Introducing This Project
I designed five Conditional Access policies in Microsoft Entra ID covering MFA for all users, blocking legacy authentication, device compliance for admins, sign in risk, and admin sign in frequency, plus an Intune device compliance policy. I kept every policy in report only mode first, the way you’d roll out changes in a real environment: watch how they affect users before enforcing them. I tested the policies with Entra’s What If tool, protected the tenant with a break glass account excluded from every policy, and exported the full configuration with Microsoft Graph PowerShell using read only permissions.
Tools and Concepts
Microsoft Entra ID, Conditional Access, Zero Trust, Intune device compliance, Microsoft Graph PowerShell SDK, and phased security rollouts.
Project Reflection
This project showed me why phased rollouts matter. Enforcing a policy for all users without testing it first can lock out everyone, including the admins. Testing with What If was also more useful than I expected. For example, when a legacy sign in matched both “require MFA” and “block access,” Block won, which is the right outcome because legacy protocols can’t do MFA at all. I also documented a gap: with no devices enrolled in Intune, the compliance policy hasn’t checked a real device yet, so that part was validated by reviewing the configuration.