Conditional Access: MFA yes, compliant device not yet

Importing the hardware hash required disabling Security Defaults, because they block the device code flow. That solved one problem and created a larger one: the tenant was left with no MFA enforced at all.

Security Defaults and Conditional Access are mutually exclusive, so this was always going to happen. The point is to not leave the gap open, and to be careful about what replaces them.

Two policies, not one

The instinct is to write a single policy requiring both MFA and a compliant device. That is the mistake, and it is expensive.

Policy	Scope	Grant	State
CA - Require MFA for all users	All users · Exclude: the two break-glass accounts	Require MFA	On
CA - Require compliant device	All users	Require compliant device	Report-only

Separating them means the second can sit in report-only for as long as necessary without holding back the first. Combined into one, you either enforce both or neither.

Why “require compliant device” is not switched on

It gets enabled when the whole fleet is managed, not before. The correct sequence is: pilot, extend gradually, then enforce.

Report-only in the meantime is not a placeholder. It records what would have happened on every sign-in, so when the time comes you already know who it would have blocked.

The break-glass exclusion

Every Conditional Access policy that could lock people out needs an account that it does not apply to. A cloud-only Global Administrator, with MFA, no licence, credentials stored somewhere physical.

Two accounts rather than one, so that losing access to a single credential does not end the discussion.

Testing without locking yourself out

A note on licensing

Conditional Access requires Entra ID P1 for the users it applies to. Business Premium includes it.

Worth watching if you are on a trial: a 25-seat evaluation that converts to a single paid licence takes the other 24 with it. It is a reason not to create licensed test users you will have to clean up — and a reason to know the conversion date before it arrives rather than after.

What comes next

Two things, in this order:

Until then the tenant has MFA enforced on everyone except two deliberately excluded accounts, which is the part that actually stops credential-stuffing. The device requirement is the second layer, and it is worth waiting to deploy it properly.