2.5. Reflection Checkpoint

Key Takeaways

• Move enforcement to Conditional Access and methods to the authentication methods policy; migrate off security defaults and per-user MFA as the tenant matures; rank methods by phishing resistance (passkeys / WHfB / CBA at the top) and use TAP for bootstrap and recovery — never SMS for admins.
• Parse every CA scenario into assignments → conditions → controls, remember all matching policies apply and block always wins, exclude break-glass accounts everywhere, and ship changes through templates → report-only → What If → pilot → enforce, reading sign-in logs when reality disagrees.
• Sign-in risk scores the event (remedy: MFA); user risk scores the account (remedy: secure password change, which needs writeback for hybrid users); nothing remediates until risk conditions are wired into CA; investigation verbs (dismiss / confirm safe / confirm compromised) each teach the system something different.
• Global Secure Access extends the same identity engine to traffic: profiles acquire it, universal CA and the compliant-network check police it, Private Access replaces VPN with per-app ZTNA (client + connectors), Internet Access filters by identity, and tenant restrictions v2 guards against foreign-tenant exfiltration.

Connecting Forward

Phase 3 turns to the identities all these controls protect: tenant roles and administrative units (the authorization side you glimpsed in 1.3.2), the objects from 1.2.2 in operational depth, guests crossing the tenant boundary from 1.2.1, and the hybrid plumbing that keeps on-premises AD and Entra ID telling the same story.

Self-Check Questions

• A company requires phishing-resistant MFA for admins, MFA for everyone else, and no lockout risk for its two emergency accounts. Sketch the minimal CA policy set, including what each policy's authentication strength and exclusions look like.
• ID Protection flags a synced (hybrid) user as high risk; your user-risk policy requires secure password change, but the user is stuck in a loop. What dependency is probably missing, and what's the stopgap policy answer while you fix it?
• Your team must give remote employees access to an on-prem RDP host with MFA, and give an external auditor browser access to one internal web app from an unmanaged laptop. Which GSA/App Proxy combination serves each, and why not one tool for both?