Conditional Access Policies · Microsoft 365 Security Checkliste

Skillplan M365 Checklist

2026-07-20 19:31

Bewertungsfortschritt 0 / 136 Elemente 0%

Bisherige Erfüllung 0 / 0 Kontrollen 0%

Require MFA for all users for all cloud apps as the baseline Conditional Access policy.

Block sign-ins from unsupported device platforms by explicitly allow-listing only the platforms in use.

Block sign-ins from countries where the organization has no presence using Named Locations.

Require compliant or hybrid-joined devices for access to Microsoft 365 services.

Require Intune App Protection Policies for mobile access to Outlook, Teams, and OneDrive.

Disable persistent browser sessions on unmanaged devices via Conditional Access session controls.

Enforce sign-in frequency of at most 24 hours on unmanaged devices.

Run every new policy in Report-only mode for at least 7 days before switching it On.