Key Takeaways

  • Conditional Access is the "if this, then that" engine that decides who can sign in to your Microsoft 365, from where, on what device, and with what kind of MFA.
  • It has grown from a single device-compliance check in 2016 into a platform that governs users, service accounts, network paths, and now AI agents.
  • Microsoft is increasingly writing policies for you (security defaults, Microsoft-managed policies, Baseline Security Mode, mandatory MFA) — which is great, unless nobody on your team knows what those policies are about to change.
  • Big dates ahead: Sept 1, 2026 passkeys become the default method, and Feb 1, 2027 Microsoft retires SMS and voice-call MFA.
  • If you have Microsoft 365 Business Premium, you already own Conditional Access (Entra ID P1). Most Tampa Bay small businesses we meet have it and aren't using it.

If you've ever been asked to approve a sign-in on your phone, been blocked from opening company email on a personal laptop, or wondered why your accountant can log in from home but not from a hotel in another country, you've already met Microsoft Conditional Access. It is the policy engine inside Microsoft Entra ID (formerly Azure Active Directory) that sits between every login and every Microsoft 365 app, and it's the single most important security control most small businesses own but never configure.

Conditional Access has changed a lot since it first appeared, and Microsoft's pace of change has only accelerated. This post walks through every major milestone in one place, explains what each one meant for a business like yours, and finishes with how Landshark IT designs, tests, and rolls out Conditional Access for organizations across Tampa Bay.

What Conditional Access Actually Does

Think of it as a bouncer with a rulebook. Every time someone (or something) tries to sign in, Entra ID collects signals — who the user is, what group they're in, what app they want, what device they're on and whether it's managed, where the request is coming from, and how risky the sign-in looks. Conditional Access compares those signals to your policies and makes a decision: allow, block, or allow only if a condition is met (require MFA, require a compliant device, require a phishing-resistant sign-in method, limit the session, and so on).

The power is in the combinations. "Require MFA for everyone" is a good start. "Require phishing-resistant MFA for admins, block legacy protocols entirely, require a company-managed device for anyone touching client files, and re-check every few minutes if the user's risk level changes" is what a properly built tenant looks like in 2026.

The Timeline: Every Major Conditional Access Change

Dates below are the month Microsoft announced general availability (GA) unless marked as a preview. Where Microsoft's own posts and third-party coverage differ by a few weeks, we've used Microsoft's date.

Era 1 · 2014–2016 · The Foundations
  • April 2014 Azure AD Premium launches

    The paid identity tier that would house every Conditional Access feature to come. At launch it brought self-service password reset, group management, and per-user MFA settings — the "legacy MFA" that Microsoft would spend the next decade retiring.

  • March 2016 Azure AD Identity Protection enters public preview

    Microsoft's first risk-based policies: block or challenge a sign-in when it looks like a leaked credential, an impossible-travel login, or an anonymous IP. This is the seed of what later becomes "risk-based Conditional Access."

  • July 2016 MFA and location-based Conditional Access policies reach GA

    The first generally available policy controls in the Azure portal: require MFA for specific apps, or require it only when a user signs in from outside your trusted IP ranges.

  • September 2016 Azure AD Premium P2 arrives

    Identity Protection and Privileged Identity Management go GA under a new higher tier. The P1/P2 split created here still defines Conditional Access licensing today: P1 for the policy engine, P2 for the risk signals that feed it.

  • October 2016 Device-based Conditional Access goes GA

    The milestone most people consider the "birth" of Conditional Access as we know it. Policies could now require a device to be enrolled in Intune and marked compliant before granting access to Exchange, SharePoint, and other cloud apps, across iOS, Android, and Windows.

Era 2 · 2017–2019 · Growing Up
  • November 2017 macOS device-based and app-based policies go GA

    Mac users could finally be held to the same device-compliance bar as Windows users, and "require approved client app" let you insist on the Outlook mobile app instead of the built-in mail app on a phone.

  • January 2018 The "What If" tool arrives (preview)

    The first simulation tool: pick a user, app, location, and device, and see which policies would apply before you lock the CEO out. Microsoft noted Conditional Access was already protecting more than 10,000 organizations.

  • June 2018 Baseline policies (preview)

    Microsoft's first attempt at one-click, pre-built protection, starting with "Require MFA for admins." It was announced alongside a sobering stat: identity attacks were up 300% year over year.

  • October 2019 Security defaults

    Every tenant created on or after October 22, 2019 got MFA registration, admin MFA, and legacy-authentication blocking turned on for free — no Conditional Access license required. Baseline policies were deprecated in favor of this simpler on/off switch. Security defaults remain the right answer for tenants that don't own Entra ID P1, and the wrong answer for anyone who needs exceptions.

  • November 2019 Report-only mode (preview)

    Announced at Ignite, report-only mode let admins deploy a policy that logs what it would have done without enforcing it. Paired with the new Conditional Access Insights workbook, this turned deployments from a leap of faith into a measured rollout. It's how every Landshark deployment starts.

