Conditional Access: require MFA for all users

Overview

Enforcing MFA via Conditional Access (CA) is the highest ROI identity control for most tenants. Plan exclusions carefully.

Policy pattern

1. Create baseline policies: block legacy auth; require MFA for all cloud apps for all users except break-glass.
2. Add compliant device or hybrid join policies only where maturity supports—staged rings.
3. Use What If tool before enforcement.

Exemptions

Service accounts should use certificates or managed identities—not SMS MFA on a shared phone.

Rollout

Report-only mode → limited enforcement → full; communicate lockout risk for travelers without MFA method backup.

Monitoring

Sign-in logs for failure reason spikes; monthly review of policy gaps when new apps onboard.