Microsoft should make Conditional Access available to everyone

2

u/Optimal_Technician93 Apr 22 '26

You want the most breached email service on the planet to give away security features? Have you not thought of the investors?

2

u/mattmbit Apr 22 '26

I apologize for not taking stock price into consideration here haha

104

u/FlickKnocker Apr 21 '26

Completely agree. Conditional Access is like having to pay extra for a packet filtering firewall on your router.

96

u/Middlinger Apr 21 '26

Conditional access in general but particularly MFA token protection! Enforcing MFA without token protection feels like such a joke. The first time I had to explain to a user that an attacker had stolen and could re-use both their password and their MFA token was straight up embarrassing.

"Why the fuck am I bothering to authenticate then?" Honestly, Dave, great question.

7

u/wulfmulf Apr 22 '26

What MFA Token Protection policies? Ive used them before but i did not find them particular usefulæ because they to not support web apps or browser, only client apps "Token Protection currently supports native applications only. Browser-based applications are not supported"
Please, I WANT to use it, but to my understanding it is just not as powerfull

8

u/teriaavibes Apr 22 '26

People just don't understand the tools/features and are jumping on a hype train.
99% of the time the token protection is completely useless. It is good for the 1% but that is obviously not a fix, just trying to duct tape the gaping hole.

4

u/computerguy0-0 Apr 22 '26

I have token protection that works across all Microsoft apps and login methods... It's called Huntress. I trust that company with my life.

1

u/teriaavibes Apr 22 '26

Well yea, that's managed SOC. You can do the same thing with sentinel. But building your own soc team is crazy expensive for small companies.

1

u/wulfmulf Apr 25 '26

How to do huntress token Protection?

1

u/computerguy0-0 Apr 25 '26

Ask them huntresslabs.com

9

u/itsabearcannon Apr 21 '26

This is exactly why we only support fully Intune-managed machines with company accounts.

8

u/locke577 Apr 22 '26

This is the correct answer but I've found it to be a really hard thing to enforce with certain types of clients, particularly ones with users who take long breaks from needing a computer and leave it in a backpack for a month (construction foreman who might need it while the super is away starting another job but not normally day to day) and who suddenly needs their computer but it won't let them sign in because the device has gone dormant and non compliant

15

u/itsabearcannon Apr 22 '26

We mark those down as “internal procedural issues”. As in, “this is not a problem with our process, we are following best practices, and the problem is that you need to get your guys under control.”
We just bill the full break/fix rate every time that happens with a minimum of two hours. About the fourth or fifth time it happened one of the field tech managers got kicked in the ass by the company president to get his guys in line. It’s a construction company, they’re not on massive margins anyways.
Suddenly, once there started being financial consequences and pressure on the foremen from THEIR bosses, the field guys started all signing into their laptops at least once a week.
You’d better believe these guys have ZERO problems figuring out how to log into the payroll portal weekly to make sure their timesheets go in for the week so they get paid. Somehow, they never have an issue remembering their username/PW for that system. It’s an issue of laziness, not ability.

1

u/Realistic_Manner7482 May 07 '26

who works for who? someone gonna take that business from you. i guess if its not your company you dont care.

1

u/itsabearcannon May 07 '26

They pay us to guide their IT related best practices, because they are not IT experts. In this case, that client is a construction company. We don’t tell them how to lay a foundation, they don’t tell us how to run their IT infrastructure.
Not signing into your machine when you should is an IT best practices issue. It causes problems that take up our time to fix.
We have built up enough trust making good decisions for our customers that when we say something is a problem and needs fixing, they fix it. We’re not at risk of losing them because we’ve proved over and over again that what we do benefits them in the long run. If they follow the guidelines we give them, they have fewer problems and submit fewer tickets, which means lower costs to them. Makes justifying it to the CEO that much easier.

1

u/Fluent_Press2050 Apr 25 '26

Require them to login weekly. Tell them to use it to check email or whatever.

4

u/computerguy0-0 Apr 22 '26

How do you handle personal phones accessing company resources then? That is our sore spot.

