Conditional Access is powerful but easy to misconfigure — locking users out or creating gaps. Here's how Optimyze approaches Conditional Access deployment for every new client.
Key takeaways
- 1Step 1: Emergency access account — always create a break-glass admin account excluded from all CA policies before touching anything. This prevents accidental lockout of all admins.
- 2Step 2: Report-only mode — all new policies go into report-only mode first. This shows what would have happened without actually enforcing it, letting you catch unexpected blocks b
- 3Step 3: Pilot enforcement — enforce policies on a pilot group (usually IT-savvy staff) for one week before rolling out broadly.
- 4Step 4: Broad enforcement — roll out to all users once the pilot confirms no legitimate access is being blocked.
Conditional Access is the most impactful security control in Microsoft 365. It's also one of the easiest to break if configured carelessly. Done wrong, it can lock legitimate users out. Done right, it's invisible to compliant users while blocking attackers automatically.
The deployment sequence that matters
Optimyze follows a specific sequence for every Conditional Access deployment:
- Step 1: Emergency access account — always create a break-glass admin account excluded from all CA policies before touching anything. This prevents accidental lockout of all admins.
- Step 2: Report-only mode — all new policies go into report-only mode first. This shows what would have happened without actually enforcing it, letting you catch unexpected blocks before they become incidents.
- Step 3: Pilot enforcement — enforce policies on a pilot group (usually IT-savvy staff) for one week before rolling out broadly.
- Step 4: Broad enforcement — roll out to all users once the pilot confirms no legitimate access is being blocked.
The baseline policy set
Every Optimyze client gets these policies as a minimum:
- Require MFA for all users (all cloud apps)
- Block legacy authentication
- Require compliant or Entra joined device for Microsoft 365 apps
- Require MFA always for admin roles
- Block high-risk sign-ins (Identity Protection integration)
- Require password change for high-risk users
Named locations and trusted IPs
We configure named locations for each client's office IP ranges, enabling policies that apply different rules for on-premises vs off-premises access. Some clients also use country allow-lists — particularly useful for businesses whose teams never travel internationally.
