Many companies still primarily secure Microsoft 365 with:

• a username;
• a password;
• MFA.

That is a good foundation, but modern security goes further.

Because the same user might try to sign in:

• from their usual company laptop;
• from an unknown personal computer;
• from Belgium;
• suddenly from another region;
• from a compliant device;
• from a device not managed by the organisation.

What is Conditional Access?

Microsoft calls Conditional Access the policy engine of its Zero Trust model.

In simple terms, it works according to a:

For example:

But you can go much further.

Why is this important?

A valid password does not automatically mean the person behind the sign-in is trustworthy.

The password could, for example:

• have been stolen via phishing;
• appear in a data breach;
• have been extracted by malware;
• have been reused by a user;
• have been deliberately shared with someone else.

That is why modern security does not only look at:

but also at:

Which signals can Conditional Access use?

Depending on licences, configuration, and connected Microsoft services, Conditional Access can take various signals into account.

For example:

• the user;
• the group to which someone belongs;
• the application or resource being accessed;
• the device;
• whether the device is compliant;
• the operating system;
• the location or network from which someone is signing in;
• the authentication method used;
• any risk information when the appropriate licences are present.

What can Conditional Access do then?

When a sign-in meets certain conditions, Conditional Access can, for example:

• allow access;
• block access;
• require MFA;
• require a specific authentication strength;
• require a compliant device;
• require a managed device;
• impose extra conditions for sensitive resources.

A practical example

Suppose an employee normally works from a company-managed laptop.

The same user later tries to access from an unknown personal computer.

MFA and Conditional Access are not the same

This distinction is important.

MFA is an authentication method.

Conditional Access determines when and under which conditions certain authentication or other access controls are required.

The two therefore complement each other.

Can I use MFA smarter?

Yes.

Conditional Access can ensure that MFA is enforced according to the organisation's security policy.

For sensitive scenarios, a stronger authentication method can also be required.

Think, for example, of:

• passkeys;
• Windows Hello for Business;
• FIDO2 security keys;
• other phishing-resistant methods that fall within the chosen authentication strength.

Can I only allow company laptops?

That is possible in certain scenarios.

Conditional Access can work together with Microsoft Intune to, for example, require a compliant device.

As a result, access can be made conditional on requirements such as:

• the device is managed by the organisation;
• it complies with the compliance policy;
• required security settings are present.

Can I block certain countries?

Conditional Access can include location information in policies.

This allows an organisation, for example, to create access rules around certain countries, regions, or trusted locations.

But a simple country block is not a full-fledged security strategy.

Good Conditional Access therefore uses multiple security layers together.

What about administrator accounts?

Administrator accounts deserve extra protection.

A compromised regular user is serious. A compromised administrator can have much greater consequences.

For privileged accounts, stricter access can therefore be required, for example:

• stronger authentication;
• additional MFA requirements;
• restricted devices;
• specific access conditions;
• stricter session or location conditions.

Conditional Access is a core part of Zero Trust

Traditional IT security often started from the idea:

Zero Trust reverses that principle.

Microsoft summarises Zero Trust around principles such as:

• verify explicitly;
• use least privilege;
• assume breach.

"We only have five employees"

The number of employees does not determine how much damage one stolen Microsoft 365 account can cause.

Even a small business may have:

• mailboxes with confidential communication;
• SharePoint with business documents;
• OneDrive data;
• financial information;
• customer data;
• administrator accounts;
• connected SaaS applications.

Conditional Access can therefore also be very relevant for small organisations.

"But we already have Microsoft 365 Business Premium?"

Then you have a licence that supports Conditional Access.

Microsoft 365 Business Premium includes Microsoft Entra ID P1 functionality, including Conditional Access.

The security value only arises when policies are consciously designed, tested, and managed.

Which licence do I need?

Conditional Access requires at its base Microsoft Entra ID P1.

This is included, for example, in Microsoft 365 Business Premium.

Some more advanced risk-based scenarios use Microsoft Entra ID Protection and require Entra ID P2 functionality.

Can I configure Conditional Access myself?

Technically yes.