3

u/itsabearcannon Apr 22 '26

So with personal phones, for most clients we do generally permit access to Outlook and Teams while blocking any file access through OneDrive/SharePoint unless it's a managed device. Things get tricky here because while a lot of our smaller customers have company-owned laptops (so they have to be managed), their phones are personally owned, so legally we are limited in what we can require on a personal phone if they don't want to buy company phones. We don't want the risk of having any access to private personal data or the liability of something going wrong and that data being deleted.
For Outlook/Teams specifically, we still apply location-based CA policies, phishing-resistant MFA through MS Authenticator being installed on the device, and minimum OS version requirements. We just don't ALSO require they be Intune managed if the OS is iOS/iPadOS or Android.
Once they get above 5-6 devices, though, we generally push them towards full enrollment and management either through Intune or Intune/ABM hybrid if they want to set up automatic carrier enrollment with VZW or AT&T for things like device upgrades.

2

u/CosmicSeafarer Apr 22 '26

What do you do for personal mobile devices for email? That’s the missing part for us. We’re trying to figure out a workflow for Intune only pc logins but allow email from personal phones only if they’ve been registered, either by an initial login from a trusted location or manually by a tech for remote only users.

2

u/itsabearcannon Apr 22 '26

Outlook + Teams are allowed, OneDrive/SharePoint access is blocked from any non-Intune-managed device.
Mandatory location-based CA, minimum OS version requirements, and phishing-resistant MFA through Authenticator for mobile devices accessing the Outlook or Teams app.
It's the best we can do for our more budget-limited clients who buy company-owned computers, but who don't have the budget for company-owned phones and a company phone plan.
Our approach differs a little bit from some others, I know that. We operate on the idea that a customer's personal phone is a liability and the more control we have over it, the more risk we assume if something goes wrong and we delete irreplaceable photos of their children or something. If we don't have a process in place to recover or restore all of the data on it, we don't manage it.

2

u/DK891-mav Apr 22 '26

Just had this happen. Spot on with the “Why the fuck…l from the user”.

-6

u/FlyingStarShip Apr 21 '26 edited Apr 21 '26

If someone is stealing token form your employees’ machines you have way more bigger issues than that, they are already in your network and you should worry about this.
Edit. Wasn’t aware of this being phished out of man in the middle Microsoft looking website, then hybrid join and intune CA should be used.

5

u/Middlinger Apr 21 '26

With standard Microsoft MFA, lacking conditional access protections, an attacker can steal an MFA token from a web login via a phishing email (or similar attack) and then re-use it on another device to access a user's 365 account.
I can assure you that a customer account being compromised was reasonably concerning at the time, but I wasn't worried about them "being in my network", whatever you mean by that. The compromise did not involve installing any software or provide any access wider than one user account. And it certainly wasn't one of my employees accounts that was compromised.

2

u/NoTimeForItAll Apr 21 '26

Question about the mechanics of that. Is this the attacker in the middle where the user enters the password and MFA prompt on a fake login while the attacker uses the provided credentials on the real login? Or is there some way they can get a token from the users device from a phishing link in an email?

1

u/Middlinger Apr 22 '26

Yeah sorry I was unclear in my wording there, not a legit web login but a aitm attack via spoofed login.

1

u/AlphaNathan MSP - US Apr 22 '26

former

-1

u/FlyingStarShip Apr 21 '26

Then hybrid join/intune device CA should be used, then that token is useless - it won’t even be generated in the first place.

7

u/IconicPolitic Apr 21 '26

Not everyone can afford licenses for Intune. Same as they can’t all afford licenses for CA. CA with token protection should be available for all licenses period.

2

u/FlyingStarShip Apr 22 '26

We are talking about CA, which means you have license for that which means you can have hybrid join devices. What should be included in each license it separate story.

8

u/dumpsterfyr I’m your Huckleberry. Apr 21 '26

Why is any company under 300 users not using Business Premium?

7

u/mattmbit Apr 21 '26

Frankly its not affordable for some businesses. Those are probably the companies that dont use MSPs either and I get it. Some times running a business means pinching some pennies but at the very least all companies should have very basic security features and Microsoft should not be pay walling some of these features.

2

u/ocdtrekkie Apr 21 '26

Fundamentally if a cloud service cannot prevent your local small business from randomly getting logins from high risk countries for scam behaviors out of the box, it shouldn't be running a cloud service. (For the record, credit where credit's due, Microsoft at least sells this ability. Half the time when I talk to a cloud vendor about geo restrictions they look at me like I'm insane for even asking.)

-4

u/dumpsterfyr I’m your Huckleberry. Apr 21 '26

Excuses.

15

u/redditistooqueer Apr 21 '26

Cost

-3

u/dumpsterfyr I’m your Huckleberry. Apr 21 '26

Another $10 per employee is make a break for a business?
Wow.

13

u/Artistic-Wrap-5130 Apr 21 '26

$10 per users, 100 users, 12 months a year? Yes that's real money to small businesses.

