Skip to content
microsoftadmin.in

SOP: Review a Conditional Access baseline (7 checks)

Purpose

Section titled “Purpose”

Run the same seven checks on any tenant — your own, after a change, or when you inherit one — to find the misconfigurations that cause lockouts or leave gaps.

Prerequisites

Section titled “Prerequisites”

Steps (portal)

Section titled “Steps (portal)”
  1. Emergency access accounts are excluded. At least two break-glass accounts are excluded from every policy and monitored. See the break-glass SOP.
  2. New policies start in Report-only. Check recent policies were in Report-only before switching On, and review their impact in the sign-in logs’ Report-only tab.
  3. Legacy authentication is blocked. A policy targets All users, All resources, client apps Exchange ActiveSync clients and Other clients, with Block access. Check sign-in logs for legacy clients first.
  4. Exclusion groups are owned and reviewed. Every exclusion lives in a named group with an owner and an expiry date. Use Access reviews if licensed.
  5. Guests and external users are covered. Your MFA policy includes Guest or external users, or a dedicated policy covers them.
  6. The baseline MFA policy targets All resources. Exceptions are justified and written down.
  7. Changes are tested with What If. Run the What If tool with a real user, app, platform and location before and after each change.

Steps (PowerShell / Graph)

Section titled “Steps (PowerShell / Graph)”

List policies with their state and user exclusions:

Terminal window
Connect-MgGraph -Scopes 'Policy.Read.All' -NoWelcome
Get-MgIdentityConditionalAccessPolicy -All |
  Select-Object DisplayName, State,
    @{ n = 'ExcludeUsers';  e = { $_.Conditions.Users.ExcludeUsers -join ', ' } },
    @{ n = 'ExcludeGroups'; e = { $_.Conditions.Users.ExcludeGroups -join ', ' } } |
  Format-Table -AutoSize

Verify

Section titled “Verify”

Record a pass/fail for each of the seven checks, with evidence (policy name, screenshot from your test tenant, or log query).

Rollback

Section titled “Rollback”

This SOP is a review — it changes nothing. For any fix it leads to, export the affected policy as JSON first so you can restore it.

Do’s

Section titled “Do’s”
  • Export policies before every change.
  • Keep a short change log: what, why, who, when.

Don’ts

Section titled “Don’ts”
  • Don’t switch a new policy straight to On.
  • Don’t add “temporary” exclusions without an expiry date.

Common mistakes

Section titled “Common mistakes”
Check Good state
Emergency access accounts 2+, excluded, monitored
New policies Start in Report-only
Legacy authentication Blocked for everyone
Exclusion groups Owned, named, reviewed
Guests & external users Covered by MFA
Baseline MFA scope All resources
Changes Tested with What If

Weekly · 5-minute read

The Identity Brief

Identity & Microsoft 365 changes that need action, one SOP, one script — every week. Verified against official Microsoft sources.

No spam. Unsubscribe anytime. Privacy