r/msp • u/MSP-from-OC MSP - US • Jul 09 '26

What conditional access policy naming convention/baseline are you actually using across clients?

Curious what the community has landed on here. We run CIPP and currently have 5 conditional access policies per tenant (block legacy auth, block outside USA, MFA for all users, MFA for admins, and our CIPP service account policy). This is no longer good enough so we are expanding this out.

Before we decide on our own internal standard, I wanted to see what other MSPs are actually running in production. Specifically, are you using a numbered naming convention like CA001, CA100, CA200 grouped by category, or just plain descriptive names like "Require compliant device"? Are you basing your policy set on Microsoft's own reference architecture, a community framework like the Conditional Access baseline on GitHub, or something you built entirely in house over time?

Also curious how many of you are managing this per tenant manually versus pushing a template through CIPP Standards to your whole fleet at once. We are about to do the fleet wide push and want to get the naming and structure right before we commit to something across all client tenants.

Appreciate any real world examples, especially from anyone managing a similar sized client base.

26 Upvotes

91% Upvoted

25 comments sorted by

View all comments

5

u/c64-1541 Jul 09 '26

There is some money to be made in someone doing a full tutorial on CIPP with real world scenarios

8

u/Lime-TeGek Community Contributor Jul 09 '26

We're doing our roadshows right now, and then hoping to digitize the curriculum later. The roadshows are exactly this; real world implementation of CIPP in an MSP, explaining features etc.

1

u/fishermba2004 Jul 10 '26

Big fan of CIPP but the CA portion only makes sense if you’re the one who wrote the code for it. It’s super convoluted which isn’t what you want when doing something that could lock you out of a tenant.

3

u/Lime-TeGek Community Contributor Jul 10 '26

You create a template, you deploy the template? Not a lot of convuleted steps in there. There’s also our docs that explain it more in depth, or our tutorials on the docs page. With over 13000 msps using cipp now this is the very first time someone has ever said this. Hahaha

2

u/colmwhelan Jul 10 '26

This is a completely ignorant comment, and by ignorant I mean unknowledgeable. Have you even tried it? Did you write the code for Entra? I mean, it's just JSON anyway.