conditional access system

where we just made that a mandatory configuration on their device where they had to at least set up a PIN and have that registered as a passkey.

And from there, it was, that's why, you know, conditional access is such a key technology that we're able to then start to guide our CA policies to have a mandate for requiring only the strong auth methods and start to disable using the weaker methods.

Right.

Nice.

Yeah.

Yeah, what we do and has worked really well is we just target small groups.

You know, conditional access policies are great for that, for targeting small groups of users and letting them kind of validate the advanced security experiences that we're rolling out.

And that becomes immediate feedback because that group, typically security-facing users, are eager and willing to adopt everything that's asked of them.

Because most probably the assumption is that everyone is covered.

The thing that's confusing is conditional access does support nested groups.

Yeah.

And I think this is really also the complex thing about nested groups that you have this limitation.

So I've seen also that you can use it for conditional access and you cannot use this for GSA.

I see also you cannot use it for licensing.

So when you have members in nested groups and assign it to a group which is a less licensed assigned, the nested group members doesn't get the license.

I was wondering how they're saying that once, you know, we hit that date and the dynamic group won't process anymore, are you able to still then edit the dynamic group rules if you wanted to change it to some other rule set? Or can you only change it before we hit the...

Without it, you've no forensic record of what happened in the event of a compromise.

Consider conditional access policies that restrict or flag device code authentication flows, particularly for accounts with access to sensitive SharePoint content.

And if your organization is on Microsoft 365 Business Basic or Standard, raise this specifically with your IT provider.

We covered conditional access licensing in episode 36 on Thursday, and it's worth revisiting.

Conditional access availability varies by license tier, and you need to know where the compensating controls are in place if the full feature set isn't available to you.

Three separate threats.

One common thread running through all of them.

Okay? Then the second was is like, of course, identifying the first baseline.

Okay? Like here, uh, we should make conditional access and identity protection as the foundation-

Mm-hmm

... not an afterthought, of course.

Uh, cloud native or hybrid?

Uh, hybrid.

Uh, compliance policy or conditional access?

Conditional access.

They, they should read the, the information written in the dialog window without just automatically clicking the OK button.

So against some, some other attacks, it makes sense to create more advanced conditional access policies, you know.

So not only requiring phishing-resistant authenticators, but also requiring compliant devices and so on, making sure that EDR is really running on that computer, making sure that some permission security hardening is applied on that computer from which a person, and especially a privileged user, is accessing the cloud services.

And I'm, I'm not saying to, to apply such security hardening to, to all of your devices, but s- uh, you should, you should definitely treat devices of global administrators differently than other devices.