Use Microsoft Entra Conditional Access to require stronger sign-in for administrators while testing the policy safely.
Before you create a policy
Conditional Access requires eligible Microsoft Entra licensing for targeted users. Confirm that administrators have registered a phishing-resistant method, such as an approved FIDO2 passkey or Windows Hello for Business. Maintain and test emergency access accounts; Microsoft advises excluding them from restrictive policies to prevent lockout.
Create the administrator policy
- Sign in to the Microsoft Entra admin center as a Conditional Access Administrator.
- Open Entra ID → Conditional Access → Policies and create a new policy.
- Under Users, target the relevant directory roles. Exclude your designated emergency access accounts.
- Under Target resources, select the resources to protect following Microsoft’s administrator policy guide.
- Under Grant, choose Require authentication strength and select Phishing-resistant MFA.
- Set Enable policy to Report-only, then create it.
Validate before enforcement
Review report-only results in sign-in logs for each administrator, including users who activate roles through Privileged Identity Management. Check that their registered methods satisfy the policy and that emergency access works. After resolving unexpected failures, change the policy from Report-only to On.
Keep it operational
Document how a new administrator registers a permitted method before receiving privileged access, and how a lost device is handled. Recheck the policy after changes to authentication methods, role assignments, or licensing.
Sources
Microsoft Learn: Require phishing-resistant MFA for administrator roles; Microsoft Learn: Manage emergency access accounts.
