Cybersecurity Glossary
Conditional Access
Rules that decide whether to allow a sign in based on the circumstances, not just the password.
What Conditional Access means
Conditional access evaluates signals at the moment of sign in: is the device managed and healthy, is the location expected, is the sign in risk score high, is the application sensitive. It then allows, challenges or blocks accordingly.
Why Conditional Access matters for small businesses and nonprofits
It is the mechanism that makes zero trust practical inside Microsoft 365, and it is included in the licences many small organisations already hold. It also lets you block entire categories of attack, such as sign in from countries where you have no staff.
What to do about Conditional Access
- Require multi factor authentication for all administrative accounts without exception
- Block legacy authentication protocols that cannot support a second factor
- Require a compliant device for access to finance and human resources data
Not sure where you stand on this?
We review your current setup against the basics, tell you plainly what is covered and what is not, and give you a ranked list with effort and cost. No jargon and no scare tactics.