Conditional Access in Microsoft 365: A Small Office Guide

Conditional Access is the Microsoft 365 feature that lets you write your own sign-in rules: who must use multi-factor authentication, which devices may reach company data, and which sign-in methods are blocked outright. It requires Microsoft Entra ID P1, which is included in Microsoft 365 Business Premium but not in Business Basic or Business Standard. A small office usually needs about five policies, tested in report-only mode first, with an emergency “break-glass” administrator account created before any policy is switched on.

What Is Conditional Access?

Microsoft describes Conditional Access policies as if-then statements: if a user wants to access a resource, then they must complete an action. The “if” side can look at the user or group, the app, the device, and the location the sign-in comes from. The “then” side either blocks access or grants it with conditions such as:

• Require multi-factor authentication (MFA)
• Require the device to be marked as compliant (meeting rules you set in Microsoft Intune)
• Require an app protection policy (for example, a protected Outlook app on a personal phone)
• Require a password change or acceptance of terms of use

Policies are evaluated after the password step succeeds, on every sign-in, with nobody watching a dashboard. Conditional Access lives inside Microsoft Entra ID, the identity system behind Microsoft 365. In the Entra admin center (entra.microsoft.com) it sits under Entra ID > Conditional Access.

What License Do You Need for Conditional Access?

Microsoft’s documentation states that Conditional Access requires Entra ID P1 licenses and that Microsoft 365 Business Premium customers can also use it. Policies based on Microsoft’s sign-in risk scoring need Entra ID P2.

List prices per user per month with annual billing, as of September 2026, from Microsoft’s small and medium business security pricing and its 2026 pricing update:

Option	List price	Conditional Access?
Microsoft 365 Business Basic	$7.00	No
Microsoft 365 Business Standard	$14.00	No
Business Standard plus Entra ID P1 add-on	$14.00 + $7.00	Yes
Microsoft 365 Business Premium	$22.00	Yes, plus Intune and Defender for Business

The arithmetic matters. Adding P1 to Business Standard costs $21.00 per user, one dollar less than Business Premium, which also includes device management and endpoint security. If you want Conditional Access, Premium is usually the more sensible route. Our Business Premium vs Standard comparison has the full breakdown.

If your P1 licenses lapse, Microsoft says existing policies are not deleted or disabled, but you can no longer edit them.

Security Defaults vs Conditional Access

Security defaults are Microsoft’s free, one-switch baseline: MFA for everyone and older sign-in methods blocked. Microsoft’s comparison comes down to this:

	Security defaults	Conditional Access
License required	None	Entra ID P1 or higher
Customization	None, on or off	Full
Exceptions for one account or device	Not possible	Possible
Device or location rules	No	Yes

You cannot use both. Security defaults must be turned off before your own policies apply, and Microsoft advises enabling replacement policies immediately so there is no gap.

Microsoft also creates some policies for you. Its Microsoft-managed policies (such as “Block legacy authentication” and “Multifactor authentication for all users”) appear in eligible tenants in report-only state, and Microsoft turns them on no less than 30 days later unless you switch them off. If you open the policy list and see policies nobody in your office created, that is why. You can exclude users from them but cannot rename or delete them.

Before Any Policy: Create Break-Glass Accounts

A break-glass account, which Microsoft calls an emergency access account, is an administrator account kept for the day normal admin accounts cannot sign in: a policy mistake, a lost phone, or the only administrator leaving. Microsoft’s emergency access guidance recommends:

1. Create two accounts, cloud-only, on your .onmicrosoft.com domain, not tied to any individual.
2. Assign both the Global Administrator role permanently.
3. Protect them with a passkey on a FIDO2 security key (a small USB device). This satisfies Microsoft’s mandatory MFA for admin portals and is a different method from the one your daily admin account uses.
4. Exclude them from every Conditional Access policy that blocks or restricts sign-in. A dedicated group makes this easy.
5. Store the keys in a secure place that more than one authorized person can reach.
6. Test that they can sign in at least every 90 days, and review any sign-in by these accounts.

Older advice was a very long password stored in a safe. Because Microsoft now requires MFA for its admin portals, a password alone no longer works for these accounts.

Five Starter Policies for a Small Office

Microsoft publishes policy templates, and the “Secure foundation” group is the one it recommends as a base for every organization. These five are a reasonable starting set. The first four have templates. The country block is built by hand after you define a named location.

Policy	What it does	Check first
Require MFA for all users	Everyone completes MFA to reach Microsoft 365	All staff have registered an MFA method
Require MFA for admins	Admin roles always complete MFA	Break-glass accounts are excluded
Block legacy authentication	Blocks older mail protocols that cannot do MFA	Scanners, copiers, and old apps that send email
Require a compliant device or app protection policy on phones	Company email opens only on managed devices or in protected apps	Intune is set up and devices are enrolled
Block sign-ins from countries you never work from	Refuses sign-ins from locations you list	Staff travel plans and any overseas contractors

Some honest notes on these.

