If you run your business on Microsoft 365, you have already made one of the better security decisions available to a small team. The feature most businesses never switch on is the one that decides the circumstances in which people are allowed to sign in at all. In Microsoft 365 that control is called Conditional Access, and it is one of the quiet workhorses behind modern account security.
The idea is simple. Instead of treating every sign-in the same way, Conditional Access looks at the situation around each attempt and then decides what to do: let the person straight in, ask them for a second proof such as a code or a tap on their phone, or block the attempt outright. It is how larger organisations enforce good habits without pestering staff on every login. The good news for small business is that you may already be paying for it, and even if you are not, Microsoft gives you a free baseline that covers the essentials.
What Conditional Access actually does
Think of Conditional Access as a doorperson who checks the situation rather than just the key. A key alone proves someone has a password. The doorperson also notices who is holding it, what device they arrived on, where they are standing, and whether anything about the attempt looks out of the ordinary.
In practice, a policy is built from two halves. The first half is the set of signals it reacts to: which user or group is signing in, which app they are reaching for, whether the device is known and managed, the location of the request, and Microsoft’s own read on how risky the sign-in looks. The second half is the action it takes when those signals match: grant access, grant access only after multi-factor authentication, require a managed or compliant device, or block the sign-in. You line up the conditions on one side and the response on the other, and Microsoft applies the rule every time someone logs in.
Security defaults or Conditional Access: which one you have
Most small businesses are already protected by something called security defaults, whether they realise it or not. Security defaults is a single on or off switch that Microsoft enables automatically for tenants created in recent years. When it is on, it requires multi-factor authentication for everyone, prompts for an extra check during administrative activities and higher-risk sign-ins, and blocks older sign-in methods that attackers love. It is free, it is available on every plan, and for a business just getting its house in order it is a sensible place to start.
The trade-off is that security defaults is deliberately simple. You cannot fine-tune it, you cannot carve out exceptions, and you cannot say “require a second check only when someone signs in from an unknown device”. Conditional Access is the grown-up version of the same idea. It gives you the dials that security defaults hides, so you can tighten the rules where risk is high and ease them where staff are working normally. You run one approach or the other, not both at once: turning on Conditional Access means turning security defaults off.
This staged path matches the advice the Australian Cyber Security Centre gives in its small business cloud security guidance. The ACSC points businesses to security defaults first as a way to get multi-factor authentication switched on across the tenancy with the least disruption, then suggests moving to your own Conditional Access policies once you have gained confidence operating the system. There is no prize for jumping straight to the complex option before you are ready for it.
The licence question: what you need to turn it on
Conditional Access is not part of every Microsoft 365 plan. It is a feature of Microsoft Entra ID P1, the identity layer that sits underneath Microsoft 365. The practical point for small business is this: Entra ID P1 is included in Microsoft 365 Business Premium. If Business Premium is your plan, Conditional Access is already sitting in your account waiting to be configured.
If you are on a lighter plan such as Business Basic or Business Standard, Conditional Access is not listed as included, so security defaults is your tool until you upgrade. That is not a failure, and a smaller business can run securely on security defaults for a long time. It simply means the granular policies below are a reason to consider Business Premium rather than a box you already own.
There is also a more advanced tier worth knowing about. Risk-based Conditional Access, which reacts automatically to Microsoft’s live scoring of how dangerous a sign-in looks, needs Microsoft Entra ID P2. That comes with larger enterprise plans or as an add-on, and most small businesses will not need it on day one. One last detail: if the licence that powers your policies lapses, Microsoft does not quietly delete your rules, but you lose the ability to edit them, so keep your subscription current if you depend on them.
Policies worth setting up first
You do not need dozens of rules. A handful of clear policies covers the risks that matter most to a small team. These are the ones worth putting in place before anything clever:
- Require multi-factor authentication for every user, so a stolen password alone is never enough to get in.
- Apply the strictest rules to accounts with administrator roles, since those are the keys to the whole tenancy and the first thing an attacker goes looking for.
- Block legacy authentication, the older sign-in methods that cannot carry a second factor and are a common way around multi-factor authentication.
- Challenge or block sign-ins from countries where your business has no staff and no reason to be logging in.
- Require a managed or compliant device before granting access to your most sensitive apps and data.
- Ask people to re-prove who they are more often when they are working from an unmanaged or personal device.
Pay particular attention to the admin accounts. Attackers do not need to compromise everyone; they need one person with the power to change settings. Tightening the rules around privileged accounts, and keeping the number of administrators small in the first place, gives you the biggest return for the least effort.
Set-up tips that save you pain
Conditional Access is powerful, which also means a careless policy can lock everyone out of their own accounts, including you. A few habits make the roll-out far less nerve-racking.
First, create two emergency administrator accounts that are excluded from your policies, give them long unique passphrases, and store those credentials offline somewhere physically secure such as a locked cabinet or a safe. The ACSC specifically recommends keeping break-glass accounts like these for exactly the moment a policy misfires and locks out your normal logins. They are your way back in.
Second, use report-only mode before you enforce anything. This lets a new policy run quietly in the background and record what it would have done, without actually blocking a single person. You review the results, confirm the rule behaves the way you expect, and only then switch it to enforced. Roll changes out to a small pilot group first rather than the whole company at once, and resist the urge to build intricate rules. A few policies that everyone understands will protect you better than a tangle that no one can safely change.
Where Conditional Access fits in the bigger picture
Conditional Access is one of the most practical ways a small business can put the principles of zero trust into effect: never assume a sign-in is safe just because the password was correct, and check the context every time. It works best alongside the other identity basics, not instead of them. Pair it with phishing-resistant multi-factor authentication so the second factor itself is hard to steal, keep the number of administrators to a minimum, and make sure staff know why the extra prompts appear so they do not treat them as a nuisance to click past.
It is also worth being clear about what Conditional Access does not do. It guards the front door of your accounts; it is not a backup, it is not antivirus, and it will not clean up after a device is already infected. Think of it as one strong layer among several, each covering a different kind of risk.
Find out where you stand
Conditional Access is one control among many, and the hardest part is usually knowing which gaps to close first. SecurityScore gives you a clear read on exactly that. Answer 27 short questions about how your business handles access, email, backups and more, and you will get a personalised report mapped to the ACSC Essential Eight, ISO 27001 and SOC 2, showing where you are strong and where to focus next.
It takes about 5 to 10 minutes, it is free, and you get your PDF report straight away. Take the free assessment and see where your business stands today.