1,000+ Conditional Access Policies Later: The Gaps Admins Miss

Summary

Brandon Colley draws on reviews of more than 1,000 Microsoft Entra Conditional Access policies to describe recurring security gaps. The main theme is that policies can look comprehensive while leaving users, devices, or applications outside their effective scope.

Conditional Access Pitfalls

• Check what security defaults cover before replacing them. Colley says security defaults protect two more administrative roles by default than Microsoft’s managed Conditional Access policy or template, which cover 14. He recommends carefully defining which roles count as privileged rather than relying only on Microsoft’s default role list.
• Conditional Access has no “allow” rule. Policies apply controls when their scopes and conditions match; a narrowly scoped policy does not grant access to everyone else. Colley warns that administrators can mistake a policy for “allow this group into this app” when it only protects that particular group and app.
• Conditions can unintentionally narrow coverage. Conditions within a policy are combined, so a policy requiring several risk or location conditions may only apply when all are met. Likewise, selecting each listed device platform is not necessarily equivalent to covering every platform. Colley recommends having an explicit policy for unknown or unsupported devices, which may otherwise remain unaddressed.
• Test for what policies don’t do. Testing only a successful sign-in misses gaps. The speakers describe building test matrices across users, apps, locations, and managed or unmanaged devices. Colley uses the What If tool and scripts, and has reviewed sanitized Conditional Access JSON with AI to reason through complex configurations. He cautions that AI output should be challenged and validated.
• Review user actions and device code flow. Policies may overlook actions such as security-information or MFA registration and device registration. Device code flow can also be overlooked; checking sign-in logs can help determine whether it is used legitimately before deciding how to restrict it.
• Revisit trusted-location exceptions. A policy requiring strong authentication everywhere except trusted locations can leave users with single-factor authentication at the office. Colley says modern Windows sign-in mechanisms may make that exception unnecessary for single sign-on. He suggests using locations instead to restrict accounts that cannot perform MFA—such as service, shared, or kiosk accounts—to expected networks or devices.

Application and Consent Risks

• Apps can become a back door. Strong controls on user accounts do not protect an application with an exposed client secret or overly broad permissions. Colley also describes risks from vulnerable apps that expose OAuth tokens, for example through unsafe browser storage or cross-site scripting.
• Audit redirect URIs. Stale or wildcard redirect URIs can create opportunities for token theft if an attacker can take control of the URL or a reclaimed domain. A sign-in may still appear to be a legitimate Microsoft authentication flow. Colley recommends checking for obsolete and risky redirect URIs.
• Understand organization-wide consent. When an administrator approves an app for the whole organization, users across the tenant may be able to use the consented permissions. The speakers recommend granting only the required permissions and, where appropriate, enabling Assignment required so only designated users or groups can sign in.
• Find and review privileged apps regularly. Relevant information is spread across Entra and Defender portals and recommendations, making application permissions and unused apps easy to miss. The discussion mentions Maester as a community tool that can bring security checks and findings into a more visible report.

Tools and Product Mention

The episode is an experience-based discussion and practical guidance, not a step-by-step tutorial or product review. It also includes a sponsor segment for ENOW Software’s App Governance Accelerator 4.0, described as offering configurable multi-stage app approvals, Defender for Cloud Apps risk-score integration, and centralized app request and review workflows.

Main Speakers and Sources

• Brandon Colley — Senior Security Consultant at TrustedSec and Microsoft Security MVP; shares findings from Conditional Access and application-security assessments.
• Merill Fernando — Host of Intro Chat, asking questions and adding operational context.