This repository contains a comprehensive set of Conditional Access (CA) policies and PowerShell management tools for Microsoft Entra ID (formerly Azure AD), designed to enhance your organization's security posture while maintaining usability.
This project builds upon the excellent work of:
- Kenneth van Surksum (@kennethvs) - Original CA baseline policies
- Daniel Chronlund (@DanielChronlund) - DC Toolbox CA implementations
Before implementing these baselines, ensure:
- Security Defaults are disabled in your tenant
- Legacy Per-User MFA is disabled for all users (except unlicensed accounts if necessary)
- Required licenses are available for your users
- Basic familiarity with Conditional Access concepts
- 42 Entra ID Groups for inclusion/exclusion management
- 44 Conditional Access policies
- Supporting Intune MAM/APP policies
- Most policies are deployed in "Report-only" mode for impact assessment
- Compliance-check policies are set to "Off" mode initially to prevent unexpected authentication prompts
- Intune Management Tool - For importing and managing policies
- IdPowerToys - For visualizing and understanding policy interactions
-
Group-Based Assignment
- Always use groups for inclusions/exclusions instead of direct user assignments
- Enables easier management and automated import via Intune Management Tool
-
Staged Rollout
- Start with policies in report-only mode
- Use provided PowerShell tools to analyze sign-in logs
- Assess impact before enabling enforcement
-
Policy Management
- Maintain documentation of policy exceptions
- Regular review of policy effectiveness
- Monitor for policy conflicts
- Clone this repository
- Create required Entra ID groups
- Import baseline policies using Intune Management Tool
- Review and customize policies for your environment
- Use provided PowerShell tools to monitor impact
- Gradually enable enforcement based on analysis
This repository includes PowerShell scripts for:
- Managing user/group assignments
- Analyzing sign-in logs for report-only policies
- Impact assessment reporting
- Policy compliance monitoring
- Enhanced PowerShell tools for sign-in log analysis
- Automated impact assessment reporting
- Additional compliance templates
- Integration with Microsoft Graph API
- Additional baseline policies for specific scenarios
Detailed documentation for each component is available in the respective folders:
/policies- Baseline CA policies/scripts- PowerShell management tools/docs- Implementation guides and best practices
Contributions are welcome! Please read our contributing guidelines before submitting pull requests.
This project is licensed under the MIT License - see the LICENSE file for details.
For issues and feature requests, please use the GitHub issues section.