Most tenants we inherit have between 20 and 60 Conditional Access policies, half of them overlapping, several in report-only mode "temporarily" since 2022, and nobody who can say with confidence what happens when a contractor signs in from an unmanaged Mac. This is the framework we use to replace that with something a small IT team can reason about.
Start with the guard rails
- Two break-glass accounts excluded from every policy, with FIDO2 keys in a safe and sign-in alerts on.
- Named locations and authentication strengths defined before any policy references them.
- Report-only first, for at least a week, with the Conditional Access insights workbook reviewed.
The baseline set
| # | Policy | Intent |
|---|---|---|
| CA001 | Block legacy authentication | Remove the easiest bypass |
| CA002 | Require phishing-resistant MFA for admins | Protect privileged roles first |
| CA003 | Require MFA for all users | Baseline for everyone |
| CA004 | Require compliant device for Microsoft 365 | Tie access to device management |
| CA005 | Block unsupported platforms | Reduce unknown OS surface |
| CA006 | Require MFA for Azure / admin portals | Protect the control plane |
| CA007 | Guests: MFA + limited apps | Least privilege for externals |
| CA008 | Sign-in / user risk: require MFA or block | Identity Protection signals (P2) |
| CA009 | Block countries you never operate in | Cheap noise reduction |
| CA010 | Session controls for unmanaged devices | Browser-only, no download |
Naming convention
CA###-<Users>-<Apps>-<Condition>-<Control>, e.g. CA004-AllUsers-M365-AnyPlatform-RequireCompliantDevice. The number is the deployment order; the name is the policy.
Roll out in rings
Pilot group → IT → early adopters → everyone, one policy at a time, with a dated exclusion group per policy that is reviewed (and emptied) monthly. Export the whole set as JSON with Microsoft Graph so it lives in source control alongside your Intune configuration.
Want this baseline deployed and documented in your tenant? It is part of the Microsoft 365 Hardening Sprint.