Conditional Access sanity check
A policy nobody can explain isn't working.
Conditional Access rules accumulate the same way everything else in a tenant does—one exception at a time. A sanity check is a plain review of whether the current rule set still makes sense together.
Book a scoping callWhat a sanity check looks for
Four patterns worth naming out loud.
- Coverage
An accidental gap in coverage
An admin account, a service account, or a whole app was excluded during setup and never added back.
- Conflicts
Policies that quietly contradict each other
Two rules target the same sign-in and one silently wins, without anyone deciding it should.
- Legacy
Legacy authentication left open
An older protocol that bypasses modern sign-in controls is still technically allowed.
- Break-glass
No documented emergency account
Nobody can say what happens if the normal sign-in path fails for every administrator at once.
What this is—and is not
Sanity check, not a penetration test.
A sanity check, not a formal test or a scored audit.
This is a plain-language read of whether the policy set is internally consistent: does multi-factor authentication actually apply where it is supposed to, do exclusions still make sense, and would anyone notice if a rule silently stopped working? It does not produce a compliance score, map to a specific regulatory framework, or substitute for a formal penetration test or identity security assessment.
The goal is narrower and more useful month to month: catch the gap before it becomes an incident, not after.
What belongs in the monthly view
Five recurring checks.
- Multi-factor authentication still applies to every standard user and administrator sign-in
- No policy exclusion exists without a documented, current reason
- Legacy or basic authentication protocols remain blocked where they should be
- A break-glass account exists, is excluded deliberately, and is monitored for use
- New apps or integrations added since the last review are covered by an appropriate policy
When the question is deeper than a sanity check
A formal identity or posture review is a separate, defined scope.
Regulatory mapping, a full identity security assessment, or hardening beyond the baseline deserves its own written scope—not an assumption baked into routine monthly care.
Connect this to the rest of care