Entra ID¶
Entra ID (formerly Azure Active Directory) is the identity backbone of Microsoft 365. This section covers the key configuration areas for a secure tenant.
Checklist¶
- Disable Security Defaults (required before configuring Conditional Access)
- Create a break-glass account, this will be excluded from all CA policies
- Create Standard MFA and Admin MFA authentication strengths
- Create Approved Countries named location
- Create Overseas Travel security group
- Create CA Policy - Enforce 2FA for All Users (Authentication Strength: Standard MFA)
- Create CA Policy - Enforce 2FA for Admins (Authentication Strength: Admin MFA)
- Create CA Policy - Block Legacy Authentication
- Create CA Policy - Block Device Code Flow
- Create CA Policy - Geoblock — Approved Countries Only
- Review Global Administrator count — keep to 2–4 accounts
- Enable Privileged Identity Management (PIM) for admin roles (Requires Entra ID P2 Licenses)
Portal Locations¶
| Task | Portal path |
|---|---|
| Conditional Access | Entra admin center → Entra ID → Conditional Access |
| Authentication Strengths | Entra admin center → Entra ID → Authentication methods → Authentication strengths |
| Authentication Methods | Entra admin center → Entra ID → Authentication methods → Policies |
| Named locations | Entra admin center → Entra ID → Conditional Access → Named locations |
| PIM | Entra admin center → Identity Governance → Privileged Identity Management |