Security and governance on Microsoft Azure

The Azure review covers the tenant and the subscriptions together, because most real incidents cross that line. Everything we report is exportable configuration you can reproduce.

• Export every Microsoft Entra ID privileged role assignment, including eligible and active assignments, service principals holding application permissions, and guest accounts with directory roles.
• Record which Microsoft 365 and Entra ID service plans are actually enabled per licence against the controls the target design requires, separating unused entitlement from a real gap.
• Take a baseline Microsoft Defender for Cloud secure score per subscription and list every exempted recommendation with its reason and approver.
• Run Microsoft Purview content discovery across SharePoint, OneDrive, Exchange and connected data sources to establish where sensitive information types actually appear.
• Measure Microsoft Intune enrolment and compliance coverage against the full device population that reaches corporate data, including personal and unmanaged devices.
• Assess the tenant and subscriptions against the Essential Eight maturity model, documenting the Azure and Microsoft 365 configuration evidence behind each rating.

Identity comes first, then platform guardrails, then edge protection. Each layer is deployed from a repository so the configuration is reviewable and repeatable across environments.

• Implement Privileged Identity Management for Entra ID directory roles and Azure resource roles with approval, justification, maximum activation duration and alerting on every activation.
• Configure Entra ID Governance access packages and scheduled access reviews so joiners, movers and leavers change entitlement through policy rather than through a service desk ticket.
• Build the conditional access policy set in report-only mode first, with named break-glass accounts excluded, monitored and periodically tested, then enforce by user wave.
• Apply Azure Policy initiatives at management group level for encryption, public network exposure, allowed regions and diagnostic settings, deployed from source control rather than clicked into the portal.
• Move keys, certificates and application secrets into Azure Key Vault behind managed identities and private endpoints, with rotation configured, then strip secrets from pipelines and configuration files.
• Place internet-facing applications behind Azure Web Application Firewall with rule sets tuned against real traffic, and enable Azure DDoS Protection on the virtual networks carrying public endpoints.

Detection content and governance artefacts are treated as products with owners and version history. Nothing depends on a configuration only one person remembers making.

• Connect Microsoft Defender XDR and Microsoft Defender for Cloud Apps so identity, endpoint, email and SaaS signal arrives in one incident queue with a single triage owner.
• Onboard only the data sources that support agreed detections into Microsoft Sentinel, holding analytics rules, watchlists and automation rules in a repository and deploying them through a pipeline.
• Apply Microsoft Purview sensitivity labels, data loss prevention policies and retention rules to the classification tiers agreed with data owners, starting with the two highest tiers and widening from there.
• Introduce Microsoft Security Copilot where it shortens hunting and incident write-ups, with a standing rule that an analyst reviews and owns its output before it reaches an incident record.
• Maintain a control library mapping Entra ID, Defender, Purview, Intune and Azure Policy configuration to Essential Eight and ISO 27001 control themes, so an assessor can trace a claim to a setting. We prepare you for assessment; the assessment itself is performed by an independent party.

Identity changes are the ones users feel, so they are rolled out in waves with a measured feedback loop. The service desk is trained before the first user is affected, not after.

• Release conditional access in waves by user population, watching sign-in failure patterns in the Entra ID sign-in logs and support ticket volume before each wave widens.
• Train the service desk on Privileged Identity Management activation, access package requests and Intune enrolment using the real screens, and give them a one-page decision guide.
• Pilot Purview labels with one department that handles genuinely sensitive material, then adjust the taxonomy based on what they tell you before wider release.
• Grant application owners scoped Microsoft Defender for Cloud access to their own subscription findings, with a short guide to which recommendation classes are mandatory before a release.
• Rehearse a break-glass sign-in and an Intune device wipe with the people who would actually perform them, and update the runbook from what went wrong in the rehearsal.

We keep the Microsoft control set current as the tenant changes and as Microsoft ships new capability. Work happens during agreed support hours with an escalation path you have reviewed.

• Report monthly on Microsoft Defender for Cloud secure score movement per subscription, Entra ID risky sign-in trend, and findings still open past their agreed age.
• Triage Microsoft Defender XDR and Microsoft Sentinel incidents against an agreed severity model, escalating through a named playbook with a documented fallback contact.
• Run quarterly Entra ID Governance access reviews and remove the assignments nobody re-justifies, recording the removals for the next assurance cycle.
• Keep Sentinel analytics rules, Azure Policy definitions and automation runbooks in version control, tested in a non-production scope before promotion.
• Review Sentinel ingestion by table each month and re-tier or retire high-volume low-value sources, with each decision recorded against the cost ceiling agreed at design time.
• Track Intune compliance and update ring health, and chase the device population that drifts out of policy before it becomes a conditional access lockout.