How to harden Microsoft Entra ID with Conditional Access and break-glass accounts

Stolen and guessed passwords remain one of the most common ways into Microsoft 365 tenants. Microsoft says more than 97 per cent of credential stuffing attacks and more than 99 per cent of password spray attacks it analyzed use legacy authentication, which cannot do multi-factor authentication (MFA). Closing that door, and requiring strong MFA everywhere else, removes a large share of the risk.

This guide follows Microsoft Learn documentation current as of October 2026. Menus are in the Microsoft Entra admin center, where the identity section is now labelled Entra ID. Conditional Access requires Microsoft Entra ID P1 or higher. Tenants without it can turn on security defaults, which also block legacy authentication.

Step 1: Create two emergency access (break-glass) accounts

Do this first. A misconfigured Conditional Access policy can lock every administrator out of the tenant.

1. Create at least two cloud-only users on your *.onmicrosoft.com domain. They must not be federated or synchronized from on-premises Active Directory.
2. Assign them the Global Administrator role. In Privileged Identity Management, make the assignment active permanent, not eligible.
3. Register a passwordless method that meets Microsoft's mandatory MFA requirement. Microsoft recommends passkeys (FIDO2) on security keys; certificate-based authentication is the alternative if you already run a PKI. Use a different method from your everyday admin accounts.
4. Do not tie the accounts to any individual's phone or device. Store the keys in secure, fireproof locations in separate places, available to more than one authorized person.
5. Create a security group such as EmergencyAccess, add both accounts, and exclude this group from every Conditional Access policy that blocks or restricts sign-in. Report-only policies do not need the exclusion.

Step 2: Alert on every use of those accounts

1. Send Entra sign-in logs to a Log Analytics workspace (or your SIEM).
2. Get each account's Object ID from Entra ID > Users.
3. In the Azure portal, open Monitor > Alerts > + Create > Alert rule. Use a Custom log search on the SigninLogs table filtered by those Object IDs, with a threshold of greater than 0 and severity 0 - Critical, and attach an action group that emails and texts several administrators.
4. Test sign-in at least every 90 days, and after staff changes, to confirm the accounts work and that the alert fires.

Step 3: Find out who still uses legacy authentication

1. Sign in as at least a Reports Reader and go to Entra ID > Monitoring & health > Sign-in logs.
2. Add the Client App column, then Add filters > Client App and select the legacy protocols.
3. Repeat on the User sign-ins (non-interactive) tab.
4. Contact the owners of old mail clients, multifunction printers and scripts that appear, and move them to modern authentication or a supported relay before you block.

Step 4: Block legacy authentication

1. Sign in as at least a Conditional Access Administrator and browse to Entra ID > Conditional Access > Policies > New policy.
2. Under Assignments > Users or workload identities, include All users and exclude the EmergencyAccess group.
3. Under Target resources > Resources (formerly cloud apps), include All resources.
4. Under Conditions > Client apps, set Configure to Yes and tick only Exchange ActiveSync clients and Other clients.
5. Under Grant, choose Block access.
6. Set Enable policy to Report-only and select Create. After reviewing the results, switch it to On.

Step 5: Deploy the Secure foundation templates

Microsoft groups its recommended baseline under Entra ID > Conditional Access > Create new policy from templates, in the Secure foundation category. It includes:

• Require multifactor authentication for admins
• Securing security info registration
• Block legacy authentication
• Require multifactor authentication for admins accessing Microsoft admin portals
• Require multifactor authentication for all users
• Require multifactor authentication for Azure management
• Require compliant or Microsoft Entra hybrid joined device or multifactor authentication for all users
• Require compliant device

Templates are created in report-only mode, and they exclude only the person who creates them. Open each one afterwards under Policies and add the EmergencyAccess group, plus any service accounts you have not yet replaced with managed identities, to the exclusions.

For administrators, add the Require phishing-resistant multifactor authentication for administrators template from the Protect administrator category. With Entra ID P2, the Zero Trust category adds risk-based policies for risky sign-ins and high-risk users.

Step 6: Check Microsoft's mandatory MFA enforcement

Microsoft now enforces MFA for Azure administration on its own. Since October 2024, sign-ins to the Azure portal, Microsoft Entra admin center and Intune admin center require MFA. A second phase starting Oct. 1, 2025, extends the requirement to create, update and delete operations through Azure Resource Manager, including the Azure CLI, Azure PowerShell, REST APIs and infrastructure-as-code tools. Workload identities are excluded. Make sure automation runs under managed identities or service principals rather than user accounts, and that admins use recent versions of the CLI and PowerShell modules.

Step 7: Deal with service accounts and shared mailboxes

Microsoft recommends excluding service accounts, such as the Microsoft Entra Connect Sync account, from user-targeted policies, and notes that calls made by service principals are not blocked by those policies anyway. That makes service accounts an attractive target. List every account excluded from your policies, record why, and replace user-based service accounts in scripts and integrations with managed identities where possible. Use Conditional Access for workload identities if you need to restrict service principals.

Step 8: Retire classic policies and review regularly

1. Classic Conditional Access policies stopped enforcing controls after July 10, 2024. If Entra ID > Conditional Access > Classic policies lists any, document and recreate them, then disable them.
2. Use the What If tool to test the effect of policies on a given user before you switch them on.
3. Review report-only results, exclusions and the emergency access drill each quarter.

Sources

• Microsoft Learn: Manage emergency access admin accounts
• Microsoft Learn: Block legacy authentication with Conditional Access
• Microsoft Learn: Conditional Access templates
• Microsoft Learn: Planning for mandatory Microsoft Entra multifactor authentication
• Microsoft Azure Blog: Azure mandatory multifactor authentication phase 2 starting in October 2025