The settingWhat we hold this to
CreativeTechs minimum
A CA policy in state ENABLED targeting DIRECTORY ROLES (not named users), grant = Require MFA, with NO trusted-location or named-location exclusion. Break-glass excluded and alerted. Covers at minimum: Global Administrator, Privileged Role Administrator, Security Administrator, Exchange Administrator, SharePoint Administrator, User Administrator, Helpdesk Administrator.
Benchmark position
CISA MS.AAD.3.x and Microsoft's own guidance both require MFA on privileged roles with no location bypass. Same target; no gap.
Where we differ, and why
Targeting roles rather than users is the part people get wrong — a policy scoped to named admins silently fails to cover the next person promoted.
Where the switch is
Entra admin centre → Protection → Conditional Access → Policies → New policy → Users → Include → Directory roles.
How to verify
Graph: /identity/conditionalAccess/policies → conditions.users.includeRoles populated, conditions.locations.excludeLocations empty
- Why it matters
- Smallest population, largest blast radius. A trusted-location bypass is how an office IP address becomes the exploit.
- How we check
- Maester MT.1006, CISA.MS.AAD.2.x. Secure Score AdminMFAV2.
- Fix — M365
- A separate CA policy targeting directory roles rather than named users, so anyone promoted later inherits it. No location exclusion. Break-glass excluded and alerted.
- Fix — Google
- Enforce 2SV on the super-admin group with no grace period.
- User notices
- Admins are prompted more often.
- Expected pushback
- Minimal. Ship this before the all-users policy — small population, proves the pattern, and it's the population that matters most.