Conditional Access Microsoft 365 Perth: Explained

Require MFA for all sign-ins

The single most important Conditional Access policy. Even if a password is compromised, an attacker can't sign in without completing MFA on the legitimate user's phone.

Block sign-ins from outside Australia

For Perth businesses whose staff never work overseas, blocking all sign-in attempts from outside Australia prevents most credential-based attacks before they start.

Require compliant devices only

Only allow access from devices enrolled in Intune that meet your compliance policy: current OS, disk encryption, no jailbreak. Personal and unmanaged devices can be blocked.

Block legacy authentication protocols

Older email protocols like POP3 and IMAP don't support MFA. Conditional Access can block these protocols entirely, closing a common attacker bypass route.

Require stronger MFA for admin accounts

Global Admin accounts can be required to use FIDO2 security keys or certificate-based authentication, a higher bar than phone-based MFA.

Restrict access to specific apps from specific conditions

Allow staff to access email on personal phones but require Intune compliance to access SharePoint and Teams from the same device.