1
00:00:00,000 --> 00:00:02,040
Imagine you sit down at your computer,

2
00:00:02,040 --> 00:00:04,120
type in your email address, punch in your password,

3
00:00:04,120 --> 00:00:04,940
and hit enter.

4
00:00:04,940 --> 00:00:06,900
There's that brief pause while the system decides

5
00:00:06,900 --> 00:00:08,040
if it's really you.

6
00:00:08,040 --> 00:00:10,760
Most folks assume that pause is just the password check.

7
00:00:10,760 --> 00:00:12,920
If the password matches, you're in, right?

8
00:00:12,920 --> 00:00:15,000
Actually no, a lot more happens behind the scenes

9
00:00:15,000 --> 00:00:16,240
than you probably realize.

10
00:00:16,240 --> 00:00:18,720
While you're waiting, Microsoft 365 runs a series

11
00:00:18,720 --> 00:00:19,760
of checks in the background.

12
00:00:19,760 --> 00:00:21,640
It looks at where you are, what device you're using,

13
00:00:21,640 --> 00:00:23,880
and whether this sign-in seems normal or suspicious.

14
00:00:23,880 --> 00:00:26,120
And it does all of that before it lets you through the door.

15
00:00:26,120 --> 00:00:27,760
By the end of this episode, you'll understand

16
00:00:27,760 --> 00:00:30,800
what conditional access is, how it works every single time

17
00:00:30,800 --> 00:00:33,400
you sign in, and why it's one of the most important security

18
00:00:33,400 --> 00:00:35,880
controls in your Microsoft 365 tenant.

19
00:00:35,880 --> 00:00:38,040
So let's start with the simplest definition.

20
00:00:38,040 --> 00:00:40,400
What actually is conditional access?

21
00:00:40,400 --> 00:00:42,040
Here's the definition in plain English.

22
00:00:42,040 --> 00:00:44,880
Conditional access is a policy engine that checks context

23
00:00:44,880 --> 00:00:46,400
before letting someone in.

24
00:00:46,400 --> 00:00:48,960
It doesn't just look at your password and say good enough.

25
00:00:48,960 --> 00:00:51,440
Instead, it asks extra questions about who you are

26
00:00:51,440 --> 00:00:53,640
and what's happening around your sign-in.

27
00:00:53,640 --> 00:00:55,360
Think of it like a nightclub bouncer.

28
00:00:55,360 --> 00:00:56,720
You show your ID at the door.

29
00:00:56,720 --> 00:00:58,200
That's your username and password.

30
00:00:58,200 --> 00:01:00,960
But a good bouncer doesn't just glance at it and wave you through.

31
00:01:00,960 --> 00:01:03,560
They check your name on the guest list, look at what you're wearing,

32
00:01:03,560 --> 00:01:06,120
and might even remember if you've caused trouble before.

33
00:01:06,120 --> 00:01:07,600
Conditional access does the same thing.

34
00:01:07,600 --> 00:01:10,440
It checks your identity against rules, sees where you're coming from,

35
00:01:10,440 --> 00:01:13,120
checks your device, and decides if everything looks right

36
00:01:13,120 --> 00:01:14,200
before letting you in.

37
00:01:14,200 --> 00:01:15,280
Now here's a key point.

38
00:01:15,280 --> 00:01:18,120
Conditional access runs after you've already typed your password.

39
00:01:18,120 --> 00:01:20,360
It's not a replacement for multi-factor authentication.

40
00:01:20,360 --> 00:01:21,640
It's an extra layer on top.

41
00:01:21,640 --> 00:01:24,080
Think of it as the second checkpoint after you've shown your ID

42
00:01:24,080 --> 00:01:25,120
at the front door.

43
00:01:25,120 --> 00:01:26,040
The logic is simple.

44
00:01:26,040 --> 00:01:28,400
If then, if a user tries to access a cloud app

45
00:01:28,400 --> 00:01:31,200
and they meet certain conditions, then enforce this rule.

46
00:01:31,200 --> 00:01:34,920
For example, if someone is trying to access outlook from outside the office,

47
00:01:34,920 --> 00:01:37,280
then require multi-factor authentication.

