Listen to this Post
Introduction:
Conditional Access (CA) has become the cornerstone of modern identity and access management within the Microsoft 365 ecosystem. As organizations increasingly rely on cloud identities, implementing a robust, baseline CA policy is no longer optional but a critical defense against credential-based attacks and data exfiltration. This guide deconstructs a proven, industry-standard baseline to empower IT professionals to harden their Microsoft Entra ID environments effectively.
Learning Objectives:
- Understand the core components and security rationale behind a best-practice Conditional Access baseline.
- Learn to implement and manage key CA policies using PowerShell, Graph API, and manual portal configuration.
- Develop the skills to audit, document, and maintain your CA posture against a evolving threat landscape.
You Should Know:
1. Foundations: Blocking Legacy Authentication
Legacy authentication protocols like Basic Authentication (SMTP, POP3, IMAP, etc.) do not support multi-factor authentication (MFA), making them a primary attack vector. This policy is your first and most critical line of defense.
Verified Commands & Configuration:
Policy Name: `
Block Legacy Authentication`</h2>
CLI/Graph API Filter: To identify users still attempting legacy auth, use the Microsoft Graph PowerShell module:
[bash]
Connect to Graph API with required scopes
Connect-MgGraph -Scopes "AuditLog.Read.All"
Fetch sign-in logs for legacy authentication clients
Get-MgAuditLogSignIn -Filter "clientAppUsed eq 'exchangeActiveSync' or clientAppUsed eq 'outlookService' or clientAppUsed eq 'pop3' or clientAppUsed eq 'imap' or clientAppUsed eq 'authenticatedSmtp'" -All | Select-Object UserDisplayName, UserPrincipalName, ClientAppUsed, CreatedDateTime
Step-by-step guide:
Navigate to Microsoft Entra Admin Center > Protection > Conditional Access. Create a new policy. Under “Cloud apps or actions,” select “All cloud apps.” Under “Conditions,” select “Client apps.” Configure the policy to apply to “Exchange ActiveSync clients” and “Other clients.” Under “Access controls,” select “Block access.” Enable the policy and submit. This will prevent any sign-in attempt using these older, insecure protocols.
2. Enforcing Multi-Factor Authentication for All Users
MFA is the single most effective control to prevent account compromise. This baseline mandates MFA for every user, regardless of location or device.
Verified Commands & Configuration:
Policy Name: `
Require MFA For All Users`
<h2 style="color: yellow;"> PowerShell (MSOnline Module - Legacy but common):</h2>
[bash]
Create a new Conditional Access policy template (conceptual)
Note: Actual CA policy creation is primarily GUI/Graph API driven. This checks MFA status.
Get-MsolUser -All | Where-Object {$_.StrongAuthenticationRequirements.State -ne "Enforced"} | Select-Object UserPrincipalName, DisplayName
Graph API (Modern Method): Use the `Microsoft.Graph.Identity.ConditionalAccess` module to create policies programmatically for DevOps pipelines.
Step-by-step guide:
Create a new CA policy. Assign it to “All users.” Exclude your emergency “break glass” accounts to avoid lockout. Under “Target resources,” select “All cloud apps.” Under “Conditions,” you may choose to not require MFA on “Trusted locations” like your corporate HQ IP range. Under “Grant,” select “Grant access” and require “Require multi-factor authentication.”
3. Device Compliance and Hybrid Join Enforcement
Ensuring that only managed, compliant, and known devices can access corporate data is crucial for endpoint security.
Verified Commands & Configuration:
Policy Name: `
Require Compliant or Hybrid Joined Device` Intune Graph API Query: To check device compliance status: [bash] GET request via Graph API GET https://graph.microsoft.com/v1.0/deviceManagement/managedDevices?$filter=complianceState eq 'noncompliant'
Troubleshooting Hybrid Join (On-Prem AD Connect):
On a domain controller, check device registration status
Get-ADDevice -Filter -Properties msDS-CloudExtensionAttribute1 | Where-Object {$_.'msDS-CloudExtensionAttribute1' -ne $null}
Step-by-step guide:
Create a policy targeting “All users” and “All cloud apps.” Under “Grant,” select “Require device to be marked as compliant” and/or “Require Hybrid Azure AD joined device.” Use a control like “Require one of the selected controls” to provide flexibility. This ensures that only devices managed by Intune (and compliant with your security policies) or domain-joined PCs can access services like SharePoint or Teams.
4. Securing Administrative Privileges
Admin accounts are high-value targets and require the strictest controls, including MFA and dedicated workstations.
