Entra Identity

Identity is where most intrusions start and where most lockouts happen, often in the same week. This series is the order I’d harden an Entra ID tenant in, with the steps that tend to go wrong called out before you hit them.

Start with break-glass accounts, because every other change in this series can lock you out and those accounts are your way back in. Then roll out Conditional Access slowly, report-only first. After that, take standing admin rights away, so nobody holds Global Administrator all day just in case they need it for an hour.

Parts appear below as they go live, newest at the top.