Identity best practices

Enforce it with Conditional Access, not per-user MFA settings, so it applies to every sign-in path.

Apply the built-in phishing-resistant authentication strength to privileged roles: FIDO2, Windows Hello for Business or certificates.

Move users to Microsoft Authenticator with a registration campaign, then scope SMS to a shrinking exception group and disable it.

Protocols that cannot do MFA let password spray bypass every other control. Check the sign-in logs before enforcing.

New starters and people who have lost a method get a short-lived, single-use pass instead of a password sent by email.

No security questions. Notify users and admins when a reset happens.

Cloud-only, permanent Global Administrator, a registered phishing-resistant method, credentials stored offline, and tested at least twice a year.

Read the sign-in logs and the What If tool before enforcing anything that could lock people out.

Require MFA on risky sign-ins and a secure password change for high-risk users, favouring self-remediation over blocks.

Combine strong authentication with a trusted device for the most sensitive access.

A numbered convention such as CA001 to CA005, with an owner and purpose for each, makes reviews and audits far easier.

Everyone else is eligible through Privileged Identity Management and activates just in time.

Microsoft recommends fewer than five. Use least-privileged roles such as User Administrator for routine work.

Require a second person to approve Global Administrator and Privileged Role Administrator activations.

No mailbox, no browsing, not synchronised from Active Directory.

Tier 0 tasks only from hardened, dedicated devices.

Unique, rotated local admin passwords stop one stolen hash opening every machine.

Disable, revoke sessions, remove groups and licences, and transfer data ownership. Immediately for hostile leavers.

Apply results automatically and decide deliberately what happens when a reviewer does not respond.

Dry run first, a grace period for new joiners, a protected exclusion group, and a cap on actions per run.

For example, nobody should both create accounts and grant privileged roles.

Requested, approved and time-limited access instead of open-ended group adds.

Drive joiner, mover and leaver events from HR, not from helpdesk tickets.

Dedicated host, restricted logon, administered only from a privileged access workstation.

It adds resilience and powers leaked-credential detection in ID Protection.

Microsoft advises rotating the AZUREADSSOACC key at least every 30 days.

Each federated domain is a token-forgery surface. Use staged rollout to move safely.

Nothing to leak and nothing to rotate. Use them for runbooks, functions and pipelines.

Find expiring or long-lived secrets, apps with no owner, and apps nobody uses.

Restrict user consent and review every admin consent grant to high-privilege Graph permissions.

Turn off default user app registration and route requests through an owner.

The one account where an unnoticed sign-in is least acceptable.

Keep them beyond the default retention so investigations can look back months, not days.

Detect DCSync, Golden Ticket and lateral movement on the on-premises side.

Report the trend alongside the remediation plan so a rising score cannot hide stalled work.

A versioned module that produces the same report every week, with no stored secrets.

Before and after exports, policy JSON and review outcomes are your audit trail.

Record an owner and date against each item that is still open.