Most breaches do not start with an advanced exploit. They start with a stolen password, an old account nobody disabled, or a user with far more access than the job needs. If your company runs Microsoft 365, Microsoft Entra ID (formerly Azure Active Directory) already gives you the tools to close those gaps. These seven basics are where to start.
1. Turn on multifactor authentication for everyone
MFA blocks the large majority of password-based attacks. Start with administrators, then roll it out to all users. Prefer authenticator apps or passkeys over text messages.
2. Block legacy authentication
Older protocols such as basic authentication for email cannot enforce MFA. Blocking them removes an easy way around your other controls.
3. Use Conditional Access
Conditional Access policies decide when to allow, challenge or block a sign-in based on the user, device, location and risk. Common starting points: require MFA everywhere, require compliant devices for admin access, and block sign-ins from countries where you do not operate.
4. Limit and protect admin roles
Keep the number of Global Administrators small, give people the narrowest role that fits their work, and use separate admin accounts. Privileged Identity Management can make admin rights time-limited and approved on request.
5. Automate joiners, movers and leavers
Accounts should be created, changed and disabled from one source of truth, such as your HR system. Former employees with active accounts are one of the most common audit findings.
6. Review access regularly
Access reviews ask managers and app owners to confirm who still needs access to groups, apps and roles. Run them at least quarterly for sensitive systems.
7. Use single sign-on for business apps
Connecting apps such as Salesforce to Entra ID means one identity, one MFA policy and one place to switch access off. Our Salesforce integration guide covers how Salesforce connects to the rest of your stack.
Get help with identity and security
CloudMosaic has an expert team for Microsoft identity and access management. We also design and deploy firewalls and endpoint protection as part of our cybersecurity practice. Talk to us about your Entra ID setup.