Loading page
Sketch a policy before you click in Entra. This does not call Graph and does not enforce anything.
Markdown
# Conditional Access: Require MFA for admins - State: Report-only - Users / roles: Directory roles: Global Administrator, Privileged Role Administrator - Exclude: Break-glass accounts - Target resources: All cloud apps - Conditions: Any location except named trusted; any client app - Grant: Require MFA; require compliant device (optional) - Session: Sign-in frequency 8 hours; Persistent browser: never Review break-glass exclusions, report-only impact, and named locations before switching on.