Designing Conditional Access Policies Without Locking Yourself Out

September 14, 20262 min read

Conditional Access is one of the few places in Microsoft 365 where a single misconfigured policy can lock an entire organization out of their tenant — including the admins who need to fix it. The fix isn’t to avoid Conditional Access; it’s to roll it out in a way that can’t do that.

Always keep a break-glass account

Before writing a single policy, create at least one emergency access account:

Excluded from every Conditional Access policy, by group membership, not by name.
Cloud-only, with a long random password stored outside the tenant (a password manager or physical safe, not a text file in SharePoint).
Monitored — any sign-in from this account should trigger an alert, since it should almost never be used.

Report-only before enforced

Every new policy should start in report-only mode. This evaluates the policy against real sign-ins without blocking anyone, and the sign-in logs show exactly who would have been affected:

Entra admin center → Sign-in logs → filter by Conditional Access → Report-only

Run it for at least a few business days — long enough to catch weekly patterns like a batch job that signs in once a week, which a two-day test would miss entirely.

Roll out by group, not tenant-wide

Once a policy looks safe in report-only mode, enable it for a pilot group before switching it to “All users”:

# Example: scope a Conditional Access policy to a pilot group via Graph PowerShell
$policy = Get-MgIdentityConditionalAccessPolicy -ConditionalAccessPolicyId $policyId
$policy.Conditions.Users.IncludeGroups = @($pilotGroupId)
Update-MgIdentityConditionalAccessPolicy -ConditionalAccessPolicyId $policyId -BodyParameter $policy

Expand the pilot group over a few waves. If something breaks, it breaks for a controlled set of people you can reach directly — not the whole company at once.

Document the “why”, not just the “what”

A year from now, nobody will remember why a policy requires compliant devices for one app but not another. A short note next to each policy — what it’s protecting against, and why the exclusions exist — saves far more time than it costs to write.