4.4Identities, MFA & M365 security (Entra ID)
The essentials in 30 seconds
- In the cloud, identity becomes the real security perimeter: you sign in from anywhere, and protecting identity protects access to everything.
- Entra ID (formerly Azure AD) manages M365 identities; MFA adds a second factor and blocks password theft alone — the most cost-effective measure.
- Conditional access tailors the requirement to the context (location, device, risk); administrator accounts are protected as a priority.
Running mini-case — Sofiane hardens the SME's access
Sofiane, a systems administrator in a distribution SME in Algiers, runs an audit of identities in Entra ID. He finds that MFA is not enabled everywhere and that two administrator accounts are exempt "to move faster". He corrects it: MFA required for all, as a priority on privileged accounts, then a simple conditional access rule — MFA mandatory outside the office. He also defines what to do in the event of a compromised account: reset and revoke sessions. He notes the reflex: protecting identities means protecting all access.
Standalone case for this section: it returns in the course, the diagram, the script and the 48h challenge of section 4.4.
1. Identity, the new perimeter
In the cloud, there is no longer a network "wall" around the company: you sign in from anywhere. The real perimeter becomes identity. Entra ID (formerly Azure AD) manages these identities for Microsoft 365. Protecting identity means protecting access to everything — hence the importance of going beyond a simple password.
2. MFA, essential
A password alone gets stolen (phishing, leak, reuse). MFA (multi-factor authentication) adds a second factor: something you possess (authenticator app, code) in addition to something you know (password). Even with the password, an attacker is blocked without the second factor. It is the most cost-effective measure against account takeover.
3. Conditional access
You go further with conditional access: rules that tailor the requirement to the context ("require MFA outside the office", "block connections from unrelated countries", "require a compliant device"). The idea: the riskier the context, the more guarantees you demand. Privileged accounts are protected as a priority, never exempt from the rules.
🔎 Concrete example — 🔎 Concrete example — A password stolen by phishing
A user enters their password on a fake site; Sofiane compares the two cases:
Without MFA: the attacker signs in -> account compromised X
With MFA: the attacker has the password but not the 2nd factor
-> sign-in blocked + alert OK
Reading : MFA neutralises password theft alone.
Lesson : enabling MFA is the most cost-effective measure against account takeover.Reading: MFA neutralises password theft alone — the attacker does not have the second factor.
Lesson: enabling MFA is the most cost-effective measure against account takeover, especially on admins.
Section vocabulary
- Entra ID
- Microsoft's cloud identity service (formerly Azure AD) for M365.
Simple example: Sofiane manages accounts and MFA from Entra ID.
What it is not: a team file storage service.
Reflex: M365 identities → Entra ID.
- Identity
- An account that proves who you are; the real security perimeter in the cloud.
Simple example: Protecting identity protects access to everything, Sofiane recalls.
What it is not: a network cable or port, which authenticates nobody.
Reflex: signing in from anywhere → protect identity.
- MFA
- Multi-factor authentication: password + a second factor you possess.
Simple example: Sofiane requires MFA for everyone, admins first.
What it is not: a single password, reused and easily stolen.
Reflex: block password theft → MFA.
- Conditional access
- Rules that tailor the authentication requirement to the context.
Simple example: Sofiane requires MFA outside the office.
What it is not: a single rule identical in every situation.
Reflex: higher risk → stronger requirement.
- Phishing
- A deception aimed at stealing credentials via a fake site or message.
Simple example: A fake portal imitates the M365 sign-in to steal the password.
What it is not: a hardware failure that cuts the connection.
Reflex: a password asked for by message → be suspicious.
In practice — In practice — Hardening a tenant's access
- Check that MFA is enabled for all accounts, especially administrators, like Sofiane.
- Define a simple conditional access rule (e.g. MFA outside the office).
- Identify the privileged accounts that deserve stronger protection.
- Plan what to do in the event of a compromised account (reset, revoke sessions).
Step-by-step script — hardening access like Sofiane (5 min)
1) Open Entra ID and list the accounts, spotting the administrator accounts. 2) Check that MFA is enabled everywhere — and never exempt for admins. 3) Create a simple conditional access rule: MFA mandatory outside the office. 4) Note the privileged accounts and the stronger protection planned. 5) Write the procedure in case of compromise: reset and revoke sessions.
Reminder: these settings are part of a policy approved by the organisation — principle of least privilege, without bypassing security.
Copy-paste template — my identity security sheet
Perimeter : identity (not the network) — Entra ID manages M365 accounts
MFA : required everywhere, as a PRIORITY on admin accounts
Cond. acc.: tailor the requirement to context (location, device, risk)
Privileges: least privilege, never exempt 'to move fast'
Compromise: reset the account + revoke sessionsA stolen password
Thanks to MFA, Sofiane blocks the attacker who has only the password.
A protected admin
Sofiane applies MFA as a priority to privileged accounts, never exempt.
Outside the office
Conditional access requires MFA as soon as the connection comes from outside.
An alert handled
Sofiane reacts to a suspicious sign-in: reset and revoke sessions.
✓ Best practices
- Enable MFA everywhere, as a priority on admins.
- Tailor the requirement to the context (conditional access).
- Treat identity as the real perimeter.
✗ Common pitfalls
- Relying on the password alone.
- Exempting admin accounts from MFA "for convenience".
- Ignoring alerts of a suspicious sign-in.
Key takeaways
- In the cloud, identity is the real security perimeter.
- Entra ID manages M365 identities.
- MFA blocks password theft alone: the most cost-effective measure.
- Conditional access tailors the requirement to the context (location, device, risk).
48h challenge — apply it tomorrow
Like Sofiane, audit the identities of a tenant: check that MFA is active everywhere (admins first) and write a simple conditional access rule (e.g. MFA outside the office). State in one sentence what to do in the event of a compromised account (reset, revoke sessions).
- I can explain why identity is the security perimeter.
- I know why MFA blocks password theft.
- I understand conditional access and the priority given to admin accounts.
Frequently asked questions
Is MFA really necessary if passwords are strong?
Yes: even a strong password gets stolen by phishing or a leak. MFA adds a barrier the attacker does not have, and neutralises the vast majority of automated account takeovers. It is the measure with the best effort/protection ratio.
Why protect administrator accounts above all?
Because a compromised admin account gives the keys to the whole tenant. They are protected as a priority (MFA, conditional access, dedicated accounts) and never exempt from the rules "to move faster".
Why does MFA protect even if the password is stolen?