium as including Entra ID P1, and says not to turn off security defaults unless you are switching to Conditional Access policies. Our guide on whether Business Premium is worth it covers the cost side.

Before you start: break-glass accounts and report-only mode

A badly scoped policy can lock every admin out of the tenant. Two habits prevent that.

1. 1

   Create two emergency access accounts

   Microsoft's emergency access guidance says to create two or more cloud-only accounts on the onmicrosoft.com domain, with Global Administrator rights.

2. 2

   Protect them with a different strong method

   Use a phishing-resistant method such as a FIDO2 passkey on a hardware key, not the same Authenticator app your normal admin uses. Store the keys safely.

3. 3

   Exclude them from blocking policies

   Add both accounts to a group and exclude that group from every Conditional Access policy that blocks or restricts sign-in.

4. 4

   Set up an alert on their use

   Monitor sign-in logs for these accounts. They should almost never be used, so any sign-in deserves a look.

5. 5

   Create every new policy in report-only mode

   Report-only evaluates the policy at sign-in and logs the result without enforcing it. Leave it a week, check the sign-in logs, then switch it on.

See Microsoft's pages on emergency access accounts and report-only mode for the details.

The 5 Conditional Access policies worth turning on

Microsoft's overview lists common policies and the admin centre offers templates for most of them. For a small business, these five deliver most of the value.

Policy 2 pairs well with passkeys; our passkeys guide explains how to register them. Microsoft's template for blocking legacy authentication is the quickest to deploy, but check report-only logs for old scanners, printers or apps that send email with a password first.

Policy 4 is the one that changes daily life. Microsoft's device compliance policy template assumes devices are enrolled in Intune and marked compliant. Enrol company laptops before you enforce it, and use app protection policies for staff on personal phones.

How to create a policy in the Entra admin centre

The flow is the same for every policy.

1. Sign in to the Microsoft Entra admin centre as a Conditional Access Administrator.
2. Go to Entra ID, Conditional Access, Policies, and select New policy or Create from templates.
3. Under Users, include the target group and exclude the break-glass group.
4. Under Target resources, choose All resources or the Microsoft 365 apps you want to cover.
5. Set Conditions (for example locations or client apps) and the Grant control.
6. Set Enable policy to Report-only, create it, and review the sign-in logs after a few days.

Name policies clearly, for example CA01 Require MFA all users, so whoever looks after the tenant next understands them.

Mistakes that lock people out or leave gaps

MFA alone is not the end of the story. Push-approval MFA can be abused by attackers who send repeated prompts; our guide to MFA fatigue attacks explains number matching and other defences.

Do it yourself or get help?

If you are on Business Basic or Standard, keep security defaults on; that is the right answer, not a compromise. If you have Business Premium, Conditional Access is worth the effort, but it needs careful testing and someone who will look at the sign-in logs.

Our Microsoft 365 / Google Security Lockdown (S$590) sets up break-glass accounts, the five policies above in report-only, then enforces them once the logs are clean. Device Encryption and Management (S$490) enrols laptops and phones in Intune so the managed-device policy can go live. The rest of the tenant is covered in our Microsoft 365 security checklist.