Healthcare-sector ransomware incidents doubled year over year, with ninety-five percent of reported cases resulting in a successful compromise of sensitive data. This stark reality underscores the necessity of the Essential Eight Maturity Model, a framework developed by the Australian Signals Directorate to help organizations mitigate cyber threats. In the current landscape of 2026, the shift from basic security to a hardened Level 2 posture is no longer a luxury but a fundamental requirement for business continuity. Implementing multi-factor authentication through Microsoft Entra ID provides a scalable and effective method to meet these stringent requirements. By leveraging Conditional Access, technical teams can move beyond static security rules and adopt a dynamic, risk-based approach that addresses modern identity threats. This transition requires a deep understanding of how identity signals are evaluated and enforced across diverse cloud environments.
The architectural foundation of Level 2 maturity focuses on extending multi-factor authentication to every user within the environment, regardless of their privilege level. Unlike the initial stages of maturity, Level 2 specifically targets the elimination of legacy authentication bypasses and the establishment of comprehensive logging. This ensures that every entry point into the corporate network is monitored and protected against credential-based attacks. Organizations that successfully implement these controls see a dramatic reduction in successful account takeovers and unauthorized lateral movement. As security professionals navigate the complexities of 2026, the integration of Conditional Access into the broader security operations center has become the standard for achieving compliance and operational resilience. The following roadmap provides the specific technical steps required to architect this environment using modern tools and automation.
1. Examine Current Legacy Authentication Traffic
Identifying the footprint of legacy authentication is the first critical step toward securing the identity perimeter. Protocols such as IMAP, POP3, and SMTP AUTH do not support modern interactive sign-in prompts, making them prime targets for automated password-spraying attacks. In the 2026 threat environment, attackers frequently scan for these open protocols to bypass multi-factor authentication challenges entirely. Organizations must use KQL queries within Microsoft Entra Log Analytics to isolate and analyze every instance where these legacy methods are still being utilized. This diagnostic phase allows administrators to identify specific service accounts, older hardware like office scanners, or outdated mobile mail clients that are still relying on basic authentication. Without this initial visibility, any move to enforce stricter policies could lead to significant operational disruptions across various business departments.
Once the initial inventory is complete, technical teams must categorize these legacy connections by their business impact and technical necessity. In many cases, a simple upgrade to a modern application or a configuration change on a mobile device is sufficient to transition the user to a more secure protocol. However, some integrated systems may require more extensive updates to support OAuth 2.0 or modern authentication flows. The data gathered during this audit provides the evidence needed to justify upgrades to stakeholders and prepares the IT team for the eventually mandated block. By meticulously documenting every legitimate use case for legacy protocols, the organization can create a roadmap for decommissioning these vulnerabilities over a defined period. This proactive approach ensures that by the time enforcement policies are activated, the number of potential service failures is minimized to the greatest extent possible.
2. Establish a Connection to Microsoft Graph
Automation is the linchpin of modern identity management, and the Microsoft Graph PowerShell SDK has become the primary interface for managing Conditional Access at scale. Starting from 2026, the reliance on graphical interfaces for policy deployment has shifted toward infrastructure-as-code models. By establishing a secure connection to Microsoft Graph with the Policy.ReadWrite.ConditionalAccess scope, administrators can ensure that their security baselines are reproducible and auditable. This programmatic access allows for the rapid deployment of complex policy sets across multiple tenants while maintaining a single source of truth in a version-controlled repository. Using PowerShell 7.4 or later ensures compatibility with the latest identity features and provides a more robust environment for executing complex scripts that manage hundreds of individual policy settings.
Establishing this connection requires more than just a simple login; it necessitates a structured approach to permission management. Administrators should adhere to the principle of least privilege, ensuring that the credentials used for automation only have the specific scopes required for the task at hand. Once the connection is established, the environment can be used to pull current policy configurations for backup or to simulate changes in a sandbox environment. This level of technical control is essential for organizations tracking their progress from 2026 to 2028, as it allows for the continuous refinement of security controls without the risks associated with manual configuration errors. Programmatic management also facilitates more frequent internal audits, as scripts can quickly generate reports on policy compliance and identifying any drift from the established security baseline.
