HOW-TO GUIDE 4

Set up Conditional Access with Entra ID P1 and Intune compliance

1. Purpose

Conditional Access decides who can sign in to Microsoft 365, from which devices and under what conditions. This guide sets up four policies: require MFA for all users, require a compliant (Intune-managed) device, block legacy authentication, and optionally block sign-ins from countries where you do not operate. Every policy starts in report-only mode, is checked with the What If tool, and is only then switched on.

2. Applies to / licence required

3. Prerequisites

• Two emergency access (break-glass) accounts: cloud-only (for example breakglass1@<tenant>.onmicrosoft.com), Global Administrator, long random passwords stored securely offline, not linked to any one person. Microsoft now enforces MFA for its admin portals, so protect them with a strong method such as a FIDO2 security key kept in a safe.
• A security group SG-CA-Exclude-BreakGlass containing only these accounts. Exclude this group from every policy.
• A pilot group (for example SG-CA-Pilot) of IT users.
• Users have registered MFA methods (see Part B). Devices enrolled in Intune with compliance policies assigned (Guide 1).
• A list of service accounts or devices that still use basic authentication (old scanners sending mail by SMTP, legacy apps). Fix or plan for these before blocking legacy authentication.

Important: Security Defaults must be turned off before you can use Conditional Access. Do this only when your first Conditional Access policies are ready to enable straight away, otherwise the tenant is left without MFA protection.

4. Step-by-step procedure

Part A – Turn off Security Defaults (when ready)

1. Sign in to the Microsoft Entra admin center and go to Entra ID > Overview > Properties.
2. Select Manage security defaults, set Security defaults to Disabled (not recommended), choose the reason My organization is planning to use Conditional Access, and select Save.
3. Check Entra ID > Conditional Access > Policies for Microsoft-managed policies that may already exist in report-only mode. Review them; you can keep, enable or replace them with the policies below.

Part B – Prepare MFA with Microsoft Authenticator

4. Go to Entra ID > Authentication methods > Policies. Select Microsoft Authenticator, enable it for All users (or the pilot group), and keep number matching (on by default). Save.
5. Optionally enable Temporary Access Pass – useful for onboarding new staff and recovering locked-out users.
6. Ask users to install Microsoft Authenticator on their phone and register at https://aka.ms/mysecurityinfo (Add sign-in method > Microsoft Authenticator, scan the QR code). Recommend adding a second method (phone number) as backup.
7. Check progress in Entra ID > Authentication methods > User registration details (menu name may vary).

[SCREENSHOT PLACEHOLDER – Authentication methods – Microsoft Authenticator enabled for all users]

Part C – Create the policies (report-only)

For each policy: go to Entra ID > Conditional Access > Policies > + New policy (or + New policy from templates, which has ready-made versions of most of these). Always set Users > Exclude > Users and groups to the break-glass group, and Enable policy = Report-only.

8. For CA04, first create the location: Entra ID > Conditional Access > Named locations > + Countries location, name it Blocked countries, select countries you never do business from, and save. (Alternatively, create an 'Allowed countries' location such as India and exclude it.) Remember travelling staff.
9. For CA02, devices must be enrolled and compliant first. Users of personal phones without Intune enrollment will be blocked – decide whether to scope CA02 to Windows only, or to add an app-protection (MAM) approach for mobiles.
10. Select Create for each policy. They now log results without blocking anyone.

[SCREENSHOT PLACEHOLDER – New Conditional Access policy – Grant: Require multifactor authentication, Enable policy: Report-only]

Part D – Test with What If and report-only results

11. On Conditional Access > Policies, select What If. Choose a user, target resource (for example Office 365), platform and location, then select What If. Confirm the expected policies apply and the break-glass account shows no blocking policy.
12. After 1–2 weeks, open Entra ID > Monitoring & health > Sign-in logs, select sign-ins and review the Report-only tab, or use Conditional Access > Insights and reporting. Look for 'Report-only: Failure' results – these users or devices would have been blocked.
13. Fix issues found (unregistered MFA users, non-compliant devices, legacy clients).

Part E – Enforce

14. Switch each policy from Report-only to On one at a time, in this order: CA03 (legacy auth), CA01 (MFA), CA04 (countries), then CA02 (compliant device) – first for the pilot group, then all users.
15. Keep a browser session signed in with an admin account while enabling each policy so you can roll back quickly.

5. Verification and testing

• Pilot user signs in from a new browser: MFA prompt with number matching appears.
• Pilot user on a non-enrolled or non-compliant Windows PC is blocked with a message to enroll/fix the device.
• Old mail client using basic authentication fails; sign-in log shows CA03 as the blocking policy.
• Break-glass account can sign in (test quarterly and record the result).

6. Troubleshooting / common issues and lockouts

7. Best practices

• Always exclude break-glass accounts and monitor their sign-ins with an alert.
• Always start in report-only mode and use What If before enabling.
• Change one policy at a time, during working hours, with IT available.
• Use clear names (CA01, CA02…) and record each change.
• Review Conditional Access policies and exclusions every quarter; remove temporary exclusions.

8. Glossary

9. Need help with rollout?

Need help planning or rolling this out across your sites? Contact Kalpesh Adhvaryu (IT consultancy) for rollout support, pilot planning and hands-on configuration.

Portal menus change regularly. This guide was checked against Microsoft Learn documentation in October 2026; if a menu name differs in your tenant, search for the setting name in the portal or check the linked Microsoft Learn topic.