SMB Guide to Zero Trust and Conditional Access

The SMB Guide to Zero Trust and Conditional Access in Microsoft 365 is the first of the three core guides that I recommend to MSPs and independent consultants who serve small and mid-sized business customers.

This guide describes what good looks like when it comes to Conditional Access policy design. It contains detailed explanations for CA policy settings and best practices as regards naming convention, organization, enforcing access controls, and more.

As with all the core guides, this document will outline three security profiles (Baseline, Standard, and Strict) along with corresponding scripts and other supporting materials like end user communication templates and statements of work.

Latest update: 03/2024 - Minor update, including adding description of "Authentication flows" to section on Conditional Access. Also made minor updates to the Import-CAPolicies.ps1 script for better error checking, etc.