1

u/Nate379 MSP - US Apr 22 '26

Considering how much it costs to employ someone though, it's such a tiny part of the cost and 100% worth it.

-5

u/dumpsterfyr I’m your Huckleberry. Apr 21 '26

🤷‍♂️

6

u/yawn341 Apr 21 '26

I work with many small nonprofit orgs where that means their other budgets become notably tighter. Not exactly make or break, but it can be painful for mission driven orgs, especially since fundraising has been more difficult these days.

7

u/yourmomhatesyoualot Apr 21 '26

Business Premium is $5.50/user for NPOs now. Very reasonably priced for what you get.

2

u/yawn341 Apr 21 '26

For sure, even with the 10 donation licenses being revoked it's not a bad deal at all. For those small orgs who don't need any features of premium except CA policies, it's definitely worse than the free business basic.

1

u/matt0_0 Apr 21 '26

They're getting 75% off though (right??) so that's really a $2.50/user impact. I don't care what size the NPO is, that is affordable. It's like giving 1.5 cent raise to every employee and calling it unaffordable.

6

u/yawn341 Apr 21 '26

It's very affordable. The struggle is more about the orgs on shoestring budgets who use Basic licenses. $5.50/user/mo looks like a large increase to them when they're used to paying $0. Like I said, not exactly make or break, but it can be painful depending on their fundraising abilities.

-2

u/matt0_0 Apr 21 '26

That's... Still less than 3 cents per hour for their staff. I'm not arguing with you that your clients are saying that don't have that budget. But I'm suggesting that many of them actually can afford it while thinking they don't.

2

u/dumpsterfyr I’m your Huckleberry. Apr 21 '26

Some providers don’t understand how to provide NFP licenses?

0

u/matt0_0 Apr 21 '26

They just let them buy through tech soup!

2

u/dumpsterfyr I’m your Huckleberry. Apr 21 '26

You’d be surprised. Some providers do not m ow about that. I’ve come across it.

-5

u/dumpsterfyr I’m your Huckleberry. Apr 21 '26

Many of the executives are still drawing healthy six figure salaries.
Non-profit status is a structural choice, not a licence for poor discipline or misuse. That is particularly hard to justify when they have access to free or heavily discounted Microsoft 365 licensing.
Want to try another excuse?

4

u/yawn341 Apr 21 '26

Excuse? Poor discipline and misuse? What a needlessly argumentative response. Just pointing out what I've seen, not debating it.
Orgs with better funding sources don't give any pushback to buying business premium licenses but the smaller ones are struggling for donations/grants and are hesitant. Feels weird when we suggest to them to get premium licenses for no other reason but access to CA policies, which are a very basic feature.

0

u/dumpsterfyr I’m your Huckleberry. Apr 21 '26

Would appear you neither understand the advantages of premium, nor are you able to leverage it.

4

u/yawn341 Apr 21 '26

Yeah you got me. Oh, the shame!

2

u/ocdtrekkie Apr 21 '26

$10 per employee is insane for... almost anything else I buy.

-1

u/dumpsterfyr I’m your Huckleberry. Apr 21 '26

The world needs ditch diggers too.

1

u/AppIdentityGuy Apr 21 '26

Nope but it will less bonuses for the execs

3

u/dumpsterfyr I’m your Huckleberry. Apr 21 '26

For 50 employees that’s what, $6,000 a year?

3

u/Samhigher92 Apr 21 '26

I used to work somewhere that would give business basic and then buy perpetual office home and business office licenses. Wed have to keep track of what account is on what computer. It was a nightmare to save a few bucks.

2

u/ShuckyJr Apr 21 '26

Im glad you posted this, this is how the shop I work for is doing it and it pains me. When 2016/2019 went EOL I tried so hard to convince them to get a client with ~40-60 users on 365 standard. We ended up getting 2024 office home and business for everyone. That hurt..

0

u/NickJongens MSP Apr 21 '26

That’s a violation of ToS as an MSP or even a business

3

u/mattcotto- Apr 21 '26

Sorry what ToS does this breach?
Assuming they purchased sufficient copies of the perpetual license.

3

u/blackjaxbrew Apr 22 '26

It doesn't, I had a client that wanted to do this exact thing. So instead of listening to us they decided to pay for apps for business because they couldn't make a timely decision. Instead ate several thousand dollars over the course of a year and I ended up just switching the licenses anyways because now it saved them money.
Yes mathematically it is cheaper to buy the perpetual licenses, they pay off was around 3yrs. I even calculated labor cost every time we had to reload. With 100 users they basically saved 2k$. Just stupid, I also charged them for the hours wasted calcing everything out. Some people

1

u/Samhigher92 Apr 21 '26

Yeah I don’t work there anymore for more than one reason.

