If you run Microsoft 365 and someone has told you to turn on Conditional Access, this guide is for you. It covers the Conditional Access Microsoft 365 tenants already include, how it differs from security defaults and plain MFA, what it costs, and how to roll it out without locking anyone out.
Conditional Access Microsoft 365 policies are if-then rules: if this user, on this device, from this location, wants this app, then require MFA, require a compliant device, or block. It is Microsoft’s Zero Trust policy engine for Entra ID, and it needs Entra ID P1, which Microsoft 365 Business Premium includes.
Conditional Access Microsoft 365 policies decide whether to allow, challenge or block a sign-in based on who the user is, what device they’re on, where they are and what they’re opening. Security defaults are the free, fixed version. Conditional Access is the customisable one, and it needs Entra ID P1.
What Are Conditional Access Policies in Microsoft 365?
Conditional Access policies are the rules in Microsoft Entra ID that decide what happens after a user enters a correct password. Microsoft calls Conditional Access its Zero Trust policy engine: it gathers signals about the user, the device, the location, the app and the risk of the sign-in, then applies a decision, either grant with conditions or block.
The signals Microsoft lists in its Conditional Access overview are the user or group, IP location, device platform and state, the application being opened, real-time risk from Entra ID Protection, and session data from Defender for Cloud Apps. The decisions are block, or grant with one or more requirements: multifactor authentication, a set authentication strength, a compliant device, a hybrid-joined device, an approved client app, an app protection policy, a password change or accepted terms of use.
Three things trip people up. The policies run after first-factor authentication, so a wrong password never reaches them, and Microsoft says they aren’t a frontline defence against denial-of-service. They’re built in the Microsoft Entra admin centre under Entra ID, then Conditional Access, and what many still call Azure AD Conditional Access is the same feature under the product’s old name. And every policy created from a Microsoft template starts in report-only mode, which evaluates sign-ins without enforcing anything.
What Is the Difference Between Security Defaults and Conditional Access?
Security defaults are Microsoft’s free, one-switch baseline. Conditional Access is the fully customisable version that needs Entra ID P1. Security defaults require every user to register for MFA, make administrators use it every time, block legacy authentication and device code flow, and protect the Azure portal. You can’t edit any of that, and you can’t run both at once.
Microsoft’s security defaults documentation says MFA plus blocking legacy authentication stops more than 99.9% of common identity attacks. That’s why tenants created since 22 October 2019 often have security defaults switched on, and why Microsoft turns them on automatically for tenants with no Conditional Access policies, no premium licences and no legacy authentication in use. Microsoft’s own advice is that if you hold Entra ID P1 or P2, security defaults are probably not right for you.
The practical difference is exceptions. Security defaults prompt everyone the same way. Conditional Access lets you exclude the meeting-room device, require a compliant laptop for the finance team, and skip the MFA prompt on the office network. Transputec’s Microsoft 365 services configure Conditional Access policies aligned with Zero Trust principles as part of tenant security, alongside MFA enforcement and Intune device compliance.
Rolling Out Conditional Access? Get the Policies Right First
Transputec's Microsoft 365 services cover Conditional Access, MFA enforcement and Intune device compliance across more than 350 UK-managed tenants, working to a Microsoft Secure Score baseline of 88%. Talk to our team about the security work behind your sign-ins.
Get a Strategic ConsultationDo I Need Conditional Access If I Already Have MFA?
Yes, if you want to decide when MFA applies instead of leaving it to a blanket setting. MFA is a control. Conditional Access is the engine that decides who has to pass it, from where, on what device, for which app. It also closes the gap MFA alone leaves open: legacy authentication protocols that never prompt for a second factor.
Microsoft’s data on that gap is blunt. More than 99% of password spray attacks use legacy authentication protocols such as IMAP, POP3 and SMTP, and those protocols can’t do MFA at all. So an attacker with a stolen password uses an old mail protocol and walks past your MFA policy. Blocking legacy authentication is in every one of Microsoft’s recommended policy sets, and it’s one of the Microsoft-managed policies Microsoft now creates in eligible tenants. Per-user MFA, the older per-account setting, is a configuration Microsoft no longer recommends; Conditional Access is its replacement.
MFA is also no longer optional for the accounts that matter most. Microsoft’s mandatory MFA enforcement covered the Azure portal, the Entra admin centre and the Intune admin centre from October 2024, the Microsoft 365 admin centre from February 2025, and Azure CLI, PowerShell and the REST API from 1 October 2025, with no opt-out. Cyber Essentials v3.3 says authentication to cloud services must always use MFA, and cyber insurers ask for it too; see our posts on the 5 Cyber Essentials controls and cyber insurance requirements. The government’s 2025/26 breaches survey still found only 47% of UK businesses using two-factor authentication. Conditional Access is how you make that 100% in your tenant, then decide where the prompt is worth the friction.
