What Conditional Access is and is not
Conditional Access is not a standalone “extra MFA toggle” and not antivirus. It is a set of if-then rules in Microsoft Entra ID: if this user or app, then this condition or effect. Common building blocks: require MFA; block legacy or risky clients; require a managed or compliant device; limit to approved countries or networks; or session controls for sensitive apps.
It is also not a replacement for MFA. Without multifactor authentication you miss the most common first requirement. Conditional Access decides when and under which conditions that requirement (or a block) applies. See also Microsoft 365 Secure Score: score points often follow after you first set deliberate rules and exceptions.
When MFA alone is no longer enough
Three situations keep returning in SMEs. Admins: a Global Admin or Exchange admin from a personal laptop in another country is riskier than the same role from the office network — MFA alone says nothing about device or location. Guest or partner access: you want guests to use MFA, but not the same freedom as employees — see guest accounts. Legacy clients: apps that do not speak modern authentication bypass MFA; Conditional Access (together with turning off legacy authentication) closes that door. If everyone may sign in from anywhere as long as MFA succeeds, you have MFA — not yet an access policy.
Do not start with twenty rules. One or two sharp policies for admins plus a clean MFA baseline for everyone fix more than a maze nobody dares to change.
What you should decide in writing
Keep it short enough to decide this quarter:
- which groups or roles fall under Conditional Access (everyone, admins only, external access only);
- which conditions you require: MFA, compliant/managed device, approved countries or IP ranges — and what you deliberately do not require;
- exceptions: break-glass accounts, service accounts or emergency procedures — narrow and monitored, see break-glass accounts;
- what happens on deny: who gets the alert, who may temporarily widen an exception;
- review cadence: at least each quarter or after major change (new site, remote-first, new vendor);
- tie-in with joiner and leaver: new admins automatically fall under the admin rule.
Write those points on one page. That is your Conditional Access agreement; the tenant follows that text.
What Floor ICT configures — and what you decide
In the Microsoft 365 tenant we typically: build Conditional Access rules to your written choices; MFA requirements on named users; narrow exceptions for approved break-glass accounts; blocks or reporting on risky or legacy clients where that fits; and a short test “who still gets in after the change”. We tie this to MFA, admin roles, Secure Score actions and break-glass already in scope.
You still decide: how strict device requirements are; whether working from certain countries is allowed; which apps count as sensitive; and who may approve an exception. Technical toggles without those choices give false comfort; policy without working rules does not help either.
More depth
Checklist for SME directors
1) Confirm MFA is on for named users. 2) Limit day-to-day Global Admins. 3) Ask Floor ICT to propose one admin rule and one baseline MFA rule (or report-only first). 4) Decide on countries/devices: what is acceptable for your company. 5) Keep break-glass outside the normal rules, with monitoring. 6) Plan a quarterly review — not a new rule every week.
Report-only versus enforce
Many tenants start Conditional Access in report-only or with a small pilot group, so you see who would be hit before you block. That is not a stalling trick: it avoids locking the whole organisation out on a Friday afternoon. Floor ICT advises per tenant whether report-only helps; you decide when you move to enforce.
Licences and Entra ID
Baseline MFA is available in many Microsoft 365 setups; richer Conditional Access conditions (risk detection, some device checks) often need Microsoft Entra ID P1 or similar in your bundle. Floor ICT inventories what your licences already cover before we promise what the toggles do — Essential/Advanced/Elite say nothing about Entra licences.