Identity and Privileged Access Security
Entra ID Security
We review admin roles, app permissions and sign-in policies in your Microsoft Entra ID tenant. We identify paths from a cloud account to tenant admin.
What it is
Entra ID is the central access point for Microsoft 365 and Azure. Privileges are not limited to admin roles. API permissions granted to apps, app ownership and group management can also provide indirect admin rights. The assessment reviews these indirect paths along with Conditional Access policies and tenant settings.
Scope
- Admin roles with permanent and time-bound (PIM) assignments
- App registrations, enterprise apps and granted API permissions
- Passwords and certificates assigned to apps and service principals
- Conditional Access policies and exclusions
- Guest users and external collaboration settings
- Sign-in and audit log retention
The need
When organizations need it
- When Microsoft 365 and Azure usage increases and the number of admin roles becomes unmanageable.
- After a cloud account takeover or a business email compromise.
- When many SaaS applications are connected to Entra ID for single sign-on.
Method
How we work
-
Read access
We export the tenant configuration using an account with the Global Reader role.
-
Role and permission analysis
We map direct and indirect admin rights, together with app permissions, in a single diagram.
-
Policy review
We test Conditional Access policies against combinations of user, app and location, and identify flows they do not cover.
-
Priority changes
We propose a sequence for converting permanent admin assignments to time-bound and removing unnecessary permissions.
Outcome
What you have at the end
You know who is an admin in your tenant, directly or indirectly. Unneeded app permissions and policy gaps are listed by priority.
Frequently asked questions
We have security defaults enabled. Is that sufficient?
Security defaults provide basic MFA protection. They do not address privilege risks such as app permissions and role assignments. When you start using Conditional Access, security defaults must be disabled.
What can the Global Reader role see?
It can read almost all tenant configuration but cannot change any settings. This is sufficient for the assessment.
Identity and Privileged Access Security
Other services in this area
Let's talk about this service.
Tell us briefly what you need. We will agree on the scope and timing together in the first meeting.
Schedule a Meeting