48
00:01:37,280 --> 00:01:40,680
That's the basic structure behind every conditional access policy.

49
00:01:40,680 --> 00:01:42,600
Why passwords aren't enough anymore?

50
00:01:42,600 --> 00:01:44,200
So why do we need this extra step?

51
00:01:44,200 --> 00:01:46,240
Because passwords get stolen every single day.

52
00:01:46,240 --> 00:01:48,920
Fishing attacks, data breaches, people reusing the same password

53
00:01:48,920 --> 00:01:52,600
across multiple sites, your password could be compromised right now

54
00:01:52,600 --> 00:01:53,600
and you would not even know it.

55
00:01:53,600 --> 00:01:54,880
And you might be thinking, well, that's fine.

56
00:01:54,880 --> 00:01:57,520
We have multi-factor authentication that protects us.

57
00:01:57,520 --> 00:01:59,200
And you are right, MFA does help a lot.

58
00:01:59,200 --> 00:02:00,680
But it is not a silver bullet.

59
00:02:00,680 --> 00:02:03,960
Imagine a hacker gets hold of one of your employees passwords.

60
00:02:03,960 --> 00:02:07,200
They try to sign in from a country you have never done business with.

61
00:02:07,200 --> 00:02:09,240
Using a device you have never seen before.

62
00:02:09,240 --> 00:02:11,720
MFA might stop them if it triggers a prompt.

63
00:02:11,720 --> 00:02:14,760
But what if the hacker also has access to that employee's phone?

64
00:02:14,760 --> 00:02:18,160
Or what if they are using a fishing attack that captures the MFA code too?

65
00:02:18,160 --> 00:02:20,520
Suddenly, MFA alone does not look so bulletproof.

66
00:02:20,520 --> 00:02:22,120
Here's a real-world example.

67
00:02:22,120 --> 00:02:24,480
A salesperson's credentials leak on the dark web.

68
00:02:24,480 --> 00:02:28,560
Without conditional access, an attacker can sign in from anywhere in the world.

69
00:02:28,560 --> 00:02:31,760
They can access email files, customer data, everything.

70
00:02:31,760 --> 00:02:33,560
And you would never know until it is too late.

71
00:02:33,560 --> 00:02:35,000
The old way was all or nothing.

72
00:02:35,000 --> 00:02:39,480
You gave a user a license and they could sign in from any device, any location, any network.

73
00:02:39,480 --> 00:02:43,200
No context, no intelligence, just a password check and then full access.

74
00:02:43,200 --> 00:02:45,120
Conditional access changes that completely.

75
00:02:45,120 --> 00:02:47,040
It adds context to every sign in.

76
00:02:47,040 --> 00:02:51,200
It looks at where you are, what device you are using, what app you are trying to open,

77
00:02:51,200 --> 00:02:54,040
how risky the sign in looks based on Microsoft's analysis.

78
00:02:54,040 --> 00:02:57,600
It turns a flat yes or no decision into a smart, layered judgment.

79
00:02:57,600 --> 00:03:00,480
The signals, what conditional access looks at?

80
00:03:00,480 --> 00:03:02,600
So what exactly does conditional access check?

81
00:03:02,600 --> 00:03:05,640
Let's break it down into the signals it uses to make its decision.

82
00:03:05,640 --> 00:03:07,400
Identity is the first signal.

83
00:03:07,400 --> 00:03:08,400
Who are you?

84
00:03:08,400 --> 00:03:12,160
Are you a regular employee, an admin with elevated privileges, or a guest from outside

85
00:03:12,160 --> 00:03:13,160
the company?

86
00:03:13,160 --> 00:03:16,960
Conditional access looks at your user account and what groups you belong to.

87
00:03:16,960 --> 00:03:20,600
An admin trying to sign in might face stricter rules than a standard user.

88
00:03:20,600 --> 00:03:23,320
A guest might be blocked from certain apps entirely.

89
00:03:23,320 --> 00:03:26,320
Your identity determines the baseline of what is allowed.

90
00:03:26,320 --> 00:03:27,320
Location is next.

91
00:03:27,320 --> 00:03:28,400
Where is this sign in coming from?