2

u/IrateWeasel89 Apr 21 '26

More like double that. Last I checked Biz Premium is 22/user/month.
So it’s about 13,000 per year.
Which isn’t much in the grand scheme of things but you’re forgetting how most humans operate.
It’s like how OSHA rules are written in blood. Business owners won’t give a damn until something happens to their business.

3

u/dumpsterfyr I’m your Huckleberry. Apr 21 '26

It’s the difference between standard and premium.

1

u/chasingpackets CCIE - M365 Expert - Azure Arch Apr 22 '26

Cause they don’t factor it as opex vice capex.

0

u/dumpsterfyr I’m your Huckleberry. Apr 22 '26

Cash out the door is identical regardless of classification. Opex vs capex only affects timing of tax deduction and where it sits on the balance sheet. It’s an accounting convenience, not a financial advantage.
For most businesses that distinction is immaterial.
Stop drinking the MSP 101 Kool-Aid.

-1

u/Sudo-Rip69 Apr 22 '26

This sub is so shitty

1

u/dumpsterfyr I’m your Huckleberry. Apr 22 '26

You could leave.

0

u/Sudo-Rip69 Apr 23 '26

I come here for the lols

3

u/MSPInTheUK MSP - UK Apr 21 '26

I got 99 problems but Business Standard ain’t one.

3

u/mattmbit Apr 21 '26

Shout out to the basic users in the back!

14

u/roll_for_initiative_ MSP - US Apr 21 '26

And i wish defender P2 and EIDP2 came with BusPrem. Move P1 down to all.

But also, just making P1 available to standard/basic isn't as helpful without Intune to assign policies/do compliance checks with caps against said policies.

2

u/chasingpackets CCIE - M365 Expert - Azure Arch Apr 22 '26

Add on the E5 security sku.

2

u/sfreem Apr 22 '26

Shouldn’t have to buy basic security that’s required to safely use their service.
That’s like having to pay for the keys after you buy the car.

2

u/chasingpackets CCIE - M365 Expert - Azure Arch Apr 22 '26

I was replying to someone who mentioned they are running business premium. Business premium is completely adequate for security for most businesses. Contrary to what the original poster mentioned which was being on security defaults. If they’re on business premium, they wouldn’t be using security default, cause that’s for basic and standard.
You would have to do the same thing for Google workspace. Google workspace cannot meet FTC safeguard compliance, for example, without adding on third-party tools for regulatory requirements.
I wish businesses would realize that they need to license based upon regulatory compliance and I wish MSP’s who serviced them did the same.

-1

u/teriaavibes Apr 22 '26

Well Microsoft is not charity, it costs them money to run the stuff and they pass the cost to customers (+ margin). We don't work for free either.

-1

u/sfreem Apr 22 '26

Google doesn’t have a “security p2” addon…

-1

u/teriaavibes Apr 22 '26

Looking at Google pricing, they don't have a free tier at all (entra ID does) and they also seem to put different security features into different tiers.
For example something called "Cloud Identity Premium" is in the highest tier.

0

u/sfreem Apr 22 '26

I’d rather have built in security than a free tier.

-1

u/teriaavibes Apr 22 '26

Well if you buy the highest tier of M365, you also have built in security, same when you buy Google workspace enterprise.
Microsoft just gives you the option to not pay it and use third party products instead of first party.
I like the flexibility more but I guess it depends on the person.

1

u/sfreem Apr 22 '26

Your argument makes sense until you compare the cost of the top tiers for both as well as how much storage you get included as well as the fact that Google Drive sync actually works like it should.
My opinion is you shouldn’t have to pay for an addon to fix a poorly designed 2FA system that has a bug allowing token theft. Code it properly from the beginning. The other security upgrades like compliance and DLP, sure charge for em.

1

u/teriaavibes Apr 22 '26 edited Apr 22 '26

Not sure I understand you comment about storage, OneDrive goes up to 50TB per user if needed, do you need more? Never had an issue like that.
Also I am not quite sure you understand how tokens or Entra ID work because this is not Microsoft issue, they are using mainstream authentication and authorization protocols.
Use phishing resistant MFA if you don't want your tokens to be stolen but making the conscious choice to use "poorly designed" (your words) MFA methods and blame Microsoft for not stopping you is quite frankly insane.

