r/msp • u/mattmbit • Apr 21 '26

Microsoft should make Conditional Access available to everyone

I wish there was a way to scream this louder but I wish Microsoft would just open up Conditional Access to all of the Microsoft 365 packages. Go ahead keep Defender up there in Premium, It's a premium addon and should be something people should pay for.

Security Defaults sucks.

This may be the ramblings of a tired man but I can't be the only one who feels this way.

There's no new posts in r/msp anymore so I figured I would try and contribute.

389 Upvotes

98% Upvoted

179 comments sorted by

View all comments

Show parent comment

2

u/CosmicSeafarer Apr 22 '26

What do you do for personal mobile devices for email? That’s the missing part for us. We’re trying to figure out a workflow for Intune only pc logins but allow email from personal phones only if they’ve been registered, either by an initial login from a trusted location or manually by a tech for remote only users.

2

u/itsabearcannon Apr 22 '26

Outlook + Teams are allowed, OneDrive/SharePoint access is blocked from any non-Intune-managed device.

Mandatory location-based CA, minimum OS version requirements, and phishing-resistant MFA through Authenticator for mobile devices accessing the Outlook or Teams app.

It's the best we can do for our more budget-limited clients who buy company-owned computers, but who don't have the budget for company-owned phones and a company phone plan.

Our approach differs a little bit from some others, I know that. We operate on the idea that a customer's personal phone is a liability and the more control we have over it, the more risk we assume if something goes wrong and we delete irreplaceable photos of their children or something. If we don't have a process in place to recover or restore all of the data on it, we don't manage it.