3. Designate a Break-Glass Bypass Group
The risk of a total lockout is a major concern when deploying restrictive identity policies, making the creation of emergency access accounts a non-negotiable requirement. These accounts, often referred to as “break-glass” accounts, must be cloud-only and excluded from every Conditional Access policy to ensure that administrators can regain control of the tenant if a configuration error or a third-party service outage occurs. In 2026, industry best practices dictate that these accounts should use highly complex passwords stored in a secure, physical location, such as a fireproof safe, rather than a digital password manager that might itself be subject to the same identity policies. The designated exclusion group must be monitored with high-severity alerts so that any sign-in attempt using these credentials triggers an immediate security investigation.
Maintaining this exclusion group requires strict governance and regular testing to ensure its effectiveness. The group should contain at least two separate accounts to provide redundancy and avoid a single point of failure in an emergency scenario. These accounts should not be assigned to any specific individual but should be treated as a shared organizational resource with strict access logs. Organizations should perform quarterly “fire drills” where they verify the credentials and the ability to sign in without being blocked by Conditional Access rules. This practice ensures that the emergency procedures are well-understood by the senior technical staff and that the accounts remain active and ready for use. By explicitly excluding this group from all policies, the organization creates a safety net that allows for more aggressive security enforcement elsewhere in the environment.
4. Prohibit Legacy Authentication Across the Tenant
Blocking legacy authentication is perhaps the most impactful single action an organization can take to satisfy Essential Eight Level 2 requirements. This policy acts as a definitive barrier against attackers who seek to exploit the lack of multi-factor authentication support in older protocols. When creating this policy in the Entra admin center, administrators must target “Other clients” and “Exchange ActiveSync” under the client app conditions. This ensures that any attempt to use basic authentication is rejected at the protocol level, regardless of the user’s password strength. By the middle of 2026, the majority of modern enterprises have already moved toward this “block by default” posture, recognizing that the security risks of legacy protocols far outweigh the convenience of supporting outdated software.
Transitioning to a full block should always involve a monitored phase where the policy is set to report-only mode. This allows the security team to observe real-world sign-in attempts and verify that no critical business processes are inadvertently interrupted. If the telemetry shows that certain critical service accounts are still being blocked, those specific instances can be addressed before the policy is moved to a fully enabled state. Once the transition is complete, the organization effectively closes a massive hole in its security perimeter that has historically been the primary entry point for large-scale ransomware attacks. The successful enforcement of this policy provides a strong signal to auditors that the organization is serious about its commitment to identity security and is fully aligned with the technical objectives of the Essential Eight Level 2 maturity.
5. Enforce MFA for the Entire User Base
The core requirement of Essential Eight Level 2 is the universal application of multi-factor authentication to every user account, without exception. This policy must cover all cloud applications and services accessed through the Entra ID platform to ensure there are no “shadow” areas where a single password is sufficient for access. In 2026, the user experience for MFA has been refined to minimize friction, with many organizations utilizing number matching or biometric prompts to increase security while maintaining productivity. The broad enforcement policy should be scoped to “All users” and include all cloud apps, ensuring that any new service added to the tenant is automatically protected by the existing MFA requirements. This proactive stance prevents the common issue of new applications being deployed with inadequate security controls during rapid business expansion.
Deploying this universal requirement often uncovers cultural and technical challenges within an organization that must be managed with clear communication. Employees should be given ample notice and provided with training on how to register and use their chosen authentication methods. The initial rollout should utilize the report-only feature to identify users who have not yet registered for MFA, allowing the IT help desk to reach out and assist them before the enforcement deadline. As the policy moves to an enabled state, the organization establishes a new baseline where identity is verified through at least two distinct factors. This significantly raises the cost for attackers, as stolen credentials alone are no longer enough to gain access. The result is a much more resilient environment that can withstand the credential-focused attacks that are so prevalent in the modern threat landscape.
6. Apply Stricter MFA Rules for Administrative Roles
Privileged accounts represent the most significant risk to an organization, as their compromise can lead to full tenant takeover and data exfiltration. Consequently, Level 2 maturity demands that these accounts be subject to even more stringent Conditional Access policies than standard users. For accounts holding roles such as Global Administrator or Privileged Role Administrator, policies should mandate the use of the most secure authentication methods available. In the 2026 environment, this often means requiring phishing-resistant MFA, such as FIDO2 security keys or certificate-based authentication, for all administrative tasks. These policies should also be coupled with shorter sign-in frequency intervals, forcing administrators to re-authenticate more often to ensure that their active sessions remain secure and under their direct control.
