Securing Microsoft Entra ID for mid-sized businesses
Key takeaways
- Entra ID is a prime attack target because a compromised identity can often cause more damage than a compromised machine.
- MFA for all users is the most effective first step. SMS codes can be intercepted more easily; for privileged accounts, phishing-resistant methods such as passkeys or FIDO2 keys are the better choice.
- Access reviews and Privileged Identity Management limit permissions accumulated over years, especially for administrators and former employees.
- Conditional Access is one of the strongest protective layers, but it requires careful planning: too restrictive disrupts operations, too permissive misses the point.
Microsoft Entra ID, formerly Azure Active Directory, controls identities and access rights across Microsoft 365 and Azure. For mid-sized businesses that rely on both, a sound Entra ID configuration is a basic security requirement.
Why Entra ID is a prime attack target
A compromised identity often causes more damage than a compromised machine. Anyone who can sign in as a user, or worse as an administrator, in your Entra ID environment potentially has access to your email, documents, Teams conversations, and connected applications.
Typical attack paths are phishing campaigns targeting employee credentials and password spray attacks, in which many user accounts are tried against commonly used passwords. Both are automated and hit organisations regardless of size and sector.
Which measures protect Entra ID?
1. Enforce multi-factor authentication consistently
MFA, combined with blocking legacy authentication, is the most effective first step for Entra ID security: together they stop most common identity attacks. Yet in assessments we still find environments where MFA is only active for a subset of users or only for certain applications.
The Microsoft Authenticator app is suitable for all users. For accounts with elevated privileges, use phishing-resistant methods such as passkeys, FIDO2 keys or Windows Hello for Business. SMS codes can be intercepted and should be replaced wherever possible. How to move to passkeys is covered in a separate article.
2. Review permission structures regularly
In IT environments that have grown over years, permissions accumulate. Staff change departments, take on new roles or leave the company, and their access rights often remain unchanged. Access reviews in Entra ID let owners confirm or remove permissions at fixed intervals.
Privileged accounts deserve particular attention. Anyone with Global Administrator rights in your tenant is an attractive target for attackers. The principle of least privilege, granting only the rights actually needed for a given task, should be applied consistently.
3. Use Conditional Access deliberately
Conditional Access allows you to define access rules based on context: who is signing in, from where, and with which device? An employee signing in from an unfamiliar country or using an unmanaged device should not gain access to company resources without additional verification.
Conditional Access needs careful planning: policies that are too strict disrupt daily work, policies that are too loose leave gaps. How to introduce policies step by step without lockouts is shown in our article Rolling out Conditional Access without lockouts.
4. Actively analyse sign-in logs
Entra ID logs sign-in and audit events. This data exists in every tenant but is often not analysed systematically. If someone reviews it, anomalies such as repeated sign-in attempts from different regions or unusual time patterns become visible early.
Microsoft Entra ID Protection, included in Entra ID P2, analyses these signals automatically and can trigger risk-based policies. This helps organisations without a dedicated security operations team in particular.
What an assessment reveals
In Entra ID assessments we encounter recurring patterns: guest accounts without a clear expiry date, service accounts with interactive sign-in rights, MFA exemptions that were originally intended as temporary, and missing or untested emergency access accounts.
These weaknesses rarely come from poor security awareness; they build up in day-to-day operations. An assessment shows where they are and which to fix first.
The next step
If you would like to know where your Entra ID configuration has gaps, our Gap Assessment reviews your permission structures, Conditional Access policies and logging configuration at a fixed price and delivers a report with prioritised recommendations.
Frequently Asked Questions
How many Global Administrators should a mid-sized organisation have in Entra ID?
As few as possible. Assign the role to fewer than five people, plus two cloud-only emergency access accounts with permanent assignment. Privileged Identity Management (PIM) allows administrator rights to be activated only on demand and for a limited time; PIM requires Entra ID P2 or Entra ID Governance.
What are break-glass accounts in Entra ID and why do they matter?
Break-glass accounts are dedicated administrator accounts for situations in which normal access no longer works, for example after a faulty Conditional Access policy. They are excluded from blocking Conditional Access policies but sign in with a phishing-resistant method such as a passkey or a certificate so that they meet mandatory MFA. Credentials must be stored separately and securely, every use must be monitored, and the accounts must be tested regularly.
Which sign-in events should we actively monitor in Entra ID?
Most important: sign-ins from unusual countries or at unusual times, repeated failed login attempts (possible password spray), sign-ins from unmanaged devices, and changes to privileged role assignments or Conditional Access policies. Entra ID Protection automates much of this detection and can trigger risk-based policies automatically.
Can we roll out Conditional Access without disrupting operations?
Yes, with the right approach. Policies first run in report-only mode, which shows which sign-ins would be affected without blocking them. Only after analysis and adjustment are they enabled. Our article on rolling out Conditional Access without lockouts describes the process in detail.