Michael Narehood
A forty-person Microsoft 365 tenant does not need a forty-policy Conditional Access stack. That is enterprise theater: named locations nobody maintains, “require compliant device” with no Intune, and a policy list the next admin is afraid to touch.
You need a short starter pack. MFA for people, a hard stop on legacy protocols, extra friction on admins, and a way back into the tenant if you misconfigure something. For enrollment waves and help-desk scripts, use Turn on MFA for Microsoft 365. This tutorial is the control plane.
Microsoft’s Conditional Access planning guidance is the official map. You do not have to implement every box on it.
1. Pick Security Defaults or Conditional Access — not both
Security Defaults and Conditional Access are not a layered pair. Microsoft says they are not meant to be combined. You can create Conditional Access policies while Security Defaults is on, but you cannot enable those policies until Security Defaults is off. You cannot “keep the baseline on” while enforcing custom policies on top.
Do choose one model and document it.
Do not turn Security Defaults off just to “try a couple of CA policies.” Build the replacement in report-only first, then make the cutover as one documented change.
Use Security Defaults when you are on Entra ID Free and you need MFA plus a legacy-auth block with no policy engineering. Use Conditional Access when you have Microsoft Entra ID P1 (or P2). P1 is the usual license for the CA engine. It is included in Microsoft 365 Business Premium and several Microsoft 365 enterprise plans; confirm in the admin center rather than guessing SKUs.
If you already have P1, Conditional Access gives you the control needed to replace the packaged baseline. Turn Security Defaults off only when the policies below are ready the same day. Microsoft-managed Conditional Access policies now cover common baselines such as MFA for users, stronger authentication for admins, and blocking legacy authentication. Review what Microsoft has already placed in your tenant before creating duplicates; the current list is in Microsoft-managed policies.
2. Build break-glass exclusions before the first policy
Conditional Access can lock you out of your own tenant. Create emergency admin accounts first, exclude them on purpose, and write the exclusion in the policy description so the next person does not “clean it up.” Microsoft’s current guidance calls for at least two cloud-only emergency accounts, phishing-resistant authentication that does not depend on the normal admin method, monitoring, and a test at least every 90 days.
The full pattern is in break-glass admin accounts that work. For this tutorial, the rule is simple: no MFA-everywhere policy goes live until those accounts exist, their credentials and hardware are stored safely, the exclusions are documented, and a test sign-in succeeds.
Also exclude directory sync accounts if you run Entra Connect. Do not exclude random executives because they travel. That is how password-only VIP mailboxes survive.
3. Create three policies in report-only
In the Entra admin center: Entra ID → Conditional Access → Policies. Name them so a stranger can read the list in six months (CA001-AllUsers-MFA, CA002-Block-LegacyAuth, CA003-Admins-MFA). Set each to Report-only on create. Microsoft’s how-tos for MFA for all users and blocking legacy authentication both start that way for a reason.
Policy 1 — Require MFA for all users. Include all users. Exclude break-glass (and sync accounts if needed). Target all resources. Grant: require multifactor authentication (or the built-in multifactor authentication strength). This is the policy that actually changes risk for an SMB.
Policy 2 — Block legacy authentication. Include all users, same exclusions. Target all resources. Under Client apps, configure Exchange ActiveSync and Other clients, then Block access. Legacy protocols do not do MFA. Attackers still use them. Report-only will show you the copier, the old mail client, and the line-of-business job that still speaks IMAP.
Policy 3 — Phishing-resistant authentication for privileged roles. Target directory roles (Global Administrator and the other highly privileged roles you actually assign), all resources, and use the phishing-resistant authentication strength. The all-users policy already covers admins with MFA; this policy raises the method, which is why it is not merely a duplicate. If hardware keys or Windows Hello for Business are not enrolled yet, require MFA now, enroll the admins, then raise the authentication strength promptly. Do not leave the weaker method as the permanent “temporary” state.
Then do the part Conditional Access cannot do: look at Roles & admins and shrink standing Global Administrator. Keep the count small enough that you can explain every assignment, and keep daily admin identities separate from the emergency accounts. Everyone else gets a narrower role.
4. Read the report, then turn them on
Give report-only a few quiet days. Filter Sign-in logs for the policies and for legacy Client app values. Fix the real leftovers (modernize the copier, move a scanner to a connector, replace an ancient Outlook) before you flip On. The five weekly Entra sign-in checks show where to read those results after cutover.
Turn on in that order: the privileged-role policy, then all-users MFA, then the legacy block. Watch the help desk for a week. After that, extend phishing-resistant MFA to owners and other high-impact users.
5. Leave named locations and device compliance alone (for now)
Do not exclude the office public IP from MFA. Home ISPs, guest Wi-Fi, and a VPN egress that looks “trusted” punch a hole you will not notice until a phish from the parking lot works.
Do not require a compliant or Hybrid Azure AD joined device if you have no Intune compliance policies and no join story. That grant control is a lockout generator for phones, personal PCs, and the owner’s Mac. Device signals are a later project, after enrollment exists.
Named locations and compliance are useful when you operate them. They are not a starter pack.
Bottom line
For a small tenant, Conditional Access is three report-only policies, break-glass exclusions, and the discipline not to import an enterprise template. Security Defaults is the free baseline until you have Entra ID P1. Pick one, replace it the same day you leave it, and keep Global Admin rare.