Azure AD / Entra ID Security Checklist

Entra ID (formerly Azure Active Directory) is the identity layer nearly every other Microsoft 365 and Azure security control ultimately depends on. It’s also one of the least frequently audited — most organisations configure it once during initial rollout and rarely revisit the configuration directly, trusting that Microsoft’s defaults are safe enough. They usually aren’t, and the gap between “configured” and “securely configured” tends to be wider than expected.

The Four Things Worth Checking First

Legacy authentication status. Protocols like SMTP AUTH, IMAP, POP3, and Basic Auth don’t support Modern Authentication, which means they cannot enforce MFA — full stop, regardless of what MFA policy exists elsewhere in the tenant. Attackers specifically target legacy auth endpoints during credential stuffing campaigns precisely because they bypass MFA entirely. Microsoft has been deprecating these protocols since 2022, but a meaningful number of tenants still have them enabled, often without anyone realizing it.

Standing Global Administrator access. The number of accounts with permanent Global Admin rights is a direct measure of blast radius if any one of those accounts is compromised. Most organisations need only two or three standing Global Admins, if any at all — the rest should be converted to just-in-time access via Privileged Identity Management (PIM), which requires explicit activation, approval, and a time limit rather than granting permanent standing privilege.

Conditional Access coverage. A handful of Conditional Access policies covering a minority of actual sign-in scenarios is a common finding — meaning a large share of authentication events happen entirely outside any policy enforcement, which defeats much of the purpose of having Conditional Access configured at all. Coverage should be measured as a percentage of actual sign-ins evaluated, not just “do policies exist.”

Guest and external user access. Every guest account is a door into the tenant that a different organization’s security posture indirectly controls. Reviewing what guests can actually access, and whether that access still matches a legitimate current business need, is easy to defer and easy to regret deferring.

What a Structured Audit Actually Covers

A full audit starts with an identity architecture review — mapping the tenant structure, directory sync configuration, and authentication flows, so the rest of the review has real context rather than checking settings in isolation. Authentication and MFA audit follows: MFA deployment coverage, the authentication methods policy, legacy auth status specifically, and self-service password reset configuration. Privileged access and application review comes next — every Entra ID role assignment, PIM configuration, application registrations, and the permissions granted to enterprise apps (a frequently overlooked attack surface, since an overprivileged app registration can be as dangerous as an overprivileged user account). Finally, a full Conditional Access policy review — checking every policy for coverage gaps, testing the actual policy logic rather than assuming it works as intended, and recommending missing policies with specific configuration guidance.

Every finding gets prioritised and mapped against Microsoft Secure Score and the CIS Azure AD Benchmark, so the output isn’t just a list of problems — it’s a benchmarked, prioritised plan.

What This Found in Practice

An NHS healthcare trust with 5,000 users had legacy authentication enabled tenant-wide — SMTP AUTH and Basic Auth both active — alongside 12 Global Administrator accounts where only 2 were actually needed, no PIM in place at all, and Conditional Access policies covering just 40% of actual sign-ins. After remediation — legacy auth disabled, Global Admin count reduced to 3 with PIM enforcing just-in-time access, and Conditional Access expanded to 14 policies covering 98% of sign-in scenarios — credential stuffing attacks that had previously succeeded via legacy auth were fully blocked, Microsoft Secure Score rose from 42% to 76%, and the trust passed its Cyber Essentials Plus assessment on the strength of the remediated configuration.

The Baseline Worth Checking Today

If Entra ID has never been audited directly — as opposed to “we followed the setup wizard and it looked fine” — legacy auth status and standing Global Admin count are the two fastest things to check, because they’re consistently where the highest-severity findings live. A full Entra ID security audit covers all of this systematically, benchmarked against Microsoft Secure Score and CIS controls, with read-only access throughout.