If your business pays for Microsoft 365 Business Premium, you already own one of the strongest security tools in the Microsoft stack, and there is a good chance nobody has switched it on properly. Conditional Access is the rule engine inside Microsoft Entra ID that decides who gets into your email, files, and apps, from where, and on what device. This guide explains what it does in owner friendly terms, which licenses include it, and the five Conditional Access policies we recommend small businesses start with, along with the rollout steps that keep you from locking yourself out.
What Conditional Access does, in plain terms
Microsoft describes Conditional Access policies as if then statements. If a user wants to reach Microsoft 365, then they must complete multifactor authentication. If an administrator signs in, then the device must be company managed. If a sign in comes from a country you never work in, then block it. Each policy combines signals, such as who the user is, where the sign in comes from, which device is used, and which app is requested, with a decision: block, allow, or allow only after an extra requirement is met.
One detail matters for expectations. Microsoft notes that Conditional Access policies are enforced after the first factor, usually the password, is checked. It is not a firewall and it will not stop someone from guessing passwords. What it does is make a correct password worthless on its own.
Which Microsoft 365 licenses include Conditional Access
Conditional Access requires Microsoft Entra ID P1. Microsoft 365 Business Premium includes Entra ID P1 and Microsoft Intune Plan 1, which you need for the device rules below. Business Basic and Business Standard include only the free tier of Entra ID, which gives you security defaults: a fixed bundle that requires MFA and blocks older sign in methods, with no room to tailor anything. You use one or the other, so security defaults must be turned off before Conditional Access policies take over.
Risk based policies, the ones that react when Microsoft judges a sign in or a user as risky, need Entra ID P2. Business Premium customers can get P2 through the separately sold Microsoft Defender Suite add on. The math for upgrading also shifted this year. Under Microsoft's July 1, 2026 price update, Business Standard rose from $12.50 to $14.00 per user per month while Business Premium stayed at $22.00, so the gap is now $8.00. Our comparison of Business Premium, E3 and E5 covers what else that difference buys.
Two safeguards before you build anything
Create two emergency access accounts first. These are cloud only administrator accounts, protected with long unique credentials stored somewhere safe, excluded from every Conditional Access policy, and monitored so any use triggers an alert. Microsoft recommends excluding them for one reason: if a policy is misconfigured and blocks every administrator, these accounts are how you get back in.
Then build every new policy in report only mode. In this state the policy evaluates each sign in and records what it would have done, without enforcing anything. Let it run through a normal stretch of business, ideally including a payroll run or month end close, then review the results on the policy impact tab and in the sign in logs. Microsoft's own instructions for each policy end the same way: create it in report only mode and switch it on after you confirm it behaves as expected.
Also check your tenant for policies you did not create. Microsoft now deploys Microsoft managed policies to eligible tenants in report only mode and turns them on no less than 30 days later unless an administrator acts, with notice about two weeks ahead. They show Microsoft in the Created by column. Review them, add your emergency accounts as exclusions, and decide deliberately.
Policy one: require multifactor authentication for every user
This is the foundation. The policy targets all users and all resources, excludes the emergency accounts, and requires MFA to grant access. Microsoft states that requiring multifactor authentication reduces the risk of compromise by more than 99 percent. Before you enforce it, make sure everyone has registered an MFA method, or the first enforced sign in turns into a help desk queue. Where you can, choose the built in authentication strength settings rather than plain MFA, so you can later require phishing resistant MFA without rebuilding the policy.
Policy two: block legacy authentication
Older sign in protocols, such as POP, IMAP, basic authentication over SMTP, and very old Office clients, cannot perform MFA at all. Attackers know this. According to Microsoft's analysis, more than 97 percent of credential stuffing attacks and more than 99 percent of password spray attacks use legacy authentication.
The policy itself is simple: all users, all resources, client apps limited to Exchange ActiveSync and other clients, and the decision set to block. The work is in the discovery. Filter your sign in logs by the Client App column to find anything still using these protocols. In small offices the usual suspects are a copier that emails scans or a phone set up years ago with a basic mail app. Fix those first, then turn the policy on.
