A Conditional Access Baseline for Azure in 2026
The minimum viable Conditional Access policy set that stops 95% of identity attacks — with Entra ID configuration details.
RAZR Advisory
7 min read
The baseline
Every Entra ID tenant should ship with these five policies on day one:
- Block legacy authentication — no exceptions.
- Require MFA for all users — phishing-resistant where possible (FIDO2, Windows Hello).
- Require compliant device for admins — Intune-managed, encrypted, patched.
- Block sign-ins from unsupported countries — geo-fence by business need.
- Require MFA for risky sign-ins — driven by Identity Protection risk score.
Why phishing-resistant MFA matters
SMS and app-push MFA are bypassed daily by attacker-in-the-middle kits like Evilginx. FIDO2 security keys and passkeys are cryptographically bound to the origin — they cannot be phished.
Rollout playbook
- Start in report-only mode for 2 weeks
- Review sign-in logs for false positives
- Enable for pilot group
- Roll out tenant-wide with named-user exclusion for break-glass accounts