Your practice
You set the Conditional Access policy you want enforced (or decide there isn’t one yet), name who’s exempt and why, and confirm who signs off before a policy change that could lock someone out.
Identity & access administration Identité et accès
Who can sign in, from where, and under what conditions — named as its own line.
MFA enrollment, Conditional Access policy, and sign-in risk review usually get bundled into "Microsoft 365 administration" without ever being named on their own. That’s increasingly a problem: cyber-insurance renewal questionnaires now routinely ask whether MFA is enforced and how sign-in risk is reviewed, and "we think so" isn’t an answer your client can submit. This page names identity administration as its own governed line — the same "we check before we act" boundary as everything else here.
Delivery team
We enroll and re-enroll users into the agreed MFA method, apply the Conditional Access policy you’ve approved, and flag risky sign-ins against the threshold you set — without changing a policy that could lock out the business without your sign-off first.
MFA enrollment and Conditional Access changes
For a client whose Microsoft 365 (or other identity provider) tenant has some MFA enrollment and maybe a default Conditional Access policy, but no one has reviewed sign-in risk or documented an exception list.
What we need first
Tenant access with the right administrative role, the MFA method and Conditional Access baseline you want enforced, and a named approver for a policy change or an exception (a service account or a legacy application that can’t do modern MFA).
What’s included
- New-user MFA enrollment and re-enrollment when a method is lost or changed
- Conditional Access policy changes you’ve approved, applied, and documented
- A periodic sign-in risk review against the threshold you set, with flagged events summarized
Handled separately
- Deciding the Conditional Access policy itself or accepting the business risk of a stricter rule
- Changing a policy that could lock out active users without the named approver’s sign-off
- Presenting this as a compliance certification or a guarantee against account compromise
What you get: A documented, enforced identity policy instead of a default nobody’s checked since setup — and an answer ready the next time a cyber-insurance renewal or a client’s own auditor asks.
What we hand back: An identity change note naming what was enrolled or changed, and a sign-in risk summary with anything that needs your decision.
What identity administration has to define before it’s priced
MFA method and fallback
Push notification, authenticator app, or hardware key each have a different loss-and-recovery path. Pick the primary method and the fallback for someone who loses their device, before the first lockout call comes in.
The exception list, named
A legacy line-of-business application, a shared service account, or a single executive with a business reason — every real environment has at least one exception. Name it and its reviewer, or it becomes an undocumented policy gap.
What counts as risky enough to flag
Sign-in-risk tools score almost everything as something. Agree on the threshold that actually reaches your practice as a decision, versus what stays in the log for the periodic review.
Who can approve a change under pressure
A locked-out executive at 8 a.m. is exactly when a bad policy exception gets made. Name the approver and the standard now, so an urgent request doesn’t quietly become the new baseline.
What this line doesn’t include
- Deciding the identity provider or purchasing licences for it
- A guaranteed prevention of account compromise or a security certification
- Investigating a confirmed account compromise — that’s an incident escalation, not a policy review
Straight answers on MFA and Conditional Access
Can we tell a client this satisfies their cyber-insurance requirement?+
No — we can tell you what’s enforced and documented, but whether that satisfies a specific insurer’s questionnaire is between your client and their broker. We won’t represent this as a compliance guarantee.
What happens if enforcing a stricter policy locks someone out?+
That’s exactly why a policy change needs the named approver’s sign-off before it goes live, not after the first complaint. A lockout gets escalated and resolved the same way any other urgent access issue is.