Beyond just the authentication method, these policies should integrate with Privileged Identity Management to ensure that rights are only elevated when necessary. By requiring MFA at the time of role activation, the organization adds another layer of defense against session hijacking and unauthorized use of administrative tools. This targeted approach ensures that the “keys to the kingdom” are protected by the highest possible standards, while standard users enjoy a more balanced security profile. Auditors specifically look for these tiered security models during a Level 2 review, as they demonstrate a sophisticated understanding of risk management and resource protection. Implementing these stricter controls for admins effectively isolates the most sensitive parts of the identity infrastructure from the general pool of user accounts, creating a robust defense-in-depth strategy.
7. Define Recognized Network Locations
Utilizing network location as a signal in Conditional Access policies allows organizations to differentiate between sign-ins from trusted corporate offices and those from untrusted or high-risk regions. By configuring Named Locations in Entra ID, administrators can define specific IP ranges that belong to their physical offices or authorized VPN endpoints. In 2026, this geographical context is used to apply different levels of scrutiny to sign-in attempts; for example, a sign-in from a trusted office IP might require standard MFA, while an attempt from an unrecognized country could be blocked entirely or require a more secure authentication method. This adds a layer of “geographic fencing” that helps prevent attackers from using stolen credentials from remote locations where the organization has no legitimate business presence.
Defining these locations also facilitates the creation of targeted exclusions for specific scenarios where traditional MFA might be difficult to implement. However, it is essential to remember that under Essential Eight Level 2, network location should never be used as a replacement for MFA, but rather as an additional condition that strengthens the overall security posture. Technical teams must regularly review these IP ranges to ensure they are current, as network changes or provider shifts can lead to authorized users being inadvertently blocked. By maintaining an accurate map of the organization’s network footprint, administrators can create policies that are both highly secure and intelligently responsive to the user’s current environment. This context-aware approach is a hallmark of a mature identity strategy that balances technical rigor with operational flexibility.
8. Incorporate Guest and B2B Identities
In the collaborative business environment of 2026, guest users and B2B partners often have access to sensitive internal resources through platforms like Microsoft Teams and SharePoint. Level 2 maturity requirements explicitly state that these external identities must be subject to the same MFA requirements as internal employees. This ensures that a compromise at a partner organization does not become a backdoor into the local environment. Conditional Access policies should be specifically configured to include “Guest or external users,” ensuring that any third party accessing corporate data is challenged for a second factor. This is particularly important for organizations that rely on a global supply chain, where external access is frequent and often involves significant amounts of intellectual property.
Managing these external identities requires a clear understanding of cross-tenant access settings and how MFA claims are shared between organizations. Entra ID allows administrators to trust MFA from the guest user’s home tenant, which can improve the user experience while still ensuring that a second factor was successfully verified. If the guest’s home tenant does not support MFA, the local policy should force the guest to register for MFA within the host environment. This dual-layered approach ensures that no external user is granted access without meeting the organization’s security standards. By documenting these guest access policies and including them in the overall security baseline, the organization demonstrates to auditors that its security perimeter extends to include all entities that interact with its data, regardless of their original affiliation.
9. Activate Continuous Access Evaluation
Continuous Access Evaluation represents a major leap forward in identity security by allowing Entra ID to revoke access tokens in near-real-time when a critical security event occurs. Before this technology became standard, a user could remain logged in for hours after their account was disabled or their password was reset because their active access token was still valid. In 2026, CAE has been widely adopted as a foundational component of Level 2 maturity, providing a way to respond instantly to detected threats. When a user’s risk level increases or a specific event like a location change is detected, CAE allows the service to challenge the user for MFA or block their access immediately. This significantly narrows the window of opportunity for an attacker who has managed to hijack an active session.
Ensuring that CAE is properly configured involves monitoring the sign-in logs to verify that the service is successfully communicating with supported applications like Exchange Online and SharePoint. Administrators should check the Conditional Access insights and reporting tools to see how many sessions are being managed by CAE and to identify any apps that might not yet support this advanced feature. While CAE is largely automated, its successful implementation requires that the underlying network and identity infrastructure be healthy and responsive. By prioritizing this real-time revocation capability, organizations align themselves with the more advanced defensive strategies outlined in the Essential Eight. This capability is especially critical for defending against session-hijacking attacks, where traditional token expiration schedules are insufficient to protect high-value corporate assets.
