Entra ID Device Join Types define the relationship between a device and your organization. Different join types give different levels of trust, control, and access. There are three: Entra Joined,…
Part 9 covered the basic PIM flow: configure role → assign Eligible → user activates → admin removes when done. This guide adds two layers: An approval workflow — the…
Privileged Identity Management (PIM) flips the assumption about admin access. Instead of “users with admin roles always have admin powers”, it’s “users are eligible for admin roles, and must activate…
Sometimes the right policy is just block — not “require MFA,” not “require compliant device,” but a hard no. Common scenarios: an IP range tied to a known-malicious VPN, a…
Microsoft’s number-one recommended baseline Conditional Access policy is require MFA for any administrator. The premise is simple: admin accounts have the keys to the kingdom — if an attacker phishes…
Entra ID monitoring splits into two distinct surfaces: Audit Logs (changes — who did what to your tenant) and Sign-in Logs (access — who got in, from where, with what…
Passwordless authentication via Microsoft Authenticator turns the user’s phone into a phishing-resistant credential. The login flow becomes: type email → phone gets a notification → user types a 2-digit number…
SMS-based sign-in lets a user log in to Microsoft 365 by typing their phone number as their username and receiving a 6-digit code by text — no password, no UPN.…
A Temporary Access Pass (TAP) is a time-limited passcode an admin issues to a user that lets them sign in without their password or existing MFA. Two main use cases:…
Per-user MFA is the legacy way to enable MFA in Microsoft Entra ID — Microsoft now recommends Conditional Access for new tenants, but per-user MFA is still useful for existing…
Two ways to assign Microsoft Entra admin roles to a user. Method 1 is role-first — pick a role, add users to it. Method 2 is user-first — pick a…
Microsoft Entra Connect uses three different service accounts, each in a different place. When troubleshooting permission errors or stuck syncs, knowing which account does what — and where to look…
