Start small
- Require MFA for admins
- Block legacy authentication
- Require compliant devices for sensitive apps
Common pitfalls
- Excluding too many accounts
- Forgetting break-glass accounts
- Not testing in report-only mode first
· User
A short practical guide to the policies that matter most.