10. Manage Login Frequency and Browser Persistence
Session management is a critical but often overlooked component of Essential Eight Level 2 compliance. Organizations must strike a balance between security and productivity by defining how long a user can remain logged in without being prompted for a new MFA challenge. In 2026, the standard practice for Level 2 is to set a sign-in frequency that requires re-authentication at least once every business day for standard users, and more frequently for those in privileged roles. This ensures that if a device is left unattended or a browser session is compromised, the attacker’s window of access is limited by the mandatory re-authentication schedule. Browser persistence controls also play a role here, ensuring that sessions are not saved on unmanaged or public devices, which further reduces the risk of unauthorized access.
Implementing these controls requires configuring the Session section of a Conditional Access policy to override default browser behaviors. Administrators can choose to block persistent browser sessions entirely for users on unmanaged devices, forcing them to sign in every time the browser is closed and reopened. This is particularly effective for remote workers who might be using personal hardware to access corporate web applications. By the middle of 2026, many organizations have standardized these settings across their entire fleet to ensure consistent security regardless of where the employee is working. Regularly reviewing these session logs helps administrators understand the impact on the help desk and adjust the frequency as needed to minimize user frustration while maintaining a high level of security. This granular control over session longevity is a key differentiator between a Level 1 and a Level 2 identity environment.
11. Mandate Healthy or Domain-Joined Devices
While multi-factor authentication focuses on the identity of the user, requiring a healthy or compliant device adds a layer of security focused on the hardware itself. Under Level 2 maturity, organizations are encouraged to integrate their Conditional Access policies with Intune to ensure that only devices meeting specific security standards can access corporate data. This might include requirements for active antivirus software, BitLocker encryption, and the latest operating system patches. By the arrival of 2026, this “device-aware” security model has become a primary defense against the use of personal, unmanaged devices that may already be compromised by malware. Requiring that a device be “Hybrid Azure AD Joined” or marked as compliant provides a significant barrier to attackers who try to sign in from unauthorized machines.
This approach also supports other Essential Eight strategies, such as patch management and application hardening, by ensuring that the device’s software state is verified at the moment of sign-in. If a device falls out of compliance because it missed a critical security update, Conditional Access can automatically block its access to Microsoft 365 until the issue is remediated. This creates a powerful incentive for employees to keep their devices updated and allows the IT team to maintain a higher overall standard of fleet health. For auditors, this policy provides tangible evidence that the organization is monitoring its environment for both identity and device-level risks. The integration between Entra ID and device management platforms is a critical technical achievement for any organization serious about reaching Level 2 maturity in the 2026 to 2028 period.
12. Configure Long-Term Log Preservation
A common pitfall in Essential Eight assessments is the failure to maintain sufficient audit logs for a full 12-month period. Microsoft Entra ID P1 only retains sign-in and audit logs for 30 days by default, which is inadequate for the long-term forensic analysis and compliance reviews required at Level 2. To address this, organizations must configure diagnostic settings to stream these logs to a more permanent storage solution, such as an Azure Log Analytics workspace or a dedicated security information and event management system. In 2026, this data pipeline is the primary source of truth for security analysts who need to investigate historical sign-in patterns or verify the effectiveness of specific policy changes over time. Without these logs, it is impossible to prove to an assessor that MFA was consistently applied throughout the previous year.
Beyond just storing the data, organizations must ensure that the logs are easily searchable and that the necessary queries are pre-built for rapid reporting. This includes tracking every time a Conditional Access policy was applied, the specific MFA method used, and any instances where a sign-in was blocked. In the 2026-2028 compliance cycle, the ability to quickly generate a report showing MFA success rates for privileged users has become a standard requirement for annual security audits. By investing in a robust logging infrastructure early in the deployment process, technical teams can avoid a frantic scramble for data when the audit window opens. This focus on data retention and visibility is a hallmark of a mature security organization that understands that compliance is an ongoing process of verification rather than a one-time configuration event.
13. Maintain an Official Exception Log
In any complex enterprise environment, there will inevitably be legitimate business scenarios that require a temporary or permanent exclusion from standard security policies. Essential Eight Level 2 requires that these exceptions be documented in an official register that includes the justification for the exclusion, the specific users or groups involved, and a scheduled review date. In 2026, auditors treat an undocumented exclusion as a critical failure, as it indicates a lack of governance over the security environment. The exception log should be a living document, updated every time a change is made to a Conditional Access policy. This practice ensures that the organization remains aware of its residual risks and has a plan to remediate them as soon as technical or business constraints allow.