Policy three: require a compliant device for administrators
Administrator accounts can change everything, so they deserve the strictest rule. Target the built in admin roles, such as Global Administrator, Exchange Administrator, SharePoint Administrator, User Administrator, and Security Administrator, and require two things: a device marked compliant in Intune, meaning enrolled, encrypted, updated, and protected, plus phishing resistant authentication. Microsoft recommends phishing resistant MFA for at least 14 privileged roles.
The combination is what makes it strong. A stolen admin password plus a tricked approval still fails, because the attacker's laptop is not your enrolled, compliant device. Note that Conditional Access applies to built in roles, not custom ones, and that admins should use a separate account for daily email. Our guide to privileged access management covers that separation in more depth.
Policy four: block countries you never work from, carefully
A named location can be a list of countries, and Entra ID maps each sign in's IP address to a country using a regularly updated table. Blocking countries where your business has no staff, clients, or vendors cuts a lot of automated noise. Microsoft calls location blocks restrictive and says to apply them with care after thorough testing, and there are good reasons for caution.
VPNs and cloud proxies make a user appear wherever the provider's servers sit. Staff travel, and family visits abroad are common in a city as international as Los Angeles. Vendors and contractors may work overseas. Meanwhile, determined attackers rent residential connections inside the United States, so a country block reduces noise rather than building a wall. A practical approach is to block a defined list of countries, keep a travel exception group with an end date for each person added, and decide consciously whether to tick Include unknown countries/regions. Pair this with sound secure remote access practices for people who work on the road.
Policy five: set a sensible sign in frequency
Sign in frequency controls how often users must sign in again. Microsoft's default is a rolling window of 90 days, and its guidance is blunt that asking for credentials too often backfires, because it trains people to enter passwords and approve prompts without thinking. That is exactly the habit MFA fatigue attacks exploit.
So resist the urge to force a sign in every hour. On company managed devices, single sign on with the default lifetime is usually fine. Apply a shorter frequency, such as once per workday, and turn off persistent browser sessions for personal devices and browser access from machines you do not manage. Microsoft also advises disabling the older Remember MFA on trusted devices setting before using sign in frequency, since the two together can prompt users unexpectedly. Reserve the Every time option for specific high risk actions.
Rolling out all five without a Monday morning lockout
The order matters. Set up emergency accounts, then create all five policies in report only mode. While they collect data, clean up legacy clients, enroll administrator devices in Intune, and make sure every user has registered MFA. Use the What If tool to test real scenarios, such as an admin on a home laptop. Turn policies on one at a time, starting with MFA for all users and the legacy block, and tell staff in advance what will change. Document each policy's purpose and every exclusion, then review them each quarter, because exclusions added in a hurry tend to stay forever.
How GlobeVM helps you set up Conditional Access
GlobeVM has supported businesses for 30 years and looks after more than 75 organizations across Southern California. Multifactor authentication, firewall management, endpoint protection, and email filtering are standard in every plan, and our 24/7 monitoring watches the sign in activity these policies produce. When a policy blocks someone who needs to work, a person in Los Angeles answers in under 15 minutes, often George or Nazy, the owners, in English or Farsi.
Our managed Microsoft 365 services include designing, testing, and maintaining Conditional Access for your tenant. Check where you stand with our free security score tool, or book a free IT assessment and we will review your current policies and licensing. You can also call (818) 405-9930.
Conditional Access questions from small business owners
Do I need Business Premium to use Conditional Access?
You need Microsoft Entra ID P1, which Business Premium includes. Business Basic and Standard do not include it, though P1 can be bought separately. Business Premium is usually simpler because it also includes Intune.
What is the difference between security defaults and Conditional Access?
Security defaults are a free, fixed bundle that requires MFA and blocks legacy sign ins for everyone, with no exceptions or tuning. Conditional Access lets you write your own rules by user, device, location, and app. You use one or the other, not both.
What does report only mode do?
It lets a policy evaluate real sign ins and log what it would have done, without blocking anyone. You review the results, fix problems, and then switch the policy on with confidence.
Can Conditional Access lock me out of my own tenant?
Yes, a misconfigured policy can block every administrator. That is why Microsoft recommends emergency access accounts excluded from all policies, and why each new policy should start in report only mode.
Do small businesses need Entra ID P2?
Not to start. The five policies in this guide work with P1. P2 adds risk based policies that react automatically to risky sign ins and leaked credentials, which is a worthwhile next step once the basics are in place.