Overview

Implementing Conditional Access policies requiring device compliance in Microsoft 365 requires careful planning and a phased approach to minimize disruption while maintaining security. This comprehensive guide provides step-by-step instructions specifically tailored for small businesses.

1. Prerequisites and Initial Setup

Required Licenses

• Microsoft Entra ID P1 or P2 – Required for Conditional Access
• Microsoft Intune – Required for device compliance management
• Microsoft 365 Business Premium or higher for small businesses

Essential Preparations

1. Configure Emergency Access Accounts
   • Create at least two emergency access (break-glass) accounts
   • Exclude these accounts from ALL Conditional Access policies
   • Store credentials securely and separately
2. Create Device Compliance Policies First
   • Define minimum OS version requirements
   • Set encryption requirements
   • Configure password/PIN requirements
   • Establish jailbreak/root detection settings
3. Enable User Registration for MFA
   • Allow users to register authentication methods before enforcing policies
   • Communicate registration requirements to all users

2. Phased Rollout Strategy

Phase 1: Foundation (Weeks 1-2)

Objective: Establish baseline security and prepare infrastructure

1. Create policies in Report-Only Mode
2. Block legacy authentication protocols
3. Secure the MFA registration page
4. Target privileged accounts first with phishing-resistant MFA

Phase 2: Pilot Testing (Weeks 2-4)

Objective: Test with limited user groups

Pilot Group Selection

• Start with 5-10% of your organization
• Include IT staff and willing early adopters
• Avoid executives and VIPs initially
• Ensure representation from different departments

Creating the Policy in Report-Only Mode

1. Navigate to Microsoft Entra admin center → Conditional Access → Policies
2. Create new policy with these settings:
   • Name: “Require Device Compliance – Pilot”
   • Users: Select pilot group
   • Cloud apps: Start with non-critical apps
   • Grant: Require device to be marked as compliant
   • Enable policy: Report-only

Phase 3: Gradual Expansion (Weeks 4-8)

Objective: Progressively include more users and applications

Automated Phased Rollout Approach

If using the Conditional Access Optimization Agent (requires Microsoft Security Copilot):

1. The agent automatically creates a 5-phase rollout plan
2. Groups are assigned based on risk and impact analysis
3. Automatic progression between phases based on success metrics
4. Built-in safeguards pause rollout if sign-in success rate drops below 90%

Manual Phased Rollout Approach

1. Phase 3a: Add 25% more users (low-risk departments)
2. Phase 3b: Add another 25% (medium-risk departments)
3. Phase 3c: Add remaining standard users
4. Phase 3d: Include executives and VIPs
5. Phase 3e: Apply to all cloud applications

Phase 4: Full Deployment (Week 8+)

1. Switch policy from Report-only to On
2. Monitor for 2 weeks before removing report-only policies
3. Clean up redundant or test policies

3. Monitoring Strategies

Real-Time Monitoring Tools

A. Sign-in Logs Analysis

1. Navigate to Microsoft Entra admin center → Monitoring & health → Sign-in logs
2. Filter by:
   • Conditional Access status
   • Failure reasons
   • Affected users
3. Review the Report-only tab for policy impact without enforcement

B. Conditional Access Insights Workbook

Requires Azure Monitor subscription:

• Provides aggregate view of policy impacts
• Identifies potential issues before enforcement
• Shows user impact analysis

C. Device Compliance Dashboard

1. Access via Intune admin center → Reports → Device compliance
2. Monitor:
   • Compliance status by policy
   • Non-compliant device trends
   • Error patterns in compliance evaluation

Key Metrics to Track

• Sign-in success rate: Should remain above 90%
• Device compliance rate: Target 95%+ before full enforcement
• Help desk tickets: Monitor for unusual spikes
• User productivity impact: Track application access patterns

4. Rollback Procedures

Immediate Rollback Options

Option 1: Disable the Policy

1. Navigate to the Conditional Access policy
2. Change Enable policy from “On” to “Off”
3. Takes effect within minutes for new sign-ins

Option 2: Switch to Report-Only Mode

1. Edit the policy
2. Change Enable policy to “Report-only”
3. Maintains visibility while removing enforcement

Option 3: Exclude Affected Users/Groups

1. Edit policy → Assignments → Users
2. Under Exclude, add affected users or groups
3. Use sparingly and temporarily

Grace Period Configuration

Configure grace periods in Intune compliance policies:

1. Navigate to Intune admin center → Devices → Compliance policies
2. Edit policy → Actions for noncompliance
3. Set grace period (recommended: 3-7 days for initial rollout)
4. Users maintain access during grace period while fixing compliance issues

Recovery from Deleted Policies

• Deleted policies can be recovered within 30 days
• Access soft-deleted policies through Microsoft Entra admin center
• Restore maintains original configuration and assignments

5. Best Practices and Recommendations

Communication Strategy

1. Pre-deployment: 2 weeks advance notice with requirements
2. During pilot: Weekly updates to pilot users
3. Rollout phases: 48-hour notice before including new groups
4. Post-deployment: Success confirmation and support resources

Testing Checklist

• ✓ Test with multiple device platforms (Windows, iOS, Android)
• ✓ Verify enrollment process for new devices
• ✓ Confirm excluded accounts remain accessible
• ✓ Test rollback procedures in development environment
• ✓ Validate help desk escalation procedures

Common Pitfalls to Avoid

1. Not excluding emergency accounts – Can result in complete lockout
2. Skipping report-only mode – Misses opportunity to identify issues
3. Moving too quickly between phases – Insufficient time to identify problems
4. Inadequate user communication – Leads to confusion and resistance
5. Not monitoring device check-in intervals – Compliance updates may be delayed

PowerShell Monitoring Example

# Connect to Microsoft Graph
Connect-MgGraph -Scopes "Policy.Read.All"

# Get all Conditional Access policies
$policies = Get-MgIdentityConditionalAccessPolicy

# Filter for device compliance policies
$compliancePolicies = $policies | Where-Object { 
    $_.GrantControls.BuiltInControls -contains "compliantDevice" 
}

# Display policy status
$compliancePolicies | Format-Table DisplayName, State, CreatedDateTime