Managing the exception register also provides a structured way for the security team to push back against unnecessary requests for policy bypasses. When a department head realizes that an exception requires formal documentation and a senior-level sign-off, they are often more willing to find a way to comply with the standard security requirements. For those exceptions that are truly necessary, such as legacy integrations that cannot yet be upgraded, the register serves as a roadmap for future technical debt reduction. By the time 2026 reached its midpoint, the most successful organizations had integrated this register into their standard change management process, ensuring that security and compliance are always considered together. This level of documentation demonstrates a high degree of operational maturity and provides a clear narrative for auditors during a Level 2 review.
14. Transition Policies from Monitoring to Enforcement
The final step in the Level 2 journey is the deliberate transition of policies from report-only mode to a fully enabled state. This phase must be handled with care to avoid widespread service interruptions, particularly in large organizations with thousands of users. Technical teams should review the “Report-only” insights for each policy to identify any unexpected impacts on users or service accounts. If the telemetry shows a high volume of blocks that were not anticipated, the policy should be adjusted and monitored for another cycle. In 2026, the most effective rollouts are those that happen in stages, enabling policies for specific departments or user groups before flipping the switch for the entire organization. This phased approach allows the support team to handle any registration issues or configuration errors in a manageable way.
Once all policies are enabled, the organization moves into a period of post-implementation monitoring to ensure that the security baseline remains stable. This involves checking the sign-in logs daily for any sudden spikes in failures and ensuring that the help desk is equipped to resolve common MFA enrollment issues. The successful transition to full enforcement marks the achievement of a significant milestone in the organization’s cybersecurity journey. From this point forward, the focus shifts to maintaining the baseline and preparing for the even more stringent requirements of Level 3. By following this structured roadmap, administrators have built a defense-in-depth architecture that is both resilient against modern threats and fully aligned with the Australian Signals Directorate’s expectations for a Level 2 mature organization.
15. Gathering Necessary Evidence for Auditors
Successfully passing an Essential Eight Level 2 audit requires more than just functional security; it requires organized, undeniable proof of that security. When the audit begins, the first request will typically be for a full export of all Conditional Access policy definitions in a human-readable format. These documents should clearly show that MFA is required for all users and that legacy authentication is blocked across the entire tenant. In 2026, many organizations use automated scripts to generate these summaries, ensuring that the evidence provided to the auditor matches the live configuration exactly. Discrepancies between the intended policy and the actual enforcement are a common source of audit findings, so regular self-auditing using the “What If” tool is essential for maintaining accuracy.
Beyond policy exports, auditors will demand a sample of sign-in logs that demonstrate the policies are actually working in practice. They will look for entries where a user was successfully challenged for MFA and where a legacy authentication attempt was rejected. The exception register, which was meticulously maintained in the previous steps, will also be a primary document for review. The auditor will compare the exclusions listed in the register against the actual exclusions in the Entra ID tenant to ensure they match perfectly. Demonstrating this level of control over the environment provides the auditor with confidence that the organization’s maturity is not just a theoretical goal but a consistently managed reality. This evidentiary stage is the culmination of all the technical work performed, proving that the organization’s defenses are both active and auditable.
16. The Path Forward for Cybersecurity Resilience
The journey to achieving Essential Eight Level 2 maturity with Conditional Access was a transformative process for many technical teams by 2026. Organizations that prioritized this roadmap found themselves significantly better prepared for the evolving threat landscape than those that relied on outdated, password-only security models. By systematically addressing legacy vulnerabilities, enforcing universal multi-factor authentication, and implementing robust session and device controls, these entities built a foundation that was both resilient and adaptable. The transition from monitoring to full enforcement required a combination of technical precision and clear organizational communication, ensuring that security goals were achieved without compromising business productivity. These efforts resulted in a measurably more secure environment where identity is treated as the primary perimeter.
Moving forward, the focus shifted toward maintaining this baseline while looking toward the future requirements of Level 3. The implementation of phishing-resistant authentication methods and more advanced identity protection signals became the next logical steps for those seeking even higher levels of maturity. The documentation and logging infrastructure established during the Level 2 journey served as the groundwork for these advanced enhancements. As the cybersecurity landscape continues to change from 2026 to 2028, the principles of continuous evaluation and documented governance will remain the most effective tools for defending sensitive data. Organizations that have successfully navigated this process now possess the technical maturity to meet any new challenges that emerge, ensuring long-term resilience in an increasingly complex digital world.
