Identity is the perimeter now; everything else this month, private endpoints, firewalls, Bastion, assumes the identity layer holds. Conditional Access is where that layer is enforced: every sign in is evaluated against policies that weigh who, what device, from where, at what risk, and the result is grant, grant with conditions, or block. Here is the policy set I deploy in every tenant, and the rollout method that avoids locking out the CEO.

The Baseline Policy Set

Ten policies cover the ground that matters. Require MFA for all users on all apps, with phishing resistant methods (passkeys, FIDO2, Windows Hello) required for administrators specifically, because number matching push MFA still falls to real time phishing proxies and admins are the targets worth that effort. Block legacy authentication outright, since IMAP and SMTP basic auth bypass Conditional Access entirely and remain the favorite door for password spray. Require compliant or hybrid joined devices for access to sensitive apps, tying Intune posture into the access decision. Block access from countries you never operate in, not because attackers cannot use a VPN but because it removes the noise floor. Require reauthentication and disable persistent sessions for privileged roles. Protect security info registration so an attacker with a password cannot enroll their own MFA method from an unfamiliar network. And add sign in frequency controls for unmanaged devices so a stolen browser token has a short life.

Risk Based Policies

With Entra ID Protection (P2), two signals become policy inputs. Sign in risk (anonymous IP, impossible travel, token anomalies) should trigger MFA at medium and block at high. User risk (leaked credentials, attacker patterns on the account) at high should force a secure password change through a compliant flow. The important cultural point: let the policy do the response automatically and have the SOC review afterward, because the median time between credential compromise and use is minutes, not the hours a ticket queue takes.

Standing Privilege Is the Enemy

Global Administrator assignments should be countable on one hand, and even those should be eligible, not active, through Privileged Identity Management: activation on demand, time boxed, with MFA, justification, and approval for the highest roles. Access reviews quarterly so eligibility itself expires when people change teams. Pair PIM with two break glass accounts, cloud only, with long random passwords in a physical safe, excluded from every Conditional Access policy, and alerted on any use, because the day Entra MFA has an outage you will need a door that does not depend on it.

Rolling Out Without Lockouts

Every new policy starts in report only mode. The sign in logs then show what each policy would have done to real traffic, and the workbook for Conditional Access insights aggregates it: you will find the service account nobody documented, the conference room device authenticating with a password from 2019, the third party app doing legacy auth. Fix or exclude deliberately, then enforce for a pilot group, then broadly. Two permanent habits: exclude the break glass accounts from everything, and review the sign in log filtered to failures grouped by policy weekly for the first month, because the failure you did not predict always exists. Identity work is unglamorous, but every post this month stands on it.

Cheers
Osama