Conditional Access Explained: Sign-In Rules for Microsoft 365

Sign-in rules (Conditional Access) let Microsoft 365 decide, at the moment someone signs in, whether to let them in, ask for more proof, or block them. The rules look at who is signing in, from where, on what device and to which app. For most small firms, Conditional Access is the step up from the basic protection Microsoft turns on by default, and it requires a license such as Microsoft 365 Business Premium.

Why business owners should care

A password alone no longer tells you much about who is signing in. Conditional Access lets you set rules that match your actual risk: require a second check (multi-factor authentication, or MFA) for everyone, protect administrator accounts more tightly, and refuse sign-ins from places your firm never works.

The business value is control without friction. A partner signing in from the office laptop they use every day should not face the same hurdles as an unknown sign-in from overseas. Well-designed rules keep normal work smooth and put the friction where the risk is.

How a sign-in rule works: signals and decisions

Microsoft describes each policy as an if-then statement. If certain conditions (signals) are true, then a decision applies. Policies are evaluated after the first step of sign-in, the password or passkey, is complete.

Signals Conditional Access can look at

Decisions a policy can make

What you need to use it

Conditional Access requires Microsoft Entra ID P1 for the users the policies cover. P1 is included in Microsoft 365 Business Premium. Business Basic and Business Standard include the free tier of Entra ID, which does not include Conditional Access.

Policies based on sign-in risk or user risk need Microsoft Entra ID P2, which Business Premium does not include on its own. As of this writing, Microsoft offers P2 through add-ons such as Microsoft Defender Suite for Business Premium or as a standalone license. Licensing changes, so check Microsoft's current documentation before you buy.

Security Defaults or Conditional Access: pick one

Security Defaults is Microsoft's free, on-or-off baseline. It requires users to register for MFA, protects admin accounts and blocks older sign-in methods. It is turned on for most newer Microsoft 365 tenants and is a sensible choice when you do not have P1.

You cannot run both. Microsoft says the two are not meant to be combined, and organizations that move to Conditional Access must turn Security Defaults off, then immediately put equivalent or stronger policies in place. The gap between those two steps should be minutes, not days.

Starter policies for a small professional firm

Take a 15-person engineering firm on Business Premium, with staff who work from the office, from home and occasionally from client sites. A practical first set of policies might look like this:

That is five policies, not fifty. Small firms are usually better served by a short, well-documented set they understand than by a long list nobody remembers the reason for.

Roll out in stages, starting with report-only mode

Every Conditional Access policy can run in report-only mode. In that state, Microsoft evaluates the rule on each sign-in and records what would have happened in the sign-in logs, but does not enforce it. That shows you who would have been blocked or prompted before anyone is.

Break-glass emergency access accounts

Microsoft recommends at least two emergency access accounts, sometimes called break-glass accounts. These are cloud-only Global Administrator accounts that are not tied to one person, are excluded from policies that could lock everyone out, have long, securely stored credentials, and trigger an alert whenever they are used.

Microsoft also recommends testing them regularly, at least every 90 days and whenever IT staff change. Microsoft has made MFA mandatory for its admin portals, and its emergency access guidance has been updated accordingly, so follow the current version when you set these up.

Common mistakes

How NexJen can help

For NexJen Essentials clients on Microsoft 365 Business Premium, our security baseline includes Conditional Access, rolled out in stages: report-only first, then monitoring, then enforcement. On Business Basic or Standard, the baseline uses Security Defaults and MFA instead. The Essentials price is the same either way.

If you are not looking for managed IT, our Microsoft Entra ID and Security Posture & Compliance Assessment consulting engagements review your current sign-in settings and deliver written, risk-rated findings and a roadmap. Consulting is advisory only; any changes are quoted separately.

Common questions