Policy design
Set authentication, device, location and risk conditions for each user group and application.
Entra ID & Conditional Access
Conditional Access policies are the rules in Microsoft Entra ID that decide whether a sign-in is allowed, blocked or must meet extra conditions, such as multi-factor authentication (MFA) or a compliant device. Umbrella Tech designs, tests and deploys Conditional Access for Australian organisations using report-only evaluation, pilot groups and a staged rollout, so access is tightened without locking out the people who need it.
The problem
The challenge we help you address
Policies introduced without testing can block essential access. Policies that are too broad or contain poorly understood exclusions can also create gaps that remain hidden until an incident.
The outcome
What the engagement should deliver
You receive a policy set with a clear rationale for each rule, deployment evidence and operational guidance. This page focuses on access decisions; broader identity platform design is covered by our Entra ID service.
How we can help
Report-only evaluation
Run new policies in report-only mode and review sign-in logs before enforcing them.
Pilot and rollout
Test with representative users, then enforce in stages with clear communication to staff.
Emergency access
Exclude and protect break-glass accounts, and document a rollback approach.
Ongoing review
Record exceptions, naming conventions and who reviews the policy set.
How we deliver
How a Conditional Access rollout runs
01
Review sign-in patterns
Examine current sign-ins, legacy authentication, service accounts and devices so policies reflect how people actually work.
02
Design and run in report-only
Build policies against the agreed baseline and run them in report-only mode to see who would be affected.
03
Pilot
Enforce for a representative pilot group, resolve issues and confirm emergency access still works.
04
Enforce in stages
Extend enforcement in planned stages, monitor sign-in logs and hand over the documented policy set.
Frequently asked questions
Can't see your question? Ask us directly →
What are Conditional Access policies?
They are if-then rules evaluated at sign-in: when a user, application, device or location matches the conditions, the policy grants access, requires something extra such as MFA, or blocks the attempt. Older guides call this Azure AD Conditional Access, from before Azure Active Directory was renamed Microsoft Entra ID.
When should a business use them?
When you need MFA enforced consistently, want to block legacy authentication, or need access to depend on device compliance or location. Conditional Access requires Microsoft Entra ID P1 or higher, which several Microsoft 365 plans include.
How do you reduce the risk of locking users out?
We examine dependencies, test representative scenarios and plan a staged rollout. Emergency access arrangements and a rollback approach are in place before any policy is enforced.
How long does a project take?
It depends on the number of policies, user groups, service accounts and applications involved, and how long report-only data needs to be collected. Scope and timing are confirmed in discovery.
What are the main security or governance considerations?
Every exclusion is a potential gap, so exclusions are documented, owned and reviewed. Policy changes should go through change control, and Conditional Access is a core building block of Zero Trust Implementation.
Plan the next improvement
Tell us what concerns you most about your environment and what evidence you need to show.