Multi factor authentication was the answer for a decade. It is still necessary, and it is no longer sufficient, because the common attacks now assume it is there and work around it rather than through it.
In short: A workable Conditional Access baseline for a UK SMB is: require MFA for all users, block legacy authentication, require compliant or hybrid joined devices for access to company data, require MFA for risky sign ins, protect the administrative roles with stronger controls, and require reauthentication for admin sessions. Deploy in report only mode first, exclude a break glass account that is excluded from every policy, and enable one policy at a time. Legacy authentication is the one to do first, because it is the most common route around MFA entirely.
Why MFA on its own stopped being enough
Two reasons, and both are ordinary rather than exotic.
The first is legacy authentication. Older protocols such as IMAP, POP and SMTP AUTH cannot present an MFA prompt. If they are still enabled, an attacker with a valid password can often authenticate without ever meeting your MFA. Organisations frequently have MFA enforced and legacy auth open at the same time, which produces a confident dashboard and an open door.
The second is token theft. Adversary in the middle phishing proxies the real sign in page, including the MFA prompt, and steals the resulting session token. The user did everything right. The attacker now holds a valid session, and MFA has already been satisfied.
"An attacker who steals a session token has already passed your MFA. The next control has to be about the device, not the login."
The baseline policies
Order matters here. This sequence gets the highest risk closed first and reduces the chance of locking people out.
- Block legacy authentication. Highest value, lowest effort, and the one that undoes the most damage. Check sign in logs for legacy protocol use first, because there is occasionally a multifunction device or a line of business app relying on it that needs handling before you switch this on.
- Require MFA for all users. Including administrators, including the account nobody uses, including the shared mailbox someone signs into directly.
- Require a compliant or hybrid joined device for access to company data. This is the control that answers token theft, because a stolen token from an unmanaged machine no longer satisfies the condition. It is also the one requiring the most preparation, since devices must be enrolled and compliance policies defined first.
- Require MFA for risky sign ins. Where your licensing includes identity protection, use the risk signal rather than treating every sign in identically.
- Protect admin roles harder. Phishing resistant methods where you can, no exclusions that have quietly accumulated, and a much shorter session lifetime.
- Require reauthentication for administrative sessions. A privileged session that lasts all day is a privileged session available to whoever gets the laptop.
The two things people get wrong
No break glass account. Create at least one cloud only global administrator account, excluded from every Conditional Access policy, with a long stored credential and monitoring on its use. Without it, one misconfigured policy locks every administrator out of the tenant simultaneously, and that is a very unpleasant afternoon.
Enabling everything at once. Every policy supports report only mode. Run it, look at what would have been blocked, fix the surprises, then enforce. The surprises are always there and they are usually a service account, a meeting room device or a scanner.
What this does not cover
Conditional Access controls the front door. It does nothing about what someone can reach once inside, which is the other half of the problem and the reason SharePoint oversharing checks belong on the same plan. It also assumes your devices are actually managed and reporting compliance honestly, which is a device management question rather than an identity one.
It is also worth being clear that this is a baseline, not a finished posture. It gets a typical SMB from exposed to reasonably defended, and it is roughly what an insurer or a Cyber Essentials assessor expects to see. Where to go beyond it depends on what you hold and who wants it.
If you want to see where your current setup sits before changing anything, our Microsoft 365 security posture assessment is a quick read on the gaps, the security gaps MSPs see most often covers the recurring ones, and our security team does the deployment work where an estate needs it handled carefully.