But Conditional Access is one of those components where a small configuration error can have big consequences.

A faulty policy can:

• unnecessarily block users;
• block administrator accounts;
• create important exceptions;
• make security weaker than intended;
• disrupt legacy or service accounts;
• give a false sense of security.

Conditional Access must be strict and workable

Good Conditional Access does not mean blocking as much as possible.

The art is to secure the environment as strictly as possible without unnecessarily complicating daily operations.

A well-designed policy takes into account how your organisation actually works:

• where employees work;
• which devices they use;
• which applications are business-critical;
• which users need extra protection;
• which exceptions are truly necessary;
• which forms of authentication are feasible and secure;
• which user experience you want to maintain.

This is exactly where FLEXAMIT is particularly strong

Conditional Access is one of the areas where FLEXAMIT has built up considerable expertise.

We do not configure Conditional Access as a standard template rolled out identically to every customer.

We first look at the organisation itself:

• which roles exist;
• which user groups have which risk profile;
• which devices are managed;
• how mobile employees work;
• which SaaS applications are used;
• which administrator accounts require extra protection;
• which legacy applications or exceptions still exist;
• which security and compliance requirements apply.

No one-size-fits-all security

A manufacturing company, accounting firm, retail organisation, and consultancy firm all work differently.

Therefore, their Conditional Access configuration should also be different.

FLEXAMIT tailors policies based on, among other things:

• organisation size;
• the Microsoft 365 licences used;
• the type of end users;
• the sensitivity of business data;
• the endpoints used;
• working from home and mobile work;
• external employees;
• administrator roles;
• business continuity;
• the willingness to apply extra security controls.

How FLEXAMIT keeps the environment safe and accessible

A good Conditional Access architecture consists of multiple layers aligned with each other.

FLEXAMIT looks at, among other things:

• MFA;
• authentication strength;
• passkeys and phishing-resistant authentication;
• Microsoft Intune;
• device compliance;
• Microsoft Defender;
• administrator accounts;
• trusted locations;
• guest users;
• legacy authentication;
• break-glass accounts;
• sign-in logs and monitoring.

These components are not configured independently of each other.

Policies are tested first, then enforced

FLEXAMIT does not roll out Conditional Access blindly.

New policies are tested and evaluated in a controlled manner wherever possible before being broadly enforced.

We look at, among other things:

• which users are affected;
• which applications are affected;
• which sign-ins would be blocked;
• whether exceptions are necessary;
• whether service accounts or legacy applications encounter problems;
• whether the desired security gain is effectively achieved.

Why you test policies first

Microsoft offers the possibility to evaluate Conditional Access policies first in Report-only mode.

This allows an administrator to assess what a policy would do without immediately enforcing it fully.

Additionally, a thoughtful rollout is important:

• start with a limited test group;
• check the impact;
• keep emergency access available;
• test exceptions;
• check sign-in logs;
• then roll out further in a controlled way.

Don’t forget emergency accounts

An organisation must prevent a Conditional Access error from locking out all administrators.

Therefore, Microsoft advises provisioning emergency access accounts that are carefully managed and exempt from certain normal policies.

Is Conditional Access necessary?

For a modern organisation professionally using Microsoft 365, we consider Conditional Access a fundamental security layer.

Especially when:

• users work from outside the office;
• Microsoft 365 contains business-critical data;
• devices are centrally managed;
• users access SaaS applications via Entra;
• administrator accounts are present;
• you want to extend access policy beyond just MFA.

Why FLEXAMIT is a particularly strong partner for this

Conditional Access is not a standalone product.

It directly touches on:

• Microsoft Entra;
• Microsoft 365;
• Microsoft Intune;
• Microsoft Defender;
• endpoint security;
• identity protection;
• Zero Trust;
• user experience;
• business continuity.

Do you have Microsoft 365 but don’t know which Conditional Access policies are active?

Have your Conditional Access configuration assessed

Do you use Microsoft 365 Business Premium, Microsoft 365 E3/E5, or another licence with Conditional Access but are unsure if the environment is optimally configured?

In summary