Conditional Access in Microsoft 365 for SMEs: How to Set It Up

Every Microsoft 365 tenant has an invisible boundary: whether someone can "sign in" isn't decided only by their password and MFA, but by the conditions under which you, as the administrator, let the door open. Which device, which location, which app, which risk signal. That set of rules is called Conditional Access, and for an SME on Microsoft 365 Business Premium or E3 it's one of the most powerful controls you already have, and often one you aren't using.

What is Conditional Access in Microsoft 365?

Conditional Access, part of Microsoft Entra ID (formerly Azure AD), is the policy framework that decides, for each sign-in, whether a user gets access and on what terms. Every policy is an if-then rule: if this user, in this app, on this device, from this location, with this risk profile tries to sign in, then we require MFA, a compliant device or an approved app, or we block access altogether.

So it doesn't replace passwords or MFA; it's the layer that decides which requirement applies when. Instead of "MFA for everyone, always", you can decide "MFA for everyone outside the office, no prompt inside the office on a compliant laptop". More user-friendly and stricter at the same time, if you set it up properly.

Why SMEs need to take this seriously now

In Verizon's 2025 Data Breach Investigations Report, credential abuse was the number one initial access vector: 22 percent of all breaches started with a stolen password. MFA on its own helps, but attackers adapt with MFA fatigue, adversary-in-the-middle phishing and token theft. Conditional Access is the layer that closes those attack paths by assessing the context as well as the password.

On top of that, since 2024 Microsoft has been automatically rolling out Microsoft-managed baseline policies to tenants (such as MFA for admins), and since 2026 the Entra admin portal has been more actively flagging licensing gaps. So if you have Business Premium or E3 but aren't running any policies of your own, Microsoft is already running a few for you without you ever having set them up. That's a reason to wake up, not to sit back.

Which licence do you need?

The short version: Conditional Access requires a Microsoft Entra ID P1 licence for every user the policy applies to. That P1 licence is already included in:

• Microsoft 365 Business Premium (Business tier)
• Microsoft 365 E3 and A3 (Enterprise tier)
• Microsoft 365 F3 (frontline)
• Microsoft Entra ID P1 standalone (around $7 per user per month; the price rose from $6 to $7 on 1 July 2026)

If you only have Microsoft 365 Business Standard or Basic, you don't get Conditional Access. You can still turn on Security Defaults, Microsoft's free one-click baseline that enforces MFA and blocks legacy authentication. That's a good start for very small environments, but it can't be used alongside Conditional Access. Our guide to implementing MFA for SMEs explains that basic choice in more detail.

Entra ID P2 (around $10 per user per month, included in E5) adds risk-based Conditional Access on top, based on sign-in risk and user risk from Identity Protection, plus Privileged Identity Management (PIM) and Access Reviews. Many SMEs buy P2 for their admins only, not for the rest of the organisation.

The six policies almost every SME needs

You can create endless policies, but in practice this set covers 90 percent of what an SME needs. Microsoft itself calls them "common Conditional Access policies" and recommends them as a starting point.

1. MFA for all users

The baseline. Every sign-in to a cloud app requires MFA, optionally with a trusted-location exemption for the office. Start without trusted locations: better to prompt for MFA more often than to leave gaps open.

2. Stricter MFA for admins

For roles such as Global Administrator, Security Administrator or Exchange Administrator, require MFA every time, with no trusted-location exemption. Ideally with phishing-resistant methods (FIDO2 security keys or passkeys). Configure this through Authentication Strengths in Entra.

3. Block legacy authentication

Legacy authentication is basic authentication over old protocols such as IMAP, POP3, SMTP AUTH, EWS and old MAPI. It bypasses MFA completely. Microsoft explicitly recommends this policy and states in its own documentation that you should roll it out in report-only mode first to see the impact, and only then switch it on.

4. Require a compliant device for sensitive apps

For apps such as Exchange Online, SharePoint Online and Teams, require a compliant device (managed through Intune and meeting your compliance policies) or a hybrid Azure AD-joined device. This shuts out access from personal, unpatched laptops. See our guide to Microsoft Intune for SMEs for how to define those compliance policies.

5. Handle risky sign-ins (P2)

With Entra ID P2 you can add requirements based on sign-in risk (Identity Protection): at medium risk, require MFA again; at high risk, block access or force a password reset. This is the most effective defence against token theft and atypical-location attacks.

6. Geographic restrictions where it makes sense

Not every SME has staff working internationally. If your team never works from certain regions, you can block them explicitly. Be careful, though: hotel Wi-Fi on a director's holiday can come from an unexpected IP address. In that case, work with named locations and alerts.

Report-only mode: measure first, enforce later

The biggest pitfall with Conditional Access is a policy that locks everyone out: you switch it on, a few admins rely on legacy tooling or specific scenarios, and suddenly nobody can get in. Microsoft's own recommended process solves this with report-only mode.

In report-only mode the policy is evaluated at every sign-in, but the grant controls aren't enforced. The result lands in the sign-in logs: you can see exactly which accounts would have been affected in which scenarios, and which would have been blocked or prompted for MFA.

A sensible rollout looks like this:

1. Create the policy in report-only mode.
2. Let it run for 1 to 2 weeks.
3. Review the results using the Conditional Access insights workbook in the Entra portal.
4. Adjust exclusions (specific service accounts, system groups).
5. Only set the policy to "On" once the reporting no longer shows any unexpected impact.
6. Keep a business continuity plan to hand in case unexpected impact shows up after all.