What Are the Conditional Access Licensing Requirements?
Conditional Access needs Microsoft Entra ID P1 for the users it applies to, and Microsoft 365 Business Premium includes P1. Risk-based policies, which react to leaked passwords or impossible-travel sign-ins, need Entra ID P2. On Microsoft’s UK price list P1 is £5.40 and P2 £7.70 per user per month, paid yearly, and security defaults cost nothing.
Here are the Conditional Access Microsoft 365 licensing rules in full, taken from Microsoft’s Entra licensing page and the Conditional Access overview:
- Entra ID P1 is included in Microsoft 365 E3, E5 and E7, Microsoft 365 F1 and F3, Enterprise Mobility + Security E3, and Microsoft 365 Business Premium at £16.90 per user per month.
- Entra ID P2 is included in Microsoft 365 E5 and E7, the Microsoft Defender Suite (formerly Microsoft 365 E5 Security) and EMS E5, and is sold as a Defender Suite add-on for Business Premium.
- Business Basic and Business Standard come with Entra ID Free, which gives you security defaults but not Conditional Access. Our guide to Microsoft 365 licensing for SMEs sets out where each plan stops.
- Standalone Defender for Business includes security defaults; Conditional Access still needs P1, as our Microsoft Defender for Business guide explains.
- If P1 lapses, existing policies keep running and can be deleted, but they can no longer be edited.
| What you get | Security defaults (free) | Conditional Access with Entra ID P1 or Business Premium | Conditional Access with Entra ID P2 |
|---|---|---|---|
| UK price per user per month | £0 | £5.40 standalone, or inside Business Premium at £16.90 | £7.70 |
| MFA for all users and admins | Yes, fixed | Yes, per user, group, app or location | Yes |
| Block legacy authentication | Yes, fixed | Yes, with exclusions | Yes |
| Require a compliant or managed device | No | Yes, with Intune | Yes, with Intune |
| Named locations and IP ranges | No | Yes | Yes |
| Report-only mode to test before enforcing | No | Yes | Yes |
| Risk-based policies (leaked credentials, abnormal travel) | No | No | Yes |
| Exclusions for break-glass and service accounts | No | Yes | Yes |
| Customisation | On or off | Full | Full |
Which Conditional Access Policies Should You Start With?
Start with Microsoft’s secure foundation templates, which it recommends as the base for every organisation, deployed as a group. There are eight: MFA for admins, securing security info registration, block legacy authentication, MFA for admins using Microsoft admin portals, MFA for all users, MFA for Azure management, require a compliant or hybrid-joined device or MFA, and require a compliant device.
Microsoft Entra Conditional Access templates live in the Entra admin centre under Conditional Access, then Create new policy from templates. Two rules come with them, set out on Microsoft’s templates page. Every policy you create from a template starts in report-only mode, so nothing is enforced until you switch it on. And each template excludes only the person who created it, so add your emergency access accounts and service accounts before enabling anything. Microsoft recommends two cloud-only break-glass accounts holding the Global Administrator role, excluded from every policy.
Microsoft also creates Microsoft-managed Conditional Access policies directly in eligible tenants: block legacy authentication, block device code flow, MFA for admins using admin portals, MFA for all users, MFA for per-user MFA users, and, on P2, MFA for risky sign-ins and controls for high-risk users. They arrive in report-only mode and Microsoft enables them no less than 30 days later unless you turn them on or off first, with an email and a Message Center post two weeks before.
How Do You Roll Out Conditional Access Without Locking People Out?
In report-only mode first, with break-glass accounts excluded and legacy authentication dealt with before anything is enforced. The sign-in log shows what each report-only policy would have done, so you turn a policy on only when the log shows the result you expect. That order stops a Conditional Access Microsoft 365 rollout ending with the IT manager locked out.
- Create two cloud-only emergency access accounts with the Global Administrator role, and register them for passkey or certificate-based MFA, because Microsoft’s mandatory MFA applies to break-glass accounts too.
- Find legacy authentication in the Entra sign-in logs. Older Office clients, and scanners or line-of-business apps sending mail over IMAP, POP3 or SMTP, need moving to modern authentication or a scoped exception before you block the protocol.
- Create the eight secure foundation templates in report-only mode.
- Read the sign-in log’s Conditional Access and Report-only tabs, and the policy impact view, which covers the past 24 hours, 7 days or month.
- Switch on block legacy authentication and MFA for admins first, then MFA for all users, then device compliance once Intune enrolment is complete.
- Disable security defaults only after the replacement policies are on. Microsoft’s guidance is to enable Conditional Access immediately after disabling them.
- Check for classic policies. They stopped enforcing on 10 July 2024 and can’t be re-enabled once disabled, so document and recreate them.