Era 3 · 2020–2022 · Modern Conditional Access
  • May 2020 Report-only mode, Insights & Reporting, and troubleshooting go GA

    "Test before you enforce" becomes a supported, production practice.

  • October 2020 Continuous Access Evaluation (preview)

    Until now, a sign-in token was good for roughly an hour no matter what happened. CAE lets Entra ID and apps like Exchange and SharePoint revoke access within minutes when a user is disabled, a password changes, or a session moves to an untrusted location.

  • March–May 2021 Authentication context and device filters (preview)

    Authentication context let a policy protect a specific action or piece of data (for example, files with a "Highly Confidential" sensitivity label) rather than an entire app. Device filters added rule-based targeting on any device attribute, which is how you carve out a policy for privileged access workstations or a single problem model of laptop.

  • January 2022 Continuous Access Evaluation goes GA

    The window for a stolen token shrinks from an hour to minutes for supported services — a meaningful blow to session-hijacking attacks.

  • May–June 2022 Policy templates (preview) and security defaults for existing tenants

    Microsoft shipped pre-built templates covering its recommended policy set, and began automatically enabling security defaults on older tenants that had never turned on MFA — roughly 60 million accounts.

  • June 2022 Conditional Access for workload identities

    For the first time, policies could apply to service principals and app registrations, not just people. It requires a separate Workload Identities Premium license.

  • October 2022 Authentication strengths (preview)

    Instead of "require MFA" meaning any MFA, policies could now demand a specific tier: standard MFA, passwordless, or phishing-resistant (FIDO2 keys, passkeys, Windows Hello for Business, certificates). This is the feature that makes MFA-bypass phishing kits stop working.

Era 4 · 2023–2024 · The Entra Era
  • March 2023 Authentication strengths GA; token protection and protected actions (preview)

    Phishing-resistant MFA becomes a supported policy control. Token protection binds a sign-in token to the device it was issued to so a copied token is useless elsewhere. Protected actions let you require step-up MFA before someone can, say, edit the Conditional Access policies themselves. Microsoft also announced that the legacy per-user MFA and SSPR policy pages would stop being manageable on September 30, 2025.

  • July 2023 Azure AD becomes Microsoft Entra ID

    A rename, not a re-license: Azure AD Premium P1 and P2 became Entra ID P1 and P2 with no pricing change. Every screen, document, and PowerShell module you'll touch from here on uses the Entra name.

  • August 2023 Protected actions, the Conditional Access overview dashboard, and templates go GA

    Templates became the recommended way to deploy Microsoft's baseline set of policies, and the new dashboard gave admins a single view of coverage gaps.

  • November 2023 Microsoft-managed Conditional Access policies

    A turning point: Microsoft began creating policies inside customer tenants — MFA for admin portals, MFA for users still on per-user MFA, and MFA for high-risk sign-ins (P2). They arrive in report-only mode and switch themselves on after a review window if you don't act. Microsoft cited the numbers behind the move: over 4,000 password attacks blocked every second, and MFA adoption sitting at just 37%.

  • July 2024 Global Secure Access goes GA

    Microsoft's Security Service Edge (Internet Access and Private Access) launched with a new Conditional Access signal: the compliant network condition, which can require Microsoft 365 traffic to arrive through Microsoft's own network path — another defense against replayed tokens.

  • August–October 2024 Mandatory MFA for Azure and admin portals

    Announced in August and enforced from October 2024 (Phase 1), Microsoft required MFA to sign in to the Azure portal, Entra admin center, and Intune admin center regardless of your policies or license. Microsoft 365 admin center followed in early 2025. Around the same time, security defaults lost the 14-day "skip MFA setup" grace period.

Era 5 · 2025–2026 · Agents, Passkeys, and Microsoft Doing It For You
  • March–July 2025 Conditional Access Optimization Agent (preview → GA)

    A Security Copilot agent that reviews your tenant, finds users and apps not covered by policy, and drafts the fix. It went GA in mid-2025 alongside a public "What If" API and a policy for "all Microsoft apps."

  • September 30, 2025 Legacy MFA and SSPR policies retired

    Authentication methods can no longer be managed in the old per-user MFA portal. Everything lives in the unified Authentication Methods policy — and any tenant that hadn't migrated found out the hard way.

  • October 2025 Mandatory MFA Phase 2

    MFA enforcement extended to Azure CLI, PowerShell, REST APIs, and infrastructure-as-code tools for create, update, and delete operations. Organizations could postpone until July 1, 2026 — that window has now closed. Also new: soft-delete and restore for Conditional Access policies, so an accidental deletion is no longer catastrophic.

  • November 2025 (Ignite) Conditional Access for AI agents, and Baseline Security Mode

    With Entra Agent ID, Conditional Access policies can now target agent identities — including a "block high-risk agents" control. Separately, the Microsoft 365 admin center gained Baseline Security Mode, which rolls out Microsoft-managed policies that block legacy authentication and require phishing-resistant MFA for 19 admin roles. Rollout ran through January 2026.

