Microsoft Entra: Building Trust in a Borderless Digital World
As nonprofits embrace hybrid work, multi-cloud environments, and digital transformation to better serve their missions, the need for secure, intelligent access has never been greater. Traditional identity solutions often fall short in protecting diverse user groups like staff, volunteers, donors, and partners. Microsoft Entra offers a unified family of identity and network access products designed to verify every identity, validate every access request, and secure every connection—helping nonprofits stay resilient, compliant, and mission-focused. What Is Microsoft Entra? Microsoft Entra offers a unified family of identity and network access products designed to verify every identity, validate every access request, and secure every connection—helping nonprofits stay resilient, compliant, and mission-focused. The suite includes: Microsoft Entra ID (formerly Azure Active Directory): A cloud-based identity and access management service that supports Single Sign-On (SSO), Multifactor Authentication (MFA), and Conditional Access policies to protect users, apps, and resources. Microsoft Entra ID Governance: Automates identity lifecycle management, ensuring users have the right access at the right time—and nothing more. It supports access reviews, role-based access control, and policy enforcement. Microsoft Entra External ID: Manages secure access for external users like customers, partners, and vendors. It enables personalized, secure experiences without compromising internal systems. Microsoft Entra Private Access: Provides secure, VPN-less access to private apps and resources across hybrid and multi-cloud environments. It’s ideal for remote work scenarios and legacy app support. Microsoft Entra Internet Access: Offers secure web access with identity-aware controls, helping protect users from malicious sites and enforcing compliance policies. Why Microsoft Entra Matters for Nonprofits Unified Identity Protection: Secures access for any identity—human or workload—to any resource, from anywhere. Zero Trust Enablement: Verifies every access request based on identity, device health, location, and risk level. Multi-cloud and Hybrid Ready: Works across Microsoft 365, Azure, AWS, Google Cloud, and on-premises environments. Compliance and Governance: Supports nonprofit regulatory needs with automated access reviews, audit trails, and policy enforcement. Getting Started with Microsoft Entra Assess your security posture through Microsoft Secure Score – Helps nonprofits monitor and improve identity, device, and app security posture. Building Conditional Access policies in Microsoft Entra – Create policies to protect users and data based on risk, location, and device health. Create a lifecycle workflow – Automate onboarding, role changes, and offboarding for staff, volunteers, and contractors. Microsoft Entra External ID documentation – Manage secure access for donors, partners, and community members. Real-World Impact A global nonprofit recently used Microsoft Entra to streamline access for volunteers, staff, and external partners. By automating identity governance and enabling secure access to cloud apps, they reduced administrative overhead and improved security posture—without sacrificing user experience. Conclusion Microsoft Entra empowers nonprofits to modernize identity and access management with a unified, secure, and intelligent approach. Whether you're enabling remote work, collaborating with external partners, or safeguarding sensitive donor data, Entra provides the tools to build trust, enforce least privilege, and stay compliant. By adopting Entra, nonprofits can focus more on their mission and less on managing risk—ensuring that every connection is secure, every identity is verified, and every access is governed.Comprehensive Identity Protection—Across Cloud and On-Premises
Hybrid IT environments, identity is the new perimeter—and protecting it requires visibility across both cloud and on-premises systems. While Microsoft Entra secures cloud identities with intelligent access controls, Microsoft Defender for Identity brings deep insight into your on-premises Active Directory. Together, they form a powerful duo for comprehensive identity protection. Why Hybrid Identity Protection Matters Most organizations haven’t fully moved to the cloud. Legacy systems, on-prem applications, and hybrid user scenarios are still common, and attackers know it. They exploit these gaps using techniques like: Pass-the-Hash and Pass-the-Ticket attacks Credential stuffing and brute-force logins Privilege escalation and lateral movement Without visibility into on-prem identity activity, these threats can go undetected. That’s where Defender for Identity steps in. What Is Microsoft Defender for Identity? Defender for Identity is part of Microsoft Defender XDR—a cloud-based solution that monitors on-premises Active Directory for suspicious behavior. It uses behavioral analytics and threat intelligence to detect identity-based attacks in real time. Key capabilities: Detects compromised accounts and insider threats Monitors lateral movement and privilege escalation Surfaces risky users and abnormal access patterns Integrates with Microsoft 365 Defender and Sentinel for unified response Why It Pairs Perfectly with Microsoft Entra Microsoft Entra (formerly Azure AD) protects cloud identities with features like Conditional Access, Multifactor Authentication, and Identity Governance. But Entra alone can’t see what’s happening in your on-prem AD. By combining Entra and Defender for Identity, you get: End-to-end visibility across cloud and on-prem environments Real-time threat detection for suspicious activities like lateral movement, privilege escalation, and domain dominance Behavioral analytics to identify compromised accounts and insider threats Integrated response capabilities to contain threats quickly and minimize impact Actionable insights that help strengthen your identity posture and reduce risk Together, they deliver comprehensive identity protection—giving you the clarity, control, and confidence to defend against modern threats. Real-World Impact Imagine a scenario where an attacker gains access to a legacy on-prem account and begins moving laterally across systems. Defender for Identity detects the unusual behavior and flags the account as risky. Entra then blocks cloud access based on Conditional Access policies tied to that risk signal—stopping the attack before it spreads. Getting Started Deploy Defender for Identity sensors on your domain controllers Install a sensor - step-by-step instructions to install Defender for Identity sensors on your domain controllers to begin monitoring on-premises identity activity. Activate the sensor on a domain controller - Guidance on activating the installed sensor to ensure it starts collecting and analyzing data. Deployment overview - A high-level walkthrough of the Defender for Identity deployment process, including prerequisites and architecture. Connect Defender for Identity to Microsoft 365 Defender Integration in the Microsoft Defender portal - Learn how to connect Defender for Identity to Microsoft 365 Defender for centralized threat detection and response. Pilot and deploy Defender for Identity - Best practices for piloting Defender for Identity in your environment before full-scale deployment. Enable risk-based Conditional Access in Entra Configure risk policies in Entra ID Protection - Instructions for setting up risk-based policies that respond to identity threats in real time. Risk-based access policies overview - An overview of how Conditional Access uses risk signals to enforce adaptive access controls. Use Entra ID Governance to enforce least privilege Understanding least privilege with Entra ID Governance - Explains how to apply least privilege principles using Entra’s governance tools. Best practices for secure deployment - Recommendations for securely deploying Entra ID Governance to minimize identity-related risks. Integrate both with Microsoft Sentinel for advanced hunting Microsoft Defender XDR integration with Sentinel - How to connect Defender for Identity and other Defender components to Microsoft Sentinel for unified security operations. Send Entra ID data to Sentinel - Instructions for streaming Entra ID logs and signals into Sentinel for deeper analysis. Microsoft Sentinel data connectors - A catalog of available data connectors, including those for Entra and Defender for Identity, to expand your threat detection capabilities. Final Thoughts It's the perfect time to evaluate your identity protection strategy. By pairing Microsoft Entra with Defender for Identity, you gain full visibility across your hybrid environment—so you can detect threats early, respond quickly, and protect every identity with confidence. Ready to strengthen your identity perimeter? Start by deploying Defender for Identity and configuring Entra policies today.How to move Active Directory Source of Authority to Microsoft Entra ID and why
