Conditional Access decides when to challenge someone. This decides what counts as a challenge, and how people get enrolled in the first place. Requiring MFA means very little if the method behind it is a text message — and "Require MFA" accepts exactly that. Every setting here lives in Entra ID → Authentication methods, and almost none of it needs a licence you don't already have.
Read this first — the order is the whole method
Every change in this dojo can lock somebody out, and the order that feels natural is the order that causes the outage. Turning off the weak method first is the mistake. Nobody should ever be between credentials.
- Audit, then enable, then migrate, then retire. Enable the strong method and move people onto it before you touch the weak one.
- Retire by shrinking scope, not by disabling. Point the method at a group and empty the group. Rollback becomes a membership change instead of an emergency.
- "Microsoft managed" is not "on". It means "whatever Microsoft decides today" — and for Report suspicious activity it currently means off. Set anything you rely on explicitly.
- Enforcement is a Conditional Access policy. So it follows the CA rules: report-only, read the logs, then On. Break-glass excluded from every one.
- Find your service accounts before you start, not when they break. The exclusion you add in a hurry outlives everyone who remembers why.
Full guidance: Plan a phishing-resistant passwordless deployment ↗
Size up your environment
Two quick questions. Nearly everything in this dojo works on any licence — the Authentication methods policy isn't a premium feature, which surprises people. If you've been through another dojo, your licence mix is already filled in.
Which licences do you have in the tenant? Select all that apply.
Mostly here for the other dojos. Passkeys, TAP, registration campaigns, system-preferred and report suspicious activity are all available on any licence. Only the enforcement policy needs P1, and acting on the risk signal automatically needs P2.
Do you run a PKI / issue smartcards?
Walk out with a plan
Your deployment plan lists every in-scope setting with its status, MITRE references and Microsoft Learn source. The PowerShell script contains the Graph calls for your in-scope controls in belt order — with every read ready to run and every write left for you to run deliberately, because a bad PATCH here locks people out of their own tenant.