Entra ID
Microsoft Entra ID security auditing: Conditional Access, MFA, privileged roles, applications and hybrid identity, with the checkpoints to verify.
Each article starts from what we find when auditing tenants and ends with the list of checks to run.
Managed identities: the Graph and Azure privileges nobody looks at
Managed identities remove secrets, not privileges. How to inventory their Microsoft Graph and Azure permissions, spot escalation paths and apply least privilege.
Entra IDToken protection in Conditional Access: what it really covers
Token protection binds sessions to the device that obtained them. Its real scope, supported clients and platforms, and a careful rollout in report-only mode.
Entra IDPHS, PTA or federation: choosing hybrid authentication and moving off AD FS
Password hash sync, pass-through authentication or federation: strengths and risks of each, then a gradual migration off AD FS using staged rollout.
Entra IDUser consent to applications: closing the door on consent phishing
Restricting user consent, relying on verified publishers and low-impact permissions, and setting up the admin consent workflow.
Entra IDSecrets and certificates on app registrations: credential hygiene that holds up
Client secrets versus certificates, lifetimes, long-lived secrets, app registration owners and orphaned apps: what needs to be under control.
Entra IDHigh-risk Microsoft Graph permissions: why some applications are Tier 0
RoleManagement.ReadWrite.Directory, AppRoleAssignment.ReadWrite.All, Application.ReadWrite.All, Mail.ReadWrite: these application permissions amount to Global Administrator-level control.
Entra IDManaged identities or service principals with secrets: choosing and auditing
When to use a managed identity rather than a service principal with a secret, the difference between system-assigned and user-assigned identities, and how to audit their Azure and Graph rights.
Entra IDWorkload identity federation: removing secrets from pipelines without opening a gap
GitHub Actions, Azure DevOps and Kubernetes can authenticate to Entra ID without a secret using OIDC. The critical point: how tightly the subject claim is scoped.
Entra IDEntra ID default user settings: what every user can do without a role
Registering apps, creating groups or tenants, reading the directory, reaching the admin center: a review of default permissions and the settings worth hardening.
Entra IDExternal collaboration settings: keeping guests in check in Entra ID
Guest access restrictions, invitation rights, domain allow and deny lists and email one-time passcode: the external collaboration settings worth reviewing.
Entra IDInactive and never-redeemed guests: detect, disable, delete
Using signInActivity and invitation state to find dormant guest accounts, then putting a regular, automated clean-up process in place.
Entra IDEntra certificate-based authentication: bindings, affinity and deployment pitfalls
PKI trust, username bindings, high versus low affinity and revocation: what makes certificate-based authentication genuinely phishing-resistant, or not.
Entra IDAuthentication strengths in Conditional Access: requiring the right MFA in the right place
Built-in and custom strengths, phishing-resistant MFA for administrators, guests and cross-tenant access: how to use authentication strengths without locking yourself out.
Entra IDSign-in frequency and persistent sessions: getting Conditional Access session controls right
Sign-in frequency, persistent browser sessions and the "Every time" option: how to use Conditional Access session controls to reduce risk without wearing users out.
Entra IDTesting Conditional Access without locking yourself out: report-only mode and the What If tool
Report-only mode, the What If tool, the insights and reporting workbook and staged rollout: a method for enabling Conditional Access policies without blocking the organisation.
Entra IDJoining devices to Entra ID: who can join, and who becomes local administrator?
Entra ID device settings are rarely reviewed: join permissions, per-user quota, local administrators, Windows LAPS and access to BitLocker keys.
Entra IDPHS, PTA or federation: choosing your hybrid authentication method
Password hash synchronization, pass-through authentication or federation: the three methods compared from the angle of security, resilience and leaked credentials detection.
Entra IDLeaving AD FS: moving to cloud authentication without disrupting users
Relying party inventory, staged rollout, migration of applications and claims rules, then full decommissioning: the steps of a controlled exit from AD FS.
Entra IDSeamless SSO: protecting the AZUREADSSOACC account and rolling over its key
Seamless SSO relies on a computer account whose Kerberos key is shared with Entra ID. Why that account is sensitive, how to roll over its key and when to turn the feature off.
Entra IDEntra Cloud Sync or Entra Connect Sync: choosing your synchronisation engine
Architecture, features, the security footprint of the agents and the migration approach: the criteria for choosing between Microsoft Entra Cloud Sync and Microsoft Entra Connect Sync.
Entra IDSoft match and hard match: when synchronisation can take over a cloud account
The matching mechanisms between Active Directory and Entra ID accounts make migrations easier, but they can let an on-premises attacker take over a cloud account. How they work and how to lock them down.
Entra IDMFA fatigue: number matching, additional context and what comes next
Push notification bombing is still an effective technique against traditional MFA. What number matching and additional context change, how to make use of user reports, and why phishing-resistant methods should be the goal.
Entra IDTemporary Access Pass: a valuable tool that needs strict controls
The Temporary Access Pass makes passwordless onboarding and account recovery easier. One-time or multi-use, lifetime, roles allowed to issue it: the settings that stop it from becoming a back door.
Entra IDEntra smart lockout: tuning it properly against password spraying
Threshold, duration, familiar locations and interaction with Active Directory lockout: how to tune Entra ID smart lockout without locking out your own users.
Entra IDTenant restrictions v2: stopping data from leaking to other tenants
How tenant restrictions v2 prevent your users from signing in to third-party tenants from your devices and network, and how they fit with cross-tenant access settings.
Entra IDCustom Entra ID roles: least privilege when built-in roles are too broad
When to create a custom role in Entra ID, how to pick its permissions, scope it to an administrative unit or an application, and which pitfalls to avoid.
Entra IDCloud-only admin accounts: keeping Entra ID administration separate from on-premises AD
Why privileged Entra ID roles should never be granted to synchronised accounts, and how to design dedicated, mailbox-free and strongly protected admin accounts.
Entra IDFive useful KQL queries on Entra ID sign-in and audit logs
Legacy authentication, MFA failures, password spraying, application consents and role changes: simple KQL queries for Log Analytics and Microsoft Sentinel.
Entra IDAuditing the OAuth permissions already granted in Entra ID
Delegated permissions, organisation-wide consents, application permissions: how to inventory what third-party applications have already been granted and clean up without breaking production.
Entra IDEnterprise applications: why you should turn on "Assignment required"
By default, any user in the tenant can get a token for most enterprise applications. How the "Assignment required" option and Conditional Access actually restrict access.
Entra IDSecurity defaults: what they protect, and when to move to Conditional Access
What Entra ID security defaults enforce, where they fall short, and how to replace them with Conditional Access policies without opening a window of exposure.
Entra IDAzure access elevation: when a Global Administrator takes over every subscription
The "Access management for Azure resources" option lets a Global Administrator grant themselves User Access Administrator at the Azure root scope. Risk, monitoring and control.
Entra IDFederated domains: a quiet backdoor in Entra ID
Adding a federated domain, changing federation settings, slipping in an extra signing certificate: how attackers use them to persist in a tenant, and how to detect it.