Verified Commands & Configuration:
Policy Name: `
Require MFA For Administrators`</h2>
<h2 style="color: yellow;"> PowerShell to Identify Admin Roles:</h2>
[bash]
Connect to MSOnline module
Connect-MsolService
Get users with global admin role
Get-MsolRoleMember -RoleName "Company Administrator" | Select-Object DisplayName, EmailAddress
Step-by-step guide: Create a policy assigned to “Directory roles,” selecting all high-privilege roles like Global Administrator, SharePoint Admin, etc. Apply this to “All cloud apps.” Set the grant control to “Require multi-factor authentication.” There should be no exclusions for location or device. Consider creating an even stricter policy that only allows admin logins from specific, secure “Trusted locations.”
5. Implementing Risky User and Sign-In Policies
Leverage Microsoft Entra ID Protection’s risk detection to automate responses to compromised or suspicious accounts.
Verified Commands & Configuration:
Policy Name: `
High Risk Users Must Change Password`
<h2 style="color: yellow;"> Graph API to Query Risky Users:</h2>
[bash]
Using Microsoft.Graph.Identity.SignIns module
Get-MgIdentityProtectionRiskyUser -All | Where-Object {$_.RiskLevel -eq "high"}
Step-by-step guide:
Create a new policy. Under “Users and groups,” select “All users.” Under “Conditions,” go to “User risk” and select “High.” Under “Grant,” choose “Grant access” and then “Require password change.” This forces a secure password reset if the system detects a high probability of account compromise, effectively revoking the attacker’s access.
6. Application-Specific Protection Policies
Apply stricter controls to sensitive applications like HR, CRM, or financial systems that hold critical data.
Verified Commands & Configuration:
Policy Name: `
Require MFA For Sensitive Apps (e.g., SAP SuccessFactors)` <h2 style="color: yellow;"> Graph API for App ID:</h2> [bash] Find the Service Principal (App) ID GET https://graph.microsoft.com/v1.0/applications?$filter=displayName eq 'AppName'
Step-by-step guide:
Instead of selecting “All cloud apps,” choose “Select apps” and pick your high-sensitivity applications. Assign the policy to the relevant user groups. Configure grant controls to require MFA and potentially a compliant device. This creates a layered security model where the most sensitive data has the highest barriers to entry.
7. Continuous Monitoring and Documentation
A Conditional Access deployment is not a “set and forget” system. Continuous auditing and documentation are vital.
Verified Commands & Configuration:
Tool: Merill’s Conditional Access Documenter (as referenced in the source)
PowerShell to Export CA Policies:
Using the Microsoft.Graph.Identity.ConditionalAccess module Connect-MgGraph -Scopes "Policy.Read.All" Get-MgIdentityConditionalAccessPolicy
Script to Check Policy Gaps:
Conceptual script to compare users covered by MFA policies $AllUsers = Get-MgUser -All $UsersInMfaPolicies = ...Logic to parse CA policies and get assigned users... Compare-Object -ReferenceObject $AllUsers -DifferenceObject $UsersInMfaPolicies -Property UserPrincipalName
Step-by-step guide:
Regularly run the Conditional Access Documenter tool from your DevOps pipeline to generate a PDF report of your current CA state. Use PowerShell scripts to audit sign-in logs and ensure policies are triggering as expected. Schedule monthly reviews to assess if new apps, users, or threats require policy updates.
What Undercode Say:
- Baselines are a Starting Point, Not a Finish Line. A published baseline like v2025-10 provides an exceptional foundation, but it must be tailored to your organization’s specific risk tolerance, user workflow, and application landscape. Blind implementation can lead to productivity loss or unexpected security gaps.
- Automation is Key to Governance. Manually configuring and documenting CA policies is unsustainable. The integration of GitHub for version control and tools like the Conditional Access Documenter highlights the industry’s necessary shift towards Infrastructure as Code (IaC) for security, enabling audit trails, rollbacks, and consistent deployments across tenant hierarchies.
The analysis from the source material underscores a mature approach to cloud identity security. By focusing on maintaining a living baseline on GitHub, the author acknowledges that threat landscapes and platform features are dynamic. This moves beyond static whitepapers and into an operational model where security configurations are treated as code—continuously integrated, tested, and deployed. The emphasis on layered policies (user + device + condition) reflects a defense-in-depth strategy that is far more resilient than relying on any single control. For organizations, the key is not just to copy this baseline but to adopt the underlying processes that allow for its continuous evolution.
Prediction:
The systematic, code-driven approach to Conditional Access governance, as demonstrated by this baseline, will become the standard for enterprise security within the next 2-3 years. This will converge with AI-driven identity protection, where CA policies will dynamically adjust in real-time based on AI-assessed user and sign-in risk, moving from static rules to adaptive, self-healing security frameworks. This evolution will render traditional, perimeter-based security models entirely obsolete, solidifying identity as the primary, intelligent control plane for all digital enterprise security.
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Kennethvansurksum Conditional – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
