Personas are the unit a reviewer can reason about; individual policies are not. These eight rows compile to 38 deployed policies, and the rows are what gets signed off.
Every row has an explicit outcome, including the two that are Block. A Conditional Access estate with no block rules is a set of suggestions.
Break-glass is a row rather than a footnote, because its exclusions are the most security-relevant configuration in the tenant and they must be visible to be reviewed.
Rollout discipline
Every policy ships in report-only mode for 14 days, and the impact query must show zero unexpected blocks before enforcement.
Policies are deployed from JSON in the IaC repository (view 21), so a change is a pull request with a diff rather than a portal edit nobody can reconstruct.
Workload identities are targeted by Conditional Access too, restricted to named locations. That is the control that turns a leaked service principal secret from access into a blocked sign-in.
Assumptions and residuals
Legacy authentication is fully blocked. Confirm no business-critical application still needs it — this is the change most likely to cause an outage on day one.
Guests are trusted for MFA satisfied in their home tenant. That transfers part of the assurance to 34 partner organisations, which is a deliberate and reviewable trade.
Privileged Access Workstations are assumed available for all 190 administrators. If they are not, the administrator row weakens to compliant-device-only.
