Conditional Access is often described as the last line of defense for your identities. The problem is that most environments contain weak links that quietly undermine the entire design.

A forgotten service account. Legacy authentication. Weak MFA methods. Coverage gaps. An administrator who can modify Conditional Access without oversight. Any one of them can become the opening an attacker needs.

In this live, demo-driven session, we'll take a Conditional Access environment with all the usual weaknesses and see if we can eliminate every weak link before time runs out.

Starting with break-glass accounts and tenant safety, we'll build a secure Conditional Access architecture from the ground up. Along the way we'll implement a block-by-default strategy, create persona-based access controls, handle exceptions without creating security holes, and protect Conditional Access administration using Restricted Management Administrative Units (RMAU) and delegated roles.

Whenever a design decision requires explanation, we'll stop and discuss the reasoning, trade-offs, and common mistakes behind it. The focus is not on clicking buttons. It's on understanding why Conditional Access architectures succeed or fail.

You'll leave with a practical framework for identifying weak links in your own environment, along with a proven blueprint for building a Conditional Access architecture that remains secure as it grows.

Level 300
Assumes familiarity with Microsoft Entra ID, Conditional Access, and modern authentication concepts.

Demo-heavy, requires a basic understanding of Conditional Access and authentication in Entra.