A Conditional Access Baseline for Microsoft 365: The Policies to Start With

The baseline

Microsoft ships templates for each of these under Entra ID > Conditional Access > Create new policy from templates. Start with:

• Require multifactor authentication for admins.
• Require multifactor authentication for all users.
• Block legacy authentication.
• Require multifactor authentication for Azure management.
• Securing security info registration, so an attacker with only a password cannot register their own MFA method.
• Require phishing-resistant multifactor authentication for administrators.

With Entra ID P2, add the risk-based policies: require MFA for risky sign-ins, and require a secure password change or block access for high-risk users.

Microsoft-managed policies

Since late 2023 Microsoft creates policies in tenants itself. You recognise them by 'Microsoft' in the Created by column. They include blocking legacy authentication, blocking device code flow, MFA for admins on the admin portals, MFA for all users and, with P2, policies for risky sign-ins and high-risk users.

They are created in Report-only and switched on automatically no sooner than 30 days later, after a notice in the message center. You cannot rename or delete them, but you can switch them off, exclude users, or duplicate them into a policy of your own. Read them before they turn on, especially in tenants with service accounts or older devices.

How to roll out without locking anyone out

1. Create a group with your two break-glass accounts and exclude it from every policy. Templates only exclude the admin who creates them.
2. Create each policy in Report-only. The Policy impact view and the sign-in logs show what it would have done.
3. Check for a week: service accounts, scanners, guest users and other devices without modern authentication show up here.
4. Switch the policy to On, one at a time. Security defaults must be off before your own policies can be switched on, so have the baseline ready before you switch them off.

Gaps to look for in an existing setup

• Policies left in Report-only for months. They protect nothing.
• Exclusion lists that grew: 'temporary' users, service accounts, the director who complained. Each one is an account the policy does not cover.
• Policies that target selected apps instead of all resources, so a new app falls outside them.
• Guest and external users left out of MFA policies.
• No break-glass exclusion, which makes the next mistake a lockout.

List the policies and their state with Microsoft Graph PowerShell:

Connect-MgGraph -Scopes "Policy.Read.All"
Get-MgIdentityConditionalAccessPolicy |
  Select-Object DisplayName, State |
  Sort-Object State

State 'enabledForReportingButNotEnforced' means Report-only.

Frequently asked