Microsoft Entra ID is the front door to everything your organization runs in the Microsoft cloud: Azure subscriptions, line-of-business apps, email and files. Stolen or misused identities are behind most breaches, and a handful of settings stop the majority of attacks. Here are the five we check first in every tenant.
1. Require multifactor authentication for everyone
Stolen passwords are the most common way in, and multifactor authentication (MFA) stops the vast majority of those attacks.
- No Entra ID P1 licenses? Turn on security defaults in the Microsoft Entra admin center. It's free, requires every user to register for MFA and protects administrator sign-ins.
- Have Entra ID P1 (included in Microsoft 365 Business Premium)? Use Conditional Access instead. It gives you finer control, such as requiring MFA everywhere while trusting compliant company devices.
Where you can, go further than text messages: passkeys and the Microsoft Authenticator app resist phishing far better.
2. Make sure legacy authentication is blocked
Older sign-in protocols can't do MFA, so attackers love them. Security defaults block legacy authentication automatically. With Conditional Access, create a policy that blocks it explicitly. Then check the sign-in logs for anything that still depends on it; old copiers and line-of-business apps are the usual suspects.
3. Keep admin roles few, narrow and just-in-time
Every Global Administrator is a skeleton key.
- Aim for at least two but fewer than five Global Administrators, and use separate admin accounts that aren't used for day-to-day work.
- Give people the narrowest built-in role that does the job, such as User Administrator, Application Administrator or Security Reader.
- With Entra ID P2, use Privileged Identity Management so admin rights are activated only when needed, for a limited time, with a reason recorded.
4. Stop users from granting access to unknown apps
By default, users may be able to let third-party apps read their data with a single click, a favorite trick of phishing campaigns. Restrict user consent to verified publishers (or turn it off), and set up the admin consent workflow so people can request apps for you to review.
The same discipline applies to your own apps: prefer managed identities and workload identity federation over client secrets, so there are no credentials to leak or rotate.
5. Plan for emergencies and watch your sign-ins
- Keep two cloud-only emergency access ("break-glass") accounts. Microsoft now requires MFA for admin portals, so protect them with a passkey or FIDO2 security key, store the credentials securely, and alert on every use.
- Review sign-in logs regularly. With Entra ID P2, ID Protection can automatically challenge or block sign-ins and users it flags as risky.
Where to go from here
None of these changes requires new software, and together they close the identity gaps behind most small-business breaches. If you'd like a second pair of eyes, we're happy to review your tenant and give you a prioritized list. Get in touch.