Some policies I use in Conditional Access

This site is called Conditional Access, and yet surprisingly, it has very little advice on what you should do for CA policies. I’ve stayed away from this subject on purpose; it’s very hard to “baseline” CA policies as they are very bespoke to the individual needs of a business, and nobody can ever agree on what’s best.

The word “baseline” holds a lot of weight too. Many frameworks or baselines have become inarguable rulesets for administrators everywhere, even though few of them ever set out to be used in that way.

So, this isn’t a baseline, I’m not even going to call it guidance. These are some policies I use, feel free to take some inspiration.

I’ve copied ideas I’ve seen from Jay Kerai, Ru Campbell and others.

General Approach

Apply broadly, exclude narrowly.

If you assign to static groups, you’ve made yourself a static problem. Even if it’s a dynamic group, there might be times where for whatever reason a user isn’t quite fitting the rule, and it may as well have been an “all users” assignment from the start anyway.

Note: Where specific property types aren't configured, that means it will apply to everything.

In "MFA all users all resources", I'm not configuring any network or conditions. It simply means it applies to all users regardless of other possible login routes.

Policy list