Conditional Access Policies¶

Conditional Access is the policy engine that gates access to Microsoft 365 resources based on signals such as user identity, device state, location, and risk level.

Break-Glass Accounts¶

Create two emergency access accounts and exclude them from every CA policy. If a misconfigured policy locks out all admins, these accounts are the only recovery path.

• Cloud-only accounts — not synced from on-premises AD
• Named clearly: breakglass1@domain.com, breakglass2@domain.com
• Long, randomly generated passwords stored in a sealed envelope and a password manager
• FIDO2 hardware security key registered as the only auth method (no Authenticator app)
• No roles assigned permanently — activate via PIM only when needed
• Alert rule in place to notify security team on any sign-in

Pre-Configuration¶

Named Location — Approved Countries¶

Create this before Policy 5 (Geoblock).

Entra admin center → Protection → Conditional Access → Named locations → + Countries location

Security Group — Overseas Travel¶

Create this group in Entra ID before Policy 5 (Geoblock).

Entra admin center → Groups → New group

Add users to this group when they notify IT of upcoming travel. Remove them on return.

Policies¶

CA001 — Enforce 2FA for All Users¶

Purpose: Require all users to complete MFA using an approved authentication method before accessing any cloud app.

MFA is enforced through Authentication Strength rather than the basic "Require MFA" grant — this gives precise control over which methods are accepted.

Standard MFA strength allows:

• Microsoft Authenticator (push notification + number match)
• Windows Hello for Business
• FIDO2 security key / Passkey
• Temporary Access Pass (one-time or multi-use)

CA002 — Enforce 2FA for Admins¶

Purpose: Apply a stricter authentication strength to privileged directory roles. Admins are the highest-value targets — this policy ensures they can only use methods appropriate for sensitive accounts.

This policy targets specific roles rather than a group, so it automatically catches any new admin role assignments.

Admin MFA strength allows everything in Standard MFA, plus:

• Software OATH token (e.g., hardware token app generating TOTP codes)

CA003 — Block Legacy Authentication¶

Purpose: Block authentication protocols that cannot perform MFA — SMTP AUTH, IMAP, POP3, Exchange ActiveSync (basic auth), and other legacy clients. These protocols are a primary vector for credential stuffing attacks.

CA004 — Block Device Code Flow¶

Purpose: Block the OAuth 2.0 device authorization grant (device code flow). This flow is exploited in phishing attacks where an attacker sends a victim a code to enter at microsoft.com/devicelogin, authenticating as the victim without needing their credentials.

CA005 — Geoblock — Approved Countries Only¶

Purpose: Block sign-ins from any country not in the Approved Countries named location. Staff travelling internationally can be added to the Overseas Travel security group to temporarily bypass this policy.

Overseas Travel process¶

When a user notifies IT of international travel:

1. Add the user to the Overseas Travel group in Entra ID
2. Confirm the policy exclusion is active (sign-in should succeed from destination)
3. Set a calendar reminder to remove them on their return date
4. On return, remove from the group

# Add a user to the Overseas Travel group
Connect-MgGraph -Scopes "GroupMember.ReadWrite.All"

$groupId = (Get-MgGroup -Filter "displayName eq 'Overseas Travel'").Id
$userId  = (Get-MgUser -Filter "userPrincipalName eq 'user@domain.com'").Id

New-MgGroupMember -GroupId $groupId -DirectoryObjectId $userId

# Remove after travel
Remove-MgGroupMemberByRef -GroupId $groupId -DirectoryObjectId $userId

Policy Deployment Order¶

Deploy in this sequence to avoid locking users out before break-glass and exclusions are in place:

flowchart LR
    A[1. Create break-glass accounts] --> B[2. Create Authentication Strengths]
    B --> C[3. Create Named Locations + Overseas Travel group]
    C --> D[4. Deploy CA001–CA004 in Report-only]
    D --> E[5. Deploy CA005 in Report-only]
    E --> F[6. Review sign-in logs 2+ weeks]
    F --> G[7. Enable CA003 + CA004 — low risk]
    G --> H[8. Enable CA001 + CA002]
    H --> I[9. Enable CA005 last]

Monitoring¶

Entra admin center → Monitoring → Workbooks → Conditional Access Insights and Reporting

This workbook shows policy impact, sign-in success/failure counts, and which policy is enforcing or blocking for each sign-in — essential for validating Report-only mode before going live.

Useful PowerShell¶

Connect-MgGraph -Scopes "Policy.ReadWrite.ConditionalAccess","Policy.Read.All"

# List all CA policies with state
Get-MgIdentityConditionalAccessPolicy |
    Select-Object DisplayName, State, Id |
    Sort-Object DisplayName

# Export all policies to JSON (good for documentation / disaster recovery)
Get-MgIdentityConditionalAccessPolicy |
    ConvertTo-Json -Depth 10 |
    Out-File "CA-Policies-$(Get-Date -Format yyyyMMdd).json"

# Find sign-ins blocked by a specific CA policy (requires Graph Reports scope)
Connect-MgGraph -Scopes "AuditLog.Read.All"

Get-MgAuditLogSignIn -Filter "conditionalAccessStatus eq 'failure'" -Top 50 |
    Select-Object UserDisplayName, UserPrincipalName, CreatedDateTime, IpAddress,
        @{N="CAPolicies";E={ ($_.AppliedConditionalAccessPolicies | Where-Object { $_.Result -eq "failure" }).DisplayName -join ", " }}