Conditional Access Policies Every UK SME Needs: A Practical Setup Guide

Beyond Security Defaults: Why Conditional Access Matters for UK SMEs

Default security settings in Microsoft 365 are a blunt instrument. When you enable Microsoft Security Defaults, every user gets prompted for multi-factor authentication, legacy protocols get blocked, and administrators must complete extra verification. That baseline is better than nothing, but it offers zero flexibility. You cannot exempt specific service accounts, you cannot require managed corporate devices, and you cannot adjust policies based on user location or risk level.

Growing UK small and medium-sized businesses quickly outgrow that rigid model. As soon as you introduce third-party integrations, hybrid working arrangements, or shared accounts for operational equipment, Security Defaults break down. The alternative is Microsoft Entra Conditional Access, available with Microsoft 365 Business Premium and standalone Microsoft Entra ID P1 licences.

Conditional Access operates as an intelligent policy engine. It evaluates real-time signals, including user identity, device health, physical location, and target application, before granting access to your company data. Instead of asking whether a password is correct, it asks whether the entire context of the sign-in attempt looks legitimate.

Prerequisites Before You Build Your First Policy

Jumping directly into the Entra admin centre to create policies without preparation is the fastest route to locking everyone out of your tenant. Before touching a single toggle, you need two fundamental safeguards in place.

First, verify your licensing. Every user who benefits from a Conditional Access policy requires a licence that includes Microsoft Entra ID P1 capabilities. For most UK businesses, this comes packaged within Microsoft 365 Business Premium. If you run Business Standard or Basic across your team, you will need to add standalone Entra ID P1 add-on licences or upgrade your subscription.

Second, create and exclude at least one dedicated emergency access account, commonly referred to as a break-glass account. This account must have the Global Administrator role, use a complex 30-character passphrase stored in a physical fireproof safe or secure password vault, and never have standard multi-factor authentication tied to an individual employee's mobile phone. Exclude this break-glass account explicitly from every single Conditional Access policy you create. If a misconfigured policy blocks all standard access, this account remains your sole lifeline to recover your tenant.

Policy 1: Enforce Phishing-Resistant Multi-Factor Authentication for Administrators

Administrative accounts hold the keys to your entire digital estate. A single compromised Global Admin account allows an attacker to export mailboxes, disable backups, create malicious inbox forwarding rules, and deploy tenant-wide ransomware.

Standard text message codes and simple phone notifications no longer provide adequate protection. Attackers routinely bypass basic SMS verification using SIM-swapping or adversary-in-the-middle phishing proxy kits. Your administrative policy must require strong authentication via the Microsoft Authenticator application using number matching, or hardware FIDO2 security keys.

Scope this policy to all directory roles with privileged access, including Global Administrator, Security Administrator, Exchange Administrator, SharePoint Administrator, and User Administrator. Set the target resource to All Cloud Apps, and configure the grant control to require multi-factor authentication and authentication strength. Remember to exclude your dedicated emergency break-glass account.

Policy 2: Block Legacy Authentication Protocols Across the Board

Legacy authentication protocols such as POP3, IMAP4, SMTP AUTH, and older MAPI connections cannot enforce multi-factor authentication prompts. Attackers know this loophole intimately. When bad actors launch credential-stuffing campaigns against UK businesses, they almost exclusively target these older protocols to bypass modern login challenges.

Modern apps using OAuth 2.0 handle multi-factor authentication natively, but legacy email clients send usernames and passwords in plain text or basic authentication headers. Leaving legacy authentication enabled on your tenant makes your multi-factor authentication rules almost pointless.

Create a dedicated policy targeting All Users. Under Target Resources, select All Cloud Apps. In the Conditions menu, open Client Apps and select Exchange ActiveSync clients and Other clients. Set the Access Control to Block Access. This single policy immediately shuts down more than ninety percent of automated password spray attacks against your organisation.

Policy 3: Require Compliant or Hybrid Joined Devices for Sensitive Data

Allowing staff to access corporate SharePoint sites, customer records, and confidential emails from personal, unmanaged home computers introduces massive data leakage risks. Malware on a family laptop or an unpatched operating system can siphon session cookies directly out of the browser.

By pairing Conditional Access with Microsoft Intune, you can enforce that users only access corporate cloud resources from devices that meet your company security baseline. A compliant device has BitLocker disk encryption enabled, runs active antivirus software, maintains an up-to-date operating system, and complies with password complexity rules.