Skip this step and you'll be enabling policies on a Friday and spending Sunday evening on the phone with an angry management team.

Break-glass accounts: the deliberate exception

Every Conditional Access policy that could lock out admins must exclude two emergency accounts. These are dedicated cloud-only Global Administrator accounts that are deliberately kept outside every CA policy, with an extremely long random password stored in a physical safe, and with monitoring on every sign-in.

Microsoft explicitly recommends at least two of these emergency access accounts, outside federation (no hybrid link), excluded from the MFA policies themselves if those cover all users, but with extensive alerting whenever they're used. Test them once a quarter: a break-glass account nobody can find any more is no longer a break-glass account.

This isn't an optional extra. Without such an account, a policy that accidentally locks out every administrator means a support ticket with Microsoft that can take days.

How to start if you have nothing in place

Many SMEs have Business Premium or E3 but no active Conditional Access policies. A realistic sequence for starting from scratch:

1. Week 1: audit the current situation. Are Security Defaults enabled? Are any Microsoft-managed policies active? Which admins have per-user MFA? Which service accounts sign in?
2. Week 2: create two break-glass accounts, document them, put the credentials in the safe and set up alerting on their use.
3. Weeks 3-4: set up the six baseline policies in report-only mode. Monitor the sign-in logs.
4. Weeks 5-6: analyse the impact of each policy, adjust exclusions and train the helpdesk on the new MFA flow.
5. Week 7: switch policies to On one at a time, in this order: block legacy authentication, MFA for admins, MFA for all users, require a compliant device.
6. Week 8+: review the sign-in logs every month and fine-tune. Conditional Access is not set-and-forget; new apps and usage patterns call for adjustments.

This phased approach avoids the classic "enable everything on Monday and fight incidents until Friday" experience. Combine it with our zero trust guide for SMEs to see how Conditional Access fits into a broader zero trust strategy.

Mistakes we see regularly

• Switching all policies on at once without reporting. A guaranteed recipe for a busy Monday on the helpdesk.
• No break-glass accounts. Your first misconfiguration becomes an urgent Microsoft ticket.
• Service accounts mixed in with user policies. An MFA requirement on a service account that scans Exchange mailboxes breaks mail flows.
• Trusted locations on every office IP with no MFA around them. An insider or a guest Wi-Fi user then no longer needs MFA; the entire CA layer disappears within that segment.
• Forgetting Microsoft-managed policies. Microsoft automatically enables some policies in report-only mode; if you never switch them to On, your picture of your protection is an illusion.
• No monitoring of CA changes. If someone changes a policy, you want to know. Audit logs should have an alert on changes to sign-in conditions by an admin.

The limits of Conditional Access

It isn't a magic barrier. CA assesses sign-ins; it doesn't continuously check what an already signed-in session is doing. Tokens stay valid until they expire, unless you enable Continuous Access Evaluation (CAE), which re-evaluates sessions in real time. Turn on CAE for every app that supports it.

CA also sits on top of your identity model. An attacker who has obtained OAuth consent through phishing can sometimes stay inside longer than you'd like. Combine CA with modern email security against phishing and BEC for a more robust whole.

Frequently asked questions about Conditional Access

Does every Microsoft 365 subscription include Conditional Access? No. You need at least Microsoft Entra ID P1, which is included in Business Premium, E3, A3 and F3, or available as a standalone licence. Business Basic and Business Standard only have Security Defaults.

What's the difference between Security Defaults and Conditional Access? Security Defaults is a free, Microsoft-managed baseline that enforces MFA for everyone and blocks legacy authentication, switched on or off with one click. Conditional Access is more granular: you set the rules yourself per app, user, device and location. The two can't be used together in the same tenant.

Can Conditional Access fully replace MFA? No. Conditional Access is the policy framework that decides when MFA is requested, but you still need the MFA method itself (Authenticator app, FIDO2 key, passkey). The two complement each other; without an MFA method, a policy can't enforce "require MFA".

How do you handle service accounts and application identities? Explicitly exclude them from user CA policies and preferably use workload identities or managed identities in Azure. A service account with a password that sits outside all policies is a risk in its own right.

Do we need Intune before Conditional Access is worthwhile? Partly. MFA policies, legacy authentication blocks and risky sign-in policies work without Intune. "Require a compliant device" does need an MDM solution that marks devices as compliant. Many SMEs start without that requirement and add it later.

What does it cost an SME to introduce Conditional Access? The licences are often already included if you're on Business Premium or E3. The real work is configuration, testing and rollout. Depending on complexity, we allow 1 to 3 weeks for an initial rollout, including a phased report-only review.

Conclusion

Conditional Access turns "who has access" into a question with context. Instead of static MFA for everyone all the time, you let the device, location, risk and app have a say. For an SME on Microsoft 365 Business Premium or E3, it's an available security layer that too often goes unused. With a phased rollout, break-glass accounts and the six baseline policies in report-only mode before you switch them on, you get the benefits without your team being locked out for a whole Monday.

Want Conditional Access set up and managed properly, including sign-in reviews, compliance policies in Intune and documentation for audits? We do this every day for SMEs in the Netherlands across a range of sectors. Book an introductory call via our contact page or call us directly on +31 85 303 5869.