How to Set Up Microsoft 365 Entra ID Conditional Access Policies

What Are Conditional Access Policies?

Conditional Access policies in Microsoft 365 (formerly Azure AD) let you control who can access your company's apps and data based on specific conditions. Think of them as smart gatekeepers that check multiple factors before letting someone in: where they're logging in from, what device they're using, and whether their login looks suspicious.

For small businesses, these policies are one of the most effective ways to prevent unauthorized access without making life difficult for your team. You can require multi-factor authentication for remote workers, block access from certain countries, or flag risky sign-in attempts automatically.

Prerequisites

Before you start creating policies, make sure you have:

• Microsoft 365 Business Premium or higher (Conditional Access isn't available in Basic plans)
• Global Administrator or Security Administrator role
• Users already set up in Entra ID
• Multi-factor authentication (MFA) configured for your organization

If you're not sure about your current security setup, it's worth reviewing your licensing and permissions first.

Accessing the Entra ID Admin Center

1. Sign in to the Microsoft 365 admin center at admin.microsoft.com
2. Navigate to the Entra ID admin center (entra.microsoft.com) or click "Show all" in the left menu and select "Identity"
3. In the left sidebar, expand "Protection" and click "Conditional Access"

You'll see a dashboard showing any existing policies. If this is your first time here, it will be empty.

Creating Your First Policy

Let's walk through creating a basic policy that requires MFA for all users when they sign in from outside your office network.

Step 1: Start a New Policy

Click "New policy" at the top of the Conditional Access page. Give it a clear name like "Require MFA for external access" so you'll know what it does six months from now.

Step 2: Assign Users and Groups

Under "Assignments," click "Users or workload identities."

• Select "All users" for company-wide protection, or
• Choose "Select users and groups" to target specific departments

For your first policy, consider starting with a test group of 3-5 people rather than rolling it out to everyone immediately. You can always expand it later.

Important: Always exclude at least one emergency access account (sometimes called a "break glass" account) from every policy. If something goes wrong, you need a way to get back in.

Step 3: Set Target Resources

Click "Target resources" under Assignments.

• Choose "All cloud apps" to protect everything, or
• Select specific apps like Outlook, SharePoint, or Teams

For most small businesses, "All cloud apps" makes sense. You don't want gaps in your security.

Step 4: Define Conditions

This is where you specify when the policy should kick in. Click "Conditions" to see your options:

Locations: This is useful for requiring extra verification when people work remotely.

• Click "Locations" and set Configure to "Yes"
• Under Include, select "Any location"
• Under Exclude, select "Selected locations" and add your office IP addresses as a "Named location"

Now the policy will only apply when users are outside the office.

Device platforms: You can require different security for mobile devices versus desktops.

Sign-in risk: Microsoft analyzes each login attempt and assigns a risk level. You can automatically challenge high-risk logins.

Step 5: Configure Access Controls

Under "Access controls," click "Grant."

• Select "Grant access" (you're not blocking anyone, just adding requirements)
• Check "Require multi-factor authentication"
• Leave "Require all the selected controls" checked

Click "Select" to save.

Step 6: Enable the Policy

At the bottom of the page, you'll see "Enable policy" with three options:

• Report-only: The policy runs but doesn't enforce anything. Use this to test.
• On: The policy is active immediately.
• Off: The policy is saved but disabled.

Start with "Report-only" mode. Let it run for a few days while you check the reports to make sure it won't lock anyone out unexpectedly.

Click "Create" to save your policy.

Testing and Monitoring

After creating a policy in report-only mode, check back in 24-48 hours:

1. Go to Entra ID admin center
2. Navigate to "Monitoring" then "Sign-in logs"
3. Look at the "Conditional Access" column to see what would have happened

If everything looks good and no one would have been incorrectly blocked, go back to your policy and switch it from "Report-only" to "On."

Common Policy Examples for Small Businesses

Here are a few more policies worth considering:

Block legacy authentication: Older email clients and apps don't support MFA, making them security risks. Create a policy that blocks "Exchange ActiveSync clients" and "Other clients" under conditions.

Require compliant devices: If you manage devices through Intune, you can require that phones and laptops meet your security standards (updated OS, encryption enabled, etc.) before accessing company data.

Block specific countries: If you never do business in certain regions, you can block all sign-in attempts from those locations to reduce your attack surface.

Require MFA for administrators: Create a separate policy that always requires MFA for admin accounts, even when they're in the office.

Troubleshooting Common Issues

If users report they can't sign in after you enable a policy:

• Check the sign-in logs to see which policy blocked them and why
• Verify they're not using an old app that doesn't support modern authentication
• Make sure they've registered for MFA if that's required
• Confirm their device is recognized if you're requiring device compliance

Remember that policies can take up to 15 minutes to fully apply across all Microsoft services.

Best Practices

• Start with report-only mode for every new policy
• Always exclude emergency access accounts
• Use clear, descriptive names for policies
• Document why each policy exists and what it protects
• Review your policies quarterly as your business changes
• Don't create too many overlapping policies (they can conflict)

Conditional Access is part of a broader cloud security strategy. These policies work best when combined with other protections like data loss prevention and threat detection.

Need Help Getting Started?

Setting up Conditional Access policies correctly the first time prevents headaches later. If you'd like assistance reviewing your Microsoft 365 security or configuring policies for your specific business needs, reach out to our team. We help small businesses implement practical security controls that actually work.

FAQ

Do I need special licensing for Conditional Access?

Yes, Conditional Access requires Microsoft 365 Business Premium, Microsoft 365 E3/E5, or standalone Entra ID P1/P2 licenses. It's not available in Basic or Business Standard plans.

What happens if I accidentally lock myself out?

This is why you should always exclude an emergency access account from all policies. If you do get locked out, you'll need to contact Microsoft support or use an account that wasn't included in the policy assignments.

How many policies should I create?

Start with 2-3 core policies (like requiring MFA for external access and blocking legacy authentication). You can add more as needed, but too many policies become hard to manage and can conflict with each other. Quality over quantity.