Microsoft-managed Conditional Access policies
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit f24e125 · +12 −6 lines · also on GitHub
⋯ 54 unchanged lines
5555
5656
You can edit the state of a policy and what identities the policy should exclude. Exclude your [break-glass or emergency access accounts](../role-based-access-control/security-emergency-access.md) from managed policies just like other Conditional Access policies. Consider duplicating these policies if you need to make more changes than what's allowed in the Microsoft-managed policies.
5757
58
−### Baseline Security Mode policies
58
+### Baseline security mode policies
5959
60
−[Baseline Security Mode (BSM)](/microsoft-365/baseline-security-mode/baseline-security-mode-settings) in the Microsoft 365 admin center bundles recommended security settings and policies for Microsoft 365 workloads. Two of these settings show up as Conditional Access policies:
60
+[Baseline security mode (BSM)](/microsoft-365/baseline-security-mode/baseline-security-mode-settings) in the Microsoft 365 admin center bundles recommended security settings and policies for Microsoft 365 workloads. Two of these settings show up as Conditional Access policies:
6161
6262
- Require phishing resistant authentication for admins
6363
- Block legacy authentication
6464
65
−These policies are deployed in Microsoft Entra as Microsoft-managed policies, but they show up as **Baseline Security Mode** in the **Created by** column.
65
+These policies are deployed in Microsoft Entra as Microsoft-managed policies, but they show up as **Baseline security mode** in the **Created by** column.
6666
67
−:::image type="content" source="media/managed-policies/baseline-security-mode-policies-list.png" alt-text="Screenshot of the Security Baseline Mode policies in the Conditional Access policies list." lightbox="media/managed-policies/baseline-security-mode-policies-list-expanded.png":::
67
+:::image type="content" source="media/managed-policies/baseline-security-mode-policies-list.png" alt-text="Screenshot of the Security Baseline Mode policies in the Conditional Access policies list." lightbox="media/managed-policies/baseline-security-mode-policies-list.png":::
6868
6969
One important difference between BSM policies and Microsoft-managed policies is that the BSM policies are created by the administrator, not Microsoft.
7070
⋯ 2 unchanged lines
7373
The following Microsoft-managed policies are currently available:
7474
7575
- [Block all high risk agents from accessing all resources](#block-all-high-risk-agents-from-accessing-all-resources-preview) (Preview)
76
−- [Block legacy authentication](#block-legacy-authentication) (also a Baseline Security Mode policy)
76
+- [Block legacy authentication](#block-legacy-authentication) (also a Baseline security mode policy)
7777
- [Block device code flow](#block-device-code-flow)
7878
- [Multifactor authentication for admins accessing Microsoft Admin portals](#multifactor-authentication-for-admins-accessing-microsoft-admin-portals)
7979
- [Multifactor authentication for all users](#multifactor-authentication-for-all-users)
8080
- [Multifactor authentication for per-user multifactor authentication users](#multifactor-authentication-for-per-user-multifactor-authentication-users)
8181
- [Multifactor authentication and reauthentication for risky sign-ins](#multifactor-authentication-and-reauthentication-for-risky-sign-ins)
82
−- [Require phishing resistant authentication for admins](#require-phishing-resistant-authentication-for-admins) (Baseline Security Mode policy)
82
+- [Require phishing resistant authentication for admins](#require-phishing-resistant-authentication-for-admins) (Baseline security mode policy)
8383
8484
### Block all high risk agents from accessing all resources (Preview)
8585
⋯ 53 unchanged lines
139139
- This setup ensures that the policy doesn't block legitimate users and that you’re getting maximum value on your P2 licenses.
140140
141141
To prevent attackers from taking over accounts, Microsoft blocks risky users from registering for multifactor authentication.
142
+
143
+### Require phishing resistant authentication for admins
144
+
145
+Accounts that are assigned specific privileged administrative roles are frequent targets of attackers. Requiring phishing-resistant MFA on those accounts is an easy way to reduce the risk of those accounts being compromised. For more information on this policy, see [Require phishing resistant authentication for admins](policy-admin-phish-resistant-mfa.md).
146
+
147
+This policy is a [Baseline security mode](/microsoft-365/baseline-security-mode/baseline-security-mode-settings) policy from Microsoft 365.
142148
143149
## Upgrade from security defaults
144150
⋯ 101 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 01:29 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.