Legacy authentication is the one most likely to break something. Multifunction printers that scan to email often sign in with an old protocol. Before enforcing, filter Entra ID > Monitoring & health > Sign-in logs by client app to see what still uses legacy protocols, and follow Microsoft’s guidance on setting up a device to send email through Microsoft 365.

Device rules only work once devices are managed. Requiring compliant devices before anything is enrolled in Intune blocks everyone. If staff use personal phones, read our BYOD policy outline first, because the app protection route avoids enrolling their phones.

Country blocking reduces noise but is not strong protection by itself, since a VPN can make a sign-in appear to come from an allowed country. Locations are defined under Entra ID > Conditional Access > Named locations.

How Do You Create a Policy from a Template?

1. Sign in to entra.microsoft.com with a Conditional Access Administrator or Global Administrator account.
2. Go to Entra ID > Conditional Access and choose Create new policy from templates.
3. Pick the template and review the users, apps, and conditions it proposes.
4. Under excluded users, add your break-glass group.
5. Leave the policy state as Report-only and create it.
6. Review results (next section), then change the state to On.

Policies can be assigned to a pilot group first. Starting with a small group of willing staff, then widening to everyone, is slower but keeps surprises small.

What Is Report-Only Mode?

Report-only mode is a policy state in which Entra ID evaluates the policy at each sign-in and records what would have happened, without enforcing it. Nobody is blocked or prompted.

To read the results, open a sign-in in the sign-in logs and select the Report-only tab. Each policy shows a result such as “Report-only: Success”, “Report-only: Failure” (would have been blocked), or “Report-only: User action required” (would have been prompted for MFA). The Conditional Access page also has a What If tool that simulates a given user, app, and location.

One caveat from Microsoft: a report-only policy that requires a compliant device can still show certificate prompts on Mac, iPhone, iPad, and Android. Microsoft suggests excluding those platforms from report-only policies that check compliance.

Leave a new policy in report-only long enough to cover a normal cycle of work, including anyone who works remotely or part time, before turning it on.

Common Mistakes

• Enforcing a policy with no break-glass account excluded, then locking every administrator out.
• Turning off security defaults and not enabling replacement policies the same day.
• Blocking legacy authentication without checking scanners and older line-of-business software.
• Requiring compliant devices before Intune enrollment is finished.
• Excluding the owner or a senior person from MFA for convenience. Those are the accounts attackers want most.
• Writing a dozen overlapping policies. Five clear ones are easier to reason about.

When You Do Not Need Conditional Access

If you are on Business Basic or Standard, everyone can use an authenticator app, and you have no need for exceptions or device rules, security defaults already give you MFA and block legacy sign-ins at no cost. That is a legitimate place to stay.

Conditional Access earns its cost when you need something security defaults cannot do: an exception for one service account, protection for company data on personal phones, rules tied to device health, or evidence of access controls for a framework such as HIPAA or the FTC Safeguards Rule. It is also a building block of the zero trust approach.

Common Questions

Is Conditional Access included in Microsoft 365 Business Standard?

No. Conditional Access requires Microsoft Entra ID P1. Business Basic and Business Standard include the Free edition of Entra ID, which offers security defaults instead. Business Premium includes P1, or you can add P1 to individual users for $7.00 per user per month as of September 2026.

Can Conditional Access lock us out of Microsoft 365?

Yes, a policy that blocks too broadly applies to administrators as well. That is why Microsoft recommends two emergency access accounts that are excluded from blocking policies, and why new policies should run in report-only mode before being enforced. With both in place, a mistake can be undone by signing in with the emergency account and switching the policy off.

Do we still need MFA if we have Conditional Access?

Conditional Access is how you require MFA, not a replacement for it. The policy says when MFA is demanded and from whom. Staff still register a method such as the Microsoft Authenticator app or a passkey, and the policy decides when they are asked to use it.

How long does setup take for a small office?

Creating the policies is the quick part. Most of the calendar time goes to preparation and testing: ordering security keys for the break-glass accounts, confirming everyone has registered for MFA, finding devices that use legacy protocols, and running policies in report-only mode before enforcing them.

How Coastal Growth Co. Can Help

We set up Conditional Access for small businesses in Orange County: break-glass accounts, the starter policies above, report-only review, and written notes on what each policy does so it can be maintained later. We also check what would break before anything is enforced. Scope and price are agreed before paid work begins. See our Microsoft 365 and cloud services or get in touch.