This gives you seamless access for your teams, stronger authentication with MFA and passwordless options, and centralized visibility into risks across your environment. Simplify hybrid identity management by reducing dual overhead, prioritizing key groups, migrating users without disruption, and automating policies with Graph or PowerShell. Jeremy Chapman, Microsoft 365 Director, shows how to start minimizing your local directory and make Microsoft Entra your source of authority to protect access everywhere. Strengthen your identity security. Sync your on-prem AD with Microsoft Entra ID, adding MFA and Single Sign-on. Start here. Gain full visibility into risky sign-ins. Minimize dual management by moving the source of authority to Microsoft Entra. Check it out. Automate moving groups and users to the cloud. Streamline your identity management using Graph API or PowerShell. Take a look. QUICK LINKS: 00:00 — Minimize Active Directory with Microsoft Entra 00:34 — Build a Strong Identity Foundation 01:28 — Reduce Dual Management Overhead 02:06 — Begin with Groups 03:04 — Automate with Graph & Policy Controls 03:50 — Access packages 06:00 — Move user objects to be cloud-managed 07:03 — Automate using scripts or code 09:17 — Wrap up Link References Get started at https://aka.ms/CloudManagedIdentity Use SOA scenarios at https://aka.ms/usersoadocs Group SOA scenarios at https://aka.ms/groupsoadocs Guidance for IT Architects on benefits of SOA at https://aka.ms/SOAITArchitectsGuidance Unfamiliar with Microsoft Mechanics? As Microsoft’s official video series for IT, you can watch and share valuable content and demos of current and upcoming tech from the people who build it at Microsoft. Subscribe to our YouTube: https://www.youtube.com/c/MicrosoftMechanicsSeries Talk with other IT Pros, join us on the Microsoft Tech Community: https://techcommunity.microsoft.com/t5/microsoft-mechanics-blog/bg-p/MicrosoftMechanicsBlog Watch or listen from anywhere, subscribe to our podcast: https://microsoftmechanics.libsyn.com/podcast Keep getting this insider knowledge, join us on social: Follow us on Twitter: https://twitter.com/MSFTMechanics Share knowledge on LinkedIn: https://www.linkedin.com/company/microsoft-mechanics/ Enjoy us on Instagram: https://www.instagram.com/msftmechanics/ Loosen up with us on TikTok: https://www.tiktok.com/@msftmechanics Video Transcript: -Your identity system is your first and last line of defense against unauthorized access, data exfiltration, and lateral movement. And now with AI agents acting on behalf of users, identity is more critical than ever. Today we’re going to explain and demonstrate how moving more of your groups and users to centralized management in the cloud can increase your identity security posture without breaking access and authorization to the resources that you have running on premises so that your users don’t even notice anything changed. If we step back in an architectural level, if yours is like most organizations, you’re probably running hybrid identity, where core identity management tasks happen on your local infrastructure, and many of your user, group, app and device accounts are still created or exist on-prem. -And as you’ve started using cloud services, you’ve also set up identity synchronization between your local Active Directory and Microsoft Entra ID so that you can synchronize on-prem objects like usernames, passwords, and groups to the cloud. And if you’ve then gotten the extra step of a Cloud first approach, your new users, apps, and groups are managed in Microsoft Entra by default, and your new managed devices are Entra Joined. Now, you should have implemented multifactor authentication, ideally phish-resistant MFA with device compliance checks along with Single Sign-on for your apps. In both cases, these are really strong foundations. -That said, though, you’re dealing with dual management overhead, on-premises and in the cloud, which can result in less visibility and policy gaps. Moving the Source of Authority to Microsoft Entra to manage identity from the cloud across your digital estate, solves this. Here you’re minimizing your local directory services to only what’s necessary and bringing your existing groups, users and devices as well as your apps and cloud services wherever they live, into Microsoft Entra, which gives you holistic visibility and access control into user sign-ins, risky behaviors, and more across your environment. -In fact, as I’ll show you, this approach even improves controls as users access on-premises resources. The best path to making Microsoft Entra the source of authority is to start with your Active Directory Security Groups where you’ll prioritize the apps that you want to move to cloud-based authentication. Then after working through those, you’ll turn your attention to moving existing user accounts to the cloud. Let me show you how, starting with groups. So here you’re seeing a synced group in Microsoft Entra. The ExpenseAppUsers group has its source in Windows Server Active Directory, as you can see here. In fact, if I move over to the server itself and into Active Directory, you’ll see this group here on top. -Now I’m going to go open that up and you’ll take a look at the group membership tab here, and you’ll see that the group currently has two members, Dan and Sandy. And this is the expense app that we actually want to move. It’s a local on-premises line of business app. So let’s go back to Microsoft Entra and move this group. So we’re going to use Graph API to do this, and for that we’ll need the Object ID. So I’ve already copied the Object ID and I’ve pasted that value into this URI and the Graph Explorer. And of course this can be done using PowerShell or in code, too. And I’ve already run a GET command on this Object ID. And you can see that this new parameter IsCloudManaged equals False below. Now, to change this group to be cloud managed, I just need to patch this object with IsCloudManaged:true. Then I’ll run it. -Now if I select the GET command for that same object. Below, we’re going to see that it’s changed from False to True for IsCloudManaged. And if I go back to Microsoft Entra, we can confirm that it’s cloud managed as the group Source. So now we can add users to the group from Microsoft Entra using Access Packages. So from Access Packages, I’m going to open up the one for our app. Then under Policies, I can see the Initial Policy and edit it. Now moving to the Request tab, I’ll add our newly cloud managed group. There it is, ExpenseAppUsers, and confirm. Now I’ll just click through the tabs and finally update the policy. Of course, self-service access requests and reviews will work as well. And now we can actually try this out by adding users from the Microsoft Entra admin center to grant them access to our on-premises Expense App. -So back in our group for the Expense App, I’ll go ahead and navigate to members and there are the two that we saw before from Active Directory. Now let’s add another member. So I’m going to search here for Mike, there he is, and pick his account, then select to confirm. Now if I take a look at Mike’s account properties and scroll down, we’ll see that he’s an On-premises synced account account. So this account is managed in our local Active Directory, but now the group source of authority is actually in Microsoft Entra and I can grant the account access to on-premises resources as well from the cloud. In fact, let’s take a look at how this appears in our local AD. -So now if I open up our ExpenseAppUsers group and I go to the Members tab, you can see that Mike is there as a new member, synced down from the cloud. Under the covers, this is using a matching Group SID and assigning new members to our local group based on our configurations in Microsoft Entra. So, no changes are even necessary in the local directory or the app. And the point of doing this was to ensure that Mike could be granted access to