Entra ID and Conditional Access
reviewed, gap by gap.
We review how sign-in is protected in your Microsoft Entra ID tenant, using exports and screenshots you choose to share, and give you a written report of the gaps in Conditional Access, admin roles, app consent and MFA, ranked by what to fix first.
Who it is for
Organisations on Microsoft 365 or Azure that have added Conditional Access policies over time and want an independent check of what they do and do not cover, for example before an audit, a licence change or after a sign-in incident.
What we review
- Policy inventory and gap analysis. which users, apps and conditions each Conditional Access policy targets, what is excluded, and what is left uncovered or covered twice.
- Report-only policies. policies left in report-only mode, what their sign-in log results suggest, and what is needed before enforcing them. Report-only evaluates and logs a policy without enforcing it.
- Emergency access (break-glass) accounts. whether two or more cloud-only emergency accounts exist, how they are excluded from policies that block or restrict sign-in, how their credentials are protected, and whether use of the accounts raises an alert. Microsoft documents these points on its emergency access page.
- Privileged roles and PIM. permanent versus eligible assignments, how many Global Administrators exist (Microsoft recommends fewer than five), activation requirements and access reviews. Privileged Identity Management requires licences, so the report notes what yours appear to allow.
- Legacy authentication. whether a policy blocks legacy authentication protocols, and what the sign-in logs show about remaining use.
- MFA coverage and methods. the authentication methods policy, which methods are enabled and for whom (for example voice calls, text message, authenticator app, passkeys or certificate-based authentication), and which methods administrators and emergency accounts use.
- Device and session controls. requirements for compliant or hybrid-joined devices, sign-in frequency and persistence, as configured in the policies you share.
- App consent and enterprise applications. user consent and admin consent settings, applications holding high-privilege permissions, applications without an owner, and secrets or certificates close to expiry.
- Guest and external access. B2B collaboration and invitation settings, cross-tenant access settings and how guest accounts are reviewed.
- Named locations, risk-based controls and logging. named locations, sign-in and user risk policies where your licences include them, and whether sign-in and audit logs are retained and alerted on.
What you get
A written report, delivered through the channel agreed in the quote. It contains:
- An executive summary in plain language
- A policy-by-policy coverage matrix showing who and what each policy reaches
- Findings with severity and the evidence behind each one
- A fix-first list with effort for each item
- A 30/60/90-day plan
- A list of what was not checked and why
See the format in the fictional report sample (sample, fictional data).
What we need from you
- A named contact with authority over the tenant
- Read-only exports or screenshots your administrator chooses to share, such as the Conditional Access policy list, the authentication methods policy, role assignments and the enterprise applications list
- An agreed, secure channel for the evidence (never email credentials, tokens or tenant exports)
How it works
- Send an enquiry. Tell us the question. Keep credentials and customer data out of it.
- Agree the written scope. We propose scope, fee and timing in writing. Nothing starts until both sides accept it.
- We review what you choose to share. We read only the exports and screenshots in the agreed scope. We do not sign in to your tenant or use Graph permissions.
- You get a written report. It says what was checked, what was not, and suggested next steps.
- Any change is approved separately. A report does not authorize changes; anything that changes needs its own written approval.
See what the report looks like: Read a fictional report sample (sample, fictional data). How we handle your information: Trust and data handling.
What we need from you. A named contact with authority, and a small set of evidence you choose to share through a channel we agree in writing first. Please do not send credentials, access tokens or customer exports through the enquiry form.
What we do not do. We do not sign in to your tenant, use Graph permissions, create or edit policies, or test sign-ins. We give no security guarantee, and this is not a penetration test or a compliance attestation.
What needs separate approval. Creating, changing or enforcing any Conditional Access policy, role or consent setting, and any re-test after changes.
Questions before an enquiry
Do you need admin access to our tenant?
No. Your own administrator exports or screenshots the settings named in the scope and shares them through the agreed channel. We review what you provide.
Will you change or enforce policies?
No. The report recommends; any change is yours to approve, or a separate written scope. Report-only mode is a safe way for you to test a policy before enforcing it, and the report explains what your logs suggest.
Which licences do we need?
The Microsoft Entra licence you hold decides which features are available, and Microsoft documents the requirement for each feature; Privileged Identity Management, for example, requires licences. The report notes what your current licences appear to allow. Check current Microsoft documentation, because licensing changes.
Is this the same as the Microsoft 365 baseline review?
No. The baseline review covers settings and workloads you choose across Microsoft 365. This review goes deeper on identity and sign-in protection only.
How is this different from the free policy reviewer tool?
The free tool checks a policy export in your browser against a fixed list. The review adds a person reading your whole set of policies, roles and apps in context, with a ranked written report.
Free tools, reading and vendor documentation
- Conditional Access policy reviewer (free)
- Conditional Access review checklist: 12 things to check
- What is Conditional Access?
- What is Privileged Identity Management?
- Phishing-resistant MFA and fake sign-in pages
Microsoft documentation (opens in a new tab). Product behaviour and licensing change, so check current Microsoft documentation before acting:
Ready to start?
Tell us what you need. We reply to confirm fit and to propose scope, fee and timing in writing.