.jpg&w=3840&q=75)
Most practices we work with have multi-factor authentication turned on. That's good, and it's one of the ACSC's Essential Eight strategies for a reason (we've covered the full Essential Eight here). But MFA on its own answers one question: is this really you? It doesn't ask anything about the situation the login is happening in.
Conditional Access does that second part.
What Conditional Access actually adds
Conditional Access is a Microsoft Entra feature that evaluates the circumstances of a sign-in, not just the credentials, before deciding whether to let it through. It can look at:
- Where the sign-in is coming from (country, network)
- Whether the device is managed and compliant
- What app or resource is being accessed
- How risky Microsoft's own signals say the sign-in looks
Based on those signals, a policy can require MFA, block the sign-in outright, require a compliant device, or grant access with no extra friction, depending on what's set.
Why MFA alone has gaps
MFA stops the most common form of account takeover: a stolen password used on its own. It doesn't stop everything. Push notification fatigue, where an attacker repeatedly triggers MFA prompts hoping someone taps approve without thinking, is a known technique against app-based MFA. Legacy authentication protocols that don't support modern MFA at all are still enabled on plenty of tenants by default.
Conditional Access closes those gaps by adding context. A policy that blocks legacy authentication entirely removes that bypass. A policy requiring a compliant, enrolled device for anyone accessing patient records through SharePoint or a practice management portal means a stolen password and a one-time MFA approval still aren't enough on their own, the device itself has to be one the practice controls.
What this looks like for a typical practice
Policies we set up most often:
- Block legacy authentication protocols across the tenant
- Require MFA for every admin role, with no exceptions, including break-glass accounts that get monitored separately
- Require a compliant or hybrid-joined device for access to clinical or patient-facing systems
- Flag or block sign-ins from outside Australia unless a staff member is genuinely travelling
The licensing detail worth knowing
Conditional Access needs Entra ID P1, which isn't included in Microsoft 365 Business Basic. It's bundled with Business Premium. If your practice is still on Business Basic, this is one of the practical reasons that licensing conversation comes up, not just for the extra apps, but for what it unlocks on the security side.
One practical warning
Test any new Conditional Access policy in report-only mode before enforcing it. A policy that requires a compliant device for everyone, switched on without testing, can lock out staff using personal phones for email mid-shift. Report-only mode shows exactly who would have been blocked, before anyone actually is.