Locking Down Entra ID: 5 High-Impact Conditional Access Policies for Day 1

When onboarding a new tenant or taking over an existing client infrastructure, Conditional Access (CA) is your primary perimeter.

Default security defaults are a decent start, but they lack granularity, exclusion handling, and emergency access safeguards. Here are the 5 high-impact policies we deploy on Day 1 for every enterprise tenant.

---

The Non-Negotiable Rule: Break-Glass Accounts First

[!CAUTION] Before creating or modifying a single Conditional Access policy, ensure you have two cloud-only Break-Glass (Emergency Access) accounts with permanent Global Administrator roles, excluded from all CA policies, and protected by hardware FIDO2 keys stored in physical safes.

Create a dedicated Security Group in Entra ID named SG-CA-Emergency-Exclusions and add your break-glass accounts. Every policy below must exclude this group.

---

Policy 1: Block Legacy Authentication Protocols

Legacy authentication protocols (POP3, IMAP, SMTP AUTH, older ActiveSync) do not support modern MFA challenges, making them prime targets for password spraying attacks.

Policy Configuration:

• Users: All users (Exclude: SG-CA-Emergency-Exclusions and any vetted service accounts using Modern Auth).
• Target Resources: All Cloud Apps.
• Conditions > Client Apps: Select Exchange ActiveSync clients and Other clients.
• Access Controls > Grant: Block access.

[ Client Request ] ──▶ [ Client App: POP3 / IMAP / MAPI ] ──▶ 🛑 Blocked at Gateway

---

Policy 2: Phishing-Resistant MFA for Privileged Admin Roles

SMS and standard Microsoft Authenticator push notifications can be defeated via SIM-swapping or MFA fatigue (push bombing). Highly privileged administrators require FIDO2 Passkeys or Certificate-Based Authentication.

Policy Configuration:

• Users: Select directory roles:
  • Global Administrator
  • Security Administrator
  • Privileged Role Administrator
  • Exchange & SharePoint Administrator
  • Intune Administrator
• Target Resources: All Cloud Apps.
• Access Controls > Grant: Grant access ➔ Require authentication strength: Phishing-resistant MFA.

---

Policy 3: Enforce MFA for All Users & Register from Trusted Locations

Require all standard standard knowledge workers to perform modern MFA whenever accessing enterprise data.

# Quick PowerShell check via Microsoft Graph for users without registered MFA methods
Get-MgReportAuthenticationMethodUserRegistrationDetail -All | 
    Where-Object { -not $_.IsMfaRegistered } | 
    Select-Object UserPrincipalName, IsMfaRegistered, MethodsRegistered

---

Policy 4: Block Known Risky and High-Threat Sign-Ins

(Requires Entra ID P2 license)

Leverage Microsoft’s threat intelligence to immediately block sessions flagged with high sign-in risk or prompt for password reset on high user risk.

• Conditions > Sign-in Risk: High and Medium.
• Access Controls > Grant: Require multi-factor authentication and compliant device.

---

Policy 5: Restrict Device Registration and M365 Portal from Unmanaged Endpoints

Prevent users from exfiltrating sensitive client data onto untrusted personal devices.

• Use session controls with Conditional Access App Control (Defender for Cloud Apps) to restrict downloads on unmanaged devices while allowing read-only web view.