our on-premises Expense App. So let’s see if that worked. So from Mike’s PC, this is his view of the Expense App and he now has access to that local resource even though I made all the configurations in the cloud. So that was how to get groups managed in the cloud and you’d work through other groups based on the priority of the apps and corresponding groups that you want to move to the cloud. -Now the next step is then to move your user objects to be cloud managed by Microsoft Entra. So here I’m in Microsoft Entra, and I’m looking at our Sandy Pass user account, and we saw her account before in Active Directory. And if I scroll down, you’ll see that her account is indeed managed on premises and synced up to Microsoft Entra. Now the goal here is to ensure that we maintain seamless access to on-premises resources like our app that we saw before, or also file shares, for example, with better security using passwordless authentication. So if I move over to the view from Sandy’s PC, you’ll see that she has a hybrid joined account, and I can access local file shares like this one, for example, for DanAppServer. -Now if I head over to the System Tray, you’ll see that this machine also has Global Secure Access running for on-premises resource access. And next, I’ll open up a command prompt and I’ll run klist to see the issued Kerberos Tickets to show domain authorization is indeed working. So now let’s move this account to be cloud managed like we did with our group before. And the process is pretty similar and equally automatable using scripts or code. Again, we’ll need the Object ID from Microsoft Entra. Remember this text string. Now if I move over to Graph Explorer again in the URI, you’ll see that the Object ID for Sandy’s account is already there and I’ve already run the GET command and IsCloudManaged as you would expect is currently False. So let’s change that property to True. And again, I’ll use the PATCH command like we do with the Group, and I’ll run it. So now if I go over to the dropdown and rerun the GET command, you’ll see that IsCloudManaged is now True. -So if I go back to the Entra portal, we can then head over to the account properties and scroll down and then we’ll see that On-premises sync enabled says No. So, Sandy is now managed in the cloud. In fact, let’s head back over to Sandy’s machine and I’m going to purge the klist just to ensure that there aren’t any residual tickets to grant access to on-premises resources. Now I’m going to run dsregcmd and a switch for refreshprt to refresh the primary refresh token. Then running the status switch, I can get all of the details for the device registration. Then if I scroll down, eventually I can see the OnPremTgt and CloudTgt are both YES, which means the Kerberos ticket, granting ticket is working. -So now if I sign out of this machine then sign back in, the meerkat on screen looks pretty optimistic. So I’ll go ahead and open the Start menu, then I’ll head over to our file share from before and no problems. And I still have write permissions, too. So I’ll go ahead and create a folder, now I’ll name it Employee Data, then drag a file into it just to make sure that my experience wasn’t compromised and everything works. So now if I open up Start and then the Command Prompt and then run klist, there are my two issued tickets for the login as well as the file share access respectively. Again, the account is cloud managed now and we moved from on-premises and we haven’t even affected access or authorization to our resources on the local network. We’re still getting Kerberos Tickets, and our user didn’t even notice the change. -Moving your on-premises groups and user objects to be cloud managed is one of the strongest ways to improve your security posture, add control and better visibility. Now to find out more and get started, check out aka.ms/CloudManagedIdentity and keep checking back to Microsoft Mechanics for the latest tech updates, and thanks so much for watching.Cybersecurity Starts Here: Strong Passwords for Nonprofits
In the nonprofit world, trust is everything. Whether you're protecting donor data, safeguarding beneficiary information, or managing internal systems, your digital security matters. One of the simplest—and most powerful—ways to protect your organization is by using strong passwords. These tools form the first line of defense against cyber threats and help ensure your mission stays on track. Why Strong Passwords Matter Weak passwords are like unlocked doors—they invite trouble. Cybercriminals often exploit simple or reused passwords to gain unauthorized access, impersonate staff, steal sensitive data, or disrupt operations. A strong password acts as a digital lock: hard to guess, harder to crack. Characteristics of a strong password: At least 12 characters long A mix of uppercase, lowercase, numbers, and symbols Unique for every account Not based on personal info (no pet names, birthdays, or favorite sports teams!) Microsoft Tools That Help You Stay Secure Microsoft offers nonprofit-friendly tools to help enforce strong password policies and protect user identities: Microsoft Entra ID (formerly Azure Active Directory) Centralized identity and access management Multi-factor authentication (MFA) to prevent unauthorized logins Conditional access policies and role-based access control Microsoft 365 Security Center Monitor password-related alerts and suspicious sign-ins Enforce password expiration and complexity policies View security recommendations tailored to your organization Microsoft Defender for Endpoint Detects brute-force password attacks and credential theft Protects devices from malware and phishing attempts Integrates with Microsoft 365 for unified threat response Tips for Nonprofit Teams Building a culture of cybersecurity starts with small, consistent actions: Make it policy: Require strong passwords use across your organization Train your team: Host a lunch-and-learn or share a how-to guide on password safety Enable MFA: Add multi-factor authentication for all accounts Audit regularly: Review access and update credentials when staff roles change Clean up old accounts: Remove unused logins and shared credentials Your Mission Deserves Protection Cybersecurity isn’t just an IT issue—it’s a mission-critical priority. By adopting strong password practices, you’re taking a proactive step to protect your people, your data, and your impact. Microsoft’s ecosystem offers scalable, nonprofit-friendly tools to help you build a secure foundation—so you can focus on what matters most: serving your community.Cybersecurity 101: Protecting Your Nonprofit with Microsoft Tools
Cybersecurity isn’t just an IT concern—it’s a mission-critical priority. For nonprofits, safeguarding sensitive data, maintaining donor trust, and ensuring operational continuity are foundational to achieving impact. In an increasingly digital world, cyber threats are evolving rapidly, and nonprofits—often operating with limited resources—can be especially vulnerable. The good news? Microsoft offers a suite of powerful, easy-to-use tools designed to help nonprofits build a resilient security posture without needing a full-time IT department. What Is Cybersecurity? Cybersecurity is the practice of protecting systems, networks, and data from unauthorized access, attacks, or damage. For nonprofits, this means defending the integrity of: Donor and beneficiary information: Personal data that must be protected to maintain trust and comply with privacy laws. Financial records: From grant funding to payroll, financial data is a prime target for cybercriminals. Internal communications: Sensitive discussions around strategy, staffing, and partnerships. Program data and impact reports: Valuable insights that drive funding and stakeholder engagement. A breach in any of these areas can lead to reputational damage, legal consequences, and disruption of services—making cybersecurity a strategic imperative. Microsoft Tools That Help You Stay Secure Microsoft’s ecosystem is designed to meet nonprofits where they are—whether you're just starting your digital journey or managing complex operations across borders. Microsoft Defender Built-in protection against viruses, malware, ransomware, and phishing attacks Available across Windows devices and Microsoft 365 environments Real-time threat detection, automatic updates, and endpoint protection Microsoft Entra ID (formerly Azure Active Directory) Centralized identity and access management Multi-factor