Microsoft Entra ID
Entra ID is the control plane for most estates I review. Conditional Access design and exclusion governance produce more risk reduction per hour than anything else.
Updated
How I use it
- Conditional Access policy set with documented exclusion governance
- PIM for just-in-time privileged elevation with approval
- Phishing-resistant authentication for admins
- App registration and service principal credential governance
Recurring problems I find
- Exclusion groups that quietly void the policy they belong to
- Break-glass accounts used for routine work
- Consent grants allowing broad Graph permissions to unreviewed apps
Microsoft Entra Agent ID reached general availability, giving AI agents first-class identities distinct from a shared service principal, with Conditional Access now extending to them.
Related
Identity & Zero Trust
Entra ID hardening, Conditional Access authentication strengths, privileged access management and identity attack-path analysis with BloodHound.
BloodHound
BloodHound for mapping privilege escalation paths across Active Directory, Entra ID and — via OpenGraph — cloud, SaaS and agentic identities.
Identity attack paths
Using BloodHound and Entra ID review to find privilege escalation paths across on-premises Active Directory and cloud identity.
Cloud security
Multi-cloud security practice: landing zones, identity, posture management, MITRE ATT&CK-aligned detection engineering and CIS hardening baselines.
Conditional Access baseline
An Entra ID Conditional Access baseline ordered by blast radius: which policies to ship first, how to stage them, the legacy-policy retirement dates that create silent gaps, and the exclusions that quietly undo them.
Microsoft SC-100
SC-100 Cybersecurity Architect Expert: Zero Trust strategy, GRC alignment and security architecture across Microsoft platforms.