(neither my last) In previous blogs, I covered the sign-in risk and user risk policies as part of the Secure Score Series, and in my blog, about Azure Multifactor Authentication I talked about Azure AD Identity Protection, and how it can be used to roll out MFA in your organization. This is not my first article on this subject. This blog is about Azure AD Identity Protection and Conditional Access, and how these two features are working together.

Important as always with Conditional Access, it is highly recommended to first pilot and test these policies before a wider go-live. These policies are available for activation (and configuration as you can define users exclusion) from your Azure AD portal ( ) or Azure portal ( ) in the Conditional Access configuration blade

Baseline policy: Require MFA for Service Management, will require MFA for all service management access (administration portal, PowerShell, Azure Cli).

Baseline policy: Block legacy authentication, is a preconfigured policy to block all legacy authentication based applications (Office 2013, Office 2010, POP-IMAP clients (like Thunderbird), legacy Lync/Skype for Business client and native Android mail client.

This policy will require your end-users to register for MFA within 14 days

Leaked credentials are blocked until a password reset occurs. It will require Azure Multi-Factor Authentication (MFA) during risky sign-in.

Baseline policy: End user protection, to help protecting your end-users.

After providing in preview an Azure Active Directory (Azure AD) Conditional Policy to request MFA for administrator accounts (which by the way is now GA), Microsoft is providing 3 new pre-configured conditional access policies in preview:

Risky sign in azure ad