authentication (MFA) to prevent unauthorized logins Role-based access control to ensure staff and volunteers only access what they need Microsoft Purview Advanced data governance and compliance tools Helps classify, label, and protect sensitive information Supports regulatory compliance (e.g., HIPAA, GDPR) for nonprofits handling health or financial data Microsoft Outlook + Exchange Online Protection Filters out spam, phishing attempts, and malicious attachments Encryption options for secure email communication Safe Links and Safe Attachments features to prevent accidental clicks on harmful content Microsoft 365 Security Center Unified dashboard to monitor and manage security across your organization Actionable alerts and recommendations tailored to your environment Designed for ease-of-use, even for teams without dedicated IT staff Cybersecurity Best Practices for Nonprofits Technology alone isn’t enough—building a culture of security is key. Here are essential practices every nonprofit should adopt: Use strong, unique passwords and consider a password manager for staff Enable MFA on all accounts to add an extra layer of protection Educate your team on phishing, social engineering, and safe online behavior Keep software and systems updated to patch known vulnerabilities Limit access to sensitive data based on roles and responsibilities Back up data regularly using secure, encrypted methods Your Mission Deserves Protection Whether you're a small grassroots organization or a global NGO, your mission depends on trust, continuity, and resilience. Cybersecurity isn’t a luxury—it’s a necessity. Microsoft’s tools are designed to be scalable, affordable, and accessible, helping nonprofits protect what matters most: their people, their data, and their impact. By investing in cybersecurity today, you’re not just protecting your organization—you’re strengthening your ability to serve tomorrow.NEW Conditional Access Optimization Agent in Microsoft Entra + Security Copilot in Entra updates
Instead of switching between logs, PowerShell, and spreadsheets, Security Copilot centralizes insights for faster, more focused action. Resolve compromised accounts, uncover ownerless or high-risk apps, and tighten policy coverage with clear insights, actionable recommendations, and auto-generated policies. Strengthen security posture and reclaim time with a smarter, more efficient approach powered by Security Copilot. Diana Vicezar, Microsoft Entra Product Manager, shares how to streamline investigations and policy management using AI-driven insights and automation. Skip the scripting. Ask questions in plain language and get back policy and risk insights in seconds. Microsoft Entra now has built-in AI with Security Copilot. Stay ahead of threats. Use AI to track auth changes, elevated roles, and risky signals with Security Copilot in Entra. Start here. Improve your security posture. Receive personalized recommendations of policies and configurations to make using Microsoft Security Copilot in Microsoft Entra. Take a look. QUICK LINKS: 00:00 — Microsoft Entra with Security Copilot 01:26 — Conditional Access Optimization Agent 03:35 — Investigate risky users 05:49 — Investigate risky apps 07:34 — Personalized security posture recommendations 08:20 — Wrap up Link References Check out https://aka.ms/SecurityCopilotAgentsinMicrosoftEntra Unfamiliar with Microsoft Mechanics? As Microsoft’s official video series for IT, you can watch and share valuable content and demos of current and upcoming tech from the people who build it at Microsoft. Subscribe to our YouTube: https://www.youtube.com/c/MicrosoftMechanicsSeries Talk with other IT Pros, join us on the Microsoft Tech Community: https://techcommunity.microsoft.com/t5/microsoft-mechanics-blog/bg-p/MicrosoftMechanicsBlog Watch or listen from anywhere, subscribe to our podcast: https://microsoftmechanics.libsyn.com/podcast Keep getting this insider knowledge, join us on social: Follow us on Twitter: https://twitter.com/MSFTMechanics Share knowledge on LinkedIn: https://www.linkedin.com/company/microsoft-mechanics/ Enjoy us on Instagram: https://www.instagram.com/msftmechanics/ Loosen up with us on TikTok: https://www.tiktok.com/@msftmechanics Video Transcript: -Microsoft Entra has built-in AI with Security Copilot. In fact, if you are new to the experience or haven’t looked at it in a while, you’ll find that it is continuously being fine-tuned with skills to accelerate your daily troubleshooting and risk assessments, which means whether you’re a seasoned admin or just getting started, you don’t need deep expertise in filtering, PowerShell, or Graph API. You can just use natural language and have Security Copilot surface the information for you. Additionally, new specialized agents like the one for Conditional Access Optimization work with you to continuously look for misaligned policies along with gaps in coverage that could be putting your organization at risk. -Today, I’ll walk through examples of just how powerful Security Copilot in Microsoft Entra can be, starting with a pretty common challenge, policy coverage and conflicts, where right now, you might try to work through these issues by using filters to identify new users in the Entra audit logs or by using PowerShell with the Microsoft Graph module, then perhaps, you might export log outputs into a spreadsheet for manual analysis, and repeat the same process to identify new Enterprise apps, all with the goal of identifying coverage or gaps in policies. It’s a manual effort that can take hours from your day. And that’s where the Conditional Access Optimization Agent comes in. It can be accessed and enabled from the agents page in the Microsoft Entra admin center. From there, the Conditional Access agent works alongside you, proactively surfacing issues and suggestions like gaps in protection, users, or apps that should be added to an existing policy and policy overlaps. And you can track the status of agent suggestions as you work through them. -Clicking into a suggestion gives you the details. For this one about adding users, the agent has listed userIDs for the new users. And I can review the user impact of the suggested policy before I apply the changes. You can also dive into the agent’s activity to explore its path of analysis and the reasoning behind each suggestion to validate its logic, making sure its behaving in the way you want it to. Then moving back to the policy details, before you apply any changes, you can review the summary of changes and even the detailed JSON view if you want a deeper look, down to the individual configuration options for the policy. And at the tenant level, if you need to fine-tune the agent’s behavior, you can do so in the agent Settings tab using Custom Instructions. -For example, you can instruct the agent to make exceptions like excluding break-glass admin accounts, which the agent will take into account on its next run. And beyond just giving you suggestions and recommendations, the agent can go a step further and create a fully configured policy if no existing equivalent policy is found. By default, these are report-only policies. And from here, you can even turn it on to enable the policy directly. And from Edit, you can review the policy details. The Conditional Access Optimization Agent is great for consistently tracking your policy coverage as users, apps, and access policies evolve over time. Additionally, the specialized Microsoft Entra skills in Security Copilot will also help save you time and even help you add to your existing expertise. -For example, let me show you how Security Copilot helps automate the manual steps when investigating and fixing a known compromised user account. Typically, you would need to use sign-in logs to isolate what they are trying to access or audit the actions that they have taken with visibility into their sign-in events as well as any group memberships giving them access to resources or examine any current or recently elevated role assignments, which could increase the severity of the compromise. Already I’m jumping between tabs, and it’s time-consuming to collect all of that information to see why they’re showing up as risky. Security Copilot on the other hand can pull everything together in a fraction of the time. In this case, I know that a user, Michael, has had an account compromise. -So, I’ll ask Copilot if his account was recently flagged as risky, which even if he is low risk now, could be a sign of a persistence