Conditional Access is the most useful security control in a Microsoft 365 tenant and the easiest one to lock yourself out with. One badly scoped "block" policy can stop every admin from signing in, including you.

The answer isn't to avoid it. It's to build a small, boring baseline, test each policy in report-only mode , and only then switch it on. This guide covers which policies to start with in a small tenant (roughly 5 to 300 users), how to read the report-only results, and a rollout order that doesn't wreck anyone's Monday.

Menu paths and recommendations were checked against Microsoft Learn in October 2026. Microsoft renames things often, so treat the docs as the source of truth if a label has moved.

Prerequisites

Licensing. Conditional Access needs Microsoft Entra ID P1, which is included in Microsoft 365 Business Premium and E3/E5. Risk-based policies need P2. If you only have the free tier, use security defaults instead.…