Multi-factor authentication is the most valuable single security control most businesses can deploy, and once it is in place many stop there. The next step, and one that is available to most organisations already paying for Microsoft 365 business licensing, is conditional access — evaluating the circumstances of a sign-in rather than only the credentials.
What it changes
Traditional authentication asks one question: are these credentials correct? Conditional access asks a set of them. Who is this, on what device, from where, to reach what, and does anything about this attempt look unusual?
Based on the answers it can allow, allow with additional verification, restrict what the session can do, or block outright. The point is proportionality — a routine sign-in from a managed laptop in the office need not be interrogated, while the same account appearing on an unknown device overseas should be.
Policies worth starting with
A handful of policies deliver most of the benefit.
Require MFA for administrative accounts, always. No exceptions, no trusted locations. Administrative accounts are the ones worth attacking.
Block legacy authentication. Older mail protocols cannot enforce MFA, which makes them the standard route around it. Attackers use them precisely because they bypass the control you deployed. Blocking legacy protocols is one of the highest-value changes available, and it needs checking first — old multifunction printers, scanners and line-of-business applications sometimes depend on them.
Require compliant or managed devices for sensitive data. Access to finance systems or bulk data from an unmanaged personal machine is a substantially different risk from the same access on a managed one.
Restrict by location where it fits. If your business operates entirely in Australia, sign-ins from other countries are worth blocking or challenging. This is not comprehensive protection, since attackers use local infrastructure, but it removes a large volume of untargeted attempts.
Respond to risk signals. Higher licence tiers surface sign-in risk assessments — impossible travel, known compromised credentials, anomalous behaviour — and can require a password change or block automatically.
Deploy it carefully
Conditional access can lock you out of your own tenancy, and this happens to people regularly. Two precautions are essential.
Maintain a break-glass account excluded from all policies, with a long unique password stored securely offline, monitored for use, and tested periodically.
Use report-only mode first. Every policy can run in a mode that logs what it would have done without enforcing it. Run for a week or two, review what would have been blocked, and you will find the printer, the old application and the person working from a holiday house before they find you.
The people side
Tell staff before enforcement begins, explain what will change, and give them a route to get help quickly. A policy that blocks someone with no explanation and no fast path to resolution generates pressure to weaken it, and weakening under pressure is how these deployments unravel.
Watch the exception list. Exceptions granted temporarily during rollout have a habit of becoming permanent, and an exception list that grows quietly is a policy that no longer means what you think it means.
Where the gaps remain
Two worth knowing. Conditional access governs interactive sign-ins; it does not by itself govern application permissions granted through consent, which is a separate and increasingly used route in.
And it does not address inbound email threats at all. Business email compromise frequently begins with a convincing message rather than a stolen credential, and the controls for that are on the mail side — authentication records, filtering, and the discipline of verifying payment changes by phone. Making sure your mail authentication and delivery configuration is correct is a genuinely separate piece of work from access control, and businesses that have done one often assume they have done both.
Start small
Two policies — MFA for admins, legacy authentication blocked — deployed carefully with report-only testing will improve your position more than a comprehensive design that never gets finished.