Microsoft has started creating security policies inside your Microsoft 365 tenant without anyone asking — and if you leave them alone, they switch themselves on.
Here's what's going on. If your practice is on Business Premium, you're already paying for Conditional Access: the control that decides who can sign in, from where, and on what device. Most offices I look at have never opened it.
So Microsoft is now deploying its own policies into eligible tenants — things like blocking outdated sign-in methods and requiring MFA for admins — and they land in "Report-only" mode first. Report-only watches, but doesn't block. Then, around 30 days later, Microsoft turns the policy on for real. You get an email and a Message center post roughly two weeks ahead.
The security direction is right. It's also a surprise waiting to happen if nobody reads those notices. I've seen offices where the one account running the scanner-to-email workflow, or the after-hours billing sync, is exactly what a new sign-in policy breaks — on a Tuesday morning with a full waiting room.
Checking takes about twenty minutes: open Conditional Access, look at what Microsoft created, see what Report-only is already flagging, and fix the gaps before the switch flips. Exclude your break-glass admin account while you're in there.
You're already paying for this. Worth knowing what it's about to do.
Want the next one in your inbox?
One practical Microsoft 365, Copilot, Azure, or security move per week — plain English, no pitch.
Subscribe via email