Conditional Access in Plain English: How to Control Where and How People Sign In to Microsoft 365

Your office has a front door. Microsoft 365 does not. Its sign-in page sits on the internet, reachable from any country, any device and any hour of the night, and for many businesses the only thing between a stranger and the company mailbox is a password.

Conditional Access is how you put a door back. It is a set of rules inside Microsoft 365 that decides, at the moment someone signs in, whether to let them through, ask for more proof, limit what they can do or turn them away.

So, to answer the question directly: yes, you can control where and how people sign in. Most businesses already own the tools to do it.

What Conditional Access actually does

Think of it as a series of if-then rules that run every time someone signs in. If the person is an administrator, then require extra verification. If the sign-in comes from a country where you have no staff, then block it. If someone is on a personal laptop you do not manage, then allow email in the browser but not file downloads.

Each rule looks at a few signals:

• Who is signing in, such as an executive, a contractor or an admin.
• Where the sign-in is coming from, based on location or network.
• What device they are using, and whether it is managed by the business.
• Which app they are trying to reach, such as Exchange, SharePoint or Teams.
• How risky the attempt looks, such as signs of a stolen password or an unusual pattern of behaviour.

Then it makes a decision. It can allow the sign-in, require multi-factor authentication, require a compliant device (one that meets your standards, such as being encrypted, up to date and managed through Intune), restrict the session, or block it outright.

The practical effect is that a correct password stops being the whole story. The sign-in also has to make sense.

The sign-in rules most businesses need

There is no universal policy set, but a handful of rules show up in almost every well-run Microsoft 365 environment.

Require MFA for everyone, and stronger protection for admins. This is the baseline. It also lines up with the Essential Eight, where multi-factor authentication is one of the eight mitigation strategies. Conditional Access is one of the better ways to enforce it consistently rather than leaving it to individual settings.

Block legacy authentication. Some older email protocols cannot prompt for MFA at all, which makes them a convenient side door for attackers who already have a password. If nothing in your business needs them, blocking them closes that door.

Require a managed device for sensitive data. A company laptop that is encrypted and patched is a different proposition from an unknown machine in an internet cafe. You can let both in, but not to the same extent.

Restrict by location. If your business operates in Australia and New Zealand, there is rarely a reason for a sign-in from somewhere you have no staff or customers. One honest caveat: location is a signal, not a wall. Someone using a VPN can appear to be in another country, so this works best alongside the other rules rather than instead of them.

Apply higher scrutiny to risky sign-ins. Risk-based policies react to signals such as leaked credentials or impossible travel. These need a higher licence tier, covered below.

Set clear terms for guests and contractors. External users rarely need the access your own staff have, and a separate rule keeps it that way.

What we have noticed

Most of the problems we see are not missing policies. They are policies that were built once and never looked at again.

An exclusion gets added for one person on one awkward day, and three years later it is still there. A location rule that made sense before a manager started travelling now generates a support ticket every time they land somewhere new. And the classic way to lock a whole business out of Microsoft 365 is a well-meaning policy applied to everyone, including the one admin account needed to fix it.

Two habits prevent most of this. First, keep at least two emergency access accounts that are excluded from the rules and monitored closely, so a mistake can always be undone. Second, use report-only mode, which lets a new policy log what it would have done without actually enforcing it. Reading those logs for a week or two before switching a rule on is dull work, and it is exactly the kind of dull work that prevents a Monday morning with 200 people locked out.

Security that staff find unbearable does not stay in place for long. The best policy set is one people barely notice on a normal day.

Do you already own it?

Possibly. Conditional Access is part of Microsoft Entra ID P1, which is included in Microsoft 365 Business Premium and in the E3 and E5 plans. Risk-based policies need Entra ID P2, which comes with E5. Microsoft 365 Business Basic and Standard do not include Conditional Access. They rely instead on security defaults, a free baseline that turns on MFA but offers no control over location, device or app.

Licensing changes from time to time, so confirm against your own tenant and Microsoft’s current documentation. A surprising number of businesses are paying for the capability and not using it.

Where Affinity MSP fits in

We treat Conditional Access as something to be designed around how a business actually works, not a template applied to every tenant. That means mapping who signs in from where and on what, building the policy set around it, running each rule in report-only mode first, and then reviewing sign-in logs on an ongoing basis so the rules keep pace with the business. It sits alongside the rest of the identity and Microsoft 365 security work in our Managed IT Services and our approach to the Essential Eight.

If you are not sure what your tenant is currently enforcing, that is a reasonable place to start. Get in touch and we can walk through it with you.

Frequently asked questions

What is Conditional Access in Microsoft 365?
It is a feature in Microsoft Entra ID that lets a business set rules for sign-ins. The rules consider who is signing in, from where, on which device and to which app, then allow, restrict, challenge or block the attempt.

Do I need Conditional Access if I already have MFA?
MFA is one of the things Conditional Access can enforce, but it is only one rule. Conditional Access also lets you apply different requirements depending on the device, location and risk, and block sign-in methods that bypass MFA entirely.

Which Microsoft 365 licences include Conditional Access?
It requires Microsoft Entra ID P1, included in Microsoft 365 Business Premium, E3 and E5. Risk-based policies need Entra ID P2. Check your own licensing, as Microsoft updates its plans.

Can Conditional Access block sign-ins from overseas?
Yes, you can block or restrict sign-ins from specific countries. Because a VPN can disguise location, it works best as one layer among several.

Will Conditional Access slow my staff down?
Done well, rarely. Most staff see an extra prompt when something is unusual, such as a new device, and nothing otherwise. Poorly tuned policies are the ones that cause friction, which is why testing in report-only mode first matters.

How does Affinity MSP help with Conditional Access?
We assess what your Microsoft 365 tenant currently enforces, design a policy set around your people, devices and locations, test it in report-only mode before enforcing it, and review sign-in activity regularly so the rules stay accurate as the business changes.