The castle-and-moat network perimeter did not die in a keynote; it died when everyone worked from home and SaaS became the workplace. Conditional Access is the control plane you actually have left for many Microsoft estates. This post is how we design CA so it raises security without locking out the CEO on a Sunday — named locations, device compliance signals, break-glass accounts, report-only mode, and killing legacy authentication on purpose.
Principles
- Report-only first for any policy that can block production
- Break-glass accounts excluded, monitored, and rare
- Legacy authentication blocked when inventory allows — highest ROI
- Device compliance for high-value apps when Intune/config allows
- Named locations for trusted egress, not as a sole factor
Report-only is not optional
Every blocking policy ships in report-only (or equivalent pilot) until logs show who would have been denied. We review a week of what-if impact with the business before flipping to on. The reverse — block first, explain later — is how CA projects get permanently politically dead.
Break-glass
At least two cloud-only emergency accounts:
- Long complex passwords in a safe
- Excluded from CA carefully
- Monitored for any sign-in
- Tested quarterly
If your only global admin is subject to a misfired MFA policy and you have no break-glass, you built a self-lockout device.
Legacy auth kill switch
Password spray loves basic auth. Pair CA “block legacy authentication” with Exchange protocol work. Inventory first (service accounts, printers, IMAP). Stage enforcement. This single control often matters more than exotic session controls people debate for months.
Device compliance without fantasy
Requiring compliant devices for Exchange Online and SharePoint is right for many enterprises — when compliance is achievable. Field staff with unmanaged devices need a path: VDI, app protection policies, or accepted risk. “Compliant only” with no managed device program is a business outage.
Named locations and risky travel
Trusted IPs for offices help reduce prompts. They are not MFA. Home IP ranges change; do not maintain ten thousand home CIDRs as a job. Use locations for office egress and VPN egress you control.
MFA prompts and user experience
Too many prompts train users to approve blindly. Prefer improved session controls and device trust over prompting on every resource. Educate on number matching / fatigue when available in your feature set — and still design for least prompt friction that meets risk.
Rollout rings
- IT
- Friendly business unit
- Broad standard users
- VIPs with white-glove
- Service accounts as their own program
VIP last is deliberate: you want policy correctness before the board meeting.
Common failure modes
- All users in one CA policy with no exclusions for emergency
- Blocking legacy auth without printer/LOB inventory
- Requiring MFA from trusted network incorrectly and breaking service accounts
- No owner for CA — policies accumulate like GPO in 2009
Extended practice notes (2020)
The remaining gap between a short checklist and a usable field note is usually scenario detail. In practice, the same engagement type described above still requires explicit answers to: what is in scope this quarter, what is deferred with a date, who can halt a wave, and how success is measured in production — not in a lab.
We document those answers before the first production change. When stakeholders disagree, the disagreement is resolved in writing, not on the bridge at cutover. That habit is independent of whether the workload is mail, identity, virtualization, desktop delivery, or security hardening.
Repeatable detail also includes communication: who tells users what changes, when the freeze starts, where status is posted, and how exceptions are requested. Technical excellence without communication still produces an outage from the user's point of view.
If you're facing this
If your perimeter is still “VPN equals safe,” rebuild around Conditional Access and legacy-auth burn-down. We design CA policy architectures for Azure AD tenants that people can actually run — bring license SKU reality and a list of non-human accounts.