Conditional access patterns that survive real users

Start with a small pilot

Roll out conditional access in phases: break-glass accounts, named locations, and clear naming. Document every exception before you grant it.

What usually breaks

Overly broad "require MFA" policies without registration campaigns, and blocking legacy auth without checking dependencies. Review sign-in logs weekly for the first month.