The previous post covered how to enable Conditional Access safely — the evaluation logic, the prep work, the report-only phase, the rollback plan. This post answers the next question: which policies should you actually deploy?

The answer depends on where your tenant is. An SMB with 20 users and no Intune has different needs than a regulated finance org with 2,000 managed devices. Trying to deploy the same policy set for both is how you end up with either a false sense of security or a flood of lockout tickets.

The framework below is built on j0eyv’s ConditionalAccessBaseline — a community-maintained set of 30+ pre-configured CA policy templates with a systematic naming convention, organised by persona. I’ve mapped every policy to one of three tiers based on licence requirements, infrastructure dependencies, and user friction. Start at Level 1. Prove it works. Promote upward.


The Three Levels

Conditional Access tiered framework — three levels showing policies organised by category and maturity

Level 1 — Foundational

Licence: Entra ID P1 (no Intune required) Target: Any organisation, SMB, BYOD-heavy, no device management Friction: Minimal

These are the policies every tenant should have, full stop. They require only Entra ID P1, don’t depend on device management, and the user impact is limited to MFA prompts (which your users should already be accustomed to if you’ve been running Security Defaults).

Nine policies cover the essentials: MFA for all user personas (global, admins, internals, service accounts, guests), legacy auth blocking, device registration protection, and authentication flow restrictions.

Level 2 — Managed

Licence: Entra ID P1 + Intune Target: Organisations with managed devices Friction: Moderate

Level 2 adds device trust, session controls, and app protection. These policies assume you have Intune deployed and compliance policies configured — if you haven’t done that yet, the Intune compliance tiered framework is the companion piece.

This tier introduces device compliance requirements, sign-in frequency controls, persistent browser restrictions, app protection policies for BYOD/mobile, geo-blocking via named locations, and continuous access evaluation (CAE). It’s a significant step up in security posture, but it requires infrastructure that Level 1 doesn’t.

Level 3 — High Security

Licence: Entra ID P2 Target: Regulated industries — finance, legal, healthcare, government Friction: High

Level 3 adds risk-based policies that require Entra ID Protection (P2). Sign-in risk and user risk detection, phishing-resistant MFA for all users (not just admins), and agent risk blocking. These are powerful controls, but they need P2 licensing and careful tuning to avoid false positives on risk detections.

The golden rule: start at Level 1 and promote upward as the tenant’s maturity increases. Never start at Level 3.


Policy Mapping by Persona

The j0eyv baseline organises policies by persona — the type of account the policy targets. This is a deliberate design choice: rather than one giant “All Users” policy that tries to do everything, you get specific policies scoped to specific account types. The naming convention makes the scope visible at a glance: CA[number] — [Persona]-[Category]-[Target]-[Platform]-[Control].

Full policy mapping showing all 30+ policies organised by persona with tier colour coding

Global (CA000–CA006)

Global policies apply to all users across the tenant. These are your broadest controls.

PolicyTierWhat it doesWatch out for
CA000 — Global MFAL1MFA for all users, all appsCore baseline. Deploy after legacy auth block.
CA001 — Country WhitelistL2Blocks sign-ins from outside allowed countriesUpdate named locations first — defaults to BE/LU/NL. See the geo-blocking discussion before enabling.
CA002 — Block Legacy AuthL1Blocks IMAP, POP3, SMTP basic authZero user friction. Deploy this first — it’s the safest CA policy to enable.
CA003 — Device Register MFAL1MFA required for device registration/joinDisable the Entra “require MFA to join” tenant setting first to avoid double-gating.
CA004 — Authentication FlowsL1Blocks device code flow and auth transferPrevents token phishing attacks that abuse device code flow. Low friction.
CA005 — Unmanaged App ProtectionL2Requires app protection policy on unmanaged devicesRequires Intune APP policies configured first.
CA006 — iOS/Android App ProtectionL2MAM enforcement for mobile devicesPairs with CA005. Ensures managed apps on mobile.

Admins (CA100–CA105)

Admin accounts get their own policies because they need stricter controls. A compromised admin account is a compromised tenant.

PolicyTierWhat it doesWatch out for
CA100 — Admin Portals MFAL1MFA for admin portal accessAlways include — even if CA000 already requires MFA. Defence in depth.
CA101 — Admin Any App MFAL1MFA for all admin app accessPairs with CA100. At L3, replaced by CA105 (phishing-resistant).
CA102 — Sign-in FrequencyL2Forces re-authentication on admin sessionsConfigure frequency to suit the org — 4 hours is a common starting point.
CA103 — Persistent BrowserL2Disables persistent browser sessions for adminsAdmins should re-authenticate when they reopen the browser.
CA104 — Continuous Access EvaluationL2CAE enforcement for admin sessionsNear real-time token revocation. Requires supported apps.
CA105 — Phishing-Resistant MFAL3FIDO2/WHfB required for admin sign-inReplaces CA101 at this tier. Requires key distribution to admins.

