Microsoft Entra ID security review and assessment
A Microsoft Entra ID security review is an independent assessment of how your tenant’s configuration protects sign-in and administrative access. It audits multifactor coverage, authentication methods, Conditional Access, privileged roles, emergency access accounts, and guest settings against Microsoft’s published guidance, and shows how those settings interact.
What Microsoft recommends for Microsoft Entra ID
These are Microsoft’s own public recommendations for securing Microsoft Entra ID, each shown with the sentence it comes from on Microsoft Learn. The review checks your tenant against each one that your licensing and agreed scope include.
Enable Conditional Access policies as soon as security defaults are turned off
What the review checks: Whether security defaults are enabled and, if not, whether Conditional Access covers the protections they provide: blocking legacy authentication and device code flow, and requiring MFA for administrators, Azure management, and all users, with those policies On rather than Report-only or Off.
“After administrators disable security defaults, organizations should immediately enable Conditional Access policies to protect their organization.”
Security defaults in Microsoft Entra ID, Microsoft Learn Licensing: Security defaults require no license, and Conditional Access requires at least Microsoft Entra ID P1.
Block legacy authentication protocols that don’t support multifactor authentication
What the review checks: Whether an enabled Conditional Access policy blocks Exchange ActiveSync clients and Other clients for all users and resources, or security defaults are on. Where the agreed access includes sign-in logs, they are filtered by client app to find remaining legacy use.
“Microsoft recommends that organizations block authentication requests using legacy protocols that don't support multifactor authentication.”
Block legacy authentication with Conditional Access, Microsoft Learn Licensing: Tenants without licenses that include Conditional Access can use security defaults to block legacy authentication.
Require phishing-resistant MFA for privileged administrator roles
What the review checks: Whether an enabled policy requires the Phishing-resistant MFA strength for the administrator roles Microsoft lists, and whether those administrators have registered a qualifying method. Custom and administrative unit-scoped role assignments are checked separately, as policies that target directory roles apply only to built-in roles.
“Microsoft recommends requiring phishing-resistant multifactor authentication for at least the following roles:”
Require phishing-resistant multifactor authentication for administrators, Microsoft Learn Licensing: Conditional Access requires at least Microsoft Entra ID P1.
Assign the Global Administrator role to fewer than five people
What the review checks: The number of active and eligible Global Administrator assignments, and whether each is protected with multifactor authentication. Microsoft Entra shows a Global Administrators alert card on the Overview page at five or more assignments.
“As a best practice, Microsoft recommends that you assign the Global Administrator role to fewer than five people in your organization.”
Best practices for Microsoft Entra roles, Microsoft Learn Keep privileged role assignments to fewer than 10 across the organization
What the review checks: Which roles and assignments carry the PRIVILEGED label, and how many privileged assignments the tenant holds in total. Microsoft Entra shows a warning on the Roles and administrators page when there are more than 10.
“Since these roles can potentially lead to elevation of privilege, you should limit the use of these privileged role assignments to fewer than 10 in your organization.”
Best practices for Microsoft Entra roles, Microsoft Learn Use Privileged Identity Management for just-in-time administrator access
What the review checks: The balance of eligible and permanent active assignments for privileged roles, with emergency access accounts as the documented exception, and each role’s settings for activation duration, MFA or authentication context, justification, approval, and notifications.
“Microsoft recommends that you use PIM in Microsoft Entra ID.”
Best practices for Microsoft Entra roles, Microsoft Learn Licensing: Privileged Identity Management requires Microsoft Entra ID P2 or Microsoft Entra ID Governance.
Maintain at least two emergency access accounts for redundancy
What the review checks: Whether at least two cloud-only accounts on the onmicrosoft.com domain hold Global Administrator as permanent active, use phishing-resistant methods different from normal admin accounts, are excluded from Conditional Access policies that block or restrict sign-in, raise alerts when used, and were validated within 90 days.
“Maintain at least two emergency access accounts for redundancy.”
Manage emergency access accounts in Microsoft Entra ID, Microsoft Learn Move per-user MFA users to Conditional Access, then disable per-user MFA
What the review checks: Which users still show Enabled or Enforced on the per-user MFA status page, whether a Conditional Access MFA policy covers all users before per-user MFA is turned off, and the state of the related Microsoft-managed policy where present.
“If your users were enabled using per-user MFA enabled and enforced Microsoft Entra multifactor authentication, we recommend that you enable Conditional Access for all users and then manually disable per-user multifactor authentication.”
Plan a Microsoft Entra multifactor authentication deployment, Microsoft Learn Licensing: Conditional Access requires at least Microsoft Entra ID P1.
Manage authentication methods through the Authentication methods policy
What the review checks: The migration state of the Authentication methods policy. Until migration is complete, legacy MFA and self-service password reset settings are still respected, so methods such as text messages and voice calls are checked in those policies as well as the Authentication methods policy.
“The Authentication methods policy is the recommended way to manage authentication methods, including modern methods like passwordless authentication.”
