Identity security

Hardening Entra ID: the ten controls that stop real tenant compromises

Gociux · June 2026 · 7 min read

Identity is the perimeter now, and in Microsoft-shop reality that means Entra ID is the perimeter. Most real tenant compromises don't use exotic techniques; they walk through the same handful of open doors. These are the ten controls that close them, roughly in order of how often their absence shows up in incidents.

1. Kill legacy authentication — completely

Protocols like IMAP, POP and SMTP basic auth cannot perform MFA, which makes them the universal MFA bypass: attackers with a password simply pick a legacy protocol. Block legacy authentication tenant-wide with Conditional Access, then watch sign-in logs for what breaks — the answer is usually one ancient scanner or script that deserved replacement years ago.

2. MFA for everyone, no exceptions list that grows

The exceptions are the breach. Every "temporary" exclusion for an executive, a service workflow, or a stubborn application is a standing invitation. If something genuinely cannot do MFA, it needs compensating controls and an expiry date, not a permanent pass.

3. Phishing-resistant MFA for privileged roles

Push notifications and SMS fall to real-time phishing kits and MFA fatigue. For Global Admins and other privileged roles, require FIDO2 security keys or passkeys — methods that cryptographically bind to the legitimate domain and cannot be relayed by a lookalike login page.

4. Break-glass accounts, excluded and watched

Two emergency accounts, excluded from Conditional Access so a misconfigured policy can't lock everyone out, with long random credentials stored offline — and an alert that fires on any use. An unmonitored break-glass account is just a backdoor with documentation.

5. Conditional Access as policy, not patchwork

Healthy tenants have a small, comprehensible policy set: require MFA for all users, block legacy auth, require compliant or hybrid-joined devices for sensitive apps, restrict or step up risky sign-ins. Unhealthy tenants have forty overlapping policies nobody dares touch. Use report-only mode to test, and document the intent of each policy.

6. Tame user app consent

Illicit consent grants are a quiet epidemic: users approve an OAuth app once and the attacker holds durable API access that survives password resets and MFA. Restrict user consent to verified publishers and low-risk permissions (or disable it), route the rest through admin consent workflow, and review existing grants — the archaeology is usually sobering.

7. Privileged role hygiene with PIM

Count your Global Administrators; if the number embarrasses you, you're typical. Keep standing GAs to a bare minimum, use least-privileged roles for daily work, and make elevation just-in-time through Privileged Identity Management with approval and time limits. Standing privilege is standing risk.

8. Turn the risk signals on

Entra's identity protection signals — leaked credentials, anomalous travel, unfamiliar sign-in properties — should at minimum alert, and ideally gate access via risk-based Conditional Access. A leaked-credential detection nobody reads is indistinguishable from no detection.

9. Ship the logs out

Sign-in and audit logs have limited native retention. Export them to your SIEM — they are the primary evidence in any identity incident, and the difference between answering "what did this account touch" in minutes versus never.

10. Review enterprise applications and their credentials

Service principals with expired owners, multi-tenant apps with broad Graph permissions, client secrets that never rotate — the application layer accumulates risk silently. Inventory it on a schedule.