MSP Onboarding Checklist & Best Practices for a Smooth Start
November 29, 2025
cyberhusky
Conditional access policies best practices help organizations adapt to changing trends where employees use the cloud, laptops and a range of other devices. Microsoft Entra ID allows the strict enforcement policies that protect against:
Remote work and diverse endpoints make conditional access policies a requirement for modern businesses.
Companies are diverse. Employees spread across offices must connect to interconnected spaces worldwide, whether from their home or at their desk. Enforcing conditional access (CA) goes beyond a simple:
Instead, CA goes beyond the basics (weāll explain more below), by blocking legacy authentication. Multi-factor authentication (MFA) is one of the simplest solutions that reduces the risk of compromised accounts being leveraged to gain access to corporate systems.
But CA goes beyond these policies, even with the addition of hybrid-joined accounts and strict location access restrictions.
Strong security starts with your organizationās foundation. CA starts with two main, core principles:
Over 87% of companies with 10k or more employees use multi-factor authentication. Why? Itās the most effective way of reducing compromised account risks. For example, if a user tries to log in, a text is sent to their mobile phone.
Your company may also use an authentication app.
If the right code is put in on top of the personās username and password, then they gain access to company resources. The risk of a hacker obtaining the personās credentials and the extra code is very low.
Outdated protocols pose a risk to your organization. Conditional access best practices require blocking all of these legacy authentications:
Why?
Brute-force and password spray attacks are possible due to the lack of MFA capabilities. Blocking these methods forces users to use modern, secure methods rather than older ones.
You can also take a dual approach to conditional access policies.
Hybrid-joined devices can further be strengthened.
Conditional access best practices also integrate a must-access approach. For example, these policies can:
If a user tries to log in from an untrusted location, you can then require them to use MFA. Integrating these complex security measures restricts access and protects your company in the process.
CA is not a silver bullet for all security problems. You can use conditional access best practices in conjunction with other measures to limit these gaps.
Areas where CA falls short or is limited include:
MFA does lower the risk of advanced credential harvesting and phishing, but there are still user risks. Attackers may trick users into giving them the multi-factor authentication code or a session cookie, which will bypass the protective measures you have in place.
We integrate CA for our clients, and some of the first measures we recommend are:
Architecture that trusts everyone is a recipe for disaster. Zero-trust is part of the best practice conditional access policies because everyone is denied by default.
Exceptions are added in for compliant scenarios and known, verified users only.
Conditional access policy best practices also add one or more scenarios to create targeted control. For example, MFA may be required in a scenario where:
Granular controls allow for less disruption for users while maintaining security standards.
Never implement a new Conditional Access policy directly into On mode. Every new policy, especially those affecting a large number of users, should be deployed in Report-Only mode first.
The strongest conditional access best practices link who the user is and what they are using. Compliant devices and the introduction of MFA help limit your attack surface.
Identity protection features in Microsoft Entra ID make it easy for you to follow best practice conditional access policies. For example, if a login comes in from a high user risk, it may be flagged and require a password change for flagged users.
Use conditional access policy best practices to assign access based on risk level.
Flexible policies make sense for a flexible workforce. Follow these conditional access best practices:
Continuous monitoring is a critical best practice for conditional access policies. Be sure to:
Following the conditional access policy best practices helps you avoid errors such as:
An effective CA strategy is built on the foundation of zero trust. Conditional access policy best practices start with basic controls like MFA for all and blocking legacy authentication. It then adds layers of risk-based controls and compliance checks to create a robust security posture.
Yes. Session controls allow you to set sign-in frequency. This allows users to stay signed in and bypass MFA for a specified period as long as they remain on a trusted or compliant device.
There is no set number. But a manageable implementation for a medium or large organization often falls between 10 and 30 policies. Quantity isn’t the primary concern – it’s clarity and simplicity. Aim for policies that are easily understandable rather than a few overly complex ones.
CA itself does not send alerts. But it can use User Risk and Sign-in Risk data from Microsoft Entra ID Protection as a condition to enforce an action like blocking a login. Follow the conditional access policy best practices to configure alerts for risky events such as these. This can be done through the integration of risk data with Microsoft Sentinel or other security information and event management tools.