Manage authentication methods for Microsoft Entra ID, Microsoft Learn Restrict guests from reading groups they aren’t members of
What the review checks: The guest user access level, who can invite guests, and any allow or deny list of domains in external collaboration settings, plus inbound and outbound defaults in cross-tenant access settings for collaboration with other Microsoft Entra tenants.
“Use external collaboration settings to restrict guests from reading groups they aren't members of”
Transition to governed collaboration with Microsoft Entra B2B collaboration, Microsoft Learn
What the review covers in Microsoft Entra ID
Identity settings are read together, because a sound policy can be weakened by an exclusion or a setting elsewhere. Coverage depends on the agreed scope and on the controls your licensing provides.
Part of the audit's identity and access area.
- Multifactor coverage
- Whether every user is covered by multifactor authentication through security defaults or Conditional Access, and which users still rely on per-user MFA.
- Authentication methods
- Which sign-in methods are enabled, for whom, and in which policy, and whether administrators have registered phishing-resistant methods.
- Conditional Access design and exclusions
- How policies combine across users, resources, and conditions, which accounts and groups are excluded and why, and whether policies are enforced or left in Report-only.
- Legacy authentication
- Whether legacy protocols are blocked and, where the agreed access includes sign-in logs, what they show about clients that still use them.
- Privileged roles
- Who holds Global Administrator and other privileged roles, whether assignments are standing or eligible, and how Privileged Identity Management is configured where licensed.
- Emergency access accounts
- Whether break-glass accounts exist, how they authenticate, whether they are excluded from Conditional Access policies that could block them, whether their sign-ins raise alerts, and when they were last validated.
- Guest and external identities
- What guests can see in the directory, who can invite them, which domains are allowed or blocked, and how cross-tenant access settings are configured.
When teams ask for it
- Before tightening MFA or Conditional Access
- A phishing-resistant MFA or legacy authentication policy is planned, and the team wants to know which administrators, legacy clients, and exclusions need attention first.
- Administrator access has grown
- Global Administrator and other privileged assignments have accumulated over time, and nobody is certain which are still needed or how they are protected.
- A new team takes over the tenant
- After a change of IT provider, a merger, or an acquisition, the incoming team needs an independent view of who holds administrative access and how sign-in is protected.
- Preparing evidence for a review
- A customer questionnaire, internal review, or audit asks how identities and administrator accounts are protected, and the answer needs supporting evidence.
What you receive
Each finding is reported with the configuration evidence behind it, its business context, and a recommended action. Findings are sequenced into a remediation roadmap, so your team knows what to change first.
Questions
Does a Microsoft Entra ID security review cover Conditional Access and MFA?
Yes. It reviews how multifactor authentication is enforced and which sign-in methods are allowed, how Conditional Access policies are designed and where they leave gaps, who holds privileged roles, how emergency access accounts are set up, and what guests can see in the directory and who can invite them.
It is part of the identity and access area of the Microsoft 365 tenant audit. The areas included in your engagement are agreed during scoping.
Do we need Microsoft Entra ID P1 or P2 for this review?
No particular license is needed to request the review. Licensing does determine which controls exist in your tenant, so it shapes what the review covers.
Microsoft’s documentation states that security defaults need no license, Conditional Access requires at least Microsoft Entra ID P1, customers with Microsoft 365 Business Premium licenses can also use Conditional Access features, and Privileged Identity Management requires Microsoft Entra ID P2 or Microsoft Entra ID Governance. Controls that depend on a license, such as Conditional Access and Privileged Identity Management, are reviewed where your tenant has them, and findings state where a recommendation depends on a license you may not have.
What access does the review need to our tenant?
It depends on the agreed scope and assessment method. The roles involved, who grants them, and how long access lasts are agreed before the engagement starts.
Access follows least privilege and is time-bound. Read-oriented roles are preferred wherever the assessment method allows.
Will the review change our Microsoft Entra ID settings?
Not without your agreement. The review examines and reports on configuration. Whether the engagement includes any remediation, and who carries it out, is agreed during scoping before work begins.
Some identity changes carry a lockout risk. Microsoft warns, for example, that enabling a phishing-resistant MFA policy before administrators have registered suitable methods risks locking you out of your tenant, so recommendations note what should be in place before a change is made.
How much does a Microsoft Entra ID security review cost?
Pricing follows scoping. It depends on the size and complexity of your tenant, the control areas included, and the deliverables you need.
Scope, timing, and pricing are confirmed in writing before the engagement starts.
We already use Conditional Access and Microsoft Secure Score. What does this review add?
It looks at how identity settings interact and rates each finding in the context of how your organization works. Microsoft Secure Score measures your security posture against Microsoft’s recommended actions and remains a useful way to track progress, so the two are complementary.
Some gaps only appear when settings are read together. Microsoft’s documentation notes, for example, that Conditional Access policies targeting directory roles don’t apply to administrative unit-scoped or custom role assignments, and that until the authentication methods migration is complete, a method enabled in the legacy MFA or self-service password reset policy stays usable even when the Authentication methods policy disables it.
Get a clear view of your tenant’s configuration.
Tell us about your environment and the questions you need answered. We’ll help define an appropriate assessment scope.
Discuss your audit