What is Conditional Access?
Conditional Access is a security feature in Microsoft Entra ID that controls who can sign in, from where and on which device. Instead of letting everyone in from everywhere, the rules assess the context of each sign-in. Signing in from Norway with MFA? Welcome. From an unfamiliar country without MFA? Denied.
What the rules can take into account
- User or group, for example stricter rules for administrators.
- Location, such as allowing sign-ins only from Norway or blocking high-risk countries.
- Device, such as requiring the PC to be managed by the company through Intune.
- App, with different rules for Teams, SharePoint and administration.
- Risk, where Microsoft detects that a sign-in is suspicious, for example impossible travel between two locations.
A rule can require MFA, block the sign-in completely, require an approved company device, or require a password change.
The rules we recommend
- Require MFA for everyone. The most important rule. It stops more than 99.9 percent of attacks on accounts, according to Microsoft.
- Block high-risk countries. Countries you never sign in from don't need to be open. No regular users will notice.
- Stricter rules for administrators. Administrators have access to everything. They should verify with MFA at every sign-in, and preferably only from known devices.
- Require a company device for sensitive apps. A payroll system or SharePoint with personal data should only be reachable from PCs the company manages.
What it requires
Conditional Access requires Microsoft Entra ID Plan 1. It's included with Microsoft 365 Business Premium, E3 and E5. If you have Business Basic or Standard, we can add Entra ID Plan 1 as an add-on. See Business Basic, Standard or Premium?.
We set up and manage the rules for you, and your employees won't notice anything except that their accounts are safer. Call us at 38 27 80 00.