Enforcing MFA for All Users with Conditional Access

Lab Metadata

Core technologies

Scenario and Description

Lab 02 made Microsoft Authenticator available and migrated Northgate off SMS. But a factor being registered does not mean it is demanded. Entra will only challenge a user for MFA when something tells it to, and that something is Conditional Access. Right now a user at Northgate with a leaked password can still sign in without a second factor, because nothing requires one. This lab closes that gap.

Conditional Access is the policy engine that evaluates each sign-in against signals (who, what app, what device, what location, what risk) and applies controls (require MFA, require a compliant device, block). It is the heart of a Zero Trust posture and the mechanism behind the brief's requirement to "ensure MFA is enforced on all user accounts".

Conditional Access is also the single most effective way to lock yourself out of your own tenant. A policy that requires MFA from all users, applied to all apps, with no exclusions, can trap every administrator, including you, if their session is challenged and cannot respond. This lab therefore front-loads the two controls that make Conditional Access safe: dedicated break-glass emergency accounts that are excluded from policy, and a report-only rollout that shows you the impact before a single user is actually blocked.

Prerequisites

Prior labs

Labs 01 and 02 are required. The personas and the migrated Authenticator methods from Lab 02 mean users have a factor to satisfy the policy you are about to enforce. Conditional Access requires Entra ID P1, which your Lab 01 trial provides.

Graph scopes introduced

Real-World Problem Statement

Every organisation needs MFA enforced, and every organisation needs a guaranteed way back in if MFA infrastructure fails or a policy misfires. These two needs pull against each other, and the resolution is a deliberate design: enforce broadly, exclude a tiny, monitored set of emergency accounts, and never roll out blind.

Concrete scenario: Northgate's CISO wants MFA enforced for the whole company by month end, with a written guarantee that the security team cannot be locked out. You deliver a report-only policy this week, a validated impact report, then enforcement, plus two governed break-glass accounts documented for the audit file.

Skills Mapped to Production Solutions

Architecture Overview

A sign-in is evaluated against every enabled Conditional Access policy. The design here layers two policies over a foundation of excluded emergency accounts: a broad "MFA for all users" policy, and a stricter "MFA for admins" policy. Break-glass accounts are excluded from both.

Step-by-Step Implementation

Phase A - Build the safety net first

Connect-MgGraph -Scopes 'Policy.ReadWrite.ConditionalAccess','Application.Read.All',
  'User.ReadWrite.All','Group.ReadWrite.All','RoleManagement.ReadWrite.Directory',
  'AuditLog.Read.All' -NoWelcome

$domain = (Get-MgOrganization).VerifiedDomains | Where-Object IsDefault | Select-Object -ExpandProperty Name

# 1. Exclusion group that break-glass accounts belong to.
$bg = New-MgGroup -DisplayName 'CA-Exclude-BreakGlass' -MailEnabled:$false `
  -MailNickname 'ca-exclude-breakglass' -SecurityEnabled:$true

# 2. Two emergency accounts with long random passphrases.
Add-Type -AssemblyName System.Web
1..2 | ForEach-Object {
  $upn = "breakglass$_@$domain"
  $pw  = [System.Web.Security.Membership]::GeneratePassword(40,8)
  $u = New-MgUser -DisplayName "Break Glass $_" -UserPrincipalName $upn `
        -MailNickname "breakglass$_" -AccountEnabled `
        -PasswordProfile @{ Password=$pw; ForceChangePasswordNextSignIn=$false } `
        -UsageLocation 'GB'
  New-MgGroupMember -GroupId $bg.Id -DirectoryObjectId $u.Id
  Write-Host "Created $upn"
  Write-Host "  RECORD THIS PASSPHRASE SECURELY: $pw" -ForegroundColor Yellow
}

# 3. Assign Global Administrator (template 62e90394-69f5-4237-9190-012177145e10) to both.
$gaTemplate = '62e90394-69f5-4237-9190-012177145e10'
$gaRole = Get-MgDirectoryRole -All | Where-Object RoleTemplateId -eq $gaTemplate
if (-not $gaRole) { $gaRole = New-MgDirectoryRole -RoleTemplateId $gaTemplate }
foreach ($n in 1..2) {
  $u = Get-MgUser -Filter "userPrincipalName eq 'breakglass$n@$domain'"
  New-MgDirectoryRoleMemberByRef -DirectoryRoleId $gaRole.Id -BodyParameter @{
    '@odata.id' = "https://graph.microsoft.com/v1.0/directoryObjects/$($u.Id)" }
}

Get-MgGroupMember -GroupId $bg.Id | ForEach-Object { $_.AdditionalProperties.userPrincipalName }
# Expected: breakglass1@... and breakglass2@...

Phase B - Author the policy in report-only

$params = @{
  displayName = 'CA001 - Require MFA for all users'
  state = 'enabledForReportingButNotEnforced'   # report-only
  conditions = @{
    users = @{
      includeUsers  = @('All')
      excludeGroups = @($bg.Id)                  # break-glass bypass
    }
    applications = @{ includeApplications = @('All') }
    clientAppTypes = @('all')
  }
  grantControls = @{
    operator = 'OR'
    builtInControls = @('mfa')                   # require multi-factor authentication
  }
}

$ca001 = New-MgIdentityConditionalAccessPolicy -BodyParameter $params
"Created policy $($ca001.Id) in state $($ca001.State)"

Get-MgIdentityConditionalAccessPolicy -ConditionalAccessPolicyId $ca001.Id |
  Select-Object DisplayName,State
# Expected State: enabledForReportingButNotEnforced