Configure this policy to target All Users, selecting Microsoft Office 365 and SharePoint Online as target cloud applications. Under Grant Controls, choose Require device to be marked as compliant. When an employee logs in from a work-issued laptop enrolled in Intune, access is granted without friction. If the same user attempts to download confidential documents from an unmanaged internet cafe PC, the login is blocked instantly.

Policy 4: Restrict Access by Trusted Geographic Locations

Most UK small businesses operate exclusively within the United Kingdom, or work with established partners in specific European countries. If your team never conducts business from eastern Europe, central Asia, or South America, there is rarely a legitimate reason for sign-in traffic to originate from those regions.

Named Locations within Microsoft Entra allow you to define trusted geographical boundaries. You can create a policy that restricts access or mandates strict step-up authentication when connections originate outside approved territories.

We advise caution when configuring geographic blocks. Many modern VPN services, mobile roaming carriers, and remote workers routing through regional datacentres can trigger false positives. Rather than an outright block on all foreign traffic, the most effective approach for UK SMEs is to block connections originating from high-risk countries where you have no business presence, while requiring compliant devices and multi-factor authentication for standard international travel. For official configuration guidelines, refer to Microsoft Learn conditional access planning.

Policy 5: Control Session Persistence and Web Browser Downloads on Unmanaged PCs

Sometimes business owners must accommodate contractors or remote employees who need to check emails from a web browser on a personal machine. You do not want to block them entirely, but you cannot allow them to download sensitive spreadsheets to an unprotected personal hard drive.

Conditional Access session controls solve this dilemma neatly. You can configure SharePoint Online and Exchange Online to grant limited web-only access when a connection comes from an unmanaged device. Users can read emails, edit Word documents, and collaborate within Teams in the browser window, but the options to download, print, or sync files locally are disabled.

Combine this with session lifetime controls. For sensitive roles handling financial transactions or payroll, configure Sign-in Frequency controls to require re-authentication every four to eight hours, preventing stale browser sessions from lingering indefinitely on shared workstations.

How to Test Policies Safely Without Locking Out Your Team

Deploying Conditional Access policies straight into production without testing is a recipe for operational chaos. Microsoft provides built-in staging tools to verify policy logic before enforcement.

Always create new policies in Report-Only mode first. In Report-Only mode, Entra ID evaluates sign-in events against your rules and logs the result without blocking users or prompting for unexpected credentials. Leave policies in Report-Only mode for at least one to two weeks, and inspect the Entra Sign-in Logs to identify legitimate business workflows that would have been disrupted.

Use the What If tool inside the Conditional Access portal. This simulation tool allows you to test hypothetical sign-in scenarios for specific users, devices, applications, and IP addresses. It displays exactly which policies will apply and which grant controls will trigger, giving you complete clarity before moving the policy state to On.

Common Implementation Mistakes That Disrupt UK Businesses

During our independent security reviews for UK organisations, we repeatedly encounter the same three configuration pitfalls.

The most dangerous error is failing to exclude service accounts used by line-of-business applications. If your accounting package, local scanner, or customer relationship system relays automated emails via Microsoft 365, applying a blanket multi-factor authentication policy without proper app registrations or exclusions will silently break your invoicing workflow.

The second mistake is stacking conflicting policies. When multiple policies overlap, Microsoft Entra evaluates all of them, and block controls always take precedence over grant controls. If one policy permits access from compliant devices but another policy blocks access based on an unconfigured location filter, the user remains blocked. Keep your policy design modular, simple, and cleanly documented.

The third error is neglecting user communication. Switching on strict session limits and device requirements without prior briefing generates a flood of support tickets on Monday morning. Provide clear guidance on how to install and register the Microsoft Authenticator app before policy activation.

Where to Go From Here

Identity is the new security perimeter for modern organisations. Operating Microsoft 365 with basic passwords or unmanaged defaults leaves your business exposed to preventable credential attacks and data theft. A structured, five-policy Conditional Access foundation protects your cloud assets while preserving flexible, productive working patterns for your staff.

Review your current Microsoft 365 security configuration today. Check whether legacy authentication remains open, verify that your administrators use strong multi-factor authentication, and ensure your emergency break-glass account is fully configured and excluded.