AB-650 Step by step · Lab 8

3 Conditional Access Templates Every Tenant Needs First

Create MFA for admins, MFA for everyone and block legacy auth from Entra templates in report-only mode, test with What If, then add ID Protection.

8 November 2026 · 5 min read

Conditional Access policies list with four policies in report-only mode — Watch the lesson: Lab 8: Conditional Access, MFA and ID Protection | AB-650 Microsoft 365 Step By Step

Conditional Access decides who gets in, from where, and with what proof. Three policies give most tenants the biggest gain for the least effort: MFA for admins, MFA for everyone, and block legacy authentication, because old mail protocols cannot do MFA at all.

The safe way to add them is from Microsoft’s templates, in report-only mode first. This is Lab 8 of the AB-650 course.

Before you start

Create two break-glass accounts: cloud-only Global Administrators, excluded from every policy.
Security defaults cannot run alongside policies that are On. You turn them off when you switch your policies on.
Run each policy in report-only first. (In the shared course tenant, security defaults stay on, so our policies stay report-only.)

Step 1: Create the policies from templates

Entra → Conditional Access → Policies → New policy from template.
Under Secure foundation, choose Require multifactor authentication for admins, then Review + Create.

Create new policy from templates: Require multifactor authentication for admins, policy state report-only — The template fills everything in. Policy state: report-only, already chosen.

The template excludes the signed-in admin, so you cannot lock yourself out, and includes fourteen admin roles, all apps, and grant with MFA.

Template review listing the included admin roles such as Global Administrator and Security Administrator — The admin roles the template covers.

Repeat with Require multifactor authentication for all users and Block legacy authentication, each in report-only.

Conditional Access policies: four user-created policies, all report-only — Four policies, all report-only. Every sign-in now records what they would have done, without stopping anyone.

Step 2: Test with What If

What if Lynne signs in? User Lynne Robbins, cloud app Office 365 Exchange Online, from Windows in a browser.

What If result: Require multifactor authentication for all users applies, report-only — MFA for all users applies. The admin policy does not, because Lynne is not an admin.

Run the same sign-in from an old mail client (Other clients), and Block legacy authentication applies too.

Step 3: Add risk with ID Protection

ID Protection → Dashboard shows attacks blocked, and the users and sign-ins Microsoft scores as risky, from leaked credentials to anonymous IP addresses. From Risky users and Risky sign-ins you confirm compromise or dismiss the risk.

ID Protection dashboard: number of attacks blocked and risky users — The fix for risk is again Conditional Access: MFA for risky sign-ins, and a secure password change for high-risk users.

How you know it worked

What If shows the expected policies for each test sign-in, and Insights and reporting shows what report-only policies would have done to real sign-ins. Watch it for a week before enforcing.

The rollout, in order

Check Insights and reporting for a week.
Exclude the break-glass accounts.
Turn security defaults off, then switch the policies on.
Then add the risk-based policies from ID Protection.

Do it yourself

Lab guides, practice and full mock exams come with a subscription. See the plans