92
00:03:28,400 --> 00:03:32,080
If you are connecting from the office network, that is a trusted location.

93
00:03:32,080 --> 00:03:35,400
Conditional access knows the IP range of your company headquarters.

94
00:03:35,400 --> 00:03:38,600
Signing in from a coffee shop in another country raises a flag.

95
00:03:38,600 --> 00:03:42,160
If the system cannot even figure out where you are, that is another flag.

96
00:03:42,160 --> 00:03:44,800
Location is a powerful signal because it is hard to fake.

97
00:03:44,800 --> 00:03:45,880
Device also matters.

98
00:03:45,880 --> 00:03:47,120
What are you using to sign in?

99
00:03:47,120 --> 00:03:50,920
A company laptop managed by Intune and compliant with your security policies?

100
00:03:50,920 --> 00:03:54,040
Or a personal phone with no security controls at all?

101
00:03:54,040 --> 00:03:58,080
Conditional access can check whether the device is enrolled in management, has encryption enabled

102
00:03:58,080 --> 00:04:00,000
and is up to date on security patches.

103
00:04:00,000 --> 00:04:02,400
An unmanaged device might get blocked or limited.

104
00:04:02,400 --> 00:04:03,800
The application matters too.

105
00:04:03,800 --> 00:04:05,560
What app are you trying to reach?

106
00:04:05,560 --> 00:04:09,000
Outlook, SharePoint, Teams, a custom business application?

107
00:04:09,000 --> 00:04:11,280
Not all apps have the same security requirements.

108
00:04:11,280 --> 00:04:16,480
A finance system handling sensitive data might require stricter controls than a team collaboration

109
00:04:16,480 --> 00:04:17,480
space.

110
00:04:17,480 --> 00:04:20,440
Conditional access lets you set different rules for different apps.

111
00:04:20,440 --> 00:04:22,600
If you have the right license, there is another layer.

112
00:04:22,600 --> 00:04:23,600
Sign in risk.

113
00:04:23,600 --> 00:04:26,720
Microsoft uses machine learning to score every sign in in real time.

114
00:04:26,720 --> 00:04:28,600
It looks for suspicious patterns.

115
00:04:28,600 --> 00:04:29,600
Impossible travel.

116
00:04:29,600 --> 00:04:33,480
Where a user signs in from New York and then five minutes later from London.

117
00:04:33,480 --> 00:04:34,560
Anonymous IP addresses.

118
00:04:34,560 --> 00:04:36,560
Leaked credentials from known data breaches.

119
00:04:36,560 --> 00:04:40,560
The system assigns a risk level, low, medium or high, and conditional access can act on

120
00:04:40,560 --> 00:04:41,560
that.

121
00:04:41,560 --> 00:04:42,560
There is also user risk.

122
00:04:42,560 --> 00:04:43,880
This is different from sign in risk.

123
00:04:43,880 --> 00:04:45,680
User risk looks at the account itself.

124
00:04:45,680 --> 00:04:47,640
Has this user's password appeared in a breach?

125
00:04:47,640 --> 00:04:49,840
Has there been unusual activity over time?

126
00:04:49,840 --> 00:04:53,680
If the system detects that an account might be compromised, it can block access until

127
00:04:53,680 --> 00:04:55,400
the user resets their password.

128
00:04:55,400 --> 00:04:57,320
Finally, there is authentication context.

129
00:04:57,320 --> 00:05:01,080
This lets you attach extra security requirements to specific sensitive content.

130
00:05:01,080 --> 00:05:05,360
For example, anyone trying to access the finance SharePoint site must use a compliant device

131
00:05:05,360 --> 00:05:07,480
and a phishing-resistant MFA method.

132
00:05:07,480 --> 00:05:11,600
It protects your most valuable data without slowing down everything else.

133
00:05:11,600 --> 00:05:15,120
Once these signals are collected, the policy engine decides what to do.

134
00:05:15,120 --> 00:05:16,480
Let's see how that works.

135
00:05:16,480 --> 00:05:17,720
The decision engine.

136
00:05:17,720 --> 00:05:19,080
How policies work.

137
00:05:19,080 --> 00:05:22,040
The conditional access policy works like an if/then rule.