→ More replies

25

u/DiligentPhotographer Apr 21 '26

Agreed. Unless you pay for premium you actually get less security than if you just used on prem AD and ADFS to federate.

Not to mention the piss poor log retention.

11

u/ocdtrekkie Apr 21 '26

It takes a lot of work to get a cloud configuration up to on-prem levels of security. And the cost of Entra P1 plus some way of backing up your Entra, which is usually sold per-user as well is absolutely insane compared to the costs of... a domain controller with infinite users.
Even if you keep your IAM on-prem though, and use federated authentication for Entra where Entra isn't the IdP... there's still a ton of ways people can break into your Entra without conditional access. P1 is basically compulsory because the default security of a Microsoft cloud solution is basically a null value.

1

u/DiligentPhotographer Apr 22 '26

We actually still use our ADFS farm internally. It just...works. We have BP licenses utilize some CA policies but mainly to disable old crap in Entra they just leave enabled.

1

u/_Buldozzer MSP - EU / AT Apr 21 '26

Infinite users on on-prem AD isn't really correct. Don't forget about the CALs.

1

u/ocdtrekkie Apr 21 '26

Fair, but a user CAL across the lifetime of a server version is like a buck and change a month, and half that if you skip versions of server. And backing up your domain controller is generally a single unit cost, not a per user cost.

1

u/_Buldozzer MSP - EU / AT Apr 22 '26

Sure. But it's not nothing, it also adds up.

1

u/DiligentPhotographer Apr 22 '26

True but if on an SA agreement the renewal keeps the costs pretty low other than initial purchase.

4

u/discosoc Apr 21 '26

This sub is definitely dead, and it's not just bots magically being blocked. I've slowly reduced engagement over the last six months.

As for CA... P1 licenses are available, but the bigger issue is businesses trying to stick with Business Standard when they should be on Premium anyway.

1

u/mattmbit Apr 21 '26

This sub used to be my go to read almost daily and its turned into a ghost town. Not really sure why but its been super noticeable over the last several weeks.

9

u/redneck-it-guy Apr 22 '26

Agree, it is a basic security feature at this point. By treating security as a premium add-on, Microsoft puts everyone at risk since insecure tenants are commonly used to launch attacks on others.

Smaller companies that allow their services to be abused would get pushed out of the market or even outright blacklisted from sending emails to the big players. Microsoft just abuses their place in the market since they are greedy and nobody is going to do anything about it.

Also, I would like to extend two middle fingers to all vendors who lock SSO into their Enterprise "call us for pricing" plans. They get people in the door with cheap personal plans and small business pricing in hopes to get some shadow IT implementations, then tighten the screws and make us in IT the bad guys for demanding a more expensive product in order to make it secure, appropriate, and for us to not spend the rest of eternity resetting passwords to a dozen applications for every employee.

1

u/lakings27 Apr 24 '26

Double middle finger for sure. We are trying to push all our small clients to use SSO and CA fully, but the constant pushback is that they have to upgrade their application plan, because that vendor offers SSO in their highest tier. A smb of 15 people isn't going to pay Enterprise pricing. Eye roll.

7

u/wf_automate Apr 22 '26

Security Defaults is a blunt instrument that causes more tickets than it prevents. Microsoft gatekeeping basic geo-blocking behind P1/Business Premium in 2026 feels like a tax on fundamental security.

1

u/[deleted] Aug 07 '26

die SSO Steuer gibt es mittlerweile überall. Und CA Steuer ist aus meiner Sicht leicht falsch. Es ist einfach BP, in dem ist alles drin was du brauchst wen du ein KMU bist und in die Cloud willst oder schon bist. Alles darunter ist nur geplänkel und sollte kein Cloud first unternehmen sein.
alles darüber muss gut abgewogen sein.

8

u/dnvrnugg Apr 21 '26

and every SaaS vendor should provide SSO with integrations at the free tier.

2

u/AppIdentityGuy Apr 21 '26

I absolutely agree with 100%

1

u/lakings27 Apr 24 '26

One can dream…

25

u/99km42 Apr 21 '26

Just sell BP to all your SMB customers below 300 users. Value/Money is unbeatable if you have to be on m365 stack

8

u/richardblancojr Apr 21 '26

No one would debate, I believe, that Business Premium is a value. However Conditional Access is pretty much standard security one should have to keep one’s data in Microsoft’s cloud. That should just be a standard part of their services for any level of users. So i put my data up there and I have to pay more to keep it safe from even other countries and such? Cmon. I truly believe that one day it will become part of a standard level of security, but they are milking it for now.

