Conditional Access is the single highest-leverage control in a Microsoft tenant, and it's usually either wide open or so tight that people can't work. Here's a middle path we deploy on most engagements.
Run it in report-only first
Every policy below goes in as report-only for a week. You get the sign-in impact in the logs without locking anyone out, and you fix the surprises before enforcement.
The six policies
- Require MFA for all users.
- Block legacy authentication.
- Require compliant or hybrid-joined devices for desktop apps.
- Require MFA for risky sign-ins.
- Require password change for risky users.
- Block access from unsupported countries.
What to watch
The device policy (3) is the one that generates tickets if Intune enrolment isn't finished. Sequence it last, after enrolment is above ~95%.