  • January–March 2026 Tighter enforcement, external MFA, and PIM re-authentication

    "All resources" policies with exclusions are now enforced more strictly; the "require approved client app" grant was scheduled for retirement in June 2026 in favor of app protection policies; third-party MFA providers can satisfy Conditional Access (External MFA GA); and Conditional Access can require fresh authentication on every PIM role activation.

  • July 2026 Price increase, stronger free tier, and agent licensing

    Entra ID P1 moved from $6 to $7 per user per month and P2 from $9 to $10 (applied at renewal). Security defaults on new tenants now also block device code flow, a favorite phishing technique. New "Conditional Access for Agents" service plans arrived bundled with Microsoft Agent 365 and Microsoft 365 E7.

  • Announced July 2026 — effective Sept 1, 2026 and Feb 1, 2027 Passkeys become the default; SMS and voice MFA retired

    The largest change to MFA methods since authentication strengths. From September 1, 2026, passkeys are the default authentication method Microsoft steers users toward. On February 1, 2027, Microsoft retires SMS text and voice-call MFA entirely. If your staff still approve logins with a text message, this is your deadline.

  • August 2026 Faster auto-enablement and cross-platform token protection

    The review window before Microsoft-managed policies switch themselves on was shortened to 30 days. Token protection for native apps reached GA on iOS and macOS. Microsoft also announced a CSP add-on that brings Entra ID P2 to Microsoft 365 E3 customers, and that from October 2026 Windows Hello for Business and Platform SSO count as standalone MFA.

What This History Means for a Tampa Bay Business

Three themes run through that timeline. First, Microsoft is steadily moving from "here's a tool" to "we've turned it on for you." Security defaults, Microsoft-managed policies, mandatory MFA, Baseline Security Mode, and a 30-day auto-enable window all mean that changes will land in your tenant whether or not anyone is watching. That's good for security and bad for the Monday morning when the office manager can't get into QuickBooks Online and nobody knows why.

Second, the definition of "good MFA" keeps rising. A text message was fine in 2016. Today Microsoft treats it as a liability and is deleting it in February 2027. Phishing-resistant methods — passkeys, FIDO2 keys, Windows Hello for Business — are the new floor, and Conditional Access authentication strengths are how you enforce that floor.

Third, the scope keeps widening. Conditional Access started with people and phones. It now covers service accounts, network paths, admin actions, and AI agents. Every one of those is an attack surface that a policy written in 2020 doesn't cover.

A Quick Licensing Reality Check

Conditional Access requires Microsoft Entra ID P1, which is included in Microsoft 365 Business Premium and Microsoft 365 E3/E5. If you're on Business Basic, Business Standard, or Office 365 E1/E3, you have security defaults only — no custom policies. Risk-based policies (sign-in risk, user risk) need Entra ID P2, included in E5 or available as an add-on. Not sure which you have? That's the first thing we check.

How Landshark IT Sets Up Conditional Access

Landshark IT has managed Microsoft 365 tenants for Tampa Bay law firms, medical practices, manufacturers, and financial services firms since 2008, and our principal consultant's background as a Navy cryptologist and NSA security specialist shapes how we approach identity: assume the password is already stolen, and build the policies that make that not matter. Here's how an engagement works.

01

Tenant & Licensing Assessment

We inventory your licenses, current policies (including any Microsoft-managed ones already in report-only), legacy per-user MFA settings, MFA registration rates, and which sign-in methods your staff actually use — especially SMS.

02

Policy Design

Starting from Microsoft's templates and our own baseline, we design a policy set around your business: MFA for everyone, phishing-resistant MFA for admins, legacy auth blocked, managed devices for sensitive data, sensible location rules, and break-glass accounts so you're never locked out.

03

Report-Only Rollout

Every policy goes live in report-only mode first. We review the sign-in logs and Insights workbook, fix the surprises (that one scanner that still uses basic auth, the bookkeeper's personal iPad), then enforce in phases.

04

MFA & Passkey Migration

We move users off SMS and voice before the February 2027 cutoff, roll out Microsoft Authenticator and passkeys with clear instructions, and enforce authentication strengths so the upgrade sticks.

05

Device Compliance with Intune

Conditional Access is only as strong as its device signal. We pair policies with Intune enrollment and compliance rules so "require a compliant device" means encrypted, patched, and protected.

06

Ongoing Management

As part of our managed services, we track Microsoft's roadmap, review Microsoft-managed policies before they auto-enable, adjust for staff changes, and document every policy so it makes sense to your auditor, your insurer, and your next IT person.

For law firms and medical practices, we also map policies to what your cyber-insurance application and compliance obligations actually ask for — MFA on email, MFA on remote access, and MFA for privileged accounts — so the answer on the renewal form is a confident yes.

Where to Start

If you have Microsoft 365 Business Premium and have never opened the Conditional Access blade, you're paying for a security system with the alarm switched off. If you've got a handful of policies someone built in 2021, there is a good chance they predate authentication strengths, token protection, and the SMS retirement, and they need a second look. Either way, the first step is a short assessment, and the second step is a report-only rollout that nobody in the office will notice until the day it saves you.

Contact Landshark IT or call 727-755-3493 to schedule a Conditional Access assessment for your Tampa Bay organization.

Sources