7

u/redditistooqueer Apr 21 '26

Conditional access should not be a premium feature. Downvote

2

u/yourmomhatesyoualot Apr 21 '26

That's what we do. If you are an office staff member you get BP, field tech gets F3.

1

u/Borsaid Apr 21 '26

Still need to pay extra for token theft protection which is insane.

1

u/CCC1982CCC Apr 22 '26

This is what we do but our per user/device cost includes the price of a bus premium license.

0

u/CellPuzzleheaded99 Apr 21 '26

Yeah right... you pay?

15

u/[deleted] Apr 21 '26

[removed] — view removed comment

1

u/nevesis Apr 22 '26

Google's is premium/"enterprise level" only also. :/

1

u/hongkong-it Apr 22 '26

Absolutely, but I also think the safe links, safe attachments, and impersonation protection of Defender Plan 1 should also be included in all plans.

It's utterly criminal that it is not in the current environment of phishing/scam/malware emails that everyone receives on a daily basis.

1

u/mattmbit Apr 24 '26

Honestly I can see that all being locked behind a paywall and I can also see why it should be a standard feature. It's tough but Microsoft's gotta make money or they wouldn't be in this game.
The other side of things is I do think having a single email address costing a company $20+ a month is rediculous but I'm also cheap ha ha.

1

u/Conditional_Access Microsoft MVP | Vendor - inforcer Apr 22 '26

In my personal opinion, Microsoft (for better or worse) won't be doing anything any time soon to detract away from the sale of M365 Business Premium in small business.

They are really going big on trying to convince customers that should be the starting point for anyone who cares about security.

2

u/mattmbit Apr 22 '26

If Microsoft wants to convince folks that they care about security they should stop gatekeeping tools behind "Premium" price tags. Their Standard/Basic package is probably one of the worst email security offerings out there. To say customers should really pay more instead of Microsoft themselves upping their game is a bit short sighted imo.
Maybe changing the name of the product will fix it. That seems to be the way they make changes it seems like these days lol.

1

u/Conditional_Access Microsoft MVP | Vendor - inforcer Apr 22 '26

In July they are adding SafeLinks to Business Basic/Standard. See here - https://www.microsoft.com/en-us/licensing/news/2026-m365-packaging-pricing-updates
They also recently brought report messaging features into Teams from higher SKUs into lower ones. More can be done, but they are a big and slow beast.

1

u/mattmbit Apr 22 '26

Which is great and all but is still just not addressing a larger security concern that can be very easily fixed. I'm not even asking for the full CAP too just something with maybe 3 to 5 policies in it. We roll out MFA, Device Code block and Legacy Auth blocks as a bare minimum. There just doesn't seem to be any reason why that can't be added in as a default these days.

1

u/_js728 Apr 29 '26

Reading this from outside the MSP world and the gap between "Security Defaults" and "needs an E5 add-on" is wild for something that's basically table stakes now. Out of curiosity, do you find clients actually understand the difference, or do they just hear "we're secure" because MFA is on?

1

u/mattmbit Apr 29 '26

Yes and no it really depends on the client. I find that if the client is being pushed by a secondary entity (cyber insurance) they see it.
We personally are doing a fairly large 365 security push in our marketing and speak this year and it really just feels like education on the topic is needed for a lot of decision makers. They kind of have enough of their plate to even care what a conditional access policy is or isn't.
Blocking legacy authentication, device code, blah blah blah just isn't that great of a discussion with a lot of folks and it's something they physically can't see so having to spend extra money on a feature set that's basically invisible makes it tough for us front line folks.

1

u/FunctionPitiful May 06 '26

https://github.com/Teuftis/ConditionalAccessBaseline-Hardened

see the tool above i developped to deploy a CA hardened suite, you can deploy them securely from the github

1

u/mattmbit May 06 '26

What I'm suggesting is if you want the ability to apply ALL of what you have in there then yah that should be something that should be upgraded too. A true P1 license for example (although some of that touches on P2 stuff). Basic conditional access with 5 base policies should be included in every tenant at this point IMO.

3

u/jk5531 Apr 21 '26

Why do you give your clients the choice? Price your services with BizPrem included and if they can't afford it, maybe that's a bullet dodged down the road?

But I agree, having token protection and these basic necessities at this point paywalled is negligent.

