Assignments, Users, Include = All
Exclude, Users = pick 1 admin
Target resources, Select = Resources (formerly cloud apps),
Include = All resources (formerly ‘All cloud apps’)
Network, Configure = Yes
Include = Any,
Exclude = All Trusted
Conditions, Authentication Flows, Configure = Yes
Select Device code flow.
Select SAVE<\/strong>
Grant, Grant = Block access.
Select<\/strong><\/p>\n\n\n\n
<\/p>\n\n\n\n
<\/p>\n\n\n\n
<\/p>\n\n\n\n
MFA Required to register a new Device TL<\/strong><\/p>\n\n\n\n Assignments, Users, Include = All <\/p>\n\n\n\n <\/p>\n\n\n\n Allow OS WIn,MacOS,iOS,Android TL<\/strong><\/p>\n\n\n\n Users, Include = ALL <\/p>\n\n\n\n MFA Reqd for HIGH risk sign-ins TL<\/strong> <\/p>\n\n\n\n MFA Reqd for admins TL<\/strong> Block Logins Outside CA,US,MX<\/strong> DANGER<\/strong><\/p>\n\n\n\n Apple iOS phones using Apple Mail instead of Outlook, the authentication protocols will NOT update automatically. If the phone was originally setup, long ago, it will continue to use the same insecure authentication, and the rule below will BLOCK <\/strong>email login. To fix you need to; find or reset the user’s email password, delete the mail profile, then re-create the profile using the same username+password. This will force Apple Mail to use a new, secure auth protocol.<\/p>\n\n\n\n Block legacy Authentication TL<\/strong> <\/p>\n\n\n\n To Globally enable Conditional Access <\/p>\n","protected":false},"excerpt":{"rendered":" Sign in to the Microsoft Entra admin center as at least a Conditional Access Administrator.Browse to Entra ID > Conditional Access > Policies.Select New policy.Set all new policies to Report-only,…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[81],"class_list":["post-4317","post","type-post","status-publish","format-standard","hentry","category-uncategorised","tag-microsoft"],"_links":{"self":[{"href":"https:\/\/increasec.com\/index.php?rest_route=\/wp\/v2\/posts\/4317","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/increasec.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/increasec.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/increasec.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/increasec.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=4317"}],"version-history":[{"count":26,"href":"https:\/\/increasec.com\/index.php?rest_route=\/wp\/v2\/posts\/4317\/revisions"}],"predecessor-version":[{"id":4365,"href":"https:\/\/increasec.com\/index.php?rest_route=\/wp\/v2\/posts\/4317\/revisions\/4365"}],"wp:attachment":[{"href":"https:\/\/increasec.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=4317"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/increasec.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=4317"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/increasec.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=4317"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
Exclude, Users = pick 1 admin
Target Resources,
Select what = User actions
Select the action = Register or join devices
Conditions, Locations, Configure = Yes
Include = Any,
Exclude = All Trusted
Grant = Allow,
MFA = Y
Enable = ON<\/p>\n\n\n\n![\"\"](\"https:\/\/increasec.com\/wp-content\/uploads\/2026\/05\/image-4.png\")
<\/figure>\n\n\n\n
Target, Resources (formerly Cloud Apps), Include = All Resources (formerly ‘All cloud apps’)
Network, Configure = Y, Include = Any, Exclude = All Trusted (eFAX has no OS listed)
Conditions, Device Platforms, Configure = Y, Include = Any, Exclude = Android, iOS, Windows, MacOS
Grant = Block
Enable = ON<\/p>\n\n\n\n
Users, Include = ALL
Target, Resources (formerly Cloud Apps), Include = All Resources (formerly ‘All cloud apps’)
Network, Configure = Y, Include = Any, Exclude = All Trusted (eFAX has no OS listed)
Conditions, Sign-in risk, Configure = Y, High = Y
Grant = Allow, MFA = Y
Session, Sign-in frequency =Y, Periodic reauthentication, 4, Hours
<\/p>\n\n\n\n
Policy From TEMPLATE, Require multifactor authentication for admins, review & create
Edit,
Network, Configure = Y, Include = Any, Exclude = All Trusted (this allows legacy auth for printer\/scanners)
Create Named locations for the Countries in your Continent. I like to include the 2 letter abbreviation. NOT trusted. also create a trusted IP range for your office public ip. see https:\/\/www.whatsmyip.org\/<\/a>
<\/p>\n\n\n\n
Users, Include = ALL
Target, Resources (formerly Cloud Apps), Include = All Resources (formerly ‘All cloud apps’)
Network, Configure = Y, Include = Any, Exclude = Selected, choose the Countries created in step1
Conditions, Sign-in risk, Configure = Y, High = Y
Grant = Block<\/p>\n\n\n\n
<\/p>\n\n\n\n
Policy From TEMPLATE, Block legacy Authentication, review & create
Edit,
Network, Configure = Y, Include = Any, Exclude = All Trusted (this allows legacy auth for printer\/scanners)
<\/p>\n\n\n\n
Entra, Overview, Properties,
In the Security defaults section (bottom), Manage Conditional Access
It should ask you to change from defaults to Conditional Access and create 4 Microsoft managed rules
they can be turned off but not deleted.<\/p>\n\n\n\n