# Entra ID Conditional Access Setup
*Playbook · Improving · Level: Intermediate · Typical timescale: About 1 week · Last reviewed: July 2026 · https://cyberdataservices.uk/playbooks/entra-id-conditional-access-setup*

> Set up access policies in Microsoft Entra ID, formerly Azure AD, without locking yourself out.

A set of Conditional Access policies for Microsoft Entra ID that require MFA for admins, block legacy sign in, check device health, and step up protection when a sign in looks risky.

## Prerequisites
- Microsoft Entra ID P1 or P2 licensing, which Conditional Access requires.
- Global Administrator or Conditional Access Administrator rights.
- Two break glass administrator accounts, excluded from your policies and stored securely.
- Report only mode understood and ready to use, so you can test a policy before enforcing it.

## Step-by-step

### 1. Create break glass accounts first
Before you write a single policy, create two emergency administrator accounts and exclude them from every Conditional Access policy. A misconfigured policy can lock every normal admin out of the tenant, and these accounts are how you get back in. Give them long, unique passwords, store them somewhere very safe, and monitor them for use.

Tip: Alert on any sign in to a break glass account. They should almost never be used, so a login is either a genuine emergency or a warning that something is wrong.

### 2. Test everything in report only mode
Conditional Access has a report only mode that shows what a policy would have done without actually enforcing it. Use it for every new policy. Review the sign in logs to see who would have been blocked or prompted, fix the surprises, and only then switch the policy on. This habit prevents almost every self inflicted lockout.

### 3. Require MFA for administrators
Administrator accounts are the highest value targets in your tenant, so protect them first. Create a policy that requires multi factor authentication for all administrative roles, on every sign in. Once that is stable, extend MFA to all users, because an ordinary account is often just the first step towards an admin one.

### 4. Block legacy authentication
Legacy authentication protocols cannot enforce MFA, so they undermine everything else you set up. Build a policy that blocks them, testing in report only mode first to catch any older application that still depends on them. Move those apps onto modern authentication, then enforce the block across the tenant.

### 5. Add device and location conditions
Tighten access based on context. Require that devices reaching sensitive applications are managed and compliant, so a healthy, encrypted, patched device is a condition of entry. You can also treat sign ins from unexpected countries as higher risk, prompting for extra verification or blocking them outright where that suits the business.

### 6. Use risk based policies and review regularly
With Entra ID P2, Identity Protection scores each sign in and each user for risk, using signals Microsoft sees across its estate. Create policies that step up verification or block access when the risk is high, for example forcing a secure password reset on a risky sign in. Review your policies every few months, because tenants and threats both move on.

---
Source: https://cyberdataservices.uk · Cyber Data Services (trading name of Tom Sykes Ltd, company no. 06947397), part of the Stiperstone Group.
General information only, not specific security or legal advice. For guidance on your own systems, contact info@cyberdata.services or 01952 972 404.