How do you check a Microsoft 365 tenant against a Conditional Access baseline?
Checked October 28, 2026 by Accred Consulting
Accred Manage checks a connected tenant for six Conditional Access controls: the four policies Microsoft offers when you move off security defaults (MFA for admins, MFA for all users, block legacy authentication, and MFA for Azure management) and the two Microsoft Entra ID P2 risk policies. Each control is rated met, partial, not evaluated, or a gap, and every gap or report-only control becomes a finding that links to the Microsoft Entra admin center. Manage is read-only: you close a gap by creating or turning on the policy there.
What each result means
| Result | When Manage shows it | What to do |
|---|---|---|
| Met | A policy that is turned on covers the control, or security defaults do | If the policy excludes people, confirm they are emergency access accounts; Manage asks you to |
| Partial | Only a report-only policy covers it | Check the report-only results, then turn the policy on. Manage raises an “Enforce” finding |
| Not evaluated | Manage cannot read the tenant’s Conditional Access policies, or the control needs Entra ID P2 and Manage cannot confirm the tenant has it | Check the permissions Manage was granted, or confirm your licensing before planning the risk policies |
| Gap | No turned-on or report-only policy covers it, and security defaults are off | Create the policy from Microsoft’s template; the finding links to Conditional Access |
The six controls Manage checks
| Control | What it does | License |
|---|---|---|
| Require MFA for administrators | Requires MFA for highly privileged admin roles such as Global Administrator | Entra ID P1 |
| Require MFA for all users | Requires MFA for every user at every sign-in | Entra ID P1 |
| Block legacy authentication | Blocks sign-in from clients and protocols that cannot do MFA, such as IMAP, POP3, and SMTP | Entra ID P1 |
| Require MFA for Azure management | Requires MFA for the Azure portal, the Microsoft Entra admin center, Azure PowerShell, and Azure CLI | Entra ID P1 |
| Sign-in risk policy | Requires MFA when a sign-in looks risky (medium or high risk) | Entra ID P2 |
| User risk policy | Requires users at high user risk to remediate the risk before they continue | Entra ID P2 |
The first four are the policies Microsoft offers when you upgrade from security defaults. All four are also among Microsoft’s eight Secure foundation templates, which add securing security info registration, MFA for admins in Microsoft admin portals, and two device compliance policies.
Short how-to for closing a gap
- Create two or more cloud-only emergency access accounts and exclude them from every blocking policy.
- Before blocking legacy authentication, move the accounts and apps that still use it to modern sign-in. Manage flags legacy-protocol sign-ins that recently succeeded, so you can see who they are.
- In the Microsoft Entra admin center, create the missing policy from its template. Template policies start in report-only and exclude only the admin who creates them, so add your emergency access accounts.
- Watch the report-only results in the sign-in logs. Manage shows the control as partial until the policy is on.
- Turn the policy on. Manage then reports the control as met.
Security defaults and Microsoft-managed policies
- Security defaults are free and meant for tenants on the free tier of Microsoft Entra ID; Microsoft says they are probably not right for tenants with P1 or P2. Manage counts them as covering the controls they enforce.
- Security defaults and Conditional Access are not combined: to use Conditional Access policies, turn security defaults off.
- Microsoft-managed policies arrive in report-only, and Microsoft turns them on no less than 30 days later, with two weeks’ notice, unless you turn them on or off first. In some cases Microsoft turns them on sooner; when it does, it says so in its notices and in the policy details.
The full walk-through
For a step-by-step guide to building these policies from templates, testing them with report-only and What If, and excluding break-glass accounts, see Accred Consulting’s Conditional Access guide. Accred Assess also reads Conditional Access as evidence for its AI governance readiness assessment.
Questions
Which Conditional Access policies does Accred Manage check?
Six: MFA for administrators, MFA for all users, block legacy authentication, MFA for Azure management, and, with Entra ID P2, a sign-in risk policy and a user risk policy.
Does Accred Manage create or change Conditional Access policies?
No. The check is read-only. Each gap or report-only finding links to Conditional Access in the Microsoft Entra admin center, where you make the change.
Does Microsoft 365 Business Premium include Conditional Access?
Yes. Conditional Access needs Microsoft Entra ID P1, and Business Premium customers can use it. The sign-in risk and user risk policies need Entra ID P2, which Business Premium does not include.
Sources
- Microsoft Entra Conditional Access overview · Microsoft Learn
- Microsoft-managed Conditional Access policies · Microsoft Learn
- Conditional Access templates · Microsoft Learn
- Block legacy authentication with Conditional Access · Microsoft Learn
- Security defaults in Microsoft Entra ID · Microsoft Learn
- Conditional Access report-only mode · Microsoft Learn
- Manage emergency access admin accounts · Microsoft Learn
Create your organization, then turn on the apps you need.
Hub, Manage, and the Connect preview are free for your whole team, and Assess is free to start.