What is the difference between MFA and Conditional Access?

MFA is one control: prove who you are with a second factor. Conditional Access is the policy engine that decides when that second factor is required, when it can be skipped, and when access should be refused entirely. Without the policy engine you are stuck with one setting for every person, device and location, which is why prompts stop meaning anything.

Can we use Conditional Access on Business Standard?

Not on its own. Conditional Access is an Entra ID P1 capability, so you either add P1 to your Business Standard licences or move to Business Premium, which includes it. Business Standard on its own can use security defaults, which give you baseline MFA and blocked legacy sign-in but no policies you can shape.

Are security defaults enough?

They are much better than nothing and they are free: MFA for all users, MFA for admins, legacy authentication blocked. What they cannot do is exempt a trusted office location, require a compliant device, act on risk signals, or hold administrators to a phishing-resistant method. If you handle client data or money, that gap is the reason to buy P1.

Do we need a break-glass account?

Yes, one or two, excluded from every Conditional Access policy, with long unique passwords stored offline or in your password manager's most restricted vault. If the only administrator's phone is lost or their key breaks, this is the way back into your own tenant. Test that it works once a year and log every use.

Will this slow the team down?

It usually does the opposite. On a managed device from a known location, people see fewer prompts than they did with blanket MFA, because the policy has enough signals to decide the sign-in is unremarkable. The friction moves to the sign-ins that deserve it: new devices, new countries, and anything the risk engine flags.

Does Conditional Access stop ransomware?

Not directly, but it blocks the way most incidents start. Stolen or reused credentials are the common opening move, and Conditional Access removes the two easiest paths to using them: sign-in from an unmanaged device and sign-in over a legacy protocol that cannot enforce MFA. Treat it as the first link, with backup and endpoint protection behind it.

Conditional Access: The Microsoft 365 Upgrade Worth Paying For

The gap in most tenants

Most small businesses on Microsoft 365 have Business Basic or Business Standard. They get email, Teams, the Office apps and SharePoint. What they do not get is Conditional Access.

Without it, sign-in security is one blunt setting: prompt everyone for a second factor, every time, everywhere. It works, and it trains people to approve prompts without reading them. That is what attackers exploit when they send prompt after prompt until somebody taps approve.

With Conditional Access, the prompt becomes a decision. Microsoft's own description of it is a policy engine that looks at the user, the location, the device state and the risk signals at sign-in, then allows, challenges or blocks^[1]. Same office, same managed laptop, Tuesday morning: straight in. New country, unmanaged device, odd hour: challenged or blocked.

Why it is worth the licence

The second factor itself is the control that does the heavy lifting. Microsoft's research on its own sign-in data measured MFA reducing the risk of account compromise by 99.22%, and by 98.56% on accounts whose password had already leaked^[2].

How much MFA reduced account compromise risk

Even on accounts whose password had already leaked, the second factor removed almost all of the risk.

Show the data

Range chart showing that multi-factor authentication reduced the risk of account compromise by 99.22 percent across all accounts Microsoft measured, and by 98.56 percent on accounts whose password had already leaked.
Category	Reduction in compromise risk
All accounts measured	99.22%
Accounts with a leaked password	98.56%

Source: Microsoft, How effective is multifactor authentication at deterring cyberattacks? (2023)

Conditional Access is what makes that number survive contact with your team, because it removes the prompts that do not carry information and keeps the ones that do. It also closes the bypass: legacy sign-in protocols that cannot do MFA at all, which Microsoft documents blocking with a dedicated policy^[3].

Without Conditional Access	With Conditional Access
MFA on every sign-in, everywhere	MFA when the conditions call for it
Old protocols can sidestep MFA	Legacy sign-in blocked outright
No idea whether the device is managed	Unmanaged devices kept out of your files
No risk signals	Impossible-travel and leaked-credential sign-ins blocked
Admins treated like everyone else	Admins required to use a stronger method

The five policies to start with

You do not need twenty policies. Microsoft publishes a set of common ones, and five of them cover most of the realistic risk for a small business^[4].

1. Block legacy authentication

Old mail protocols that cannot present a second factor. Nothing in a 2026 business needs them, and they are the standard route around MFA^[3].

Setting	Value
Users	All users
Apps	All cloud apps
Client apps	Exchange ActiveSync, other clients
Control	Block

2. Require MFA for everyone

The baseline, with your break-glass admin account excluded.

3. Require a stronger method for admins

Global, security and Exchange administrators get their own policy, set to require a phishing-resistant method such as a FIDO2 security key rather than a push notification.

4. Require a compliant device for your files

SharePoint and Exchange hold the data that matters. Requiring a device that Intune reports as enrolled, encrypted and patched turns "we think our laptops are fine" into an enforced condition^[5].

5. Block high-risk sign-ins

Entra ID's risk detections cover things like impossible travel and credentials seen in a leak. This policy blocks the high-risk ones and lets you review them afterwards.

Deploy all five in report-only mode first. You will find at least one service account or one shared mailbox that nobody remembered, and you would rather find it in a report than in a support call.

What it costs

Conditional Access needs Microsoft Entra ID P1, which is sold per user as an add-on and included in Microsoft 365 Business Premium^[6]. Business Basic and Business Standard do not include it, and the current per-user pricing across the business plans is published by Microsoft^[7].

For a 15-person team there are two sensible routes. Add Entra ID P1 to your existing Business Standard licences, which buys Conditional Access and nothing else. Or move to Business Premium, which bundles P1 with Intune and Defender for Business, and is the better value if you were going to need device management anyway - which, if you are enforcing policy 4, you are.

What you get for that upgrade is worth naming plainly: one account compromise in a small tenant costs days of investigation, a tenant-wide reset, and often a client-facing disclosure. The licence is a rounding error against that.

Security defaults are not the same thing

If you have no P1 licence, turn on security defaults. They give you MFA for everyone, MFA for admins and legacy authentication blocked, at no cost^[8]. What they cannot do is make exceptions for trusted locations, check device compliance, act on risk signals, or hold admins to a stronger method. They are training wheels, and they are much better than nothing.

Actually

If you are on Business Basic or Standard with no Conditional Access, you have the second factor without the judgement. The five policies above take an afternoon, including report-only testing, and the licence is a few euros per person per month.

If you want help deciding between the P1 add-on and Business Premium, and getting the policies deployed without locking anyone out, book a free 30-minute call.

Questions we get asked

Sources

Every figure in this article traces back to a named source. Where we quote our own numbers, they come from work we have done with small businesses in Israel and across Europe, and we say so.

Figures last checked 21 August 2026