138
00:05:22,040 --> 00:05:25,320
You pick the signals as conditions, then decide what action to take.

139
00:05:25,320 --> 00:05:26,480
That's really all it is.

140
00:05:26,480 --> 00:05:28,360
So there are three main parts to a policy.

141
00:05:28,360 --> 00:05:31,920
The first part is assignments, who the policy applies to, which app they're trying to

142
00:05:31,920 --> 00:05:34,160
reach and what conditions trigger the rule.

143
00:05:34,160 --> 00:05:35,960
The second part is access controls.

144
00:05:35,960 --> 00:05:37,880
What happens when those conditions are met?

145
00:05:37,880 --> 00:05:43,000
Do you grant access, block it, or require something like MFA or a compliant device?

146
00:05:43,000 --> 00:05:46,560
The third part is session controls, and those manage what happens after someone is signed

147
00:05:46,560 --> 00:05:47,560
in.

148
00:05:47,560 --> 00:05:49,640
How often they need to reauthenticate.

149
00:05:49,640 --> 00:05:51,160
Let me give you a concrete example.

150
00:05:51,160 --> 00:05:55,640
If a user is in the sales group and is trying to access SharePoint from an unmanaged device,

151
00:05:55,640 --> 00:05:56,640
then block access.

152
00:05:56,640 --> 00:05:57,960
That's a complete policy right there.

153
00:05:57,960 --> 00:05:58,960
Who?

154
00:05:58,960 --> 00:05:59,960
What app?

155
00:05:59,960 --> 00:06:00,960
What condition?

156
00:06:00,960 --> 00:06:01,960
What action?

157
00:06:01,960 --> 00:06:02,960
Grant controls are flexible.

158
00:06:02,960 --> 00:06:03,960
You can require multiple things at once.

159
00:06:03,960 --> 00:06:07,240
Say you want a user to complete MFA and also use a compliant device.

160
00:06:07,240 --> 00:06:08,680
Both conditions must be met.

161
00:06:08,680 --> 00:06:10,440
Or you could say they need one or the other.

162
00:06:10,440 --> 00:06:11,760
The system lets you choose.

163
00:06:11,760 --> 00:06:13,320
Now block is the most powerful control.

164
00:06:13,320 --> 00:06:16,440
If any policy says block, block wins, there are no exceptions.

165
00:06:16,440 --> 00:06:18,440
For exclusions you explicitly said.

166
00:06:18,440 --> 00:06:22,800
That's why you need to be careful, one mistake, and you could lock out your entire organization.

167
00:06:22,800 --> 00:06:26,920
Before you turn a policy on, there's a critical feature you need to know about.

168
00:06:26,920 --> 00:06:28,240
Report only mode.

169
00:06:28,240 --> 00:06:31,640
This lets you see what a policy would do before it actually enforces anything.

170
00:06:31,640 --> 00:06:35,400
You can run a policy and report only for a week, check the sign-in logs, and see how many

171
00:06:35,400 --> 00:06:37,760
users would have been blocked or prompted for MFA.

172
00:06:37,760 --> 00:06:40,280
It's a safe way to test without breaking anything.

173
00:06:40,280 --> 00:06:43,600
Now that you understand the engine, let's talk about the most common policies every

174
00:06:43,600 --> 00:06:45,240
business should have.

175
00:06:45,240 --> 00:06:47,960
The big three, baseline policies for day one.

176
00:06:47,960 --> 00:06:50,000
So what should you actually set up first?

177
00:06:50,000 --> 00:06:53,960
Let me give you the three baseline policies that every business should have from day one.

178
00:06:53,960 --> 00:06:56,800
Not day 30, and not after an audit.

179
00:06:56,800 --> 00:06:58,760
Policy number one is the foundation.

180
00:06:58,760 --> 00:07:01,080
Require MFA for all users.

181
00:07:01,080 --> 00:07:02,400
Not just admins everyone.

182
00:07:02,400 --> 00:07:05,920
Every single person who signs into your tenant needs to prove who they are with a second

183
00:07:05,920 --> 00:07:06,920
factor.

184
00:07:06,920 --> 00:07:09,600
But here's the important part, not all MFA is created equal.