Transputec does this work as part of its Microsoft 365 services across more than 350 UK-managed tenants, and the same identity work sits underneath our Modern Workplace deployments, where identity and security are configured to zero-trust baselines from the start. For the identity side at scale, our hybrid identity project for GCH Hotel Group brought 300 users across more than 120 hotels onto Azure AD with MFA and self-service password reset.
What Does Conditional Access Not Do?
It doesn’t check the password or manage the device. Conditional Access runs after first-factor authentication succeeds, so a wrong password never reaches it, and Microsoft says it isn’t a frontline defence against denial-of-service. It relies on Intune for device compliance, on Entra ID Protection and a P2 licence for risk, and on the apps being fronted by Entra ID.
- Device compliance needs Intune. A policy that requires a compliant device is only as good as the enrolment and compliance rules behind it, which is why Transputec pairs Conditional Access with Intune device compliance on the tenants it manages. Our guide to managing Mac endpoints with Microsoft Intune covers the non-Windows side.
- Risk needs P2. Sign-in risk and user risk policies need Entra ID Protection, which is a P2 feature.
- Endpoints need their own protection. Conditional Access decides who gets in. It doesn’t watch what runs on the laptop afterwards; that is antivirus and EDR, covered in our Defender for Business guide.
- Apps are only covered if they authenticate through Entra ID. That is the point of the identity consolidation our Entra ID migration guide describes.
Your Conditional Access Microsoft 365 Checklist
Use this before you call your Conditional Access Microsoft 365 setup finished.
- Confirm the licence: Entra ID P1 at £5.40, or Business Premium, or E3 and above. Business Basic and Standard need an upgrade or an add-on.
- Decide between security defaults and Conditional Access. You can’t run both.
- Create two cloud-only emergency access accounts and exclude them from every policy.
- Find and remove legacy authentication before you block it.
- Deploy the eight secure foundation templates in report-only mode.
- Read the sign-in log and the policy impact view before switching each policy to On.
- Turn on the Microsoft-managed policies yourself instead of waiting for the 30-day auto-enable.
- Add device compliance once Intune enrolment is complete.
- Move to P2 only if you want risk-based policies.
- Check the coverage tab in the Entra admin centre for apps with no policy.
Conclusion
Conditional Access Microsoft 365 policies are the if-then rules that turn MFA from a blanket prompt into a decision about who, where, which device and which app. Security defaults are the free version with no exceptions. Entra ID P1, included in Business Premium, buys the customisable version at £5.40 a user, and P2 adds risk-based policies at £7.70.
Microsoft’s templates and managed policies do most of the design work, and report-only mode means you see the outcome before anyone is prompted.
Transputec configures Conditional Access, MFA enforcement and Intune device compliance as part of its Microsoft 365 services, holds the Microsoft Solutions Partner designations for Modern Work and Security, and works to a Secure Score baseline of 88% across the tenants it manages. Most of the effort is in the exclusions, the legacy authentication clean-up and the order you switch things on.
If an insurer, an auditor or your own sign-in logs have raised the question, talk to us about the security work behind your Conditional Access Microsoft 365 policies.
FAQs
Is Conditional Access Included in Microsoft 365 Business Premium?
Yes. Business Premium includes Microsoft Entra ID P1, the licence Conditional Access needs, so the Conditional Access Microsoft 365 Business Premium tenants get is the full customisable version. Business Basic and Business Standard include Entra ID Free, which gives you security defaults only. Risk-based policies need Entra ID P2.
What Happened to Azure AD Conditional Access?
Microsoft announced the renaming of Azure Active Directory to Microsoft Entra ID on 11 July 2023, with licensing and features unchanged, so Azure AD Conditional Access and Microsoft Entra Conditional Access are the same feature. One real change did happen: classic Conditional Access policies, built on the retired Azure AD Graph, stopped enforcing on 10 July 2024 and have to be recreated as modern policies.
Can I Use Security Defaults and Conditional Access Together?
No. Microsoft’s guidance is that organisations moving to Conditional Access must disable security defaults, and should enable their replacement policies immediately afterwards. The Microsoft-managed policies for blocking legacy authentication and requiring MFA for admins, Azure management and all users exist to keep the same protections in place during the switch.
Does Cyber Essentials Require Conditional Access?
No. Cyber Essentials v3.3 (April 2026) requires MFA for all authentication to cloud services and for administrative and internet-accessible accounts, with a password element of at least 8 characters, but it doesn’t name a product. In Microsoft 365, security defaults or Conditional Access policies are the two ways to enforce that requirement.
How Much Does Conditional Access Cost?
On Microsoft’s UK price list, Entra ID P1 is £5.40 per user per month and P2 is £7.70, both paid yearly on an annual commitment. Microsoft 365 Business Premium includes P1 at £16.90 per user per month. Security defaults are free. Transputec’s Microsoft 365 services include quarterly licence audits that check what you already hold before you buy anything.
This article was drafted with AI assistance and reviewed by the Transputec team. Featured image: AI-generated.
