Conditional Access Baseline Kit¶
A Conditional Access baseline with phishing-resistant MFA for admins and no legacy sign-in paths.
Five Conditional Access controls to put in place first in Microsoft Entra ID: emergency access accounts excluded and monitored, report-only discipline, MFA for all users with an authentication strength, legacy authentication blocked, and phishing-resistant MFA for administrators. Each control has why, steps, impact, rollback, a read-only PowerShell check, how to verify, licence, effort and the Microsoft Learn page it is based on.
Free: Top 5 of 20 controls
The 5 controls to do first, with every file listed below.
Need all 20? See the Complete kit
What's in the download¶
| File | What it is for |
|---|---|
| Guide (Markdown) | Every control with why, steps, impact, rollback, the read-only check, how to verify, licence and effort |
| Jira import (CSV) | Epics and stories with sprint, priority and labels, ready for Jira Cloud's CSV import |
| Excel project plan | Owners, dates, a status drop-down, % complete and a progress dashboard, for teams without Jira |
| Tracker (CSV) | The same backlog for Planner, Azure DevOps or Linear |
| Read-only PowerShell | Read-only: Get-* cmdlets and Microsoft Graph GET requests only. Changes nothing in your tenant. Results go to a CSV. |
A look inside the free Top 5¶
Excerpts of the real files in the free download.
| Issue ID | Type | Summary | Priority | Parent | Sprint |
|---|---|---|---|---|---|
| 1 | Epic | Conditional Access Baseline Kit: Foundation and emergency access | High | ||
| 2 | Epic | Conditional Access Baseline Kit: Strong authentication for everyone | High | ||
| 3 | Epic | Conditional Access Baseline Kit: Block weak sign-in paths | High | ||
| 4 | Story | [CA01] Create two emergency access accounts, exclude them from every policy and alert on their use | Highest | 1 | Sprint 1 - Foundation |
| 5 | Story | [CA02] Name policies by persona and create every new policy in Report-only first | Highest | 1 | Sprint 1 - Foundation |
| 6 | Story | [CA03] Require MFA for all users on all resources with an authentication strength | Highest | 2 | Sprint 2 - Enforce MFA and block legacy |
| 7 | Story | [CA04] Block legacy authentication for all users | Highest | 3 | Sprint 2 - Enforce MFA and block legacy |
First 7 of 8 rows of conditional-access-baseline-kit-top-5-jira-import.csv: 3 epics and 5 stories, with parent, priority, sprint and labels already set. Import with Jira Cloud's CSV importer.
| ID | Control | Sprint | Priority | Effort (h) | Status |
|---|---|---|---|---|---|
| CA01 | Create two emergency access accounts, exclude them from every policy and alert on their use | Sprint 1 - Foundation | Highest | 2 | To do |
| CA02 | Name policies by persona and create every new policy in Report-only first | Sprint 1 - Foundation | Highest | 1 | To do |
| CA03 | Require MFA for all users on all resources with an authentication strength | Sprint 2 - Enforce MFA and block legacy | Highest | 2 | To do |
| CA04 | Block legacy authentication for all users | Sprint 2 - Enforce MFA and block legacy | Highest | 1 | To do |
| CA05 | Require phishing-resistant MFA for administrators | Sprint 2 - Enforce MFA and block legacy | Highest | 2 | To do |
The Project plan sheet of conditional-access-baseline-kit-top-5-project-plan.xlsx. Sheets: Read me, Dashboard, Project plan. Owner, start and due dates are yours to fill in; status is a drop-down (To do, In progress, Blocked, Done, Not applicable); the Dashboard shows % complete, overdue items and hours left by area and sprint.
<#
Conditional Access Baseline Kit: Top 5 - read-only checks (Runbook Lab)
Read-only: Get-* cmdlets and Microsoft Graph GET requests only. Changes nothing in your tenant.
Requires: Microsoft.Graph PowerShell SDK (Microsoft.Graph.Identity.SignIns, .Reports, .Identity.DirectoryManagement).
Connect first:
Connect-MgGraph -Scopes Policy.Read.All,AuditLog.Read.All,UserAuthenticationMethod.Read.All,Directory.Read.All
Role: Global Reader or Security Reader is enough for these reads.
Output: .\hardening-check-results.csv (ID, Control, Status, Output).
#>
...
Invoke-Check 'CA01' 'Create two emergency access accounts, exclude them from every policy and alert on their use' { $p = Get-MgIdentityConditionalAccessPolicy -All; $p | Where-Object { $_.State -ne 'disabled' } | ForEach-Object { "$($_.DisplayName) | $($_.State) | excluded users: $(@($_.Conditions.Users.ExcludeUsers).Count) | excluded groups: $(@($_.Conditions.Users.ExcludeGroups).Count)" }; "Active policies with NO user or group exclusion (break-glass not excluded?): $(@($p | Where-Object { $_.State -ne 'disabled' -and -not $_.Conditions.Users.ExcludeUsers -and -not $_.Conditions.Users.ExcludeGroups }).Count)" }
...
