Thoughtfully implementing MFA while balancing Risk and User Experience

Secure Shield

Multi-Factor Authentication (MFA) is one of the most effective ways to prevent unauthorized access, and many organizations start with a single Conditional Access (CA) policy to enforce MFA across all users (excluding break-glass accounts). While this blanket approach offers broad coverage—and that’s an achievement in itself—it’s not without drawbacks.

Not all users are the same.

Treating every identity in your Microsoft 365 environment identically can create unnecessary friction and ignore important risk nuances. Different user populations present different risk profiles, and your MFA policies should reflect that.

To implement MFA more thoughtfully, consider breaking out your Conditional Access policies by user group. At a minimum, you should have distinct policies for each of these categories:

• Guests & External Users

• Global Administrators

• Other Administrative Roles (excluding Directory Synchronization accounts, if applicable)

• High-Value Targets (HVTs) – non-admins who handle sensitive data or business-critical functions

• Regular Users

Why take this approach?

Because each group deserves tailored security controls. For example:

Admins should re-authenticate more frequently—every 1 to 4 hours—and their sessions should end upon browser close. They should also be using phishing-resistant MFA.

Regular users, by contrast, might only need to re-authenticate once every 12 to 24 hours, allowing for a smoother experience without compromising core security principles.

This layered approach supports better security and a better user experience. It also allows for a phased MFA rollout across user populations using Conditional Access policies—not just groups—which offers more flexibility and control.

The latest CIS Microsoft 365 Foundations Benchmark (v5) calls for multiple policies: at least one for all users, and one specifically for admins. Expanding on that structure enables organizations to minimize disruption while raising the overall security bar.

Final Thoughts

Implementing MFA isn't just about checking a compliance box—it's about making intentional, risk-based decisions that protect your organization without overwhelming your users. A one-size-fits-all approach may get you started, but a nuanced, population-specific MFA strategy is what truly strengthens your security posture while maintaining productivity. If your current Conditional Access policies aren't segmented or haven't been reviewed against the latest CIS M365 Benchmarks, now is the time to act.

Ready to take a more thoughtful and strategic approach to Microsoft 365 security?

Book a Microsoft 365 Security Assessment with Redeemer Cybersecurity Consulting. We’ll evaluate your environment against industry best practices and help you implement practical, risk-aligned improvements that reduce your exposure—without disrupting your business.

Schedule Your M365 Security Assessment

Let’s secure your M365 Tenant with purpose.

Contact us at www.redeemercyber.com