Five Conditional Access policies every small business needs
5 min read · Updated on 20 October 2026
With Conditional Access in Microsoft Entra ID you decide under which conditions someone may sign in. Microsoft offers templates you can use as a starting point. These five policies are a good start.
What do you need?
Conditional Access requires a Microsoft Entra ID P1 or P2 licence. Microsoft 365 Business Premium and Microsoft 365 E3 include Microsoft Entra ID P1.
No P1? Then use security defaults. They are available without an extra licence. Microsoft calls them the recommended baseline for every organisation. Only turn them off when you move to Conditional Access. Is per-user MFA (the old method) still on? Then your IT administrator must turn it off first.
The five policies
- MFA for all users. Every sign-in to every app requires a second factor. Microsoft provides the template Require multifactor authentication for all users.
- Block legacy authentication. Microsoft counts this among the baseline policies every organisation should deploy together. The template is called Block legacy authentication.
- Phishing-resistant MFA for administrators. Accounts with admin roles are a favourite target. Microsoft recommends the built-in Phishing-resistant MFA strength, such as a passkey or FIDO2 key, for roles including Global Administrator, Exchange Administrator and SharePoint Administrator.
- Require a managed device or MFA. With the template Require compliant or Microsoft Entra hybrid joined device or multifactor authentication for all users, access is only allowed from a managed device that meets your compliance rules, or otherwise with MFA.
- Two emergency accounts, excluded and monitored. See the next section.
Register phishing-resistant methods for your administrators before you turn on policy 3. Otherwise you risk locking yourself out.
Emergency accounts: exclude and monitor
A mistake in a policy can lock out all administrators. Microsoft therefore recommends at least two emergency access (break-glass) accounts. These are cloud-only accounts on the onmicrosoft.com domain with the Global Administrator role.
- Exclude them from every policy that blocks or restricts sign-in, for example through a separate group.
- Protect them with a different method from your normal administrators, such as a FIDO2 key.
- Make every sign-in to these accounts trigger an alert. Microsoft describes how to do this with the sign-in logs in Azure Monitor.
- Test them at least every 90 days and after changes in the IT team.
Test first in report-only mode
A policy created from a template starts in report-only mode by default. The policy blocks nothing, but the sign-in logs show what would happen. Have your IT administrator test every policy this way first. Only turn it on when the results are correct.
Note: a template only excludes the account of the person creating the policy. You add other exclusions, such as your emergency accounts, yourself.
Checklist
- Check whether you have Microsoft Entra ID P1, for example through Business Premium.
- Create two emergency accounts and set up alerts.
- Register phishing-resistant methods for administrators.
- Create the five policies in report-only mode.
- Review the sign-in logs and then turn the policies on.
- Turn off security defaults once your policies are active.