Tag: Entra ID

The Entra sign-in diagnostic tells you why a sign-in failed and what to do next. Here are the roles, 4 steps to run it, the common AADSTS codes and PowerShell and KQL checks.

Conditional Access session controls explained: sign-in frequency, persistent browser session, the device filter gotcha in Microsoft’s template, and two tested policies for unmanaged devices and admins.

Assign Microsoft Entra roles to a role-assignable group, then use PIM for Groups to make admins eligible members with MFA, approval and access reviews.

Microsoft 365 companion apps (People, Files and Calendar) stop working before 16 December 2026. Here is the timeline, what to use instead and how to remove them with Intune.

How to run Microsoft’s zero trust assessment PowerShell module against a Microsoft 365 tenant, read the report and turn the results into a prioritised fix list.

How to restrict app consent in Microsoft Entra ID, review existing app grants, set up the admin consent workflow and respond to consent phishing.

How to use restricted management administrative units in Microsoft Entra ID to protect executive, HR and break glass accounts, with PowerShell and audit checks.

How to test Conditional Access policies safely with report-only mode and the Conditional Access What If tool, read the results, and prove the impact before you switch a policy on.

Administrative units in Microsoft Entra let you scope admin roles to one school, site or department. Here is how to build them, script them and pair them with PIM.

A day-one Microsoft Entra ID tenant checklist: custom domains, branding, user and consent settings, emergency access, passkeys, security defaults, SSPR, PIM and log retention, all checked against Microsoft Learn.