--- title: "Conditional Access, Done Properly: Beyond the MFA Basics | StartCloud" description: "Module 6 of our free Microsoft 365 Security Essentials pathway: how Conditional Access policies work, the baseline three every business needs, and how to roll them out without locking anyone out." lang: en json-ld: | [ { "@context": "https://schema.org", "@type": [ "LocalBusiness", "ProfessionalService" ], "@id": "https://startcloud.au/#business", "name": "StartCloud", "legalName": "Start Technologies Pty Ltd", "alternateName": "StartCloud Australia", "identifier": { "@type": "PropertyValue", "propertyID": "ABN", "value": "17 676 121 449" }, "slogan": "Go Beyond", "description": "StartCloud is Perth's cybersecurity-first AI MSP: managed IT, Essential Eight security, Microsoft 365 and cloud, networking, and practical AI for Australian businesses with 5 to 50 staff.", "url": "https://startcloud.au", "logo": "https://startcloud.au/og-image.png", "image": "https://startcloud.au/og-image.png", "telephone": "+61862850001", "email": "web@startcloud.com.au", "priceRange": "$$", "currenciesAccepted": "AUD", "paymentAccepted": "Invoice", "foundingDate": "2023", "contactPoint": { "@type": "ContactPoint", "telephone": "+61862850001", "contactType": "customer service", "areaServed": "AU", "availableLanguage": "English" }, "address": { "@type": "PostalAddress", "streetAddress": "Ground Floor West, 6 Gibberd Road", "addressLocality": "Balcatta", "addressRegion": "WA", "postalCode": "6021", "addressCountry": "AU" }, "geo": { "@type": "GeoCoordinates", "latitude": -31.8648813, "longitude": 115.8095638 }, "openingHoursSpecification": [ { "@type": "OpeningHoursSpecification", "dayOfWeek": [ "Monday", "Tuesday", "Wednesday", "Thursday", "Friday" ], "opens": "07:00", "closes": "16:30", "description": "General support hours" }, { "@type": "OpeningHoursSpecification", "dayOfWeek": [ "Monday", "Tuesday", "Wednesday", "Thursday", "Friday", "Saturday", "Sunday" ], "opens": "00:00", "closes": "23:59", "description": "Security Operations Centre (SOC) with 24/7/365 threat monitoring" } ], "areaServed": [ { "@type": "City", "name": "Perth" }, { "@type": "State", "name": "Western Australia" }, { "@type": "Country", "name": "Australia" } ], "serviceArea": { "@type": "GeoCircle", "geoMidpoint": { "@type": "GeoCoordinates", "latitude": -31.8648813, "longitude": 115.8095638 }, "geoRadius": "50000" }, "knowsAbout": [ "Cybersecurity", "Managed Security Services", "Essential Eight", "Microsoft 365", "Microsoft Azure", "IT Support", "Network Security", "Disaster Recovery", "Compliance Management", "Microsoft Copilot", "AI Readiness", "AI Governance", "AI Agent Development" ], "hasOfferCatalog": { "@type": "OfferCatalog", "name": "IT and Cybersecurity Services", "itemListElement": [ { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Cybersecurity Services", "url": "https://startcloud.au/cybersecurity" } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Managed IT Services and Support", "url": "https://startcloud.au/technology" } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Microsoft 365 and Cloud Solutions", "url": "https://startcloud.au/cloud" } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Managed Networking", "url": "https://startcloud.au/networking" } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "AI and Automation", "url": "https://startcloud.au/ai" } } ] }, "sameAs": [ "https://www.linkedin.com/company/startcloudau", "https://www.facebook.com/startcloudaus/", "https://www.cloudtango.net/providers/12375/startcloud", "https://clutch.co/profile/startcloud", "https://abr.business.gov.au/ABN/View?abn=17676121449", "https://www.yellowpages.com.au/balcatta-wa/bpp/startcloud-581735301", "https://www.truelocal.com.au/balcatta-wa/tlp/startcloud-581735301", "https://www.google.com/maps/place/StartCloud/@-31.8648767,115.8069889,739m/data=!3m2!1e3!4b1!4m6!3m5!1s0x2a32a5b5d9e864b5:0x9f02690968f0e50c!8m2!3d-31.8648813!4d115.8095638!16s%2Fg%2F11vzbgtytj" ] }, { "@context": "https://schema.org", "@type": "LearningResource", "name": "Conditional Access, Done Properly", "description": "Module 6 of the Microsoft 365 Security Essentials pathway: how Conditional Access policies turn sign-in signals into access decisions, the anatomy of a policy, the baseline three policies, and a safe rollout using report-only mode and the What If tool.", "educationalLevel": "Intermediate", "learningResourceType": "Module", "isPartOf": { "@type": "Course", "name": "Microsoft 365 Security Essentials", "url": "https://startcloud.au/learn", "provider": { "@type": "Organization", "name": "StartCloud", "url": "https://startcloud.au" } }, "author": { "@type": "Organization", "name": "StartCloud", "url": "https://startcloud.au" }, "datePublished": "2026-07-23", "dateModified": "2026-07-23", "url": "https://startcloud.au/learn/conditional-access-done-properly" } ] --- [![StartCloud](/assets/StartCloud-Logo-ByZE1kzP.svg "StartCloud: Cybersecurity-First Managed IT Services Perth")](/ "StartCloud | Managed IT Services Perth") - Cybersecurity - AI Solutions - Cloud - Technology - Networking - Explore [Contact Us](/contact "Contact StartCloud, Perth IT Support") Open menu Module 6 of StartCloud's Microsoft 365 Security Essentials learning pathway, in six short units with a knowledge check: how Conditional Access turns sign-in signals into access decisions, the anatomy of a policy, the three baseline policies every business needs, and the report-only rollout discipline that keeps you from locking yourself out. Course contents [Pathway overview](/learn/microsoft-365-security-essentials) Pathway Microsoft 365 Security Essentials 0 of 6 units done in this module 1. [Turn on MFA ](/learn/microsoft-365-multi-factor-authentication) 2. [Protect admin accounts ](/learn/protect-admin-accounts-microsoft-365) 3. [Preset security policies ](/learn/microsoft-365-preset-security-policies) 4. [Stop email spoofing ](/learn/stop-email-spoofing-spf-dkim-dmarc) 5. [Sharing controls ](/learn/sharepoint-onedrive-sharing-controls) 6. Conditional Access, properly 1. If MFA is the lock, Conditional Access is the doorman 2 min 2. Anatomy of a policy: assignments and access controls 2 min 3. The baseline three every business needs 2 min 4. Rollout discipline: report-only, What If, and exclusions 2 min 5. Build your first policy, step by step 3 min 6. Knowledge check 2 min 7. [Data protection with Purview ](/learn/data-protection-microsoft-purview) 8. [Backups and retention ](/learn/microsoft-365-backups-and-retention) 9. [Starters and leavers ](/learn/microsoft-365-starters-and-leavers) 10. [Devices with Intune ](/learn/managing-devices-with-intune) # Conditional Access, Done Properly Module 6 · Devices Unit 1 of 6 · about 2 min ## If MFA is the lock, Conditional Access is the doorman Back in Module 1 you switched on MFA, and that was the big win. But MFA on its own is a lock that treats every knock at the door exactly the same. Your accountant signing in from the office at 9am gets the same challenge as someone trying an old mail protocol from the other side of the world at 3am. Conditional Access is Microsoft's policy engine for fixing that. At its simplest, every policy is an if-then statement: **if** a sign-in matches the conditions you describe, **then** apply the controls you chose. It gathers signals about each sign-in, weighs them against your policies, and makes a decision on the spot. Signals in, decision