A correct username and password from an unmanaged device in another country at 3am should not grant access to your business systems. Microsoft Entra ID Conditional Access enforces exactly this — evaluating the context of every sign-in before granting access.
Traditional authentication is binary: correct username and password = access granted. This model fails completely when passwords are compromised through phishing, data breaches, or credential stuffing — which, as CERT NZ data consistently shows, is one of the most common causes of business account compromise in New Zealand.
Conditional Access adds a third dimension: context. It evaluates not just whether the credentials are correct, but whether the sign-in behaviour is consistent with legitimate use — and applies appropriate controls based on that assessment.
What Conditional Access Evaluates
Device compliance: Is the device managed by the business's Intune environment? Is it encrypted? Is its OS version current? An Intune-managed, compliant device carries an implicit trust signal. An unmanaged personal laptop carries no such signal. Conditional Access can require device compliance before granting access to sensitive data, allowing read-only access from unmanaged devices while blocking write/edit access.
Location: Sign-ins from countries your business doesn't operate in, or from IP addresses associated with VPNs, Tor, or anonymous proxies, are high-risk signals. A policy blocking sign-ins from countries outside New Zealand and Australia eliminates a significant proportion of credential stuffing attacks originating from overseas.
Sign-in risk: Microsoft Identity Protection evaluates real-time risk signals for every sign-in — whether the credentials appear in known breach databases, whether the sign-in location has moved impossibly fast since the last login ("impossible travel"), whether the behaviour matches known attack patterns. High-risk sign-ins can trigger step-up authentication or automatic block.
Application sensitivity: Access to a public-facing website needs fewer controls than access to your financial management system or HR records. Conditional Access allows different policies for different applications — requiring compliant device + MFA for sensitive applications while allowing browser-only access with MFA for lower-sensitivity tools.
A Practical Conditional Access Baseline
For most NZ SMBs on Microsoft 365 Business Premium, Optimyze configures the following Conditional Access policies as a baseline: require MFA for all users on all sign-ins, block sign-ins from known malicious IP ranges, block sign-ins from high-risk countries outside the business's operating geography, require Intune-compliant device for access to sensitive applications (Teams, SharePoint, finance systems), and block legacy authentication protocols (which bypass MFA entirely).
These five policies together significantly raise the bar for any account compromise — a stolen password from a data breach, used from an overseas attacker with a non-compliant device, fails on multiple policy dimensions before it reaches MFA.
Conditional Access answers the question: even if this person has the right credentials, should they be getting in right now, from this device, in this location? Most attacks fail that question before they ever reach a human for review.
