The Zero Trust Starter Kit: 20 Baseline CA Policies

Block Legacy Authentication

Blocks authentication protocols that don't support modern MFA (IMAP, POP3, SMTP, basic auth).

Legacy protocols bypass modern security controls. Attackers use compromised passwords against IMAP/POP3 to skip MFA entirely.

Block High-Risk Sign-ins

Integrates with Entra ID Protection to automatically block logins flagged as highly suspicious (anonymous IPs, impossible travel).

Stops automated credential-stuffing attacks and botnets in real time before initial foothold.

Block Access from High-Risk Countries

Uses geofencing to deny authentication originating from regions where your company does no legitimate business.

Drastically shrinks your global attack surface right at the perimeter.

Block Unsupported Device Platforms

Prevents sign-ins from unmanaged or obsolete OS versions (Linux, ChromeOS, old Windows/Android).

Closes gaps that standard compliance policies miss. If your company uses Windows/macOS/iOS/Android, block unapproved OS attempts.

Block Device Code Flow

Disables OAuth device code authentication designed for devices without a web browser (smart TVs).

Prevents device code phishing attacks that trick users into authenticating attacker sessions.

Block Authentication Transfer

Blocks QR-code-based authentication transfer mechanisms between devices.

Prevents "quishing" (QR phishing) where users scan codes handing over active authenticated sessions to attackers.

Require Phishing-Resistant MFA for Admins

Requires admin accounts to authenticate strictly using FIDO2 keys, passkeys, or Windows Hello for Business.

Standard push notifications can be phished via AiTM proxies. Phishing-resistant credentials are domain-bound.

Require Phishing-Resistant MFA for Break-Glass Accounts

Dedicated policy forcing emergency accounts to use hardware FIDO2 keys.

Ensures emergency admin accounts remain protected even if standard policies fail.

Require MFA for Azure & Admin Portals

Mandatory MFA prompt whenever accessing administrative interfaces (Azure Portal, M365 Admin Center).

Locks down the core control plane of your cloud infrastructure.

Require Strong MFA for All Users

Requires modern MFA for every user, explicitly excluding weak methods like SMS and voice calls.

SMS can be SIM-swapped or intercepted. Closing legacy MFA options secures all user endpoints.

Require MFA & Password Reset for Risky Users

Automatically flags accounts with dark-web leaked credentials, requiring MFA + mandatory password reset.

Instantly neutralizes compromised credential leaks.

Require TAP for Security Info & Device Registration

Forces Temporary Access Pass (TAP) or fresh MFA when registering new auth methods or Intune devices.

Prevents an attacker with temporary password access from registering rogue devices.

Require Compliant Device (Desktops & Laptops)

Blocks M365 access from computers not enrolled in Intune and marked compliant (or Entra-joined).

Primary security perimeter gate. Personal devices cannot touch company data unless fully managed.

Require App Protection & Approved Apps (Mobile BYOD)

Forces mobile access exclusively through approved apps protected by Intune App Protection Policies (MAM).

Protects corporate data on personal mobile devices without full device enrollment or touching personal photos.

Block Mobile Browser Access

Denies mobile web browsers (Safari, Chrome) from accessing M365 cloud apps.

Closes BYOD loopholes, preventing users from downloading corporate files to unmanaged phone storage.

Windows Token Protection

Cryptographically binds authentication tokens to the specific Windows device that requested them.

Stops token theft attacks. Stolen memory tokens become instantly useless on any other machine.

Sign-In Frequency & Session Lifetime Limits

Sets time limits on active user sessions before re-authentication is required.

Limits the blast radius of a stolen session token.

Block Persistent Browser Sessions

Disables persistent browser sign-in states across session closes.

Stops subsequent users on shared or public computers from opening employee sessions.

Block Downloads via Conditional Access App Control

Routes browser sessions through Defender for Cloud Apps to allow web viewing while blocking local file downloads.

Enables safe web document viewing without saving corporate files to unmanaged hard drives.

Block Unsanctioned Generative AI & Web Leaks

Integrates CA with Defender for Cloud Apps to block navigation to consumer AI tools and restrict copy-pasting corporate text into external forms.

Prevents employees from inadvertently pasting proprietary code, PII, or strategy into public AI models.