One-page guide / Microsoft 365

Conditional Access: Why Context Matters

Harris Ejiofor, CISM – CyberShield Advisory

Conditional Access lets Microsoft 365 weigh who is signing in, from what device and under what conditions. This guide explains what it can do and what to ask before relying on it.

The short version

A password and a prompt tell you very little about the situation around a sign-in. The same correct credentials can come from a trusted laptop in your office or from an unfamiliar device on another continent. Conditional Access is the Microsoft Entra capability that takes that context into account. It evaluates a sign-in against rules you set and then allows it, asks for more proof, or blocks it.

What context can include

Depending on how rules are written, a decision can consider:

Who is signing in, such as everyone, a group or only administrators.
What they are reaching, such as email, files or a specific application.
Which device they use, and whether it is managed or meets your requirements.
Where the sign-in appears to come from.
The sign-in method, including older methods that cannot use MFA.
Risk signals, where your license includes them.

What it can do about it

Require MFA for everyone, or for riskier situations only.
Block sign-ins from locations where you have no staff.
Require a managed device before sensitive data can be opened.
Block older sign-in methods that bypass MFA.
Require a stronger check for administrators.

What to know before relying on it

Licensing. Conditional Access requires Microsoft Entra ID P1 or higher. Risk-based policies need a higher level still. Ask what your plan includes.
It must be configured. Having the license does not mean a policy exists. Someone has to decide what the rules are.
Rules need testing. A poorly written rule can lock out legitimate users, so test before enforcing, and keep an emergency account outside the rules.
Gaps matter. A policy that applies to most users but excludes a group, a shared account or an old sign-in method leaves the exclusion open.
It needs review. Staff, devices and locations change. Rules that were right two years ago may not be now.

Questions to ask this week

Does our license include Conditional Access?
Which policies are in place, and what do they cover and exclude?
Who reviewed them last, and when?
Is there an emergency account, and is it protected?
Would we notice if a rule were changed or switched off?

Take the next step

Our free Microsoft 365 security assessment asks five quick questions, including how sign-in is protected, and shows where to start. It is a short check, not a full review of your settings.