Entrazure
What we build
Entra ID tenant design. The role model, group structure and lifecycle: how an account is created, what it inherits, what happens when someone changes team, and what happens on the day they leave. Most access problems are joiner-mover-leaver problems wearing a technical costume.
Conditional access, built in report-only first. Policy is designed against your real sign-in data, run in report-only mode, measured, then enforced by stage. Device compliance, location, risk level and application sensitivity drive the decision. Break-glass accounts are created, excluded, alarmed and tested before anything is enforced.
Privileged Identity Management. No standing Global Administrator. Privileged roles are activated for a defined window, with justification and approval where the role warrants it, and the activation history becomes audit evidence without anyone assembling it. Access reviews run on a schedule and expire access that nobody re-approves.
Workload identity. Service principals and managed identities inventoried, secrets replaced with federated credentials where the platform allows it, and expiry monitored where it does not. A non-human identity holding a secret with no expiry is the quietest privilege escalation path in most tenants.
Guest and external access. B2B guest governance, external sharing boundaries, and a review cycle that actually removes access. Most tenants have guests from projects that ended.
Microsoft Defender XDR. Endpoint, identity, email and cloud application protection deployed as one posture rather than four consoles with four owners, with the response actions defined before an incident rather than during one.
Microsoft Sentinel, sized honestly. Log ingestion design first, because ingestion is the cost driver everyone discovers late. Then analytics rules tuned to your environment, automation playbooks for the repetitive response steps, and a written escalation path.
Defender for Cloud on the estate. Secure score remediation with a monthly target, and regulatory compliance dashboards mapped to the frameworks you are actually assessed against.
Who asks for access
- People Employees One lifecycle: created, moved, removed. Most access problems are joiner, mover and leaver problems wearing a technical costume.
- People B2B guests Sponsored, time-bound, removed by the review cycle rather than by someone remembering the project ended.
- Non-human Workload identities Applications and pipelines. Federated credentials where the platform allows them, monitored expiry where it does not.
- Exception Break-glass accounts Two of them, excluded from conditional access on purpose, held offline, and alarmed on every single sign-in.
What decides
- Microsoft Entra ID Conditional access Device compliance, location, sign-in risk and application sensitivity. Built in report-only, measured against real sign-in data, then enforced by stage.
- Microsoft Entra ID Privileged Identity Management No standing Global Administrator. A privileged role is activated for a defined window, with justification and approval where the role warrants it.
- Microsoft Entra ID Access reviews On a schedule, not on request. Access that nobody re-approves expires instead of accumulating for two years.
What is reached
- Productivity Microsoft 365 Exchange and SharePoint, under the same sharing boundary, which is what an audit of oversharing actually examines.
- Platform Azure subscriptions Role assignments scoped to a management group or a resource group. Nobody holds Owner on everything.
- Applications Line-of-business applications Single sign-on through the tenant, assignment per group, and no local password store to inherit.
What watches, on every path above
- Detection Microsoft Sentinel Sign-in and audit logs, analytics rules tuned to this tenant, and ingestion sized honestly before anything is switched on.
- Detection Microsoft Defender XDR Endpoint, identity, email and cloud application signals read as one posture rather than four consoles with four owners.
- The colored edge is the standard path. Everything that is not an exception takes it.
- The dark edge is the deliberate exception, written into the design, documented and alarmed.
Zero trust, without the poster
Zero trust is a design principle, not a product, and no vendor can sell it to you finished. In practice it reduces to a small number of decisions applied consistently: every access request is authenticated and authorized explicitly, privilege is granted for the minimum time rather than held permanently, and the architecture assumes a compromise has already happened somewhere.
That produces concrete work, and it is the work above. Conditional access replaces network location as the primary control. Private endpoints and network segmentation limit what a compromised workload can reach. Privileged access is time-bound. Logging is centralized so the detection is possible at all. When a firm describes zero trust without naming those artefacts, they are describing a slide.
Security architecture on our engagements is led by certified security architects, and the design decisions are written down with their reasoning, so the person defending them to an assessor in two years is not reconstructing them from memory.
