Microsoft 365 MFA and Conditional Access That Actually Applies
Every Outlook, SharePoint, OneDrive and Teams sign-in should meet a deliberate policy. We verify coverage, exclusions and sign-in results, not just the setting.
Block Legacy Authentication Before Attackers Find It
Older mail clients and protocol exceptions can bypass MFA entirely. Sign-in logs show which paths are still in use and what must change before blocking.
A Read-Only Microsoft 365 Security Audit, Any Tenant Size
200 checks, including MFA and Conditional Access, delivered as an executive report, technical report, risk register and remediation roadmap by a Certified CISO.
MFA alone is not Conditional Access
Microsoft 365 access is decided by identity, authentication method, device state, application, location, risk signals and the resilience of administrative recovery. MFA is one control; Conditional Access combines those conditions and can require or block other controls.
Ali Hassani, CISO (C|CISO, CISSP) with 25+ years in Microsoft infrastructure and security, reviews Microsoft 365 tenants for organizations in Orange County and Southern California on-site, and nationwide remotely. The goal is simple: prove that the policy you intended is the policy that applied.
Microsoft 365 MFA and Conditional Access controls to verify
Each area lists where to look in the Entra admin center and what evidence proves the control works.
Authentication methods policy
Move method administration to the current Entra authentication methods policy and restrict who can register or manage privileged methods.
- Protection > Authentication methods
- Migrate off legacy per-user MFA settings
- Restrict SMS and voice for admins
- Protect security-info registration with MFA
- Export policy and registration report
- Review admin role assignments
MFA baseline for users
Apply MFA to all appropriate users through Conditional Access, with stronger requirements for administrative roles.
- Protection > Conditional Access
- Target all users, not ad hoc groups
- Stronger authentication strength for admins
- Document every exclusion with an owner
- Treat guests explicitly
- Confirm results in sign-in logs
Phishing-resistant methods
Pilot passkeys or other phishing-resistant methods for privileged and high-risk users, with enrollment and recovery support in place.
- Start with admins and finance users
- Passkeys, FIDO2, Windows Hello
- Plan backup and lost-device recovery
- Brief the help desk first
- Record pilot scope and test results
- Expand in controlled stages
Report-only before enforcement
Review report-only results for service accounts, emergency accounts, device gaps and legitimate work patterns before blocking anything.
- Run new policies in report-only
- Check service and shared mailboxes
- Find users with no usable method
- Identify unsupported apps and devices
- Keep a tested rollback path
- Record remediation decisions
Legacy authentication and locations
Identify legacy authentication and mail-client exceptions, and treat trusted named locations as high-risk exceptions rather than a shortcut.
- Query sign-in logs for legacy clients
- Block legacy authentication by policy
- Approve and expire any exceptions
- Document named-location business purpose
- Assign an owner and review date
- Export named-location configuration
Emergency access and telemetry
Keep controlled emergency accounts outside blocking policies, and use sign-in logs to prove policies applied as intended.
- Two cloud-only break-glass accounts
- Separately stored credentials
- Quarterly sign-in tests with evidence
- Alert on any emergency account use
- Monitoring & health > Sign-in logs
- Investigate unexpected policy bypass
What good Microsoft 365 sign-in security looks like
Microsoft 365 Security Audit: 200 read-only checks, four clear reports.
Executive report, technical report with remediation steps, risk register and remediation roadmap. Read-only access; nothing changes in your tenant.
Led by Ali Hassani, CISO
Certified CISO (C|CISO) and CISSP with 25+ years in IT and cybersecurity. Based in Irvine, on-site across Southern California, remote nationwide.
About Ali →From policy intent to verified outcome
- STEP 1SignalUser, role, device, location, application, authentication context and risk are evaluated at sign-in.
- STEP 2PolicyConditional Access decides whether the attempt falls within an intentional, documented scope.
- STEP 3ControlThe user must satisfy MFA, authentication strength, compliant device or session requirements.
- STEP 4ResultSign-in logs record the policy decision and the requirement that actually applied.
- STEP 5ReviewOwners investigate exclusions, failures and exceptions, then retain evidence for audit.
Keep going.
Microsoft Entra ID Security Audit
$3,500 fixed, read-only: 72 checks plus 30 days of sign-in logs read for attacks.
See the audit →Microsoft Entra ID Security Implementation
Step-by-step Entra ID hardening: privileged roles, app consent and Identity Protection.
Read more →Microsoft 365 Admin Roles, PIM and Reviews
Reduce administrative risk with least privilege, PIM and access reviews.
Read more →Microsoft 365 Security Audit
$3,500 fixed-fee, read-only audit with 200 checks and four deliverables.
Read more →Frequently asked questions
Does MFA alone provide Conditional Access in Microsoft 365?
No. MFA is one control. Conditional Access combines conditions such as user, device, application, location and risk, and can require MFA or block access entirely.
Should every Microsoft 365 user receive the same Conditional Access policy?
Not necessarily. Policy should match role, risk, device, application and business requirements, but every exclusion must be explicit, owned and reviewed.
Why keep separate emergency access accounts?
Microsoft warns that accounts subject to normal MFA or device requirements may be unavailable during the very event that requires emergency access. Keep them separate, monitored and tested.
How do I know my policies actually applied?
Check the Entra sign-in logs for representative users and applications and confirm the applied policy and authentication requirement. The Microsoft 365 Security Audit includes this verification as part of its 200 read-only checks.
Prove your Microsoft 365 sign-ins are protected
Get a $3,500 fixed-fee, read-only Microsoft 365 Security Audit from Ali Hassani, CISO, on-site in Southern California or remote nationwide.