Conditional Access for multi-location practices
Once a practice has more than one location — or clinicians working from home — the old security model of 'everything happens inside the office' is gone. Conditional Access is Microsoft Entra's policy engine for that world: every sign-in is evaluated against who is signing in, from what device, where, and to which app, and then allowed, challenged, or blocked.
Done well, staff barely notice it. Done badly, it locks a physician out mid-clinic. The difference is a small set of policies, rolled out in the right order.
The four policies that matter first
- Require MFA for all users, all apps — the foundation. Use authenticator app push or passkeys, not SMS, for anyone touching PHI.
- Block legacy authentication — old protocols (IMAP/POP/SMTP basic auth) bypass MFA entirely and are the standard entry point for password-spray attacks.
- Require compliant or Entra-joined devices for clinical apps — PHI gets opened on machines you manage and encrypt, not on a family laptop.
- Block sign-ins from countries you don't operate in — crude but effective noise reduction; pair with risk-based policies if you license them.
Multi-site specifics
Name your locations. Registering each clinic's public IP as a trusted named location lets you write sharper policies — for example, kiosk-style accounts that only work on-site, or extra scrutiny for admin sign-ins that originate anywhere else.
Treat home use deliberately: clinicians reviewing charts from home is normal now. The policy answer isn't 'block remote' — it's 'remote requires a compliant device plus MFA'. That's more secure than an office full of unmanaged PCs, not less.
Rolling out without lockouts
Every policy starts in report-only mode: Entra evaluates it and logs what would have happened without enforcing. Run a week in report-only, review the would-be blocks, fix the surprises (there are always surprises — a lab interface, a legacy scanner service), then enforce. And always keep one emergency break-glass account excluded from every policy, with credentials sealed and its use alerted.