Conditional Access

Think of Conditional Access as a set of “if this, then that” rules for sign-ins. If the user is an admin, then require phishing-resistant MFA. If the device isn't managed and compliant, then block access to patient files. If the sign-in comes from a country you don't do business in, then block it. If Microsoft rates the sign-in as risky, then make the user prove who they are or reset their password.

It's part of Entra ID P1, which is included in Microsoft 365 Business Premium. Smaller plans get only “security defaults,” a one-size-fits-all switch that turns on MFA but can't make device-based or location-based decisions.

Why it matters: MFA alone stops most password attacks, but not all. Conditional Access adds the device check that makes zero trust real — combined with Intune, you can say only company-managed, encrypted, up-to-date computers may open practice data. A stolen password and even a stolen MFA approval aren't enough from an attacker's laptop.

Rules need careful design and testing. A badly written policy can lock everyone out, including the admins. Good practice includes a break-glass emergency account excluded from policies, report-only mode before switching rules on, and documenting each rule so you know why it exists.

Example: a medical practice lets staff check email on personal phones but doesn't want patient attachments saved there. A Conditional Access policy requires Outlook with app protection on personal phones, while full access to the EHR's cloud documents is limited to the practice's managed workstations.

This is a core part of our Microsoft 365 & identity service.