185
00:07:09,600 --> 00:07:12,120
You don't want people using SMS codes or voice calls.

186
00:07:12,120 --> 00:07:13,200
Those methods are weak.

187
00:07:13,200 --> 00:07:16,440
They can be intercepted, what you want is something stronger.

188
00:07:16,440 --> 00:07:20,400
Microsoft has something called authentication strengths that lets you pick exactly which

189
00:07:20,400 --> 00:07:21,640
methods are acceptable.

190
00:07:21,640 --> 00:07:26,880
The Microsoft Authenticator app, FIDO2 Security Keys, Windows Hello for Business, those are

191
00:07:26,880 --> 00:07:27,880
the good ones.

192
00:07:27,880 --> 00:07:32,560
So when you create your MFA policy, don't just check the box that says, "Require MFA,

193
00:07:32,560 --> 00:07:33,560
be specific."

194
00:07:33,560 --> 00:07:35,640
Choose the strong methods only.

195
00:07:35,640 --> 00:07:36,640
Policy number two.

196
00:07:36,640 --> 00:07:38,120
Block legacy authentication.

197
00:07:38,120 --> 00:07:39,720
This one sounds technical, but it's simple.

198
00:07:39,720 --> 00:07:43,160
There are old protocols that Microsoft 365 still supports.

199
00:07:43,160 --> 00:07:46,920
I'm app, SMTP, older versions of exchange active sync.

200
00:07:46,920 --> 00:07:50,760
These protocols were built before anyone thought about multi-factor authentication and

201
00:07:50,760 --> 00:07:51,760
they don't support it.

202
00:07:51,760 --> 00:07:55,760
So if an attacker gets a password, they can use one of these old protocols to sign in

203
00:07:55,760 --> 00:07:57,320
and completely bypass your MFA.

204
00:07:57,320 --> 00:07:58,320
That's a huge gap.

205
00:07:58,320 --> 00:07:59,720
The fix is straightforward.

206
00:07:59,720 --> 00:08:04,120
Create a conditional access policy that blocks all legacy authentication for all users.

207
00:08:04,120 --> 00:08:08,920
Unless you have a very specific business need for an old scanner or printer that uses SMTP,

208
00:08:08,920 --> 00:08:09,920
turn it off.

209
00:08:09,920 --> 00:08:12,920
It's one of the highest impact security controls you can enable.

210
00:08:12,920 --> 00:08:16,160
Machine number three, require compliant devices for admins.

211
00:08:16,160 --> 00:08:18,280
Admin accounts are the crown jewels of your tenant.

212
00:08:18,280 --> 00:08:22,280
If someone compromises a global admin account, they own everything, so you need to lock those

213
00:08:22,280 --> 00:08:24,560
accounts down harder than anyone else.

214
00:08:24,560 --> 00:08:28,840
This policy says that anyone with an admin role must use a company-owned device that meets

215
00:08:28,840 --> 00:08:33,720
your security requirements, enrolled in management, encryption enabled like Bitlocker, Defender

216
00:08:33,720 --> 00:08:36,000
running, and up-to-date on patches.

217
00:08:36,000 --> 00:08:39,800
If an admin tries to sign in from a personal laptop or an old machine that doesn't meet

218
00:08:39,800 --> 00:08:41,960
those standards, access is blocked.

219
00:08:41,960 --> 00:08:46,160
It's a simple way to make sure your most powerful accounts are also your most protected.

220
00:08:46,160 --> 00:08:49,080
Before I move on, I need to talk about something critical.

221
00:08:49,080 --> 00:08:50,320
Break-glass accounts.

222
00:08:50,320 --> 00:08:54,400
These are emergency admin accounts that you keep outside of your conditional access policies.

223
00:08:54,400 --> 00:08:55,640
You create at least two of them.

224
00:08:55,640 --> 00:09:00,400
They use long, complex passwords and phishing-resistant MFA like a FIDO-2 security key.

225
00:09:00,400 --> 00:09:04,200
You store the credentials securely, maybe in a safe or a locked cabinet.

226
00:09:04,200 --> 00:09:05,480
The purpose is simple.

