applicationpractical
How can I start designing my organization's baseline Conditional Access policies effectively?
Begin by identifying your organization's most critical assets, sensitive data, and privileged accounts. Prioritize policies that protect these first. Start with a foundational set, such as requiring MFA for administrators and for all users accessing sensitive cloud apps, and blocking access from untrusted locations. Always implement policies in 'Report-only' mode initially to monitor their impact and refine them based on logs and user feedback before enforcing them fully.
Action
Create a matrix of critical applications/data, user groups (e.g., Admins, All Users), and access scenarios (e.g., from corporate device, from personal device, from untrusted location). Use this to map out initial policy ideas.
Read the full exploration