PŻ.
    Ask the SI

    Conditional Access baseline checklist

    Run this against a tenant before assuming MFA is enforced. Most gaps are in exclusions and legacy protocols, not in missing policies.

    Updated

    Enforcement

    • Legacy authentication blocked tenant-wide.
    • MFA required for all interactive users, including administrators.
    • Phishing-resistant authentication strength (FIDO2/passkey, Windows Hello for Business or certificate-based MFA) required for privileged roles, rather than a generic MFA grant.
    • No policy has been left in report-only mode without an enforcement date.
    • Sign-in frequency and persistent-session settings reviewed for admin sessions.
    • Plan tracked for Microsoft's SMS and voice MFA retirement — passkeys become the tenant default from September 2026, with native SMS/voice delivery withdrawn from February 2027.

    Device and location conditions

    • Privileged access requires a compliant or hybrid-joined device.
    • Device registration requires MFA.
    • Location conditions used as signal, not as the sole control.
    • Unmanaged-device access restricted to browser sessions with limited download.

    Exclusions and break-glass

    • Every exclusion group has a named owner and review date.
    • Exclusion group membership changes generate an alert.
    • Exactly two emergency-access accounts exist, hardware-key protected.
    • Break-glass sign-in triggers a high-severity alert.
    • Service accounts migrated to workload identities rather than excluded.

    Guests and risk

    • Separate policy set applies to guest and external identities.
    • Access reviews run for guests and privileged roles.
    • Sign-in risk and user risk policies enabled after baseline stabilisation.
    • Policy changes captured and reviewed as configuration changes.

    Related

    Conditional Access baseline

    An Entra ID Conditional Access baseline ordered by blast radius: which policies to ship first, how to stage them, the legacy-policy retirement dates that create silent gaps, and the exclusions that quietly undo them.

    Microsoft Entra ID

    Entra ID hardening: Conditional Access design, PIM, phishing-resistant authentication, app registration governance and agent identity.

    Identity & Zero Trust

    Entra ID hardening, Conditional Access authentication strengths, privileged access management and identity attack-path analysis with BloodHound.

    Cloud security assessment

    Configuration and architecture assessment for Azure, GCP and Alibaba Cloud: identity, network, data, logging and CSPM findings with a fix roadmap.

    Cloud security

    Multi-cloud security practice: landing zones, identity, posture management, MITRE ATT&CK-aligned detection engineering and CIS hardening baselines.

    Identity attack paths

    Using BloodHound and Entra ID review to find privilege escalation paths across on-premises Active Directory and cloud identity.