Restructure Conditional Access and Admin Roles in Microsoft 365
Administrative access has grown over the years.
Who has which rights? Which exceptions are still needed? And how do you change access rules without locking out your daily work? I support your IT team in reviewing and restructuring accounts, roles and sign-in requirements.
What is Conditional Access?
Conditional Access is the policy engine in Microsoft Entra ID. At every sign-in it evaluates user, device, location, app and risk and then decides: allow access, require additional authentication or block. A clean policy set replaces many individual exceptions and can be tested in report-only mode before it is enforced.
What I often find in grown tenants
- Emergency access accounts are missing or not excluded from the policies. One faulty rule then locks out every administrator.
- Global administrator rights sit permanently on accounts that are also used to read email and open documents.
- Legacy sign-in methods without MFA support are not blocked and bypass every MFA policy.
- Exception groups created years ago for a project that nobody maintains today.
- Administrators sign in with SMS codes instead of a phishing-resistant method.
- Policies that were left in report-only mode and never enforced.
What I take on
- Review of the agreed accounts, roles and existing access rules.
- Alignment on dedicated administrative access and emergency procedures.
- Preparation of MFA, Conditional Access and privileged roles according to licence scope.
- Testing with suitable test accounts and documented approval before enforcement.
Process and duration
Usually one to three weeks, about two on average. The duration depends mainly on the number of accounts, exceptions and connected applications.
Day 1: Scope
Which accounts, roles and policies are included? Target state and acceptance criteria are defined.
Day 2–7: Implementation
Configuration, testing in report-only mode and with a pilot group, then gradual rollout.
Day 8–10: Handover
Documentation of configuration and decisions, handover meeting with your IT team.
Prerequisite
Conditional Access requires Entra ID P1. Risk-based policies and PIM require Entra ID P2.
What your IT team receives
Your IT team receives traceable decisions on access and roles plus documentation of the agreed configuration. Tests and approvals that are still pending are named explicitly.
Credentials
- Microsoft Certified: Identity and Access Administrator Associate
- Microsoft Certified: Cybersecurity Architect Expert
- 21+ years of IT experience, 50+ Microsoft 365 projects
All certifications can be verified publicly in the Microsoft Learn profile.
Frequently asked questions
Which licence does Conditional Access require?
Conditional Access requires Microsoft Entra ID P1, included for example in Microsoft 365 Business Premium and E3. Risk-based policies and Privileged Identity Management (PIM) require Entra ID P2, included for example in Microsoft 365 E5.
How do you avoid locking yourself out with Conditional Access?
With at least two emergency access accounts that are excluded from the regular policies, protected with phishing-resistant sign-in and monitored. New policies run in report-only mode first, are tested with test accounts and a pilot group, and are only enforced after documented approval.
Can our IT service provider stay involved?
Yes. At the start we clarify which tasks I take on and who reviews changes in operations. The documentation is written so that your IT team or provider can continue running the environment afterwards.
More about me: Profile Philipp Schmidt · easym365.de