How to enforce conditional access policies with Intune

The traditional perimeter of the office has effectively vanished for UK SMEs. With hybrid work models, cloud-based collaboration tools like Microsoft 365, and an increasing reliance on mobile devices, your company data is no longer safely tucked away behind a physical firewall. For many business owners, this shift creates significant security anxiety: how do you ensure that only the right people, using the right devices, are accessing your sensitive intellectual property? The answer lies in Microsoft Intune and the implementation of Conditional Access policies. This framework is the engine room of a Zero Trust security strategy. Rather than assuming that everyone inside your network is trustworthy, it verifies every single connection request based on a set of logical "if-then" statements. By integrating Microsoft Intune, you can establish a granular security posture that protects your business data while still allowing your team the flexibility to work from anywhere. This guide will walk you through the strategic implementation of Conditional Access, ensuring your SME stays compliant with UK data protection regulations while hardening your cyber security.

What Conditional Access actually means

At its core, Conditional Access is about controlling who gets to access what, and under what circumstances. Think of it as a smart gatekeeper for your cloud applications and data. Instead of simply checking a password, it assesses a range of signals about the user, their device, and where they are located. If these signals align with your predefined security rules, access is granted. If not, access might be blocked, or the user could be prompted for an additional verification step, such as Multi-Factor Authentication (MFA). It operates on an "if this, then that" principle. For instance, "If a user is logging in from outside the UK and their device isn't managed by the company, then block access to sensitive financial applications." It's a method of enforcing security policies dynamically, based on the context of each access attempt.

Why it matters for UK SMEs

For UK SMEs, neglecting robust access controls is no longer a viable option. The commercial implications extend beyond the immediate financial hit of a breach. The Information Commissioner’s Office (ICO), responsible for enforcing GDPR in the UK, mandates that organisations implement "appropriate technical and organisational measures" to secure personal data. This isn't optional; failure to comply can result in substantial fines and significant reputational damage.

Furthermore, achieving certifications like Cyber Essentials, increasingly a requirement for government contracts and supply chains, relies heavily on these principles. The National Cyber Security Centre (NCSC) consistently advises on the importance of strong identity and access management. Conditional Access directly addresses these requirements by reducing the 'attack surface' – the points at which an unauthorised party could attempt to gain access. It minimises the risk of data breaches, protects intellectual property, and ensures business continuity. In essence, it helps you meet your legal obligations while protecting your commercial interests from increasingly sophisticated cyber threats.

How to enforce Conditional Access policies

Implementing Conditional Access effectively requires a structured approach. It's not a single switch you flick, but rather a series of carefully considered policies designed to protect your assets without hindering legitimate work.

Step 1: Defining Your Signals and Conditions

Before you configure anything, you must define the conditions under which access is granted or denied. This forms the "If" portion of your security logic. Understanding these signals is fundamental to building an effective policy framework.

• User Identity: This is fundamental. Is the user who they claim to be? Conditional Access should always enforce Multi-Factor Authentication here, making it harder for unauthorised parties to impersonate legitimate staff, even if they obtain a password. This is your first line of defence against credential theft.
• Device Health: Is the device managed by your company? Does it have the latest security patches installed? Is its antivirus enabled and up-to-date? A non-compliant device is a potential entry point for malware, and allowing it access to sensitive data is a significant risk. Intune plays a crucial role in assessing and reporting on this health status.
• Location: Are they logging in from a known, safe location (e.g., within the UK or specific office IP ranges) or from a high-risk region where your business has no legitimate operations? For many UK SMEs, access from certain parts of the world is simply not required, making geographic filtering a straightforward and effective control.
• Application Sensitivity: What application is being accessed? Is it a low-risk shared document or a high-risk financial database or HR system? Not all data carries the same risk. Your policies should reflect this, applying stricter controls for the most sensitive information. This aligns with the principle of least privilege, ensuring users only have access to what they need, when they need it.
• Real-time Risk: Are there any indicators of compromise, such as unusual sign-in patterns, impossible travel scenarios, or leaked credentials? Leveraging real-time threat intelligence can dynamically adjust access requirements based on the perceived risk of the sign-in attempt itself.

By mapping these signals, you create a baseline for what "normal" looks like for your business. For example, you might decide that a user can access email from any device, but accessing the company’s SharePoint server requires a device that is fully "compliant" according to your Intune settings. This layered approach ensures proportionality in your security posture.

