Most small business breaches in Microsoft 365 start the same way: someone’s password is phished or reused, and an attacker signs in as them. Conditional Access is how you stop that sign-in from working, even when the attacker has the right password.

If you are on Microsoft 365 Business Premium, Conditional Access is already included (it comes with Microsoft Entra ID P1). Many businesses pay for it and never switch it on.

These are the five policies we set up first, including on our own tenant.

Before you start: two safety rules

1. Create a break-glass account. This is an emergency Global Administrator account, with a long random password stored somewhere safe, that is excluded from every Conditional Access policy. If a policy goes wrong and locks everyone out, this is how you get back in. Use it for nothing else.

2. Use report-only mode first. Every policy can run in report-only mode, where it logs what it would have done without blocking anyone. Leave a new policy in report-only for a few days, check the sign-in logs, then switch it on.

If your tenant still has Security Defaults enabled, you will need to turn them off before Conditional Access policies can be enforced. Plan to switch your policies on straight away afterwards, so there is no gap in protection.

Policy 1: Require multi-factor authentication for everyone

This is the single most effective policy. Require MFA for all users, for all cloud apps, excluding only the break-glass account.

Ask people to use the Microsoft Authenticator app rather than text messages where possible. It is quicker for them and much harder for attackers to get around.

Policy 2: Block legacy authentication

Older email protocols such as POP, IMAP and basic SMTP authentication cannot do MFA. Attackers know this, and use them to try stolen passwords without ever seeing an MFA prompt.

Block legacy authentication for everyone. Modern versions of Outlook, Teams and the mobile apps do not need it. If an old scanner or line-of-business app sends email, it is better to fix that one device than to leave the door open for every account.

Policy 3: Block sign-ins from countries you do not work in

If your team works in the UK, there is rarely a good reason for anyone to sign in from elsewhere. Create a named location for the UK and block sign-ins from everywhere else.

Two details make this practical:

  • Create a travel exception group. Add someone to it before they go abroad, and remove them when they are back.
  • Treat unknown locations as allowed. Some connections, particularly over IPv6, cannot always be placed in a country. Blocking unknown locations can lock out your own staff.

Policy 4: Protect administrator accounts harder

Admin accounts can change everything, so they deserve stricter rules. Target the policy at directory roles such as Global Administrator, Exchange Administrator and SharePoint Administrator rather than named people, so it automatically covers anyone given those roles later.

For admins, we require MFA, ask them to sign in again regularly (every 12 hours is a sensible start), and turn off “stay signed in” on browsers. Better still, give admins a separate admin account and keep day-to-day email on their normal account.

Policy 5: Require a managed device for sensitive access

Once your laptops are managed with Intune, you can require a compliant device to reach Microsoft 365, or at least to reach admin portals and sensitive data. That means a stolen password is useless from an attacker’s own computer, even with MFA.

This one needs Intune set up first, so it usually comes a little later than the other four.

What these policies do not cover

  • Risk-based policies, which react to suspicious sign-ins in real time, need Entra ID P2, which is not included in Business Premium.
  • Policies are only as good as their exclusions. Every exclusion is a gap. Keep them few, named clearly, and reviewed.
  • Conditional Access is one layer. Email protection, backup, device security and sensible sharing settings matter too.

Not sure where your tenant stands?

A Microsoft 365 security check reviews your Conditional Access, MFA and the rest of your security settings, and gives you a plain-English fix list in order of risk. We can then set the policies up for you, carefully and with a break-glass account in place, at a fixed price.