Create a Conditional Access Policy Design: The Castle Bypass

In the second video in our series on Practical Conditional Access, we are talking about requiring MFA except when you are in a trusted location. This type of policy is common but increases an organization's risk due to the bypass. So in this video, we will walk through a design called "The Castle Bypass" which fixes some of the issues with using a trusted location. In this video, we will be focusing on the design of the "The Castle Bypass" policy. The Castle Bypass policy goal is as follows: • Require MFA for all access except trusted locations • Block Legacy Auth • Require Admins to MFA always • Require Guests to MFA • Require MFA Registration from on Prem By the end of the video, you will have a solid CA policy that will keep your environment safe and secure. So if you are looking for a step-by-step guide on creating a Conditional Access Policy, be sure to watch this video, and stay tuned for the next videos in the series. Where we will look at device-based policies. R E S O U R C E S https://github.com/dougsbaker/Public-... https://learn.microsoft.com/en-us/azu... https://learn.microsoft.com/en-us/azu.... C H A P T E R S 00:00 Intro 01:15 Policy Design 03:53 Setting Overview & Named Locations 05:43 [MFA] Admin Accounts 07:40 [MFA] Standard Users (Non-Trusted Locations) 10:37 [MFA] Guest Users 11:45 [Block] Legacy Auth 13:20 [MFA] MFA Registration (Non-Trusted Locations) 17:30 Testing / Demo Experience of TAP 2:48 Video Wrap up