out Who is signing in User, group, or role Where from Network or country What device Platform and state What they want The app or resource How risky it looks Sign-in and user risk Your Conditional Access policies If the sign-in matches this... then do that. Block No entry, full stop Grant, with conditions MFA, compliant device, and so on The doorman way to think about it If MFA is the lock on the door, Conditional Access is the doorman standing next to it. The lock asks one question of everyone. The doorman sizes up who you are, where you came from, and what you are carrying, then decides whether you walk straight in, show extra ID, or head back to the taxi rank. Two housekeeping notes before we go deeper. Conditional Access needs Microsoft Entra ID P1, which is included in Microsoft 365 Business Premium and E3 (risk signals from Entra ID Protection need P2, which comes with E5). And policies are enforced after the first factor is completed, so it is a second gate behind the password, not a replacement for it. Mark done and continue ![StartCloud](/assets/StartCloud-Logo-ByZE1kzP.svg "StartCloud: Cybersecurity-First Managed IT Services Perth") Cybersecurity-led IT for Australian businesses. We manage security, compliance, and modern IT environments, so risk is governed, not guessed. Ground Floor West, 6 Gibberd Road, Balcatta WA 6021 [08 6285 0001](tel:+61862850001 "Call StartCloud on 08 6285 0001") Serving Perth businesses from Balcatta, Western Australia. ![Microsoft Solutions Partner - Modern Work](/assets/microsoft-solutions-partner-DqvNMv91.png "Microsoft Solutions Partner: Modern Work") ### Services - [Cybersecurity](/cybersecurity "Cybersecurity Services Perth | StartCloud") - [AI Solutions](/ai "AI & Automation Services Perth | StartCloud") - [Cloud](/cloud "Cloud Services Perth | StartCloud") - [Technology](/technology "IT Services and Support | StartCloud") - [Networking](/networking "Business Networking Perth | StartCloud") - [Packages](/packages "IT Support Packages Perth | StartCloud") ### Company - [About](/about "About StartCloud, Perth IT Support Team") - [Company Facts](/facts "StartCloud Company Facts | Perth Cybersecurity-First AI MSP") - [Resources](/resources "IT Resources & Guides | StartCloud Perth") - [Service Areas](/it-support-perth "IT Support Perth | StartCloud") - [Contact](/contact "Contact StartCloud, Perth IT Support") ### Locations - [All Service Areas](/locations "Perth IT Support Areas | StartCloud") - [IT Support Perth](/it-support-perth "IT Support Perth | StartCloud") - [Cybersecurity Perth](/cybersecurity-perth "Cybersecurity Perth | StartCloud") - [MSP Perth](/managed-service-provider-perth "Managed Service Provider Perth | StartCloud") - [Industries We Serve](/industries "IT Support by Industry Perth | StartCloud") © 2026 Start Technologies Pty Ltd trading as StartCloud. All rights reserved. ABN 17 676 121 449 [](https://www.linkedin.com/company/startcloudau "StartCloud on LinkedIn")[](https://www.facebook.com/startcloudaus/ "StartCloud on Facebook")[](https://www.google.com/maps/place/StartCloud/@-31.8648767,115.8069889,739m/data=!3m2!1e3!4b1!4m6!3m5!1s0x2a32a5b5d9e864b5:0x9f02690968f0e50c!8m2!3d-31.8648813!4d115.8095638!16s%2Fg%2F11vzbgtytj "StartCloud on Google") [Terms of Service](/terms-of-service "Terms of Service | StartCloud")| [Privacy Policy](/privacy-policy "Privacy Policy | StartCloud")| [Modern Slavery Policy](/modern-slavery-policy "Modern Slavery Policy | StartCloud")| [Cookie Policy](/cookie-policy "Cookie Policy | StartCloud") StartCloud Assistant Online G'day! 👋 I'm the StartCloud Assistant. How can I help you today? Tell me about your servicesBook a discovery callI need IT support Find Your Solution