Identity Security · Access Control
Service group: CybersecurityProtect the accounts attackers want most
Most modern attacks start with a stolen or abused sign-in. We design and maintain the identity controls around your Microsoft 365 and business applications so the right people get the right access, and suspicious sign-ins are noticed and handled.
At a glance
- Service
- Design and ongoing management of identity and access controls, primarily in Microsoft Entra ID
- Best suited to
- Organizations of roughly 5 to 200 employees using Microsoft 365 and cloud applications from many locations
- Core inclusions
- Conditional access policies, admin role separation, legacy authentication blocking, access and guest reviews, risky sign-in review in agreed hours and SSO for supported apps
- Not included by default
- Entra ID P1 or P2 licences, custom identity integrations, on-premises directory redesign and after-hours response
- Licensing note
- Conditional access needs Entra ID P1 (included in Microsoft 365 Business Premium); risk-based policies need Entra ID P2
- Pricing basis
- Per user per month for ongoing management, with initial design work quoted separately in writing
- How to start
- Begin with a Microsoft 365 Security Assessment or book a consultation
What identity security means in practice
Identity security is the set of controls that decide who can sign in, from where, on which devices, and with what level of privilege. In a Microsoft 365 organization that mostly lives in Microsoft Entra ID: user and admin accounts, groups, conditional access policies, authentication methods, application registrations and guest access.
Multifactor authentication is one important part of identity security, and we cover it on its own page. This service is broader: it decides when MFA is required and how strong it must be, separates everyday accounts from administrator accounts, removes access that is no longer needed, and responds when Entra ID flags a sign-in as risky.
Identity is now the main perimeter for most small organizations. Staff work from home, client sites and phones, and data sits in the cloud. Getting identity right does more to reduce common risk than almost any other single investment.
Identity weaknesses we commonly find
Everyday accounts with admin rights
Owners and IT contacts read email and browse the web with Global Administrator privileges, so one phishing click can compromise the whole tenant.
Legacy sign-in still allowed
Older protocols that cannot enforce MFA remain enabled, giving attackers a way around stronger controls.
Access that never gets removed
Former staff, contractors and guests keep access to mailboxes, SharePoint sites and applications long after they leave.
No response to risky sign-ins
Sign-ins from unusual countries or impossible travel are logged but nobody reviews them until a mailbox starts sending fraud.
Identity controls we manage
Conditional access
Policies that require MFA, block legacy authentication, require compliant devices for sensitive apps and restrict sign-ins by location where appropriate.
Privileged account separation
Dedicated admin accounts, least-privilege roles instead of Global Administrator, and Privileged Identity Management for just-in-time elevation where licensed.
Emergency access accounts
Break-glass accounts created, excluded correctly from policies, protected with strong credentials and monitored for use.
Lifecycle and access reviews
Joiner, mover and leaver processes tied to HR notice, with periodic reviews of group membership, guest users and app permissions.
Risky sign-in and user review
Entra ID sign-in logs and risk detections reviewed in agreed hours, with password resets, session revocation and account blocks when warranted.
Single sign-on and app consent
SSO for supported SaaS applications and user consent settings that stop staff from granting risky permissions to unknown apps.
Scope of the service
Typically included
- Design, staged rollout and maintenance of conditional access policies
- Administrator role review and separation of privileged accounts
- Emergency access account setup and monitoring
- Blocking of legacy authentication protocols
- Quarterly access reviews of groups, guests and application permissions
- Review of risky sign-ins and risky users during agreed hours
- SSO configuration for supported applications listed in your scope
Requires separate scope or quotation
- Entra ID P1 or P2 and other licence purchases
- Custom SAML or OIDC development for in-house applications
- Active Directory redesign or forest consolidation projects
- After-hours response to identity alerts unless written into your plan
- Customer-facing identity (consumer sign-in) platforms
Technologies involved
- Microsoft Entra ID, conditional access and authentication methods policy
- Entra ID Protection and Privileged Identity Management where licensed
- Microsoft Entra Connect or Cloud Sync for hybrid Active Directory
- Microsoft Intune device compliance as a sign-in condition
- Microsoft Defender for Identity where licensed
- SAML and OpenID Connect single sign-on for SaaS applications
Who needs this
Hybrid and remote teams
Organizations whose staff sign in from home, client sites and mobile devices every day.
Firms with frequent staff changes
Construction, professional services and seasonal businesses where contractors and staff come and go often.
Organizations after a mailbox compromise
Teams that have experienced account takeover or invoice fraud and want to close the gaps systematically.
What improves
- Stolen passwords become far less useful to attackers
- Administrator privileges limited to when and where they are needed
- Departing staff lose access promptly and consistently
- Suspicious sign-ins reviewed instead of buried in logs
- Clear documentation of who can access what, for clients and insurers
How we implement identity security
Identity review
We export accounts, roles, sign-in methods, guest users and app permissions to see the current state.
Policy design
We propose conditional access and admin separation tailored to your licences, devices and working patterns.
Report-only testing
New policies run in report-only mode first so we can see who would be affected before enforcing.
Staged enforcement
Policies are enforced group by group with staff communication and help desk support ready.
Ongoing management
Access reviews, risky sign-in handling and policy updates continue under your scope.
Ways to buy
Prices are proposed and confirmed in a written quotation.
Identity security project
A one-time design and rollout of conditional access, admin separation and legacy authentication blocking.
Ongoing identity management
Per-user monthly management of policies, reviews and sign-in risk once the baseline is in place.
Within Microsoft 365 administration
Bundle identity security with everyday tenant administration for a single accountable owner.
Frequently asked questions
Is MFA enough on its own?
MFA blocks a large share of password-based attacks, but attackers also use phishing proxies, MFA fatigue and token theft. Conditional access, phishing-resistant methods for admins, device compliance and sign-in review add the layers MFA alone does not provide.
Do we need Entra ID P2?
Not necessarily. Microsoft 365 Business Premium includes Entra ID P1, which covers conditional access. P2 adds risk-based policies and Privileged Identity Management, which we recommend where admin exposure or data sensitivity justifies the cost.
Will conditional access lock people out?
Badly designed policies can. That is why we test in report-only mode, keep emergency access accounts and roll out in stages with support available.
Can you manage identities for apps outside Microsoft 365?
Yes, where the application supports single sign-on with Entra ID. We list supported applications in your scope; custom integrations are quoted separately.
Related services
Products and packages
Industries we support
Service areas
Find out who can sign in to what, and how safely
We will review your identity configuration and propose a written plan for the controls that matter most.