The 22 identity settings I check on every Entra tenant and the five people usually miss

We spent the past year building automated Microsoft 365 posture assessment. Most of that year went into deciding what was worth checking — reading the CIS Microsoft 365 Benchmark, the CISA SCuBA baselines and a dozen compliance frameworks, then testing each setting against real tenants to see whether it could be read at all.

These five came up again and again. Not obscure settings — just ones that are not on most checklists.

**1. Break glass accounts**

Do they exist, and are they excluded from the policies that would lock you out? A Conditional Access policy requiring compliant devices, with no exclusion and no emergency account, is a tenant you can lock yourself out of permanently.

**2. Legacy per-user MFA alongside the Authentication Methods policy**

The migration gets started and not finished. Both active at once produces behaviour nobody intends, and it is invisible unless you look in both places.

**3. App registration restrictions**

Default is that any user can register an application in your tenant. A standing permission grant nobody approved, on an object nobody owns, that will never appear in an offboarding process.

**4. Cross-tenant access settings**

Default is open. It governs which other Microsoft tenants your users and theirs can reach, and most organisations have never opened the blade.

**5. Access reviews**

Unconfigured in most tenants. Which means privileged role membership is whatever accumulated over the years, not whatever was last approved.

**One thing we learned the hard way**

Some settings cannot be read programmatically at all. Entra Password Protection's custom banned password list is portal-only, as are diagnostic settings — whether sign-in and audit logs are exported anywhere. We name those in the report with the reason rather than scoring them as passing, because a tool that quietly marks unreadable controls green gives you a better number and a report that is wrong.

**The rest of the identity list**

MFA enforcement, Conditional Access coverage and gaps, legacy auth, SSPR, permanent Global Administrator assignments, guest permissions, Entra Password Protection, user and sign-in risk policies, PIM activation requirements, PIM security alerts, named locations, B2B domain restrictions, hybrid sync health, Windows Hello for Business, session controls, Entitlement Management.

Twenty-two in total, and 93 across the whole tenant.

These are the identity controls in Kyvoi, which assesses a tenant read-only and maps each finding to the compliance clauses it affects. Free trial on both:

Assessment https://marketplace.microsoft.com/en-us/product/saas/7081328.kyvoi-assessment?tab=Overview

Continuous monitoring https://marketplace.microsoft.com/en-us/product/saas/7081328.kyvoi-monitoring?tab=Overview

Full control list at kyvoi.com/features.

What else belongs on the list?