MFA decided, but not everywhere
Legacy protocols, guests and individual accounts still sign in with a password only.
Conditional Access for Microsoft Entra ID
Conditional Access implementation without locking anyone out.
We implement Conditional Access in your tenant at a fixed price, with break glass accounts, a report-only phase and a pilot group before any policy applies to everyone. The result: MFA at every sign-in, and the evidence your auditors ask for.
- For
- Companies with 50 or more employees on Microsoft 365
- Scope
- Break glass accounts, MFA, policy baseline, pilot and activation
- Duration
- 3 to 6 weeks, including at least 2 weeks in report-only mode
- Result
- Active policies, documented exceptions, evidence for auditors
- Price
- from €4,900 excl. VAT, fixed price after scoping
Sound familiar?
Why does Conditional Access so often stall?
The worry of locking everyone out
A badly scoped policy can hit administrators too. So the project keeps slipping.
Auditors or insurers are asking
You need to show that every sign-in is protected, and you have nothing to show them.
Rollout
How do we roll out Conditional Access without lockouts?
Emergency exit first, then observe, then enforce. An example tenant, step by step.
Step 1 / 6
Which Conditional Access policies belong in the baseline?
The baseline follows established Conditional Access best practices, tailored to your licences and edge cases.
Block legacy authentication
Old protocols without MFA are blocked once scanners and interfaces have been moved over.
MFA for all users
At every sign-in; only the break glass accounts stay excluded.
Administrators
Phishing-resistant sign-in with passkeys, enforced through an authentication strength.
Guests and external accounts
MFA for guests too, instead of a blanket exclusion.
Devices
Where Intune is in use: access from compliant devices only.
Risk-based policies
A response to sign-in and user risk, where Entra ID P2 is licensed.
How does the project work?
-
30 minutes
Introductory call
Clarify the starting point, licences and edge cases.
-
Fixed price
Scoping and quote
Scope based on your tenant and edge cases; the price is fixed before we start.
-
3 to 6 weeks
Implementation
Inventory, break glass accounts, report-only, pilot and activation.
-
Documented
Handover
Policy documentation, exception list and evidence; ongoing review through managed security if you wish.
Where does your tenant stand on Conditional Access?
In 30 minutes we clarify licences, edge cases and scope, followed by a fixed-price quote.
What changes?
Today
- MFA only where it happens to be requested
- Legacy protocols bypass MFA
- No emergency exit if a policy misfires
- Exceptions without a reason
After the rollout
- MFA at every sign-in, guests included
- Legacy authentication blocked
- Two tested break glass accounts
- Exceptions with reason, owner and expiry date
Frequently asked questions
Which licence do I need for Conditional Access?
Microsoft Entra ID P1. It is included in Microsoft 365 Business Premium, E3 and E5, among others. Risk-based policies require Entra ID P2, which is included in Microsoft 365 E5, for example.
What is a break glass account?
An emergency access account: a cloud-only account with the Global Administrator role, used only in an emergency. We set up two, with FIDO2 security keys, excluded from every policy and with an alert on every sign-in.
What happens if someone is locked out anyway?
An admin signs in with a break glass account, switches the affected policy back to report-only and analyses the sign-in in the log. To keep this rare, every policy applies to a pilot group first.
We use security defaults. Is that enough for MFA?
Security defaults enforce MFA across the board, with no exceptions, no device conditions and no evidence per policy. The two cannot run side by side, so we switch on the same day the replacement policies take effect.
Who in your company still signs in with just a password?
Your sign-in logs know. In an introductory call we clarify what that means for your policies.