Conditional Access in Microsoft 365 for Small Business: Five Policies to Turn On First

Most Microsoft 365 break-ins are not clever. A stolen password is typed into a sign-in page from another continent, and nothing stops it. Conditional Access is the feature that stops it.

Think of it as a doorman for your email and files. Every sign-in is checked against your rules before the door opens. Here is how a small business can set it up in three steps without breaking anyone's workday.

1. Get the foundation right before you write a policy

Conditional Access lives in Microsoft Entra ID (formerly Azure AD). A few things to settle first:

• Check your license. Conditional Access needs Entra ID P1, which comes with Microsoft 365 Business Premium. Business Basic and Standard use free Security Defaults instead. Our Microsoft 365 settings guide covers what each plan gives you.
• Turn off Security Defaults before you enable your own policies. They overlap, and running both causes confusion.
• Create two break-glass accounts. These are cloud-only admin accounts with long, unique passwords stored offline, excluded from every policy. If a bad rule locks everyone out, these get you back in.
• Start in report-only mode. Every policy can log what it would have done without enforcing it. Use that for a week.

If you have not yet rolled out multi-factor authentication, do that alongside this work, since most of these policies build on it.

2. The five starter policies

You do not need dozens of rules. These five cover the attacks small businesses actually see:

1. Require MFA for all users. The single biggest win. A stolen password alone no longer works.
2. Block legacy authentication. Old protocols like POP, IMAP, and basic SMTP cannot do MFA, so attackers use them to skip it. This is how many password spray attacks succeed.
3. Require stronger MFA for admins. Admin accounts deserve passkeys or a hardware key, and sign-in prompts every time.
4. Block countries you do not work in. If your team is in California, there is no reason to accept sign-ins from half the world. Allow travel by exception.
5. Protect security-info changes. Require MFA or a trusted location before anyone adds a new authenticator, which stops attackers from enrolling their own phone after a phishing success.

Once these are stable, consider requiring a managed or compliant device for sensitive apps. It pairs well with device management and limits the damage from stolen session cookies.

3. Test, roll out, and keep watching

A good policy that surprises your staff is still a bad Monday. Roll out carefully:

• Review the logs. After a week in report-only mode, open the sign-in logs and look at who would have been blocked. Fix real exceptions, such as a scanner that uses an old protocol.
• Pilot first. Switch policies on for yourself and a couple of staff before everyone.
• Tell people. A short note saying "you will see an MFA prompt Tuesday" prevents a flood of help desk calls.
• Review quarterly. Check exclusions, remove departed users, and confirm break-glass accounts still work. Add it to your offboarding checklist.
• Watch for attacks that slip past. Phishing kits that relay MFA, like device code phishing, are why policies should be paired with training and monitoring.

Common mistakes to avoid

• Enabling a policy for all users and all apps with no break-glass account.
• Skipping report-only mode and locking out the shared scanner or phone system.
• Leaving Security Defaults on alongside custom policies.
• Excluding "just this one executive" and never removing the exclusion.
• Setting it up once and never reviewing the logs.

The takeaway

Conditional Access turns Microsoft 365 from "anyone with the password gets in" into "only the right person, on the right device, from the right place." Five policies, tested in report-only mode, give a small business enterprise-grade protection for no extra software.

Frequently asked questions

What is Conditional Access in Microsoft 365?

Conditional Access is a set of if-then rules in Microsoft Entra ID. If a sign-in meets certain conditions (a risky location, an old protocol, an unmanaged device), then require MFA, require a compliant device, or block access. It is the policy engine that decides who gets into your email and files.

Do small businesses need Conditional Access or are Security Defaults enough?

Security Defaults give free baseline protection: MFA for everyone and blocked legacy sign-in. Conditional Access adds control, such as country blocking, device requirements, and different rules for admins. It needs Microsoft Entra ID P1, which is included in Microsoft 365 Business Premium.

Which license includes Conditional Access?

Microsoft 365 Business Premium and Entra ID P1 or P2 include it. Business Basic and Standard do not, and they rely on Security Defaults instead. Do not run Security Defaults and Conditional Access policies together; turn Security Defaults off first.

How do I avoid locking myself out?

Create two emergency break-glass admin accounts excluded from every policy, protected with long passwords stored offline. Start each new policy in report-only mode, review the sign-in logs for a week, then switch it to on.

What are the first Conditional Access policies to create?

Require MFA for all users, block legacy authentication, require stronger MFA for admins, block sign-ins from countries where you do no business, and require MFA when registering security info or new devices.

Prefer to talk first? Email sales@ghosxt.com or call (831) 204-0501.