Multi-factor authentication checks who you are. Conditional access checks whether that sign-in should be allowed at all: from where, on what device, into which app. If your business is on Microsoft 365 Business Premium, you already pay for it. Microsoft’s own documentation lists Business Premium as a licence that includes conditional access. However, the feature does nothing until someone creates a policy. That is how a tenant can end up with MFA switched on while conditional access remains empty.
That matters because the attacks that get past MFA make the sign-in look ordinary: a login from a country you have never traded with, an old mail protocol that never asks for a second factor, a password typed on a device the business has never seen. Conditional access is the layer that can say no to those. A stolen session token is harder to stop. That requires the device and sign-in risk controls that come later. Three policies, piloted in report-only mode, can still cover a great deal of ground. Review the users, apps and sign-in logs before enforcing them.
What conditional access adds to MFA
Think of MFA as the lock on the door and conditional access as the person deciding whether to open it. MFA proves the key is real. Conditional access looks at everything else about the visitor before the door moves.
| MFA asks | Conditional access asks | |
| Who | Is this the account holder? | Which account, in which group? |
| Where and how | Nothing | Which device, network and country? |
| What | Nothing | Which app, and does the sign-in look normal? |
Each policy is an if-then rule. If a user in this group signs in to this app from this kind of place, then require MFA, require a managed device, or block the attempt outright. Microsoft’s overview of the feature lists the signals it can read: the user or group, the IP location, the device and its state, the application, and the risk score of the sign-in itself. The risk signals need a higher licence, because they come from Entra ID Protection in the P2 tier. The core signals and controls sit within Entra ID P1. Microsoft also lists Business Premium as a licence that includes them.
Without conditional access, Microsoft offers security defaults. These provide a fixed set of protections that you cannot customise. Microsoft switches them on automatically for newer tenants that have no policies of their own.Security defaults are free, but they lack flexibility. They cannot distinguish between your finance team’s laptops and a personal phone. They also cannot block sign-ins from countries where your business never operates. Conditional access is where those decisions become possible.
Will conditional access lock my staff out?
Report-only mode first. Every policy can be saved in report-only mode. It watches real sign-ins and records what it would have done, and for the three policies below nothing changes for your staff until you move the switch to On. The one exception worth knowing is that a report-only policy requiring a compliant device can prompt Mac, iPhone and Android users to pick a certificate, which matters for the fourth policy later. Microsoft’s planning guide recommends leaving each policy in report-only mode for at least a week and reading the sign-in logs before enforcing it, and that is the pace The Unite Group would suggest for any business doing this for the first time.
Emergency access accounts. The other safeguard is the emergency access account. Before any policy goes live, Microsoft’s advice is to hold at least two of these, excluded from every policy that blocks or restricts sign-in, with their credentials kept somewhere physical and secure. If a policy is written badly enough to lock every administrator out, one of those accounts gets back in and switches the policy off. The same guide calls them break-glass accounts and lists them first among the things to verify before deployment. Without a break-glass account, a lockout means a call to Microsoft support.
Three policies to discuss first
Microsoft publishes templates and a list of common policies. Its planning guide recommends introducing them over several weeks, starting with a pilot group. This reduces the risk of blocking the wrong people before you understand how the business signs in.The three below come from that list and provide a common starting point for a Business Premium firm with no policies in place. The assessment that comes first will determine which policies fit and how to apply them.
Where to start with Conditional Access
- Block legacy authentication. Older sign-in protocols cannot prompt for a second factor, so an attacker with a password can use them to walk straight past MFA. Microsoft has already switched basic authentication off for most Exchange Online protocols, which closes a large part of this route on its own; the exception still in wide use is SMTP authentication for scanners and applications that send mail, and Microsoft has a retirement timetable for that too. This policy closes whatever remains, across every app in the tenant, and the sign-in logs will show you which old device still depends on it before you enforce the block.
- Require MFA for every user, through a policy you control. This replaces the blanket behaviour of security defaults with a rule you can shape. It can demand a stronger method for administrators, insist on MFA for the Microsoft admin portals, and later require passkeys for the accounts that matter most. Microsoft’s guidance is that security defaults and conditional access are not run together: when this policy is ready, security defaults come off and the policy goes on in the same sitting, so there is no gap.
- Consider blocking sign-ins from countries you do not work in. Conditional access can treat whole countries as named locations, and a firm that trades in the UK and visits Ireland twice a year may have no reason to accept a sign-in from anywhere else.Treat this as a policy to consider, not a default. Staff travel, cloud services that route traffic through another country, or suppliers logging in from abroad can all trigger it. Review a few weeks of sign-in logs before enforcing the policy, and exclude break-glass accounts.
A fourth policy, requiring a compliant or managed device before Microsoft 365 opens, is the one that stops a stolen password, and most stolen sessions, working from a stranger’s laptop. It depends on Intune enrolment being in place, and it is the natural next step once the first policies have been running quietly for a month.
What happens if the licence lapses
Microsoft does not delete policies when the licence that enabled them expires. The policies continue to run, but admins can only view or delete them, not edit them. Microsoft describes this as a transition period that gives organisations time to migrate away in a controlled way. It means a firm that drops from Business Premium to Business Standard keeps its protection for a while. It also means a stale policy can block a new office with nobody able to change it, so keep the licence current.
Ask for an assessment, not a switch
The wrong request is ‘switch on conditional access’. The right one is an assessment first, covering:
- which accounts exist, and which are shared or used by systems
- which apps and devices staff sign in from
- whether two emergency access accounts exist, and where their credentials live
- what the sign-in logs show over a fortnight
That assessment decides which of the policies above apply, in what form, and in what order, and it is what Microsoft’s own guidance asks for before a phased rollout. Then each policy goes to report-only, then to a pilot group, then to everyone, with the logs read at each step.
If you are unsure which licence you have, check the Microsoft 365 admin centre. You can also view any existing policies in the Entra admin centre. That assessment is where The Unite Group would start. Its managed IT services It is the step that turns a feature you already pay for into protection that fits how your business works.