Identity and Privileged Access Security
SSO, MFA and Conditional Access
We review your single sign-on, multi-factor authentication and Conditional Access policies. We identify exceptions where these protections can be bypassed.
What it is
Multi-factor authentication (MFA) ensures a stolen password alone is not enough. However, protection is only as strong as its weakest exception. Legacy authentication protocols do not support MFA, and apps excluded from policies create gaps. The assessment also reviews where phishing-resistant methods (FIDO2) are used and session validity periods.
Scope
- Identity provider settings and apps connected to single sign-on
- MFA methods, enrollment and recovery flows
- Conditional Access policies, exclusions and trusted locations
- Legacy authentication protocols and apps outside single sign-on
- Session lifetimes and device compliance conditions
- Help desk password and MFA reset process
The need
When organizations need it
- When an account is compromised despite MFA and you need to understand why.
- When you need to document MFA coverage for a cardholder data environment. PCI DSS requires MFA for all access to the cardholder data environment.
- When remote access and VPN sign-ins are still protected by password only.
Method
How we work
-
Flow inventory
We map which app each user accesses, through which path and with which verification.
-
Policy analysis
We review Conditional Access policies for all user, app and location combinations and identify unprotected cases.
-
Controlled test
With your approval, we test the identified gaps using test accounts.
-
Target policy set
We propose a policy set that reduces exceptions and moves critical accounts to phishing-resistant methods.
Outcome
What you have at the end
You know which sign-in paths are outside MFA. Your plan to move critical accounts to phishing-resistant methods is ready.
Frequently asked questions
Is SMS verification sufficient?
SMS is better than no second factor. However, it is vulnerable to SIM swapping and phishing. For admin accounts, FIDO2 security keys or passkeys are recommended.
Does requiring MFA at every sign-in fatigue users?
Conditional Access can be configured so that low-risk sign-ins do not require extra verification. Sign-ins from managed devices and unknown locations are treated differently.
Identity and Privileged Access Security
Other services in this area
Let's talk about this service.
Tell us briefly what you need. We will agree on the scope and timing together in the first meeting.
Schedule a Meeting