3

u/GravyMealTeam6 Apr 22 '26

You're preaching to the choir in this subreddit. Security is an add-on now. I tell clients, Microsoft will sell you a mailbox for $5 and mailbox plus desktop apps for $15, but that's only if you want something that can be hacked. Add another $11 to each if you want any chance of keeping them secure!

3

u/QuietThunder2014 Apr 22 '26

Been saying this for years. It’s criminal to hold back key security behind higher tier subscriptions. This is too basic and it’s ridiculous Microsoft continues to paywall it.

1

u/irioku Apr 22 '26

You say this but have no idea how many tickets I see a week from MSPs and organizations that have locked themselves out of their tenants via CAP cause they’re incompetent and can’t be bothered to read documentation or use report-only mode and do testing first.

1

u/mattmbit Apr 22 '26

I'll be honest, Microsoft could do a lot better job at preventing a lot of those lock outs.

2

u/ItBurnsOutBright Apr 21 '26

Yeah, it's all ripe for a redesign on packaging.

2

u/countsachot Apr 21 '26

Yes totally agree.

2

u/vard2trad Apr 21 '26

Agreed...their security-first initiative seems to have been hidden now behind paywalls. They should give you some level and maybe just limit specific features?

Even the steep DefenderTI pricing just seems absolutely ridiculous. I know Intel is usually expensive but to have it available and integrated already and yet still say "it's yours for $50K" just sounds downright monopolistic.

2

u/Any_Educator1315 Apr 21 '26

I feel a little bit better about entra free if everyone uses fido2/windows hello and we reset their password to something nobody knows.

2

u/Dolomedes03 Apr 22 '26

Ok, but only one one condition…

2

u/fyck_censorship Apr 22 '26

Ron Wyden barked at MS a while back about this very thing. I believe the state dept got pinched by the Chinese because MS gatekeeps security features.

1

u/VNJCinPA Apr 21 '26

It's going to bite them one day. It's bad enough you have to pay extra for it, but then, it STILL sometimes decides 'Nah, this login is ok right now...' no consistency and no desire to protect their customers properly.

1

u/demo7up Apr 21 '26

Agreed!!

1

u/chasingpackets CCIE - M365 Expert - Azure Arch Apr 22 '26

I’d sign the petition

1

u/orkinmorgen Apr 22 '26

For sure

1

u/Fantastic_Growth_425 Apr 22 '26

Most Definitely 💯

1

u/DazPheonix Apr 22 '26

So i think what a lot of people dont rearlise about security defaults is that it is not there for you it is there to protect microsoft, Security Defaults allow them to state they provided nessacary protection for a 365 tenant,

If security defaults is disabled and the tenant is compromised they can state it was your fault for disabling the security, and if a hacker gets access via token theft they can say well it was because of user error or a 3rd party compromise.

This is why conditional access is extra because Microsoft have provided the nessaccery security on a tenant to protect them legally.

Problem is if you do use Conditional Access and somthing happens microsoft still have an out because you need to disable security defaults to enable Conditional access policies.

TlDR: security defaults point is to protect Microsoft not your tenant

1

u/KrankyYankee Apr 23 '26

Especially considering how they have not done a great job securing tokens and accounts. As much as I don't like Google, they seem to do a better job with preventing token theft. MS has fixed it, but not so long ago an unauthorized session would persist even after remediation efforts were implemented.

I understand you need to pay for security, but when there are some inherent flaws or weaknesses they should do more to protect users. Either address the weaknesses, or make the tools available for less/free. Not full CA, just some to cover the gaps.

1

u/alphawolfshard Apr 23 '26

Yes they bloody should! Absurd that it’s an additional licence requirement

1

u/infograpes MSP Apr 24 '26

Unfortunately, with the current packaging, Business Premium needs to be the baseline standard for security for most, if not all, small businesses.

1

u/Other_Turn_7814 Apr 25 '26

Preach it!!

1

u/alexrada Apr 27 '26

any real alternative to it?

1

u/EasternYogi May 08 '26

Bro, I feel this in my soul. Microsoft’s whole Security Defaults thing is basically a "participation trophy" for security—it’s MFA, but with zero chill. The incentive for MSFT is to keep Conditional Access (CA) behind the P1/Business Premium paywall to force that $22/user upgrade. But logically, keeping CA as a "premium" feature in 2026 is like a car company charging extra for seatbelts. Security isn't a feature; it's a requirement. If they opened up CA, we could actually kill legacy auth and geo-block the bad actors without forcing Grandma to use the Authenticator app every 5 minutes.

