Securing access to company resources is more critical than ever. Conditional Access (CA) policies are one of the best ways to ensure that only the right users and devices can access your applications and data.
In this short guide, we’ll walk you through the steps to create a Conditional Access Baseline in Microsoft Entra (Azure AD), covering key decisions like which users and resources to target, the networks to consider, and how to test your policy before enabling it.
What policies do I need to define?
Daniel Chronlund (TrueSec) has put together an excel list of a one-size-fits-most rules:
Can be downloaded from this page (Section “Option 1: Manual Deployment”)
Prerequisites
Before creating any Conditional Access policies, you need to ensure the following:
- You have an admin account with at least Conditional Access Admin privileges.
- Access to Microsoft Entra Admin Center (formerly Azure AD).
Create a conditional access baseline
Go to Protection / Conditional Access in MS Entra Admin Center.
1. Press “Create New Policy“.
2. Enter Name for the policy.
3. Select scope of assignments.
Typically, for a general End User CA Policy, you want to Include All Users.
Also, you may want to have an Entra ID Group called “Excluded from Conditional Access” or similar and add it as an exclusion to all CA policies.
4. Select Target Resources.
Typically, for a general End User CA Policy, you may want to include All Cloud Apps.
5. Specify Target Networks.
Using this option you may create CA policies based on physical location.
6. Next you may define Conditions that would apply to this policy.
7. Define if this policy is supposed to Block or Grant access.Specify controls for Grant access.
8. Session Controls – can be defined for more granular policies.
⚠️Warning: Client Access policies can cause serious problems if defined incorrectly.
You will see several warnings during creation of a CA Policy.
Be sure that you know what you do and make a habit of testing a new policy before enabling it!
References
Microsoft Learn: Create a conditional access policy
Microsoft Learn: Building a conditional access policy
Conclusion
By creating well-defined Conditional Access policies, you can greatly improve the security of your cloud environment. Whether you’re just getting started or fine-tuning your setup, using these best practices will help you build policies that safeguard your organization without hindering productivity.
