Conditional Access is the closest thing Microsoft 365 has to a network firewall for identities. It lets you define rules that control when, where, and how users can sign in — and it's one of the most commonly misconfigured settings in Microsoft 365 tenants.
Conditional Access sits between a user's login attempt and their access to Microsoft 365 apps. When someone tries to sign in, Azure AD evaluates a set of policies you define. Depending on the conditions — who they are, where they are, what device they're on, what risk level the sign-in carries — it either grants access, requires additional verification (like MFA), or blocks the request entirely.
Think of it as: if (these conditions are true) then (do this).
Conditional Access requires Azure AD Premium P1 licences, which are included in:
If you're on Business Basic or Business Standard, you don't have access to Conditional Access. You can use Security Defaults instead — a simpler, less customisable version that enables MFA for all users and blocks legacy auth.
The foundation. Every user, every app, every sign-in should require MFA. Set this up first before anything else. Use Report-only mode initially — it logs what would have happened without enforcing it, so you can catch issues before going live.
Legacy authentication protocols — SMTP, IMAP, POP3, Exchange ActiveSync, older Office clients — bypass MFA entirely. An attacker with a stolen password can authenticate through these protocols even if MFA is enabled everywhere else. Block them. The only exception: if you have printers or line-of-business apps that use SMTP auth, those need to be migrated to modern auth first.
Admin accounts are the highest-value target. Create a separate policy targeting all administrator roles that requires MFA on every sign-in, from every location, with no exceptions and no persistent sessions.
If your business only operates in the UK, there's no legitimate reason for someone to sign in from Nigeria, China, or Russia. Create a Named Location for your operating countries and block everything else. You'll catch the vast majority of credential stuffing attacks with a single policy.
Requires Intune (included in Business Premium). Ensures users can only access company data from devices your organisation manages. Dramatically reduces the risk of data access from personal or compromised devices.
Go to Entra ID → Security → Conditional Access → Policies. If you see no policies, or only "Security Defaults", Conditional Access isn't in use.
M365Clarity checks your Conditional Access status automatically when you scan your tenant — it tells you whether policies are configured, whether legacy auth is blocked, and whether admin accounts have appropriate protection.
Connect your tenant, run a scan, and see exactly what needs attention — in plain English. Free plan available.
Scan your tenant free →Related articles