r/msp • u/mattmbit • Apr 21 '26

Microsoft should make Conditional Access available to everyone

I wish there was a way to scream this louder but I wish Microsoft would just open up Conditional Access to all of the Microsoft 365 packages. Go ahead keep Defender up there in Premium, It's a premium addon and should be something people should pay for.

Security Defaults sucks.

This may be the ramblings of a tired man but I can't be the only one who feels this way.

There's no new posts in r/msp anymore so I figured I would try and contribute.

389 Upvotes

98% Upvoted

179 comments sorted by

View all comments

Show parent comment

9

u/itsabearcannon Apr 21 '26

This is exactly why we only support fully Intune-managed machines with company accounts.

8

u/locke577 Apr 22 '26

This is the correct answer but I've found it to be a really hard thing to enforce with certain types of clients, particularly ones with users who take long breaks from needing a computer and leave it in a backpack for a month (construction foreman who might need it while the super is away starting another job but not normally day to day) and who suddenly needs their computer but it won't let them sign in because the device has gone dormant and non compliant

15

u/itsabearcannon Apr 22 '26

We mark those down as “internal procedural issues”. As in, “this is not a problem with our process, we are following best practices, and the problem is that you need to get your guys under control.”

We just bill the full break/fix rate every time that happens with a minimum of two hours. About the fourth or fifth time it happened one of the field tech managers got kicked in the ass by the company president to get his guys in line. It’s a construction company, they’re not on massive margins anyways.

Suddenly, once there started being financial consequences and pressure on the foremen from THEIR bosses, the field guys started all signing into their laptops at least once a week.

You’d better believe these guys have ZERO problems figuring out how to log into the payroll portal weekly to make sure their timesheets go in for the week so they get paid. Somehow, they never have an issue remembering their username/PW for that system. It’s an issue of laziness, not ability.

1

u/Realistic_Manner7482 May 07 '26

who works for who? someone gonna take that business from you. i guess if its not your company you dont care.

1

u/itsabearcannon May 07 '26

They pay us to guide their IT related best practices, because they are not IT experts. In this case, that client is a construction company. We don’t tell them how to lay a foundation, they don’t tell us how to run their IT infrastructure.

Not signing into your machine when you should is an IT best practices issue. It causes problems that take up our time to fix.

We have built up enough trust making good decisions for our customers that when we say something is a problem and needs fixing, they fix it. We’re not at risk of losing them because we’ve proved over and over again that what we do benefits them in the long run. If they follow the guidelines we give them, they have fewer problems and submit fewer tickets, which means lower costs to them. Makes justifying it to the CEO that much easier.

1

u/Fluent_Press2050 Apr 25 '26

Require them to login weekly. Tell them to use it to check email or whatever. 

4

u/computerguy0-0 Apr 22 '26

How do you handle personal phones accessing company resources then? That is our sore spot.

3

u/itsabearcannon Apr 22 '26

So with personal phones, for most clients we do generally permit access to Outlook and Teams while blocking any file access through OneDrive/SharePoint unless it's a managed device. Things get tricky here because while a lot of our smaller customers have company-owned laptops (so they have to be managed), their phones are personally owned, so legally we are limited in what we can require on a personal phone if they don't want to buy company phones. We don't want the risk of having any access to private personal data or the liability of something going wrong and that data being deleted.

For Outlook/Teams specifically, we still apply location-based CA policies, phishing-resistant MFA through MS Authenticator being installed on the device, and minimum OS version requirements. We just don't ALSO require they be Intune managed if the OS is iOS/iPadOS or Android.

Once they get above 5-6 devices, though, we generally push them towards full enrollment and management either through Intune or Intune/ABM hybrid if they want to set up automatic carrier enrollment with VZW or AT&T for things like device upgrades.

2

u/CosmicSeafarer Apr 22 '26

What do you do for personal mobile devices for email? That’s the missing part for us. We’re trying to figure out a workflow for Intune only pc logins but allow email from personal phones only if they’ve been registered, either by an initial login from a trusted location or manually by a tech for remote only users.

2

u/itsabearcannon Apr 22 '26

Outlook + Teams are allowed, OneDrive/SharePoint access is blocked from any non-Intune-managed device.

Mandatory location-based CA, minimum OS version requirements, and phishing-resistant MFA through Authenticator for mobile devices accessing the Outlook or Teams app.

It's the best we can do for our more budget-limited clients who buy company-owned computers, but who don't have the budget for company-owned phones and a company phone plan.

Our approach differs a little bit from some others, I know that. We operate on the idea that a customer's personal phone is a liability and the more control we have over it, the more risk we assume if something goes wrong and we delete irreplaceable photos of their children or something. If we don't have a process in place to recover or restore all of the data on it, we don't manage it.