Conditional Access controls

A Conditional Access baseline with phishing-resistant MFA for admins and no legacy sign-in paths.

ID	Control	Priority	Effort
CA01	Create two emergency access accounts, exclude them from every policy and alert on their use	Highest	2 h
CA02	Name policies by persona and create every new policy in Report-only first	Highest	1 h
CA03	Require MFA for all users on all resources with an authentication strength	Highest	2 h + 7 days report-only
CA04	Block legacy authentication for all users	Highest	1 h + 7 days report-only
CA05	Require phishing-resistant MFA for administrators	Highest	2 h + 7 days report-only

These are the free Top 5. The Conditional Access Baseline Kit has all 20 controls, with the Jira import, Excel plan and read-only script.