Step 2: Enforcing Device Compliance via Intune

Intune is the tool that assesses whether a device is "healthy" and trusted. Without Intune, Conditional Access is effectively blind to the security posture of the laptop or phone connecting to your network. It cannot make informed decisions about whether to grant access. This device compliance is a cornerstone of modern endpoint security.

You should create compliance policies in Intune that verify key security attributes:

1. BitLocker Encryption: Ensure that all Windows devices have their drives encrypted. If a laptop is lost or stolen, this is your primary defence against data theft. Unencrypted drives are an open invitation for data exfiltration, leaving your business vulnerable to GDPR breaches and reputational damage. This is a non-negotiable security baseline for any organisation handling personal or sensitive data.
2. OS Versioning: Require that devices are running a supported and current version of Windows or macOS. Legacy operating systems are a major security liability, often containing unpatched vulnerabilities that cybercriminals actively exploit. Keeping operating systems up-to-date ensures you benefit from the latest security fixes and features.
3. Threat Protection: Ensure that Microsoft Defender or your chosen Endpoint Detection and Response (EDR) solution is active, up to date, and reporting its status. An endpoint without active threat protection is a significant risk, allowing malware to potentially compromise your systems unnoticed. Intune can verify the operational status of these critical security components.
4. PIN/Passcode: For mobile devices, enforce a strong PIN or passcode. Mobile devices often hold sensitive company data, and a lack of a basic screen lock means anyone picking up a lost phone could gain access to corporate resources. This simple measure provides a crucial layer of physical security.

If a device fails these checks, Intune flags it as "non-compliant." You can then configure Conditional Access to automatically block access to corporate resources until the user updates their device or resolves the security issue. On a recent client tenant audit for a 50-user London marketing agency, we found 40% of their devices were not fully compliant with basic security baselines, primarily due to unencrypted drives, a straightforward fix through Intune. Identifying and rectifying such issues proactively is far less disruptive than dealing with a data breach, which can halt operations and incur significant costs.

Step 3: Strengthening Identity with Multi-Factor Authentication (MFA)

MFA remains the single most effective way to prevent unauthorised access, even if a password is stolen. However, many SMEs still make the mistake of using SMS-based MFA, which is increasingly vulnerable to "SIM swapping" attacks and phishing. These methods can be circumvented by determined attackers, rendering your MFA less effective than you might assume.

For robust security, enforce Conditional Access policies that require phishing-resistant MFA. This typically means using the Microsoft Authenticator app (with number matching enabled), hardware security keys (FIDO2), or Windows Hello for Business. These methods provide a cryptographic link or rely on a physical token, making them significantly harder to compromise through phishing tactics. Number matching, in particular, forces the user to actively confirm a specific number on their trusted device, mitigating "MFA fatigue" attacks where users might blindly approve prompts. You should configure your policy to:

• Require MFA for all cloud applications, without exception. Assuming any application is low-risk enough to bypass MFA is a dangerous stance.
• Require MFA specifically when accessing high-value resources, even if it's already generally enforced. This adds an additional layer of verification for your most critical data.
• Implement "Session Sign-in Frequency" to force users to re-authenticate periodically (e.g., every 8 hours or daily). This prevents a stolen session token from being used indefinitely by a malicious actor, effectively limiting the window of opportunity for an attacker who manages to compromise an active session.

Step 4: Limiting Access by Location and Risk

For many UK SMEs, there is no legitimate reason for their internal systems to be accessed from certain international locations. Leveraging location and sign-in risk can significantly enhance your security posture, acting as an intelligent filter against common attack vectors.

• Geographic Filtering: You can configure Conditional Access to block access entirely from countries where your business has no presence. This is a simple but powerful way to reduce the "attack surface" of your organisation. If your staff are based solely in the UK, blocking sign-ins from, say, Russia or China is a logical and effective measure against opportunistic attacks. It's often one of the first policies we implement for clients, providing immediate uplift in security with minimal disruption to legitimate workflows.
• Sign-in Risk Policies: If you have Microsoft Entra ID P2 licences, you can use "User Risk" and "Sign-in Risk" policies. These leverage Microsoft’s global threat intelligence to detect if a user’s credentials have been leaked on the dark web, if a sign-in attempt exhibits patterns associated with an automated bot attack, or if an "impossible travel" scenario is detected (e.g., a user signing in from London and then 30 minutes later from New York). If the risk level is deemed "Medium" or "High," you can force an automatic password reset, require additional MFA, or block the login entirely. This provides an adaptive layer of security that responds to real-time threats, moving beyond static rules to intelligent, dynamic access control. It helps protect against sophisticated attacks that might bypass simpler controls.

