Skip to content

Entra ID and Conditional Access without brittle lockouts

Map the access paths first, then tighten MFA, admin roles, Conditional Access and device trust with report-only testing, named exceptions and rollback notes. Initial review: £1,500 to £2,500; usually 5 working days.

What the work covers

  • Where access control drifts

    Legacy authentication, stale admin roles, unreviewed exclusions, weak break-glass access and policies that nobody can explain or safely enforce.

  • Scope, output and handover

    Review MFA methods, admin roles, Conditional Access, legacy authentication, break-glass accounts, app access and audit evidence. Output: access map, exception register and enforcement sequence.

How an access decision is made

What MFA does to account takeover

Microsoft's study of Entra ID business accounts found MFA cut the risk of compromise by over 99%, and by 98.6% where the password had already leaked.

99.22%lower risk of account compromise with MFA on
98.56%lower risk even where the password had already leaked
Relative risk of compromise
  • Without MFA100
  • With MFA0.78
Source: How effective is multifactor authentication at deterring cyberattacks? (opens in a new tab), Microsoft (Meyer et al.), May 2023. Microsoft Entra ID business accounts.

How the password gets stolen

Phishing is by far the most common attack on UK businesses, and the one most often named as the most disruptive.

38%of UK businesses were targeted by phishing in the last 12 months
69%of breached organisations named phishing their most disruptive attack
Types of attack businesses reported
  • Phishing38%
  • Impersonation in emails or online12%
  • Malware on devices7%
  • Online bank account hacking3%
  • Denial of service3%
  • Account takeovers2%
  • Ransomware1%
Source: Cyber Security Breaches Survey 2025/2026 (opens in a new tab), DSIT and Home Office, April 2026. UK businesses.

The handover

The work ends with written outputs you keep.

Not ready to book?

Try the free Microsoft 365 self-check first. It starts with 12 questions.

Run the Microsoft 365 security self-assessment

Questions teams ask before the work

Can Conditional Access be fixed without locking people out?

Yes — report-only, careful scope, monitoring and working break-glass before enforce.

What does the initial identity review cost and take?

The identity review on its own is £1,500 to £2,500 and usually takes 5 working days. If the whole tenant needs looking at, it becomes part of the Microsoft 365 Security Review at the same price. Remediation timing depends on exclusions and rollout risk.

Related work

Ready when you are.

Scope the identity review