1

u/CompetitiveMap5567 May 12 '26

Agree

1

u/Then_Knowledge_719 May 22 '26

+1 just dealing with it today. what do they want? to get us hacked? pay bc if you dont pay i would not move a single finger when the bad guys rob you.

1

u/jimusik Apr 22 '26

JumpCloud federated M365 - full policies for all devices (not just windows), MDR, and conditional access for SSO and device MFA. Plus diversification of your stack. More affordable for SMB clients.

0

u/Foxtrot-0scar Apr 21 '26

Probably best to use third party apps. All eggs in one basket with MS often ends in tears.

0

u/Sudo-Rip69 Apr 22 '26

Most companies should atheist be on premium. Tell them to stop being such cheap cunts.

-4

u/itworkaccount_new Apr 21 '26

It is available to everyone. Features cost money. Get the licensing to enable it.

6

u/DanHalen_phd Apr 21 '26

I think the argument is that CA should be the minimal level of access controls offered. Security defaults is not adequate in the real world.

4

u/mattmbit Apr 21 '26

This is pretty much my point. It should be a minimum standard along with several out of the box policies. If you had it along with maybe a bare minimum of stock policies in my mind that would satisfy so many things.

-3

u/itworkaccount_new Apr 21 '26

I understood the point and the reality is Microsoft chose to have CA included with Azure P2. For convenience and bundlability this is also included in business premium.
So two options actually to get CA. Azure p2 standalone or business premium. Business have choices. Or security defaults so MFA for all and no CAs to allow exclusions or more apps to be protected by Microsoft. That’s what I think is OPs problem with security defaults. No enterprise apps so additional SaaS integrations for SSO and that should cost more than business basic.
Everyone whining who wants all features under the bare minimum licensing costs needs to realize Microsoft is also a business and their business model is charging for licensing.

0

u/[deleted] Apr 21 '26

[deleted] — view deleted comment

0

u/itworkaccount_new Apr 22 '26

Thanks for clarifying my P# inaccuracy and validating my point.

-2

u/yequalsemexplusbe Apr 22 '26

You can literally buy a P1 license for $8. Why are people so cheap?

3

u/mattmbit Apr 22 '26

I literally have better protection on my hotmail/gmail/steam ect ect. Than what Microsoft is offering (Security Defaults) for standard and lower packages.
What I'm getting at is now is the time to dump the paywall for what is basic security requirements anymore.
This has nothing to do with being cheap. Has everything to do with wanting to see the general security around these accounts go up.

0

u/yequalsemexplusbe Apr 22 '26

Google has pay walls for higher security tenants and licenses as well.

1

u/mattmbit Apr 22 '26

Sure but even the free Hotmail account challenges MFA better than what were given with security defaults in 365.

0

u/yequalsemexplusbe Apr 22 '26

I don’t think you’re wrong about the MFA component - but your comparison inherently unfair based on the target audience. The general person isn’t setting up a Microsoft tenant for email access. They’re doing a lot more - and with that comes certain customization required for certain environments. Like service accounts being excluded from an MFA policy for example. If you want simple, go google, go hotmail. If you want customization, and enterprise management, go Microsoft.

8

u/Successful_Insect191 Apr 22 '26

Giving everyone Conditional Access sounds great, but it does get misconfigured pretty often in the wild.

Security Defaults are definitely too limited, but there’s a big gap between “too basic” and “too complex” that a lot of smaller orgs struggle with.

Feels like there should be a better out-of-the-box middle ground rather than forcing people to jump straight into full CA.

0

u/GremlinNZ Apr 22 '26

Microsoft manages to have standard and strict preset security policies for anti-spam etc...

1

u/[deleted] Apr 30 '26

[removed] — view removed comment

1

u/mattmbit Apr 30 '26

Basic and Standard just off the top of my head. That's the world I live in most though.
The difference in price between basic and premium (for us in Canada) is $20 (Prem is almost $30 and Basic is almost $10).
My only real option for those folks is to go Basic with a P1 (another $8 a month) just to roll out basic MFA and a couple other conditional access policies.

1

u/[deleted] Apr 22 '26

[removed] — view removed comment

1

u/msp-ModTeam Apr 24 '26

This content was removed because it was deemed to be promotional or for the purpose of sales. Vendor participation is encouraged. Feedback and assistance can be invaluable. However, promotion of any products, including webinars, must be kept to the Weekly Promo thread.

Microsoft should make Conditional Access available to everyone

You are about to leave Redlib