Microsoft Entra ID

What is Microsoft Entra ID?

Microsoft Entra ID (formerly Azure Active Directory, or Azure AD) is the cloud-based identity and access management platform that powers Microsoft 365. Every time a user signs into Outlook, Teams, SharePoint, or any Microsoft 365 app, Entra ID is what authenticates them and determines what they're allowed to access.

Entra ID is included in every Microsoft 365 licence, but the capabilities available depend on the plan. Business Premium includes Entra ID P1, which adds Conditional Access, self-service password reset, and advanced MFA options. E5 adds P2, which includes Privileged Identity Management and Identity Protection.

Why identity is your most important security control

The majority of successful cyber attacks start with compromised credentials — a phishing email that captures a password, a credential stuffing attack against a reused password, or a brute-force attack against a weak one. Once an attacker has valid credentials, they can access everything that user has permission to access.

Getting identity right — strong authentication, Conditional Access, and least-privilege access — is the single highest-impact security investment most Canberra businesses can make. It addresses the root cause of most attacks rather than trying to detect them after the fact.

Multi-factor authentication

MFA is the most important Entra ID control to implement. It requires users to verify their identity with a second factor — typically the Microsoft Authenticator app — in addition to their password. Microsoft data shows MFA blocks over 99% of account compromise attacks.

Entra ID supports multiple MFA methods: the Authenticator app (most secure and most convenient), SMS codes (convenient but less secure), hardware tokens, and Windows Hello for Business. The Authenticator app with number matching is the recommended default for most Canberra businesses.

Conditional Access

Conditional Access is the policy engine in Entra ID P1 that controls when and how users can access resources. Rather than simply requiring MFA for all sign-ins, Conditional Access lets you apply different requirements based on context: who the user is, what device they're using, where they're signing in from, and what they're trying to access.

A well-designed Conditional Access policy set might require MFA for all users, block sign-ins from high-risk countries, require compliant devices for access to sensitive data, and block legacy authentication protocols that don't support MFA.

• Require MFA for all users — baseline policy, should be in place for every organisation
• Require compliant devices — only Intune-managed, policy-compliant devices can access Microsoft 365
• Block legacy authentication — prevents attackers from bypassing MFA using older protocols
• Sign-in risk policies — automatically challenge or block sign-ins that Entra ID identifies as risky

Managing access and permissions

Entra ID is also the platform for managing who has access to what. Groups in Entra ID control access to SharePoint sites, Teams, applications, and other resources. Getting group management right — using dynamic groups based on user attributes rather than manually maintained lists — reduces the administrative overhead of access management and ensures access is revoked automatically when someone leaves.

Privileged Identity Management (available in Entra ID P2) adds just-in-time privileged access — admin rights that are activated on demand for a defined period, rather than permanently assigned. This significantly reduces the risk of a compromised admin account.

Getting your identity foundation right

The right starting point is an identity audit: reviewing who has admin rights, which accounts don't have MFA enabled, and whether any legacy authentication is still in use. From there, enforcing MFA for all users and implementing a baseline Conditional Access policy set delivers the most immediate security improvement.

I.T.S Canberra configures Entra ID, Conditional Access policies, and identity governance for Canberra businesses as part of a Microsoft 365 Business Premium deployment — ensuring your identity foundation is solid before building the rest of your security stack on top of it.