Microsoft says your security rules protect too many people. Do not lower the protection.

Some time in the first week of August, administrators started seeing a new banner on the Conditional Access page in Microsoft Entra. The message, as reported by Office 365 IT Pros among others, is that some policies protect more users than your current licences cover.

Conditional Access is the set of rules that decides when someone must use two-step verification, which devices may sign in and what gets blocked. For most companies it is the backbone of Microsoft 365 security. And according to Microsoft, the feature requires a Microsoft Entra ID P1 licence.

The reassuring part first. The warning is informational. No automatic bill arrives, and nothing gets switched off. Microsoft itself states that Conditional Access policies are not automatically disabled or deleted even when the licences expire. They can be viewed and deleted, but not updated.

So there is no need to act in a panic today. But you should act deliberately.

The figure behind the warning comes from the licence usage page in Entra. According to Microsoft's documentation, it counts the unique users who had at least one policy evaluated during the previous month, and compares that with the number of licences you own.

That measures what happened, not how many people you actually need to license. Someone on parental leave in August does not show up, but is still covered by the policies. A shared account or an old consultant account, on the other hand, can show up even though it should no longer exist.

A common cause in smaller companies is a mix of licences. Some people have Microsoft 365 Business Premium, which according to Microsoft includes Entra ID P1. Others have Business Standard or Business Basic, which do not include Conditional Access. And the policies are set to "All users".

The most obvious fix is to exclude the unlicensed users from the policies. Then the warning goes away.

But so does the protection for exactly those people. A security decision gets made through a licensing warning, which is rarely a good way to make security decisions. The person excluded from the two-step verification requirement is precisely the user an attacker is looking for.

• Look at the number yourself. In the Entra admin center it is under Billing, Licenses, License usage. Compare it with how many people your policies actually cover.
• Clean up first. Accounts for people who have left, old consultants and test accounts should go regardless of licensing. That is often half the problem.
• Decide per group, deliberately. Either upgrade the unlicensed users to Business Premium, or buy Entra ID P1 separately. Exclusions from policies should be an active decision with a reason, not a way to silence a warning.
• Write the decision down. Who is excluded, why, and who decided. It is worth its weight in gold the next time someone asks, for example a customer running a supplier review.
• No P1 at all? Then Microsoft's security defaults are a baseline available to everyone, including two-step verification.

Licence reviews like this are part of our Managed IT, and it is not unusual to find licences that are paid for but unused in the same review that finds the missing ones. Seeing the warning in your environment? Book a free consultation and we will go through it together.