Microsoft 365 · Identity
Service group: Microsoft 365Control who signs in, from where, and with what
Microsoft Entra ID, formerly Azure Active Directory, decides who can reach your email, files and business apps. We configure and maintain it so multifactor authentication is enforced, administrator rights are limited, risky sign-ins are challenged and access ends when people leave.
At a glance
- Service
- Configuration and ongoing management of Microsoft Entra ID for a Microsoft 365 tenant
- Best suited to
- Canadian organizations of roughly 5 to 200 employees that rely on Microsoft 365 sign-in for email, files and cloud applications
- Core inclusions
- MFA and authentication methods, security defaults or Conditional Access, admin role reviews, break-glass accounts, hybrid sync health, app sign-on and guest access governance (as scoped)
- Licensing note
- Conditional Access requires Entra ID P1, included in Microsoft 365 Business Premium; risk-based policies and Privileged Identity Management require Entra ID P2. Licences are purchased separately unless written into your proposal
- Not included by default
- Enterprise multi-tenant or B2C identity architecture, custom application development and licence purchases
- Pricing basis
- Included in Microsoft 365 Managed Services or quoted per user; project work confirmed in a written quotation
What Entra ID management covers
Microsoft Entra ID is the identity service behind every Microsoft 365 tenant. Each user account, group, administrator role, device registration and application sign-in passes through it. Microsoft renamed Azure Active Directory to Microsoft Entra ID in 2023, so older documentation and admin screens may still use the previous name.
Our Entra ID service covers how people prove who they are, which conditions they must meet to get in, and who holds elevated rights. That means choosing between security defaults and Conditional Access, rolling out phishing-resistant authentication methods where practical, keeping synchronized on-premises identities healthy, and reviewing guest and application access on a schedule.
Day-to-day account creation and removal belongs to Microsoft 365 Administration. Broader tenant hardening across email, devices and data is covered by Microsoft 365 Security. This page is about identity itself.
Identity problems we see most often
MFA that is only partly enforced
Some users registered, others skipped it, and legacy authentication protocols still allow sign-in with just a password from anywhere in the world.
Standing Global Administrator rights
Several everyday accounts hold full admin rights permanently, with no separate admin identity and no emergency access account if MFA fails.
Unhealthy directory synchronization
An old Azure AD Connect server stopped syncing months ago, or nobody knows which server runs it, so password changes and new accounts behave unpredictably.
Guests and apps nobody reviews
External guests from past projects still have access, and users have granted third-party apps permission to read mail and files.
What we configure and maintain
Authentication methods
MFA registration campaigns, Microsoft Authenticator with number matching, passkeys and FIDO2 keys where suitable, and retirement of weaker methods such as SMS where possible.
Conditional Access
Policies requiring MFA, blocking legacy authentication, restricting risky locations, and requiring compliant or managed devices for sensitive apps, tested in report-only mode first.
Privileged access
Separate admin accounts, least-privilege roles instead of Global Administrator, documented break-glass accounts and, with Entra ID P2, just-in-time elevation through Privileged Identity Management.
Hybrid identity
Health and configuration of Entra Connect Sync or Entra Cloud Sync for organizations that still run on-premises Active Directory, including upgrades and attribute issues.
Single sign-on for business apps
Enterprise application integrations so staff use their Microsoft 365 account for supported SaaS tools, with user consent settings restricted to approved apps.
Access reviews and guest governance
Scheduled review of guest users, group owners, app permissions and sign-in logs, with stale access removed after your approval.
What is in scope, and what is separate
Typically included
- Authentication method policy and MFA registration management
- Security defaults or Conditional Access policy design and maintenance, depending on licences
- Administrator role assignments and emergency access accounts
- Entra Connect Sync or Cloud Sync monitoring and remediation
- Enterprise application single sign-on for supported SaaS apps
- Guest user and external collaboration settings
- Periodic sign-in log and risky user review
Requires separate scope or quotation
- Entra ID P1 or P2 licence purchases, unless written into your proposal
- Customer-facing identity (Entra External ID or B2C) for your own applications
- Multi-tenant, cross-cloud or enterprise identity governance architecture, referred to CloudArchitects.expert
- Custom SAML or OIDC development for in-house software
- On-premises Active Directory redesign beyond sync requirements
Entra ID features and tools involved
- Microsoft Entra ID Free, P1 and P2 feature tiers
- Security defaults and Conditional Access
- Authentication methods policy, Microsoft Authenticator, passkeys and FIDO2 security keys
- Microsoft Entra ID Protection risk policies (P2)
- Privileged Identity Management (P2)
- Microsoft Entra Connect Sync and Entra Cloud Sync
- Self-service password reset with on-premises writeback where licensed
- Sign-in logs, audit logs and workbooks
Who this service suits
Business Premium tenants
Organizations that already own Entra ID P1 through Business Premium and want Conditional Access designed and maintained properly.
Hybrid environments
Firms that still run on-premises Active Directory alongside Microsoft 365 and need synchronization kept healthy.
Teams with many external collaborators
Professional services and project-based businesses that invite clients, contractors and partners into Teams and SharePoint.
What improves
- Password-only sign-ins and legacy protocols closed off
- Admin rights held by fewer accounts, and only when needed
- A documented way back in if an MFA method or admin account fails
- Access tied to device health and location where your licences allow
- Guest and app access reviewed instead of accumulating
How we approach identity changes
Identity review
We inventory admin roles, authentication methods, sync configuration, guests, enterprise apps and existing policies.
Design
We propose a policy set and role model that fits your licences, devices and how staff work, including exceptions.
Report-only testing
Conditional Access policies run in report-only mode so we can see who would be affected before enforcement.
Staged enforcement
Policies are enabled for pilot groups, then everyone, with staff communication and break-glass accounts excluded and documented.
Ongoing review
Sign-in logs, roles, guests and apps are reviewed on schedule and policies are adjusted as your business changes.
Ways to engage
All arrangements are confirmed by a written quotation.
Within Microsoft 365 Managed Services
Entra ID management is part of the managed tenant scope alongside devices, email and collaboration.
Identity hardening project
A fixed-scope project to roll out MFA, Conditional Access and privileged role clean-up, then hand back documentation.
Start with an assessment
A Microsoft 365 Security Assessment reviews identity configuration and prioritizes fixes.
Frequently asked questions
Is Entra ID the same as Azure AD?
Yes. Microsoft renamed Azure Active Directory to Microsoft Entra ID in 2023. Features and licensing carried over; only the name and some admin screens changed.
Do we need Conditional Access, or are security defaults enough?
Security defaults are a reasonable baseline for very small tenants without Entra ID P1. Conditional Access lets you require compliant devices, block risky locations and handle exceptions, and it requires P1, which Business Premium includes.
Could a policy lock everyone out?
That is why we test in report-only mode, roll out in stages and keep documented emergency access accounts excluded from policies. Changes are scheduled and communicated.
We still have an on-premises server. Is that a problem?
Not necessarily. Hybrid identity is common. We make sure Entra Connect or Cloud Sync is current and healthy, and plan a path to cloud-only identity if that suits you.
When would you refer us to CloudArchitects.expert?
When the work involves enterprise identity architecture, such as multiple tenants, large Azure environments or complex governance across clouds. Our sister brand specializes in that scale.
Related services
Products and packages
Industries we support
Service areas
Find out how your sign-ins are protected today
Book a consultation or start with a Microsoft 365 Security Assessment. Scope and pricing are confirmed in a written quotation.