This assumes Microsoft 365 Business Premium (or another SKU that includes Intune Plan 1 and Entra ID P1). On Business Standard you can require MFA through security defaults. You cannot honestly say “only a healthy, enrolled device may open mail.”

Authentication first

MFA for everyone who has a mailbox

Security defaults already turn MFA on for Microsoft 365 business tenants. Keep that until Conditional Access is ready. Then replace defaults with policies that:

  • Require MFA for all users, all clouds, including older protocols you still allow.
  • Block legacy authentication (IMAP/POP with a password). If a scanner or copier still needs it, give that device a dedicated mailbox and a tight exception, not a company-wide hole.
  • Prefer phishing-resistant methods where you can: Windows Hello for Business on company PCs, passkeys / FIDO2 for admins. SMS as the only factor is better than nothing and worse than an authenticator app or a passkey.

Conditional Access instead of “hope”

Entra P1 is what lets you say more than “MFA, always.” Useful first policies for a firm our size:

  • Admins: MFA every time, from a compliant device, no persistent browser session.
  • Everyone else: MFA, and a compliant Windows/macOS device or an app-protected iOS/Android client for Exchange and SharePoint.
  • Guests: MFA; no access to SharePoint unless the project actually needs it.
  • Impossible travel / unfamiliar locations: require MFA again or block, once you have looked at how your people travel.

Do not start with twenty policies. Three well-named policies beat a museum of unused drafts.

Break-glass accounts

Keep two cloud-only emergency accounts, long random passwords in a sealed process (not in the office password manager everyone uses), excluded from most CA policies, and monitored for any sign-in. If you never test them, they will not work the day Entra or your MFA vendor has an outage.

Intune: company devices

A company laptop should enroll during setup (Autopilot when you buy new hardware; a bulk or user enrollment for what you already own). Compliance we actually enforce on Windows:

  • BitLocker on, recovery key escrowed to Entra/Intune
  • Secure Boot and TPM where the hardware allows it
  • Defender antivirus real-time protection, signatures current
  • Firewall on
  • OS still in support — no “we’ll upgrade next year” for a machine that opens client files

Mark devices with no compliance policy as not compliant if Conditional Access is going to require compliance. Otherwise a brand-new machine that has not checked in yet looks healthy.

Lost or stolen: wipe from Intune. That is the feature owners remember after the first incident. It only works if the device was enrolled before it left the building.

BYOD: do not take over the phone

Most staff will not hand you their personal iPhone for full MDM, and you should not ask. App protection (MAM) is the adult answer:

  • Outlook, Teams, and OneDrive on iOS/Android get a PIN, encryption, and “copy/paste stays in the managed apps” rules.
  • A selective wipe removes company mail and files, not family photos.
  • Conditional Access can require an approved app with those protections, without the phone joining the corporate directory.

If someone needs full device control — a warehouse scanner, a kiosk, a shared tablet — that is a company device. Do not pretend a personal phone is a kiosk.

Shared and frontline devices

A front desk PC used by three people should not be “whoever logged in last Tuesday.” Use a shared-device or assigned-access model, or separate accounts that Intune can still constrain. Shared devices are also where dedicated Teams phones belong; see Teams Phone.

What users will actually follow

  • One extra prompt on a new PC or a new country is tolerated. MFA every ten minutes on the same desktop is how people install a “helper” that steals tokens.
  • Tell them why the personal phone is not fully managed. If the only story is “IT said so,” they will forward mail to Gmail.
  • Document the break-glass process on paper, not only in a Teams channel that depends on the tenant you are trying to recover.

Authentication and Intune are one design. A compliant device with a password-only account is not a design. An MFA prompt on an unmanaged, unencrypted laptop is only slightly better. Premium is the license that lets you join those two controls. Using it is the work.

Business Standard vs Premium covers which SKU to buy. Contact us if you want this implemented rather than printed.