Phase C - Validate the blast radius

# Sign in as asmith in a private browser at https://office.com to create a log entry.
# Sign-in logs can take a few minutes to surface. Then query them:

$since = (Get-Date).AddHours(-1).ToString('yyyy-MM-ddTHH:mm:ssZ')
$signins = Get-MgAuditLogSignIn -Filter "createdDateTime ge $since" -Top 50

foreach ($s in $signins) {
  foreach ($p in $s.AppliedConditionalAccessPolicies) {
    if ($p.DisplayName -eq 'CA001 - Require MFA for all users') {
      [pscustomobject]@{
        User   = $s.UserPrincipalName
        App    = $s.AppDisplayName
        Result = $p.Result   # reportOnlySuccess / reportOnlyFailure / reportOnlyInterrupted / notApplied
      }
    }
  }
} | Format-Table -AutoSize

Phase D - Enforce

Update-MgIdentityConditionalAccessPolicy -ConditionalAccessPolicyId $ca001.Id `
  -BodyParameter @{ state = 'enabled' }

Get-MgIdentityConditionalAccessPolicy -ConditionalAccessPolicyId $ca001.Id |
  Select-Object DisplayName,State
# Expected State: enabled

Phase E - Persona-based: stricter policy for admins

# Common privileged role template IDs:
# 62e90394-69f5-4237-9190-012177145e10  Global Administrator
# 194ae4cb-b126-40b2-bd5b-6091b380977d  Security Administrator
# e8611ab8-c189-46e8-94e1-60213ab1f814  Privileged Role Administrator
# fe930be7-5e62-47db-91af-98c3a49a38b1  User Administrator

$adminParams = @{
  displayName = 'CA002 - Require MFA for admin roles'
  state = 'enabledForReportingButNotEnforced'
  conditions = @{
    users = @{
      includeRoles = @(
        '62e90394-69f5-4237-9190-012177145e10',
        '194ae4cb-b126-40b2-bd5b-6091b380977d',
        'e8611ab8-c189-46e8-94e1-60213ab1f814',
        'fe930be7-5e62-47db-91af-98c3a49a38b1'
      )
      excludeGroups = @($bg.Id)
    }
    applications = @{ includeApplications = @('All') }
    clientAppTypes = @('all')
  }
  grantControls = @{ operator = 'OR'; builtInControls = @('mfa') }
}

$ca002 = New-MgIdentityConditionalAccessPolicy -BodyParameter $adminParams
"Created $($ca002.DisplayName) in state $($ca002.State)"

Testing and Validation

1. Standard user: sign in as asmith in a private window. You are challenged for MFA. Approving the Authenticator prompt grants access.
2. Break-glass: sign in as breakglass1. You are not challenged by CA001 or CA002 (result notApplied). This proves your safety net.
3. Admin: sign in as jpatel. Both CA001 and CA002 evaluate, and MFA is required.
4. Regression check: re-run the Lab 01 baseline. Your posture story is now "MFA available (Lab 02) and enforced (Lab 03)".

Security Analysis

What makes this sound

• Recoverability by design: excluded, monitored break-glass accounts mean a policy error is never terminal.
• Evidence before enforcement: report-only converts a risky change into a measured one, with logs proving impact first.
• Separation of populations: admins sit in their own policy, so their controls can be tightened without touching everyone.

Intentionally simplified for the lab

• Break-glass sign-in alerting is described but not built. Production wires these accounts to a high-priority alert in your SIEM or via a Log Analytics alert rule.
• The all-users policy uses only the MFA control. Real deployments layer device compliance, sign-in risk and session controls.
• Legacy authentication protocols are not yet blocked. A dedicated "block legacy auth" policy is standard and pairs with this one.

Production hardening

• Add a policy that blocks legacy authentication protocols, which bypass MFA entirely.
• Alert on any creation or change of Conditional Access policies and on any break-glass sign-in.
• Review policies with the What If tool after every change, and keep policy definitions in source control.

Cleanup Instructions

# Delete the two policies.
foreach ($name in 'CA001 - Require MFA for all users','CA002 - Require MFA for admin roles') {
  $p = Get-MgIdentityConditionalAccessPolicy -Filter "displayName eq '$name'"
  if ($p) { Remove-MgIdentityConditionalAccessPolicy -ConditionalAccessPolicyId $p.Id }
}

# Remove break-glass accounts and their group.
$domain = (Get-MgOrganization).VerifiedDomains | Where-Object IsDefault | Select-Object -ExpandProperty Name
foreach ($n in 1..2) {
  $u = Get-MgUser -Filter "userPrincipalName eq 'breakglass$n@$domain'" -ErrorAction SilentlyContinue
  if ($u) { Remove-MgUser -UserId $u.Id }
}
$g = Get-MgGroup -Filter "displayName eq 'CA-Exclude-BreakGlass'"
if ($g) { Remove-MgGroup -GroupId $g.Id }
Disconnect-MgGraph

Recommended Learning Links

• Conditional Access overview
• Manage emergency access (break-glass) accounts
• Conditional Access report-only mode
• Graph API: conditionalAccessPolicy resource
• Conditional Access: target resources and roles

Key Takeaways and Next Lab

• Conditional Access is what actually enforces MFA. Availability without enforcement is not protection.
• Build the safety net first: excluded, monitored break-glass accounts are non-negotiable before any all-users policy.
• Report-only mode turns a dangerous change into a measured one, always validate the blast radius before enforcing.
• Keep admins in their own policy so their controls can be tightened independently of the estate.