227
00:09:05,480 --> 00:09:08,880
If you accidentally lock yourself out of your tenant with a bad policy, you can use a

228
00:09:08,880 --> 00:09:10,880
break-glass account to get back in.

229
00:09:10,880 --> 00:09:13,360
They are excluded from every conditional access policy.

230
00:09:13,360 --> 00:09:14,360
That's by design.

231
00:09:14,360 --> 00:09:17,480
Without them, you risk being locked out of your own system with no way back in.

232
00:09:17,480 --> 00:09:19,040
Why only three policies for day one?

233
00:09:19,040 --> 00:09:21,760
Because you want to focus on the highest impact controls first.

234
00:09:21,760 --> 00:09:23,640
These three close the biggest security gaps.

235
00:09:23,640 --> 00:09:27,920
MFA stops most credential theft, blocking legacy outs closes the back door.

236
00:09:27,920 --> 00:09:30,840
Compliant devices for admins protects your most sensitive accounts.

237
00:09:30,840 --> 00:09:34,560
You can fine tune later with more granular policies, but start here.

238
00:09:34,560 --> 00:09:35,560
Advanced policies.

239
00:09:35,560 --> 00:09:36,960
Risk and Personas.

240
00:09:36,960 --> 00:09:39,800
Since the basics are in place, you can add more advanced controls.

241
00:09:39,800 --> 00:09:42,720
That's where risk-based policies and Persona-based rules come in.

242
00:09:42,720 --> 00:09:46,600
Sign-in-risk policies use Microsoft's machine learning to watch every login attempt in real

243
00:09:46,600 --> 00:09:47,600
time.

244
00:09:47,600 --> 00:09:51,720
If someone tries to sign in from an anonymous IP address, or the system detects impossible

245
00:09:51,720 --> 00:09:56,000
travel, like a login from New York, and then tow-cure 10 minutes later, it scores that

246
00:09:56,000 --> 00:09:57,520
sign in as high risk.

247
00:09:57,520 --> 00:10:01,480
From there, you set a policy that says if the risk is high, block access, or force MFA

248
00:10:01,480 --> 00:10:02,480
immediately.

249
00:10:02,480 --> 00:10:06,080
The catch is you need an Entra IDP-2 license, but this is one of the most powerful controls

250
00:10:06,080 --> 00:10:09,160
you can add because it catches attacks that static rules miss.

251
00:10:09,160 --> 00:10:13,320
User-risk policies look at the account itself over time, not just one sign-in event.

252
00:10:13,320 --> 00:10:17,040
If Microsoft detects that a user's credentials have appeared in a known data breach, it marks

253
00:10:17,040 --> 00:10:18,160
that user as high risk.

254
00:10:18,160 --> 00:10:21,680
You can then set a policy that blocks access until they reset their password.

255
00:10:21,680 --> 00:10:23,200
And yes, that also needs P2.

256
00:10:23,200 --> 00:10:27,560
Together sign-in-risk and user-risk policies create a dynamic security layer that adapts

257
00:10:27,560 --> 00:10:28,880
to threats as they happen.

258
00:10:28,880 --> 00:10:31,640
Now, Persona-based policies address a different problem.

259
00:10:31,640 --> 00:10:34,440
Not everyone in your organization has the same security needs.

260
00:10:34,440 --> 00:10:37,720
Your admins need the strictest rules, while contractors and temporary staff might need

261
00:10:37,720 --> 00:10:39,040
limited access.

262
00:10:39,040 --> 00:10:43,040
And guests from outside your company need different controls entirely.

263
00:10:43,040 --> 00:10:46,560
Persona-based policies let you group users by role and apply the right level of protection.

264
00:10:46,560 --> 00:10:48,440
Here's a concrete example.

265
00:10:48,440 --> 00:10:51,960
Contractors often use their own devices that you don't manage, so you have no idea if they're

266
00:10:51,960 --> 00:10:54,560
running antivirus or keeping up with patches.

267
00:10:54,560 --> 00:10:57,880
Instead of giving them full access, you create a policy that limits them to browser only

268
00:10:57,880 --> 00:11:02,320
access, no desktop apps, no mobile apps, and even within the browser you restrict actions

269
00:11:02,320 --> 00:11:06,520
they can view and edit files but can't download or sync them to their own device.

