Skip to content

Topic cluster

Identity and access security notes

Microsoft Entra ID, Conditional Access, MFA, passkeys, privileged access and break-glass design - the controls that decide whether real attacks land.

Identity is where most Microsoft 365 security control actually lives. These notes cover Conditional Access rollout, MFA scope, passkeys, admin sprawl, OAuth consent, password spray defence and the boring break-glass design that saves you when policy goes wrong.

When to start here

Use this identity & access cluster when the issue is bigger than one setting and you need to understand the control family before changing it.

What to collect

Bring tenant size, licences, current owners, recent incidents, audit deadlines and any policy exceptions that nobody can confidently explain.

Next decision

If the notes match your symptoms, move from reading to a scoped review so the risk, owner, evidence and remediation order are written down.

Control questions

These questions turn the identity & access notes into a useful review brief before anyone touches policy.

  • Are Conditional Access policies documented, tested and owned by someone current?
  • Do privileged roles, guests, OAuth apps and break-glass accounts have a review habit?
  • Can the team explain why each MFA exception still exists?

Move from reading to action when access rules are trusted by memory rather than evidence. Identity controls need a clean map before enforcement gets tighter.

A typical review maps admin roles, MFA methods, Conditional Access policies, exclusions, guest users and break-glass accounts so the team can see which access paths are intentional and which are inherited drift.

Notes in this cluster

16 posts