How the engagement runs
Weeks 1 and 2, identity review. Tenant assessment against a fixed checklist: privileged roles, authentication methods, legacy protocols, service principals, guests, conditional access coverage and gaps. Output is a prioritized findings report with effort and risk on each item, and it is useful even if you stop there.
Weeks 3 and 4, identity remediation. The findings that matter most, in order: privileged access under PIM, authentication strength, conditional access designed and running in report-only, service principal secrets replaced.
Weeks 5 and 6, enforcement and detection. Staged conditional access enforcement with monitoring at each stage. Defender XDR deployment, Sentinel data collection design, analytics rules and playbooks.
Weeks 7 and 8, evidence and handover. Access review cycles scheduled, compliance reporting configured, runbooks written, and a tabletop exercise on one realistic scenario, most usefully a compromised privileged account.
What you keep
- The tenant assessment report, with findings, risk rating and remediation status.
- Conditional access policies as exportable configuration, with the report-only evidence behind each.
- PIM role settings, approval workflows and the activation history they generate.
- A service principal and managed identity inventory with owners and expiry dates.
- Sentinel analytics rules, playbooks and the ingestion cost model.
- Incident runbooks and the tabletop exercise findings.
- A dated exception register, because the exceptions are the part auditors actually read.
Who this is for
Organizations of roughly 100 to 5,000 people with Microsoft 365 and Azure in production, and a trigger: an upcoming audit, a client security questionnaire, a cyber insurance renewal, a merger, or an incident at a peer that made the board ask a question. It is a prerequisite for AI engineering work, because an agent inherits whatever the user could already open and most tenants have never audited that. It runs in parallel with compliance architecture when a framework deadline is driving the timeline. Regulated sectors are our normal ground: see healthcare for how this looks under clinical and privacy constraints.
Who this is not for
If you need a penetration test or a red team exercise, buy that from a specialist testing firm. We design and build the controls, and having the same firm build and test them is a weaker arrangement for you.
If the requirement is a certificate rather than a control, we are the wrong choice. We will not sign off on an architecture we do not believe holds.
If your organization will not accept any friction for privileged users, conditional access and PIM will be diluted into decoration. That decision is yours to make, but it should be made explicitly rather than discovered halfway through the rollout.
Related
- Compliance architecture, where these controls become audit evidence.
- Azure landing zone, the identity and network baseline underneath.
- Managed Azure and FinOps, who watches the posture after the project ends.
- All Azure services, the full engagement catalog.
Questions we get
Where do you start?
Identity, every time. A two-week review of the Entra ID tenant answers the questions an auditor and an attacker both ask first: who holds standing privileged roles, which accounts bypass multi-factor authentication, which service principals hold secrets that never expire, and how many guest accounts still have access to something.
Will conditional access lock our users out?
Not if it is deployed properly. Every policy is built in report-only mode first and measured against real sign-in data before enforcement, break-glass accounts are excluded and monitored, and rollout is staged by group. We have never had to enforce blind, and there is no reason to.
What does Sentinel cost to run?
It depends almost entirely on ingestion, which is why we design the data collection before enabling anything. We model the monthly cost per data source, recommend which logs belong in an analytics tier and which belong in cheaper long-term retention, and set a budget alert. Sentinel bills are where trust in a security partner is usually lost.
Do we need PIM if we already use multi-factor authentication?
Yes. Multi-factor authentication proves who is signing in. Privileged Identity Management controls whether they hold the privilege at all when they are not using it. Standing Global Administrator rights on eight accounts is the finding that appears in almost every tenant review we run, and it is the cheapest one to fix.
Can you run our security operations?
We build and tune the detection stack and we can operate it under a managed arrangement. Entrazure is also an MSSP and reseller for Klarvant, a third-party namespace and digital territory intelligence product, relevant at enterprise and government scale rather than mid-market.
What evidence does this produce for an audit?
Access review records, conditional access policy exports, PIM activation history, privileged role assignment history and Defender for Cloud regulatory compliance reporting. Those artefacts map directly onto the identity and access control sections of SOC 2, HIPAA and ISO 27001.
Have a question about this work?
Three fields. An architect reads it and answers within one business day.