Conditional Access baseline

Certaria runs inside your Microsoft 365 tenant and uses your existing identity protections. It does not replace or configure Conditional Access for you.

Where: the Microsoft Entra admin centre. Nothing in this guide is done inside Certaria. To get the security posture Certaria is designed for, your tenant should have a minimum set of Conditional Access policies in place before or during onboarding.

Why this matters

Certaria holds your ISMS evidence and some personal data, and the people who administer it have privileged access. Conditional Access is what ensures that access is protected by multi-factor authentication and, ideally, healthy devices. Because these policies live in your tenant, you own them and Certaria relies on them.

Recommended minimum

Set these up in the Microsoft Entra admin centre. Each one maps to an ISO 27001:2022 control, so having them in place also strengthens your own certification evidence.

1. Multi-factor authentication for all administrators. This especially covers anyone holding the Certaria ISMS Admin security role. (A.5.15, A.8.5)
2. Block legacy authentication. Older sign-in protocols can skip multi-factor authentication, so blocking them protects the policy above. (A.8.5)
3. Multi-factor authentication for everyone who uses Certaria. Evidence and personal data should never be reachable with a password alone. (A.5.15)
4. Require a compliant or hybrid-joined device for administrator access (recommended). This limits the damage if an administrator credential is ever stolen. (A.8.1)
5. Sign-in and user risk policies if you have Entra ID P2 (recommended). These detect and block unusual access to your ISMS data. (A.5.7)

How Certaria helps you check

Certaria reads your Conditional Access policy definitions as evidence and stores them in the Conditional Access Policy table. You, or your auditor, can open that table to confirm the policies above are present. Your Conditional Access posture becomes part of your audit trail rather than an unverified assumption.

What Certaria does not do

Certaria does not create, change, or enforce Conditional Access policies. It reads them for evidence only. Setting up and maintaining these policies is done in the Microsoft Entra admin centre by your tenant administrator.

Related tenant hardening (not Conditional Access)

This step is not a Conditional Access policy, but it protects the same data, so it belongs alongside the baseline above. It is set in the Power Platform admin centre rather than in Microsoft Entra.

Power Platform can expose your Dataverse data (which, for Certaria, includes your ISMS evidence and some personal data) to AI assistants through a feature called the Dataverse Model Context Protocol. A list called Allowed MCP Clients controls which assistants are permitted to read and write that data using natural language. Each entry is a live path into your ISMS.

We recommend you treat that list the same way you treat any privileged access:

1. Review the list of allowed clients. In the Power Platform admin centre, open your environment, then Settings, then Product, then Features, and find the Dataverse Model Context Protocol section and its advanced settings. The list shows every assistant currently allowed.
2. Disable anything you do not use. Set unused clients to not enabled. A client you never use is a data path you do not need to leave open.
3. Take extra care with general-purpose assistants. Some assistants can move information across email, Teams, and files. If one of those can read your ISMS evidence, it can also carry that evidence outside your ISMS. Enable those only where you have a clear reason and understand where the data can travel.
4. Re-check the list periodically. New assistants can be added over time. A short recurring review keeps the list matched to what you actually rely on.

This maps to ISO 27001:2022 access-control expectations (A.5.15), restriction of information access (A.8.3), and privileged access management (A.8.2), so keeping the list tight also strengthens your certification evidence.