Identity and Zero Trust
Identity is the control plane. Almost every cloud incident I have looked at is an identity incident wearing a different hat, which is why Conditional Access design and privilege paths get first attention.
Updated
1Request
- User or workload
- Target application
- Requested scope
2Signals
- Identity strength
- Device compliance
- Risk score
- Location / network
3Decision
- Allow
- Allow with step-up
- Allow limited session
- Block
4Enforcement
- Session controls
- Just-in-time privilege
- Continuous evaluation
- Audit trail
Work items that move the needle
- Phishing-resistant authentication for privileged roles, enforced through a Conditional Access authentication strength rather than a generic MFA requirement; removal of legacy authentication paths.
- Conditional Access design with explicit exclusion governance — exclusions reviewed as risk items.
- Just-in-time privileged access (PIM) replacing standing admin rights.
- Attack-path analysis with BloodHound across on-premises AD and hybrid joins.
- Workload identity federation to eliminate long-lived secrets in pipelines.
Microsoft is retiring its own SMS and voice MFA delivery in Entra ID — passkeys become the default from September 2026, with native SMS/voice withdrawn from February 2027. Tenants still leaning on phone-based MFA have a fixed window to move users onto a phishing-resistant method.
Frequently asked questions
Is Zero Trust a product?
No. It is an architectural stance: no implicit trust from network position, every access decision evaluated with signal.
What does 'phishing-resistant' mean in Entra ID specifically?
Conditional Access authentication strengths let a policy demand a specific method combination rather than any MFA — the built-in phishing-resistant strength accepts only FIDO2/passkeys, Windows Hello for Business or certificate-based auth.
Related
Microsoft Entra ID
Entra ID hardening: Conditional Access design, PIM, phishing-resistant authentication, app registration governance and agent identity.
BloodHound
BloodHound for mapping privilege escalation paths across Active Directory, Entra ID and — via OpenGraph — cloud, SaaS and agentic identities.
Cloud architecture review
Design-stage review of cloud and hybrid architecture: trust boundaries, identity model, segmentation, key management and detection design.
Cloud security
Multi-cloud security practice: landing zones, identity, posture management, MITRE ATT&CK-aligned detection engineering and CIS hardening baselines.
Identity attack paths
Using BloodHound and Entra ID review to find privilege escalation paths across on-premises Active Directory and cloud identity.
Conditional Access baseline
An Entra ID Conditional Access baseline ordered by blast radius: which policies to ship first, how to stage them, the legacy-policy retirement dates that create silent gaps, and the exclusions that quietly undo them.