Internals (CA200–CA209)

Internal users — your standard employees. The largest population, so policies here have the highest user impact.

PolicyTierWhat it doesWatch out for
CA200 — Internal MFAL1MFA for internal users, all appsFoundational. Same as CA000 but scoped to internals for granular reporting.
CA201 — Block High Risk UserL3Blocks users flagged as high risk by ID ProtectionRequires P2. Review risk detections before enabling — false positives happen.
CA202 — Sign-in Freq (Unmanaged)L2Re-auth on unmanaged Windows/MacTargets devices not enrolled in Intune. Friction for BYOD users.
CA203 — Intune Enrolment MFAL2MFA required for Intune enrolmentEnsures MFA before a device joins your management plane.
CA204 — Block Unknown PlatformsL2Blocks unsupported OS platformsReview which platforms your org actually uses before enabling.
CA205 — Windows Compliant or HAADJL2Windows must be compliant or Hybrid Azure AD JoinedThe device trust gate. Pair with your compliance baseline.
CA206 — Persistent BrowserL2Disables persistent browser for internal usersSame rationale as CA103 but broader scope.
CA207 — Selected Apps BlockL2Blocks access to specific applicationsReview the target app list in the JSON before enabling.
CA208 — macOS CompliantL2Requires macOS complianceOnly deploy if you have a Mac fleet. Needs macOS compliance policies.
CA209 — Continuous Access EvaluationL2CAE for internal user sessionsMirrors CA104 for the broader user base.

Service Accounts (CA300–CA301)

Service accounts are the forgotten attack surface. They authenticate frequently, often with elevated permissions, and nobody monitors them.

PolicyTierWhat it doesWatch out for
CA300 — Service Accounts MFAL1MFA for service accountsVerify service accounts can satisfy MFA. Some use client credential flows that bypass interactive MFA.
CA301 — Block Untrusted LocationsL2Blocks service account sign-ins from outside named locationsRequires named locations configured. Map your service account authentication sources first.

Guests (CA400–CA404)

Guest users are external identities collaborating in your tenant. They need their own policies because you don’t control their home tenant’s security posture.

PolicyTierWhat it doesWatch out for
CA400 — Guest MFAL1MFA for all guest usersEssential. You cannot trust the guest’s home tenant MFA.
CA401 — Block Non-Guest App AccessL2Restricts which apps guests can accessTightens guest scope to only the apps they need.
CA402 — Guest Sign-in FrequencyL2Re-authentication for guest sessionsGuests shouldn’t have persistent sessions into your tenant.
CA403 — Guest Persistent BrowserL2No persistent browser sessions for guestsPairs with CA402.
CA404 — Guest Selected Apps BlockL3Blocks guest access to specific sensitive appsReview target apps in JSON before enabling.

Agents (CA501)

A newer persona in the baseline — covers workload identities and automated agents.

PolicyTierWhat it doesWatch out for
CA501 — Block High Risk AgentL3Blocks agents flagged as high risk by ID ProtectionRequires P2. Protects against compromised service principals.

Deployment Order

Within each level, there’s an optimal order that minimises risk and maximises early wins.

Level 1 — Deploy in this order

  1. CA002 — Block Legacy Auth. Zero friction, zero user impact. Deploy first, always.
  2. CA004 — Authentication Flows. Blocks device code flow abuse. Also zero friction for normal users.
  3. CA003 — Device Register MFA. Protects the registration flow. Remember to disable the Entra tenant setting first.
  4. CA000/CA200/CA300/CA400 — MFA policies for each persona. Deploy in report-only, validate for 7 days, then enable per the enablement framework.
  5. CA100/CA101 — Admin MFA. These should be in place before or alongside the broader MFA policies.

Level 2 — Prerequisites first

Before enabling any Level 2 policy:

  • Intune enrolled with compliance policies deployed and validated (see Intune compliance tiered framework)
  • Named locations configured if you’re using CA001 or CA301
  • App protection policies configured in Intune if you’re using CA005/CA006

Then deploy in report-only, validate, enable. Same process as Level 1. One policy at a time.

Level 3 — Requires P2 and tuning

Level 3 policies depend on Entra ID Protection’s risk engine. Before enabling:

  • Enable risk detections and let them run for at least 14 days to establish a baseline
  • Review risk events — understand what your tenant’s normal risk profile looks like before you start blocking on it
  • Deploy phishing-resistant credentials (FIDO2 keys or Windows Hello for Business) to admins before enabling CA105

What This Framework Doesn’t Cover

This is a CA policy baseline, not a complete identity security programme. You still need:

  • Break-glass accounts excluded from every policy via a security group
  • A rollout process — report-only first, always (covered in the enablement guide)
  • Monitoring — sign-in log analysis, CA gap analyser workbook, break-glass usage alerts
  • Ongoing review — quarterly policy audits, break-glass testing, scope creep checks

The j0eyv baseline gives you the policies. The enablement framework gives you the process. Together, they’re a complete system for deploying CA without the usual terror.


References