270
00:11:06,520 --> 00:11:12,240
That way, contractors stay productive without exposing your data to unnecessary risk.

271
00:11:12,240 --> 00:11:16,560
Authentication contexts take this idea further by protecting specific content within an app

272
00:11:16,560 --> 00:11:17,960
instead of the whole app.

273
00:11:17,960 --> 00:11:21,720
For instance, your finance team has a sharepoint site with sensitive financial data.

274
00:11:21,720 --> 00:11:25,480
You can attach an authentication context to that site, so anyone who tries to access it

275
00:11:25,480 --> 00:11:30,440
must use a compliant device and phishing-resistant MFA, even if they're already signed into Microsoft

276
00:11:30,440 --> 00:11:31,440
365.

277
00:11:31,440 --> 00:11:34,560
It's precision targeting for your most sensitive information.

278
00:11:34,560 --> 00:11:38,320
Continuous access evaluation revokes access in near real time when something changes.

279
00:11:38,320 --> 00:11:42,960
If an admin disables an account or a device gets reported lost, the session ends immediately

280
00:11:42,960 --> 00:11:45,040
without waiting for the token to expire.

281
00:11:45,040 --> 00:11:47,440
That's critical for responding to incidents quickly.

282
00:11:47,440 --> 00:11:51,720
All of this sounds powerful, but how do you actually get started without breaking things?

283
00:11:51,720 --> 00:11:52,720
Getting started.

284
00:11:52,720 --> 00:11:55,040
From security defaults to custom policies.

285
00:11:55,040 --> 00:11:58,640
If you have a brand new tenant, you're not starting from zero because Microsoft enables

286
00:11:58,640 --> 00:12:02,280
something called security defaults by default.

287
00:12:02,280 --> 00:12:07,480
It's a basic set of protections that requires MFA for admins and blocks legacy authentication.

288
00:12:07,480 --> 00:12:10,000
It's a decent starting point, but it's limited.

289
00:12:10,000 --> 00:12:13,200
You can't customize it or target specific apps or users.

290
00:12:13,200 --> 00:12:15,360
It's a one-size-fits-all solution.

291
00:12:15,360 --> 00:12:20,520
The moment you create your first custom conditional access policy, security defaults automatically

292
00:12:20,520 --> 00:12:22,440
turn off, putting you in control.

293
00:12:22,440 --> 00:12:25,320
That's a good thing, but it also means you need to know what you're doing because you

294
00:12:25,320 --> 00:12:27,200
can't rely on the training wheels anymore.

295
00:12:27,200 --> 00:12:28,680
So here's how to do it safely.

296
00:12:28,680 --> 00:12:33,320
First, start with report-only mode for every new policy and let it run for at least a week.

297
00:12:33,320 --> 00:12:36,440
Then go into the sign-in logs and see what would have happened like how many users would

298
00:12:36,440 --> 00:12:38,760
have been blocked or prompted for MFA.

299
00:12:38,760 --> 00:12:42,920
That data tells you if your policy is too strict or too loose before you enforce it.

300
00:12:42,920 --> 00:12:46,800
Second, use the "what if" tool in the Entra Admin Center to test the policy against a

301
00:12:46,800 --> 00:12:50,000
specific user, app and location before turning it on.

302
00:12:50,000 --> 00:12:53,400
You can simulate exactly what would happen if someone tried to sign in from a coffee shop

303
00:12:53,400 --> 00:12:55,720
in another country using a personal device.

304
00:12:55,720 --> 00:12:58,800
It's a safe way to catch problems before they become real.

305
00:12:58,800 --> 00:13:00,920
Third, and this is critical.

306
00:13:00,920 --> 00:13:03,480
Create your break-glass accounts before you deploy any policies.

307
00:13:03,480 --> 00:13:07,800
I cannot stress this enough if you accidentally create a policy that blocks all admins and

308
00:13:07,800 --> 00:13:11,680
you haven't set up an emergency account that's excluded from everything you lock yourself

309
00:13:11,680 --> 00:13:13,040
out of your own tenant.

