Two instruments make a Conditional Access change safe: What If for a single hypothetical, and report-only for the whole population. How to use both, read the four report-only results, and promote a policy to enforcement without locking anyone out.
Once you accept that Conditional Access is the real control plane, the next question is how to organize it, and this is where most tenants go wrong. Not because they pick the wrong controls, but because they never pick a…
A Conditional Access framework is not a project you finish, it is a system you operate. The reviews, the break-glass test nobody wants to run, the monthly drift check, and the change discipline that keeps a snapshot true a year later.
Most of a Conditional Access deployment is about people who already exist. The harder problem, and the one baselines almost never address, is the person who does not exist yet. A new hire on their first morning has no registered…
At the end of the build you have a tenant full of Conditional Access policies that do nothing. Every one of them is in report-only. That is the correct state, and it is also the most dangerous moment in the…
The design paper made the case. This is the part where you actually stand up the framework in a tenant, and it is where the gap between “imported the policies” and “operates the policies” stops being rhetorical. I built the…
Earlier this year I sat down and took apart the published Conditional Access baselines the way I’d audit a customer tenant. Every policy definition at the JSON level, every group reference resolved, every grant control checked against what it actually…
Why Conditional Access Matters More Than Any Single Policy