The header and the first of 5 checks in conditional-access-baseline-kit-top-5-readonly-checks.ps1. Results go to hardening-check-results.csv.
Controls¶
Free Top 5¶
| ID | Control | Priority | Effort |
|---|---|---|---|
| CA01 | Create two emergency access accounts, exclude them from every policy and alert on their use | Highest | 2 h |
| CA02 | Name policies by persona and create every new policy in Report-only first | Highest | 1 h |
| CA03 | Require MFA for all users on all resources with an authentication strength | Highest | 2 h + 7 days report-only |
| CA04 | Block legacy authentication for all users | Highest | 1 h + 7 days report-only |
| CA05 | Require phishing-resistant MFA for administrators | Highest | 2 h + 7 days report-only |
Added in the Complete kit (15)¶
| ID | Control | Area | Effort |
|---|---|---|---|
| CA06 | Enable passkeys (FIDO2) with passkey profiles | Authentication methods and passwordless | 2 h |
| CA07 | Set up Temporary Access Pass for onboarding and recovery | Authentication methods and passwordless | 1 h |
| CA08 | Turn on the registration campaign for passkeys | Authentication methods and passwordless | 30 min |
| CA09 | Plan for the retirement of Microsoft-provided SMS and voice MFA | Authentication methods and passwordless | 2 h |
| CA10 | Protect security info registration with Conditional Access | Authentication methods and passwordless | 1 h + 7 days report-only |
| CA11 | Block device code flow | Block weak sign-in paths | 1 h + 7 days report-only |
| CA12 | Require strong authentication for medium and high sign-in risk | Risk and session controls | 1 h + 7 days report-only |
| CA13 | Require risk remediation for high user risk | Risk and session controls | 1 h + 7 days report-only |
| CA14 | Shorten sessions on unmanaged devices and admin portals | Risk and session controls | 1 h |
| CA15 | Pilot token protection for Windows and Apple native apps | Risk and session controls | 2 h + 14 days report-only |
| CA16 | Require MFA for guests and decide on cross-tenant MFA trust | Strong authentication for everyone | 1 h |
| CA17 | Review named locations and trusted networks | Block weak sign-in paths | 1 h |
| CA18 | Turn on the Conditional Access insights and reporting workbook | Operate and review | 2 h |
| CA19 | Review every policy exclusion each quarter | Operate and review | 1 h per quarter |
| CA20 | Export all policies as a dated JSON backup and track changes | Operate and review | 30 min per quarter |
Before you run the checks¶
Requires: Microsoft.Graph PowerShell SDK (Microsoft.Graph.Identity.SignIns, .Reports, .Identity.DirectoryManagement).
Connect first:
Connect-MgGraph -Scopes Policy.Read.All,AuditLog.Read.All,UserAuthenticationMethod.Read.All,Directory.Read.All
Role: Global Reader or Security Reader is enough for these reads.
Questions¶
How is this different from Secure Score, Maester or ScubaGear?
Use those too. They tell you what is off. This kit gives you the project to fix it: an ordered backlog you import on day one, what each change breaks and how to roll it back, and checks that only read.
Will the script change anything?
No. Apart from signing in (Connect-* and, for Power Platform, Add-PowerAppsAccount), it uses read commands only: Get-, Search- and Microsoft Graph GET requests. Every kit passes a check that rejects Set-, New-, Remove- and similar commands in the checks before release.
Which version is this?
1.0 (2026-10-28; facts re-read on Microsoft Learn 2026-10-28; validated: quality gate, read-only guard, PowerShell 7.4 parse, Excel recalc). Test every change on a pilot group first: no checklist knows your tenant's exceptions.
Can I use it for clients?
Yes, in your own organisation and in your clients' tenants. Please don't resell the kit files.
Get the Complete kit¶
Conditional Access Baseline Kit: Complete¶
€29
All 20 controls in sprints, with the same files as the free Top 5. If it doesn't save you at least an hour, reply to your receipt for a refund.
AI and Identity Pack¶
€79 instead of €107 for the kits separately
3 Complete kits: Copilot readiness, AI agent hardening, Conditional Access.
Coming soon
About the bundles
Microsoft 365 Hardening Library¶
€149 instead of €233 for the kits separately
7 Complete kits: Microsoft 365 hardening, SMS and voice MFA exit, Copilot readiness, AI agent hardening, Defender for Endpoint and ASR, Conditional Access, Exchange Online protection.
Coming soon
About the bundles