Step 5: Avoiding Common Pitfalls and "Lockout" Scenarios

The most dangerous mistake an administrator can make is setting a policy that inadvertently blocks everyone—including themselves—from accessing the system. This can bring your entire operation to a halt and is, frankly, a preventable incident.

Best Practices for Deployment:

• Use Report-Only Mode: Before enforcing any new policy, set it to "Report-only" mode. This allows you to see who would have been blocked or challenged without actually disrupting their work. Review these reports thoroughly for a week or two to ensure the policy behaves as intended and doesn't inadvertently impact legitimate users. This is a critical validation step that should never be skipped.
• Exclude Break-Glass Accounts: Always maintain at least two "Global Administrator" accounts that are explicitly excluded from Conditional Access policies. These accounts should use long, complex passwords, stored securely offline (e.g., in a physical safe), and ideally be cloud-only accounts not synchronised from an on-premise Active Directory. These are your emergency recovery accounts if your primary authentication service or Conditional Access policies go awry, preventing a complete lockout. Treat them with extreme care.
• Test with a Pilot Group: Never roll out a security policy to the entire company at once. Test it with a small group of tech-savvy staff first. This helps identify any unforeseen issues or legitimate workflow disruptions before they impact your entire workforce, allowing for fine-tuning based on real-world usage.
• Phased Rollout: Once tested, implement policies in phases (e.g., by department or user group) rather than a big bang approach. This allows for controlled deployment, monitoring, and adjustment, minimising the risk of widespread disruption. It's a more pragmatic and less stressful way to introduce significant security changes.

Common mistakes we see

1. No "Break-Glass" Accounts: Failing to exclude emergency administrative accounts from Conditional Access policies creates a single point of failure that can lock everyone out, including IT.
2. Skipping Report-Only Mode: Deploying policies directly into "Enforce" mode without testing can lead to widespread access issues and significant business disruption.
3. Relying Solely on SMS-based MFA: While better than nothing, SMS is phishable and vulnerable to SIM-swapping, making it a weaker form of MFA for critical business data.
4. Ignoring Device Compliance: Without Intune policies ensuring devices are patched, encrypted, and protected, Conditional Access lacks crucial context about the endpoint's security health.
5. Overlooking Guest or External User Access: Conditional Access policies often focus on internal staff but neglect to apply appropriate controls for external collaborators accessing your data, creating a potential loophole.

Key Takeaways

Implementing Conditional Access is an ongoing process, not a one-time configuration. To summarise the path to a more secure SME:

• Zero Trust is Essential: Assume no connection is safe until it is verified against your security criteria.
• Device Compliance is Foundational: Use Intune to ensure only encrypted, updated, and protected devices access your data.
• MFA is Non-Negotiable: Move away from SMS-based codes toward app-based or hardware token authentication for superior protection.
• Context Matters: Leverage location and risk-based signals to limit access based on the sensitivity of the data and the perceived threat.
• Test Thoroughly: Always use "Report-only" mode and pilot groups to monitor the impact of your policies before full deployment, avoiding accidental business disruption. Getting this wrong can turn a minor inconvenience into a full-blown IT incident, which, frankly, nobody has time for.
• Stay Compliant: Aligning your IT policies with these security measures is fundamental for Cyber Essentials certification and meeting GDPR requirements.

By moving your security policies into the cloud, you are not just protecting your business from the latest threats; you are building a flexible, modern infrastructure that allows your team to work securely from anywhere.

When to call in help

For many UK SMEs, the intricacies of configuring and maintaining Conditional Access policies, particularly when integrated with Intune and advanced threat protection, can be complex. If your internal team lacks the specialist knowledge, time, or resources to implement these policies effectively, or if you simply want assurance that your setup is robust and compliant, engaging with experienced IT professionals is a pragmatic decision. We can help you design, deploy, and manage a Conditional Access framework tailored to your specific business needs and risk profile.

To take the next step

Book a Discovery Call