Series: 30 Days of Microsoft 365 Admin
🎯 Day-5 Objective
After learning identity security fundamentals (Day-4), today we will:
- Create Conditional Access policies
- Enforce MFA using policies
- Restrict access by location
- Block insecure legacy authentication
- Understand policy evaluation logic
1️⃣ What is Conditional Access (Quick Recap)
Conditional Access evaluates:
- Who is signing in
- Where they are signing from
- What device they are using
- Risk level of the sign-in
It enforces Zero Trust:
Never trust, always verify
2️⃣ Prerequisites (Before You Start)
✔ Entra ID P1 or P2 license
✔ At least one test user
✔ Admin account (not your daily user)
✔ Security Defaults disabled
🔧 Verify Security Defaults
- Entra Admin Center
- Identity → Properties
- Manage Security Defaults
- Set to Disabled
3️⃣ Create Conditional Access Policy – Enforce MFA for Users
🔧 Step-by-Step
- Go to Entra Admin Center
- Navigate to
Identity → Protection → Conditional Access - Click New policy
📝 Policy Name
CA-Require-MFA-For-Users
👤 Assignments – Users
- Include: All users
- Exclude:
- Break-glass admin account
- Emergency admin account
📱 Cloud Apps
- Select: All cloud apps
🔐 Access Controls
- Grant access
- Require Multi-factor authentication
- Enable policy
🧪 Test Result
- User signs in
- MFA prompt appears
- Access granted after verification
4️⃣ Location-Based Conditional Access Policy
🔧 Create Named Location
- Conditional Access
- Named locations
- Add trusted IP (office/home lab)
🔐 Policy Example
Block access from outside India
- Users: All users
- Locations: Exclude trusted location
- Access: Block
🧠 Admin Use Case
Protects tenant from:
- Foreign sign-in attacks
- Credential leaks
5️⃣ Block Legacy Authentication (VERY IMPORTANT)
🔧 Create Policy
- New Conditional Access policy
- Users: All users
- Client apps:
- Select Legacy authentication clients
- Access: Block
🧠 Why This Matters
Legacy protocols do not support MFA
They are the #1 attack vector today.
6️⃣ Policy Evaluation Order (Admin Must Know)
Conditional Access checks:
- User
- App
- Location
- Device
- Risk
- Grant / Block decision
If any policy blocks access → sign-in fails
7️⃣ Monitor Conditional Access Impact
🔧 View Logs
- Entra Admin Center
- Sign-in logs
- Filter: Conditional Access
🔍 What to Check
- Policy applied
- Result (Success / Failure)
- MFA status
✅ End of Day-5 Outcome
After Day-5, you can:
✔ Create Conditional Access policies
✔ Enforce MFA correctly
✔ Block risky sign-ins
✔ Explain Zero Trust confidently
✔ Handle real enterprise security scenarios
📅 DAY-6 PREVIEW (NEXT DAY PLAN)
Day-6: Device-Based Access & Intune Basics
We’ll cover:
🔹 Device registration vs join
🔹 BYOD vs corporate devices
🔹 Compliance policies
🔹 Device-based Conditional Access
🔹 Real admin scenarios
🔑 WHY THIS FLOW IS STRONG
✔ Day-3 → Build identities
✔ Day-4 → Protect identities
✔ Day-5 → Enforce security
✔ Day-6 → Secure devices
This is exactly how real Microsoft environments evolve.