attack, where his account is compromised and the attacker is waiting for the right timing. The response from Copilot shows me that he is high risk with an at-risk state that started on May 19th. So, I’ll ask for the risk details for his account. Copilot spots an attempted Primary Refresh Token or PRT access. Threat Intelligence has flagged his account. There are sign-in attempts from a known malicious IP address and an anonymized IP address. So, the account was definitely compromised. I’ll ask Copilot if Michael’s authentication methods have changed. And it looks like he added a new phone on May 15th, then updated details again on the 19th. Finally, I’ll ask about Michael’s account type and whether he has privileged roles assigned. And it looks like he has Cloud Device and Device Join admin permissions. This would let him easily register and modify other managed devices, for example, to have them send file contents or sign-in tokens to other cloud storage locations. So very quickly, I was able to get the visibility I needed to decide what to do next. - Now let’s move from risky user accounts to risky apps, which can present a vulnerability. Normally, you’d spend a long time digging through app lists just to isolate which apps are even worth worrying about, trying to understand the overall risk to determine what apps are created by my organization or maybe a 3rd party that might require more scrutiny. Who owns the app, or does it no longer have an owner? What protocols are the apps using? And are they risky? And which applications are stale or unused that you may want to purge from the list. Investigations like this can take hours. Let’s use Copilot for this instead. I’ll start by asking it to list some external apps that are not owned by my tenant with verified publisher details for each app. And it pulls together a list of seven apps with additional details like the app name, App ID, and Verified Publisher, so I’m not wasting time on low-risk noise. That said, sometimes it’s the apps owned by at-risk users that can be the real problem. -So, I want to ask Copilot, do the risky users in my tenant own any applications? And it finds an app that is owned by a high-risk user. Another potential problem that presents a hidden risk are apps and service principals in your environment that are currently ownerless. I’ll ask Copilot, what proportion of apps and service principals are ownerless? And Copilot tells me that more than half or 55% of my apps are ownerless and 92% of our service principals are also ownerless. And beyond finding and pointing out problems with my policies and settings, Copilot can even give me detailed recommendations to improve identity posture. -In this case, I’ll ask, give me recommendations to improve the security posture of at-risk apps in my tenant. Show this as a bulleted list with impacted resources as applications. And Copilot gives me seven actionable recommendations of policies and configurations to make, including the removal of the unused service principals that I presented earlier, as well as outdated authentication protocols and more. So, with just a few simple prompts, I have achieved something that otherwise might have taken hours in just a few minutes. -As you’ve seen, Security Copilot in Microsoft Entra simplifies troubleshooting and risk assessments, with specialized skills and agents. And while I showed you the Conditional Access Optimization agent today, there are more on the way. To learn more, check out aka.ms/SecurityCopilotAgentsinMicrosoftEntra. Keep checking back to Microsoft Mechanics for the latest updates and thanks for watching.Fix Identity Sprawl + Optimize Microsoft Entra
Enforce MFA, block legacy authentication, and apply risk-based Conditional Access policies to reduce exposure from stale accounts and weak authentication methods. Use built-in tools for user, group, and device administration to detect and clean up identity sprawl — like unused credentials, inactive accounts, and expired apps — before they become vulnerabilities. Jeremy Chapman, Microsoft 365 Director, shares steps to clean up your directory, strengthen authentication, and improve overall identity security. Prioritize top risks. Take action across MFA, risk policies, and stale objects with Microsoft Entra recommendations. Start here. Block over 99% of identity attacks. Enforce MFA for admins and users in Microsoft Entra. Detect and delete stale user accounts. See how to fix account sprawl, and get started with Microsoft Entra. QUICK LINKS: 00:00 — Microsoft Entra optimization 00:54 — New Recommendations tab 02:11 — Enforce multifactor authentication 03:21 — Block legacy authentication protocols 03:58 — Apply risk-based Conditional Access 04:44 — Identity sprawl 05:46 — Fix account sprawl 08:06 — Microsoft 365 group sprawl 09:36 — Devices 10:33 — Wrap up Link References Watch part one of our Microsoft Entra Beginner’s Tutorial series at https://aka.ms/EntraBeginnerMechanics Check out https://aka.ms/MicrosoftEntraRecommendations Unfamiliar with Microsoft Mechanics? As Microsoft’s official video series for IT, you can watch and share valuable content and demos of current and upcoming tech from the people who build it at Microsoft. Subscribe to our YouTube: https://www.youtube.com/c/MicrosoftMechanicsSeries Talk with other IT Pros, join us on the Microsoft Tech Community: https://techcommunity.microsoft.com/t5/microsoft-mechanics-blog/bg-p/MicrosoftMechanicsBlog Watch or listen from anywhere, subscribe to our podcast: https://microsoftmechanics.libsyn.com/podcast Keep getting this insider knowledge, join us on social: Follow us on Twitter: https://twitter.com/MSFTMechanics Share knowledge on LinkedIn: https://www.linkedin.com/company/microsoft-mechanics/ Enjoy us on Instagram: https://www.instagram.com/msftmechanics/ Loosen up with us on TikTok: https://www.tiktok.com/@msftmechanics Video Transcript: -If you’re managing identities using Microsoft Entra, which includes any Microsoft Cloud service, today, I’ll show you how you can fix identity sprawl, where you probably have stale accounts, groups, and devices in your directory, and improve your identity posture with stronger authentication and more. Now, these are identity management challenges that left unaddressed will introduce security vulnerabilities, but there are ways to get them under control. -So, using recommendations tailored specifically to your company to help you better secure and optimize your running environment, along with techniques to locate identity sprawl with users, groups, and devices, then delete stale objects in your directory. This is part two in our Microsoft Entra Beginner’s Tutorial series, and I’ll link you here to part one if you missed that at aka.ms/EntraBeginnerMechanics. Now, I’ll start in the Microsoft Entra admin center under Identity and the main Overview page. The new Recommendations tab gives you a super set of security and best practice-based recommendations that go beyond what’s available from Secure Score to increase your identity posture. -In fact, if you look at the recommendations here, anything in the Secure Score column marked N/A are items based on best practices. And the list that you’re seeing here is based on what applies to this specific Microsoft Entra tenant, so your list, it might look a little different. For each recommendation, you can also see the licensing requirements to implement that recommendation. As I scroll down, you’ll see that the top recommendations with high priorities require multifactor authentication, or MFA, for administrative roles at 10 Secure Score points. -Then ensure all users can complete multifactor authentication at 9 Secure Score points. And for any of these recommendations, like this one here for administrators, you can just click in to get more details and even find the accounts that are not meeting that requirement, even if you’ve scoped an all users policy and have that in place. And by the way, even Break Glass admin accounts should use MFA with FIDO2 or certificate-based authentication as a second factor. Requiring multifactor authentication is the most important control that you can enforce as an identity admin. It can block over 99% of identity-based attacks and can also solve for many of the other common issues that I mentioned before, like stale accounts, because those are most often breached because they use basic passwords. Multifactor authentication policies are set using Conditional Access policies, where it’s