Category: Microsoft Entra
-
Restrict App Consent in Entra ID: Because ‘Document Viewer’ Shouldn’t Read Everyone’s Email
How to restrict app consent in Microsoft Entra ID, review existing app grants, set up the admin consent workflow and respond to consent phishing.
-
Restricted Management Administrative Units: Because Dave From the Helpdesk Shouldn’t Reset the CEO’s Password
How to use restricted management administrative units in Microsoft Entra ID to protect executive, HR and break glass accounts, with PowerShell and audit checks.
-
Conditional Access What If Tool: Test Policies Before They Test You
How to test Conditional Access policies safely with report-only mode and the Conditional Access What If tool, read the results, and prove the impact before you switch a policy on.
-
Administrative Units in Entra: Because Not Everyone Needs to Reset Dave’s Password
Administrative units in Microsoft Entra let you scope admin roles to one school, site or department. Here is how to build them, script them and pair them with PIM.
-
Microsoft Entra ID Tenant Setup: Do It Right on Day One, Not in the Incident Review
A day-one Microsoft Entra ID tenant checklist: custom domains, branding, user and consent settings, emergency access, passkeys, security defaults, SSPR, PIM and log retention, all checked against Microsoft Learn.
-
Phishing-Resistant MFA in Entra ID: Because ‘Approve’ Shouldn’t Hand Over the Keys
A staged phishing-resistant MFA rollout for Microsoft Entra ID: passkeys, Windows Hello for Business, a report-only authentication strength pilot, log checks and safe enforcement.
-
Temporary Access Pass: The Only Password You Should Happily Hand Out
How to set up a Temporary Access Pass in Microsoft Entra ID for passkey onboarding and recovery, plus custom banned passwords in the cloud and on-premises.
-
Entra Lifecycle Workflows: Because ‘Dave Left in March’ Shouldn’t Mean Dave Still Has Access
Set up Entra Lifecycle Workflows for joiners, movers and leavers: licensing, employeeHireDate and employeeLeaveDateTime, built-in templates and tasks, PowerShell and how to prove each workflow ran.
-
Break Glass Account: Because ‘I’ll Just Ring Microsoft’ Isn’t a Recovery Plan
A break glass account gets you back in when Conditional Access locks everyone out. Here is how to set one up properly in 2026, with passkeys, alerts and regular testing.