FR-04 · Program · Worldwide Clinical Trials · 2021–2026
Conditional Access, measured before it enforces
Report-only first, a full business cycle of data, exported state before every change, and code review for the automation.
- users in scope
- 4,300
- full business cycle in report-only before enforcement
- 1
Context
Conditional Access policies decide every sign-in in the tenant. A policy that looks right in the portal can still lock out a region, a service account, or a process that only runs at month end.
Constraints
- 4,300 users across multiple countries.
- Device compliance data had to exist before device-based policy could depend on it.
What I did
- Ran every new policy in report-only mode through a full business cycle before enforcing it.
- Held device-based Conditional Access until Intune compliance data existed to feed it.
- Exported policy state before every change.
- Kept the PowerShell and Microsoft Graph automation in Azure DevOps, with branches and pull-request review, for about two years.
Outcome
New policies reached enforcement with a business cycle of report-only data behind them. The same approach is published as policy-as-code in the Entra Authentication Ops Toolkit, which diffs policy snapshots and exits non-zero on drift so CI can catch it.
Related
Field Notes
- The Secure foundation setSheet 10 / 30
Tags
- Conditional Access
- Intune
- Microsoft Graph
- Azure DevOps