recommended that you assign the policy to all users and also target all resources, formerly all cloud apps. -You can also access controls for grant and then specify specific access requirements. And if you ever wondered the difference between Require MFA and require authentication strength, well, Require MFA is more of a catch-all that works with two or more authentication methods at any strength level. Whereas require authentication strength lets you narrow down which combinations of authentication methods are allowed. For example, choosing phishing-resistant authentication as an authentication strength means that SMS text messages and passwords would not be allowed as factors, because both of those could be phished by a third party. -The next highest recommendations are related to this as well. Under high priority and at 8 Secure Score points, there is a recommendation to block legacy authentication protocols like IMAP, SMTP, and POP3. Now these are related to MFA, because all of these protocols, which are used by legacy apps, do not support MFA and Conditional Access controls. Now, here’s why this is important. If an attacker can access a legacy app using those protocols with basic password authentication, they may still be able to access protected resources, then move laterally once they’ve gained access. Then, rounding out the list of high priority recommendations are the enforcement of risk-based Conditional Access policies. -Now, these risk types might indicate that a user account has been compromised or that the user is either intentionally or unintentionally doing something that they shouldn’t be doing. And all of these recommendations are easy to implement with corresponding Conditional Access policies, where you’ll target each as a condition and pair that with a risk-based control to either block access outright or grant access with additional requirements that need to be met. Next, you’ll find a few recommendations to renew expiring application credentials. And finally, a few remove recommendations, like remove unused credentials from applications and also Remove unused applications themselves. -This leads us to identity sprawl, including unused or stale accounts, non-human accounts, and inactive registered devices. Enforcing MFA and disabling legacy authentication can mitigate much of the risk, though some of the accounts might still fall outside of MFA policies. Often, these users move on or their accounts are seasonal. They leave your company and their accounts then become stale. So, what’s the risk? The problem is that most people reuse their passwords or will just modify them slightly with known patterns like adding numbers or symbols at the end of it. And if the account in Microsoft Entra is password-only and another account of theirs is compromised by an attacker to steal their password, all the attacker needs to do then is look up the user’s profile on LinkedIn, for example, to see where they’ve last worked, guess their email address, sign into their previous employer domain using the stolen password with variations to access their stale user account, and they’re in. -Fortunately, there are ways to fix account sprawl. I’ll show you how you can do this in the admin center, but you can also automate this using PowerShell with the Microsoft Graph Module. From all users, you can see that I have 2007 users right now. Now, remember that number because we’ll come back to it. -Next, using the manage view control, I’ve added a column to my view with last interactive sign-in time so I can see how long it’s been since each account has signed in. From there, I can create a filter using that property with an operator here of less than or equal to, and I’ll go ahead and choose a time, I’ll go back about eight months ago, and then I’ll apply the filter. That narrowed my list down to 27 accounts, so now I’ll hit download users to export a CSV file with their details, which is an Excel file that starts out looking like this. Now, to save time, you’ll see that I’ve removed user principal names that I don’t want to delete. In my case, that was the meeting room accounts only. And for this to work, I needed to delete all other columns and to add a version number using this format here with the colon. In the second field, I use this exact string. User, space, name, space, userPrincipalName in square brackets. Then under that, I have my chosen UPNs listed that I want to delete. -Now, moving back to the admin center, once I have that final list of items that I want to delete, I’ll use Bulk operations and select Bulk delete. And then for the sale accounts, all I need to do is upload my CSV file that we just saw. There it is. Now I need to type yes here, and then confirm and submit. And that takes a moment to run. And you’ll see that it succeeded. Now, when I refresh the list, you’ll see that only my meeting rooms are still here. The blank lines are actually deleted. Because they matched my filter, they’re still there. And if I remove the filter, you’ll see that my user count is now 1985 or 22 fewer than before. And just in case you accidentally delete a user that you didn’t want to delete, from the deleted users, you can actually recover those accounts for up to 30 days. -So, next, let’s move on to Microsoft 365 group sprawl. These groups are typically created by users so they can quickly sprawl and pose a similar risk, especially when users with basic password auth might have persistent access to the resources from that group, or if those groups have standing access for external user accounts. Here, to help control sprawl, you can set up group lifetime policies for a number of days. By default, there are options for 180, 365, and custom. I’ll choose 180. In this case, the group owners are sent an email notification at 30 days, 15 days, and one day prior to group expiration, where they can choose to renew the impacted groups or just let them go. Now, if left unrenewed, those groups will be deleted along with associated content in Outlook, SharePoint, Teams and Power BI. In this field, you’ll add an email address for groups with no owners. -And finally, you’ll choose which Microsoft 365 groups to enable for these automatic expiration controls, either all groups or using the selected option, you’ll then be able to choose exactly each of the groups that you want to have added to this policy, or you can choose none, which will effectively disable the policy. So, in my case, I’ll keep all and then I’ll hit save. Like user accounts, groups have 30 days of grace prior to permanent deletion, and you or the group owner can restore them. -We’ve covered two main areas of identity sprawl, and the third common category we’ll cover today is devices. For this, before you just start deleting devices, you’ll need to prevent your users or yourself even from getting locked out. This is because Microsoft Entra-joined physical Windows devices are often the ones that you own and manage. Their associated BitLocker keys used to encrypt and unencrypt the local drives are stored in Microsoft Entra and accessible through their device properties, which acts as an insurance policy in case, for whatever reason, you get locked out. Likewise, local administrator passwords can be maintained here, too. So, for Windows devices, unless you’re sure, don’t delete them. Otherwise, deleting Windows devices or other registered device platforms follows roughly the same process that I showed for users and groups with one important exception. Deletion in this case is permanent. There’s not a recycle bin or 30 days grace to undelete those devices. -Implementing the tips that I’ve shown today will help improve your identity posture, and help contain identity sprawl. Now, the latter helps keep your users, groups, and devices more manageable and reduces risk associated with stale objects in your directory. To learn more, check out aka.ms/microsoftEntraRecommendations. And be sure to subscribe to Microsoft Mechanics for latest updates and thanks so much for watching.Continuing with Microsoft Entra: Advanced Identity Management