310
00:13:13,040 --> 00:13:17,400
The only way back in is to call Microsoft Support and prove you own the domain which can take

311
00:13:17,400 --> 00:13:18,400
days.

312
00:13:18,400 --> 00:13:22,720
So set up two break-glass accounts stored securely with phishing-resistant MFA.

313
00:13:22,720 --> 00:13:24,200
Do it before you start.

314
00:13:24,200 --> 00:13:26,480
Deploy in phases.

315
00:13:26,480 --> 00:13:29,440
Don't turn on a policy for everyone on day one.

316
00:13:29,440 --> 00:13:33,360
Start with a small test group, maybe the IT team and let it run for a few days.

317
00:13:33,360 --> 00:13:36,080
Check the logs to see if anyone got blocked unexpectedly.

318
00:13:36,080 --> 00:13:38,960
Then expand to a larger group and finally to all users.

319
00:13:38,960 --> 00:13:42,800
Each phase gives you a chance to catch issues before they affect the whole company.

320
00:13:42,800 --> 00:13:46,480
Monitor the sign-in logs throughout and if you see unexpected blocks adjust the policy

321
00:13:46,480 --> 00:13:48,640
before moving to the next phase.

322
00:13:48,640 --> 00:13:49,640
Recap.

323
00:13:49,640 --> 00:13:51,120
Why this matters for your business?

324
00:13:51,120 --> 00:13:53,000
So why does all of this matter?

325
00:13:53,000 --> 00:13:56,000
Global access is the bouncer at the door that doesn't just check your ID.

326
00:13:56,000 --> 00:13:57,240
It looks at everything.

327
00:13:57,240 --> 00:14:01,120
Who you are, where you're connecting from, what device you're using and whether your account

328
00:14:01,120 --> 00:14:02,960
looks like it's been compromised.

329
00:14:02,960 --> 00:14:07,800
It turns a simple yes or no password check into a smart decision based on the whole picture.

330
00:14:07,800 --> 00:14:11,320
Without it, anyone with a stolen password can walk right into your tenant from anywhere

331
00:14:11,320 --> 00:14:12,320
in the world.

332
00:14:12,320 --> 00:14:15,680
No questions asked and when you think about how many passwords get stolen every single

333
00:14:15,680 --> 00:14:17,400
day, that's a scary thought.

334
00:14:17,400 --> 00:14:20,400
The three baseline policies alone close the biggest gaps.

335
00:14:20,400 --> 00:14:22,680
MFA stops most credential theft-called.

336
00:14:22,680 --> 00:14:26,400
Locking legacy authentication closes a backdoor attackers love.

337
00:14:26,400 --> 00:14:30,080
Requiring compliant devices for admins protects your most sensitive accounts.

338
00:14:30,080 --> 00:14:33,760
Just those three policies raise your security floor dramatically and when you're ready

339
00:14:33,760 --> 00:14:38,680
to take it further, advance policies give you precise protection without killing productivity.

340
00:14:38,680 --> 00:14:41,520
Risk-based controls catch attacks in real time.

341
00:14:41,520 --> 00:14:44,600
Persona-based rules treat different users differently.

342
00:14:44,600 --> 00:14:48,200
Authentication contexts protect your most sensitive data with surgical accuracy.

343
00:14:48,200 --> 00:14:50,520
You can be both secure and flexible.

344
00:14:50,520 --> 00:14:53,440
So here's your homework, log into your Entra Admin Center.

345
00:14:53,440 --> 00:14:54,880
Go to conditional access.

346
00:14:54,880 --> 00:14:57,840
Check if you have at least those three baseline policies in place.

347
00:14:57,840 --> 00:15:00,600
If you don't, start with report only mode and build from there.

348
00:15:00,600 --> 00:15:03,040
Don't wait for an audit or a breach to take action.

349
00:15:03,040 --> 00:15:07,400
If this episode helped you see the big picture, subscribe to Microsoft Knowledge Nuggets for

350
00:15:07,400 --> 00:15:10,680
more plain English explanations of security and identity.

351
00:15:10,680 --> 00:15:13,920
And share it with someone who's just starting their Microsoft 365 journey.