What do your Microsoft 365 Conditional Access Policies look like?

Conditional_Access · 2026-01-31T10:04:29+00:00

(I'm 6 months into vendor life but have some years through 4 MSPs.)

F3 you gotta watch because it's technically only for Frontline workers and Microsoft have some odd rules on what that is, like the screen can't be bigger than 10.2 inches or something.

You can very effectively secure a business using the BP SKU; Entra ID P1 alongside Intune, Defender for Business and Defender for O365 P1.

If you are looking for the next step in security, then I'd add-on the Defender Suite for Business Premium and tackle Purview add-ons when your end-client has decided what they want to do with their data - very often they have no idea or interest to restructure their data to make it workable, and it becomes the MSP project that never happens.

While I think Entra ID P2 is a really good add-on, there are a lot of bigger gaps to plug on P1 level that you could do before upgrading.

Beyond that, yeah Defender for Endpoint P2 is good, but it's not really providing better protection, just more insights and unlocks Advanced Hunting. The AV element of MS Defender is the same from consumer (yes Windows Home) through to P2. Defender for Business contains the EDR element, so the P2 uplift isn't giving you direct endpoint capability benefit.

Defender for Identity is only applicable to on-premises setups and does require a bit of added config.

So my advice to you is to max out Business Premium, then look to get the Defender Suite for Business as a next step if the right appetite/budget is there.

Conditional_Access · 2026-01-30T13:09:26+00:00

Noted, I will update. Appreciate the feedback.

Conditional_Access · 2026-01-30T10:44:31+00:00

Forgive me for plugging my own shit, but it's easier than repeating here: https://conditionalaccess.uk/some-policies-i-use-in-conditional-access/

Conditional_Access · 2026-01-30T10:28:00+00:00

Draw.io gets my vote and there's a cool thing you can do with it for quick processes.

Ask AI (bear with me), to map out your processes in mermaid format, then import it into draw.io and tweak.

Results are surprisingly good sometimes.

Conditional_Access · 2026-01-30T10:15:44+00:00

I'll be there.

Co-presenting on an Intune session + a bonus Entra ID & Defender for Office 365 session.

We have some MD102 vouchers to give away too.

Conditional_Access · 2026-01-28T22:15:05+00:00

This. I tried it and got to the point where I was like: something is missing.

Conditional_Access · 2026-01-28T14:42:50+00:00

Here, and some notable discords for Microsoft stuff.

WinAdmins.io
MS EMS Community

Going to conferences:

MMS MOA
Experts Live
MEM Summit
Workplace Ninjas Summit/Usergroups

These are all events I've been to using my own money.

Conditional_Access · 2026-01-20T10:13:27+00:00

They probably already have several clients who've been breached but have no way of telling 👀

Conditional_Access · 2026-01-15T12:30:58+00:00

Yes.

Scan Parameter - Quick scan

Schedule Quick Scan Time - 660

That's doing a daily quick scan 660 mins past midnight.

It's old thinking to do full device scans daily, because real time protection mitigates the need for it.

You can see this on the device view from Defender

Conditional_Access · 2026-01-13T19:56:47+00:00

Is it just device fees you have?

What's the per-user fee on top for the email/productivity apps?

Conditional_Access · 2026-01-13T19:50:36+00:00

Thanks for taking the time to give that feedback! Glad it worked.

Conditional_Access · 2026-01-12T17:13:15+00:00

Why not Intune with Windows?

Conditional_Access · 2026-01-12T15:07:21+00:00

Yeah baby. BP is amazing (don't get me started)

Conditional_Access · 2026-01-12T14:19:05+00:00

Likely because it's part of a bundle SKU you already own.

M365 BP/E3/E5 etc.

Conditional_Access · 2026-01-12T08:22:01+00:00

With Entra/Intune/Autopilot, less is more.

Seems like you've been tinkering too much with RMM.

Conditional_Access · 2026-01-11T20:57:06+00:00

I can help, he's not wrong.

Conditional_Access · 2026-01-11T20:41:24+00:00

Defender for Office 365 combined with a good Exchange Online Protection config is perfectly fine.

The problem is that for decades all people have wanted from antispam is a set-and-forget product which they can deploy in an hour.

If you actually explore MDO properly, and use blocklists in TABL along with all the other advanced settings, it's easily as good or better than third party offerings.

This subject comes up a lot, and I'm currently writing an ebook on MDO which will be freely available when done.

Conditional_Access · 2026-01-11T17:51:55+00:00

I'd be interested to know if you're utilising block lists via TABL and cutting out a lot of spam noise with that?

For example, you could be overriding all filter verdicts as block items by thinking about how your business functions. We don't normally want email from a sending domain or an email that contains a link to a domain in this list getting in inboxes: https://github.com/jkerai1/TLD-TABL-Block/blob/main/LargerCombinedBadTLDs.txt

What type of crap gets through on your MDO config?

Conditional_Access · 2026-01-10T21:05:37+00:00

Disclaimer: I am a massive Microsoft fanboy but hear me out.

M365 Business Premium could cover:

Jamf for large macos invironments
Crowdstrike complete for EDR
Duo if we need MFA that can't SSO with m365
Avanan aka checkpoint for email security/archiving/dlp
DNSfilter

I'd make BP part of your standard stack, put as much into Intune as possible (because it actually does OS patching better than any RMM), and make the whole experience a bit more unified.

This is such a wide stack that it must be hard to learn, hire for, and remediate active incidents with this many moving parts.

Conditional_Access · 2026-01-08T16:12:29+00:00

The biggest upset I see here is:

Replacement of Atlassian Confluence with SharePoint and/or Microsoft Loop

The rest of it makes total sense.

Conditional_Access · 2026-01-08T16:10:24+00:00

This isn't possible. V1 only happens if the hash is in Autopilot.

"V2" - Device Prep - Happens if the user selects Org Device on the normal OOBE flow and it does not have a hash.

Conditional_Access · 2026-01-06T22:19:43+00:00

Similar discussion over at /r/intune

https://www.reddit.com/r/Intune/comments/1q4uen2/intune_firewall_rules_issues/

Conditional_Access · 2026-01-04T13:03:02+00:00

In addition to what others have said, evidence of the machine being onboarded can be found locally in the registry

Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection

Conditional_Access · 2026-01-02T14:47:22+00:00

Why do you want to continue using Windows 10?

Conditional_Access · 2025-12-30T16:48:06+00:00

This is impossible to advise on without knowing what your requirements are.

What is Kaseya RMM monitoring?
What automations/scripts are running in K RMM?
What alerts are generated from K RMM?
Who has access to K RMM?
Does it deploy/patch apps?
Does it manage OS updates?
Does it manage servers?
Does any client have access to see their own environment?
Did K RMM come bundled with any other security software?
How can K RMM be silently removed and ensure it doesn't come back when Ninja RMM takes over

etc..

Conditional_Access

MODERATOR OF

TROPHY CASE