In the previous blog Microsoft Entra Admin Center - Secure, Protect, & Manage, we explored the capabilities of the Microsoft Entra Admin Center, focusing on how it helps secure, protect, and manage your organization's identities and access. Building on that foundation, let's dive deeper into the advanced features and functionalities of Microsoft Entra ID, formerly known as Azure Active Directory, to further enhance your identity and access management strategy. Advanced Identity Management with Microsoft Entra ID Microsoft Entra ID offers a comprehensive suite of tools designed to streamline identity management in the cloud. Here are some key features that can help you take your organization's security to the next level: Conditional Access Policies Conditional access is a pivotal feature that allows you to enforce access controls based on specific conditions. By setting policies that consider user location, device state, and risk level, you can ensure that only authorized users gain access to sensitive resources. To learn more about Conditional Access click here: What is Conditional Access in Microsoft Entra ID? - Microsoft Entra ID | Microsoft Learn Identity Protection With the P2 plan, Microsoft Entra ID provides advanced identity protection capabilities. This includes risk-based conditional access, which assesses the likelihood of a user being compromised and adjusts access policies accordingly. It also offers tools to detect and remediate identity-based risks. To learn more about Identity Protection click here: What is Microsoft Entra ID Protection? - Microsoft Entra ID Protection | Microsoft Learn Privileged Identity Management (PIM) PIM helps you manage, control, and monitor access to important resources within your organization. By providing just-in-time privileged access and requiring approval for elevated roles, PIM reduces the risk of security breaches. To learn more about PIM click here: What is Privileged Identity Management? - Microsoft Entra ID Governance | Microsoft Learn Seamless Integration with Cloud Applications Microsoft Entra ID integrates seamlessly with a wide range of cloud applications, providing single sign-on (SSO) capabilities. This not only enhances user experience by reducing the number of login prompts but also improves security by centralizing authentication. To learn more about SSO click here: Microsoft Entra Connect: Seamless single sign-on - Microsoft Entra ID | Microsoft Learn Extending On-Premises Directories to the Cloud For organizations with existing on-premises Active Directory environments, Microsoft Entra Domain Services offers a bridge to the cloud. This service provides managed domain services such as domain join, group policy, and LDAP, enabling you to extend your on-premises directory to Azure without the need to manage domain controllers. To learn more about Microsoft Entra Domain Services click here: Overview of Microsoft Entra Domain Services - Microsoft Entra ID | Microsoft Learn Comparing Microsoft Entra ID Plans Understanding the differences between the P1 and P2 plans is crucial for selecting the right solution for your organization: P1 Plan: Ideal for organizations that need basic identity and access management features, including conditional access and self-service password reset. P2 Plan: Suited for organizations requiring advanced security features such as identity protection and privileged identity management. Optimizing Permissions Management Permissions management is crucial for maintaining a secure and efficient IT environment. Microsoft Entra provides tools to optimize permissions: Permission Insights: Gain visibility into who has access to what resources and identify any unnecessary permissions. Automated Permission Management: Automatically adjust permissions based on user roles and activities, ensuring that users only have access to what they need. Audit Logs: Keep track of all permission changes and access requests to maintain a clear audit trail. To learn more about Microsoft Entra Permissions Management click here: What is Microsoft Entra Permissions Management - Training | Microsoft Learn Ensuring Global Secure Access In today's remote work environment, secure access to resources is more important than ever. Microsoft Entra's Global Secure Access features include: Secure Remote Access: Set up secure connections for remote users, ensuring they can access the necessary resources without compromising security. Application Management: Manage and secure access to both cloud and on-premises applications. Network Security: Implement network security measures to protect your organization's data and resources from external threats. To learn more about Global Secure Access click here: What is Global Secure Access? - Global Secure Access | Microsoft Learn Conclusion Microsoft Entra ID is a powerful tool that provides robust identity and access management capabilities for both cloud and hybrid environments. By leveraging its advanced features, you can enhance your organization's security posture and streamline access management processes. For more information on this topic and to expand your knowledge, please check out Understand Microsoft Entra ID - Training | Microsoft Learn.Enabling Self-Service Password Reset for Your Organization
What Is SSPR? It is a frigid February morning. The time is approximately 6:30 AM. Your morning cup of joe is interrupted by an urgent call from your system administrator Jonathan. He informs you about a suspicious email incident over the weekend that potentially impacted numerous employees. He suggests resetting all passwords to reduce any potential impact after handling most of the preliminary measures. Jonathan is thinking about enabling Self-Service Password Reset (SSPR) to maximize time and efficiency. SSPR allows organizations to members to reset their own password. In this blog we will cover a useful feature that can be enabled in your Microsoft Entra Admin Center. Naturally, this blog assumes that you have not enabled this feature as you are just getting started. However, I do suggest looking into the links below for a deeper dive. Navigating to Microsoft Entra Admin Center First, before beginning to enable this feature, make sure to have your admin credentials handy. You must have the appropriate administrative role and access. Lastly, if you want to enable this policy for on-premises integration. You will need to set up a sync engine to be connected to your account. Please see the following link to learn more: Enable Microsoft Entra password writeback - Microsoft Entra ID | Microsoft Learn. Let us continue to the login page. Sign In Navigate to the following website https://entra.microsoft.com. Using your administrative credentials type in your “Username and Password.” If you have forgotten your password, click on “Forgot my password” then follow the prompts accordingly. You will be prompted to authenticate using your phone via the “Microsoft Authentication app.” After you sign in, you'll arrive at the Microsoft Entra Admin Center Home directory. From there, we'll guide you through the process of enabling the feature, one step at a time. Enabling SSPR In the home screen, select the “Protection” tab in the left-hand menu, then click “Password reset.” The first menu item is “Properties” on the right side you will see “Self-service password reset enabled.” Select between three options: None: No users within the organization selected for reset (this is selected by default if never enabled). Selected: Select the Microsoft groups within your organization to apply for self-reset. All: Apply for all users within the organizations for self-reset. Select one then click the “Save” button. Now that SSPR is enabled, you will see “Forgot my password” based on the option you selected. If all options were chosen, all members would see it; otherwise, it will be visible according to the groups you specified. This allows the Systems admin to send just one email to reset their passwords. Conclusion Moving forward, this policy aims to enhance self-sufficiency and improve security measures. By enabling Self-Service Password Reset (SSPR), organizations can streamline password management, lighten IT support loads, and boost security. Users can reset their passwords quickly and securely keeps productivity high and mitigates risks associated with forgotten credentials. Monitor its effectiveness and adjust settings as needed to meet your organization's unique needs and security standards. Hyperlinks License self-service password reset - Microsoft Entra ID | Microsoft Learn Enable Microsoft Entra password writeback - Microsoft Entra ID | Microsoft Learn Self-service password reset deep dive - Microsoft Entra ID | Microsoft Learn Microsoft Entra Admin Center - Secure, Protect, & Manage | Microsoft Community HubManagement Made Simple with Administrative Units - Microsoft Entra ID
Microsoft Entra ID, formerly known as Azure Active Directory, is a part of Microsoft Entra that manages both internal and external resources for your organization. These resources can reside in your Azure subscription or within your Microsoft 365 Tenant. Consequently, Entra ID assists IT administrators in managing who requires access to these resources. Organizations have the option to choose from three plans: Free, Microsoft Entra ID Plan 1, and Microsoft Entra ID Plan 2. Microsoft Entra ID is accessible through the Azure portal and the Microsoft Entra Admin Center, respectively. Additionally, within the Microsoft Entra Admin Center under Identity, you can manage devices, create lifecycle workflows, handle app resignations, and much more. In this lesson, we will learn about Administrative Units and how they can be utilized to manage your administrative staff within your organization. For license information please see a brief description on the different plans. However, you can learn more about the features here: Microsoft Entra Plans and Pricing | Microsoft Security. License Information: Microsoft Entra ID Free: Provides user and group management. Offers on-premises directory synchronization. Includes basic reports. Allows self-service password change for cloud users. Supports single sign-on across Azure, Microsoft 365, and many popular SaaS apps. Microsoft Entra ID Plan 1: Includes all features of the Free plan. Allows hybrid users to access both on-premises and cloud resources. Supports advanced administration, such as dynamic groups, self-service group management, Microsoft Identity Manager, and cloud write-back capabilities for self-service password reset for on-premises users. Microsoft Entra ID Plan 2: Includes all features of the Free and Plan 1. Offers Microsoft Entra ID Protection for risk-based Conditional Access to apps and critical company data. Provides Privileged Identity Management to discover, restrict, and monitor administrators and their access to resources, and to provide just-in-time access when needed. Microsoft Entra Role Based Access Control (RBAC) Microsoft Entra ID allows for access control to be limited for Administrators if you do not need them to have tenant level administrative access. Restricting access to only what is necessary is crucial to abide the least privilege principle. This principle ensures that administrators have only the permissions necessary to perform their tasks, minimizing the risk of unauthorized access. For example, if you have external collaborations from a consultant who performs helpdesk tasks for only certain permissions to perform their duties. If needed, you can also build custom roles. However, most built-in roles can cover most use cases. Auditing administrative units involves monitoring and reviewing the activities within these units to ensure compliance with organizational policies and security standards. External Partner Delegation You can also delegate external partner to provision and deploy services on your behalf. Organizational Global and Billing Administrators can agree to external partnership agreements for Microsoft Partners. Microsoft Solution Partners (MSP) can provide a wide variety of services. You will have to sign partner agreement authorizing the partner to provide services on your behalf. Depending on the partner will on the scope of work. You can find a Microsoft Certified Solutions Partner here: Find the right app | Microsoft AppSource. Partners will send an email that will establishes a connection to your accounts. You can find this agreement in Microsoft Entra Admin Center & Microsoft Entra Admin Center. To see your partnership relationship follow the instructions below: Microsoft 365 Admin Center - Partnership Relationship Navigate to Microsoft 365 Admin Center: https://admin.microsoft.com/. Login with your Administrative Username and Password. Authenticate with the Microsoft Authentication App when prompted. In the left-hand menu locate and click on the Show all tab. Select the Settings tab, then click on Partnership relationships. Microsoft Entra Admin Center - Delegated Admin Partners Navigate to Microsoft Entra Admin Center: https://entra.microsoft.com/. Login with your Administrative Username and Password. Authenticate with the Microsoft Authentication App when prompted. In the home directory, in the left-hand menu click on the Identity tab. Next, select Roles & Admins, then click on Delegated admin partners. In both areas, you will be able to view the active relationship with your partner, including the specific type of partnership they have with your organization. It is advisable to consult your partner for detailed information regarding your partnership agreement before making any decisions to cancel or delete the partnership. Additionally, it is common practice to create an administrative unit for managing external partners, guests, and similar entities. This ensures that all external relationships are organized and managed efficiently. What is Administrative Units? Microsoft Entra ID Administrative Units are specialized containers within the Microsoft Entra ID environment designed to help you efficiently organize and manage users, groups, and devices. These units enable you to delegate administrative tasks to specific segments of your organization, ensuring that permissions are confined to a well-defined scope. This functionality is particularly beneficial for IT professionals, as it provides numerous use cases for delegating tasks, thereby enhancing operational efficiency and security. Administrative Units Use Cases To learn how implementation works within Microsoft Entra. An understanding of common scenarios for using administrative units below: Delegating Administrative Tasks: Administrative units allow you to delegate administrative tasks to specific segments of your organization. For example, you can delegate the Helpdesk Administrator role to regional support specialists, enabling them to manage users only in the region they support. Restricting Permissions: Administrative units help in restricting permissions to a defined scope. This is particularly useful in large organizations where different departments or regions need to manage their own resources without affecting others. Managing Users, Groups, and Devices: Administrative units can contain users, groups, or devices, making it easier to manage these resources within a specific scope. For instance, you can create an administrative unit for a particular department and manage all users, groups, and devices within that department. Implementing Least Privilege Access: By using administrative units, you can implement least privilege access, ensuring that administrators have only the permissions necessary to perform their tasks. This enhances security by minimizing the risk of unauthorized access. Organizing by Geography or Division: Administrative units can be used to organize resources by geography or division. For example, you might add users to administrative units based on their location (e.g., "Seattle") or department (e.g., "Marketing"), allowing for more granular management. Managing Properties of Groups: Adding a group to an administrative unit brings the group itself into the management scope of the administrative unit. This allows administrators to manage properties of the group, such as group name or membership, without affecting the individual members of the group. Setting Policies at a Granular Level: Administrative units enable central administrators to set policies at a granular level. For example, in a large university with multiple autonomous schools, each school can have its own administrative unit with specific policies tailored to its needs. Conclusion In conclusion, Microsoft Entra ID Administrative Units offer a robust framework for managing user access and permissions within your organization. By leveraging these units, you can enhance security, improve efficiency, and maintain flexibility in your administrative tasks. Additionally, you have also learned how Administrative Units can be leveraged to manage external partners. Explore the possibilities and unlock the full potential of Microsoft Entra ID today! Hyperlink Administrative units in Microsoft Entra ID - Microsoft Entra ID | Microsoft Learn Overview of Microsoft Entra role-based access control (RBAC) - Microsoft Entra ID | Microsoft Learn Manage Microsoft-certified solution provider partner relationships | Microsoft Learn Find the right app | Microsoft AppSource
