Azure AD security: how to audit and harden what is now Entra ID

Microsoft renamed Azure Active Directory to Entra ID, but the security problems did not rename themselves. If you searched for Azure AD security, this page is for you: what to audit, the settings that matter most, and how to keep the tenant hardened after the audit is done.

Run a free Azure AD security scan

Azure AD is Entra ID now

Microsoft completed the rename in 2023: Azure Active Directory (Azure AD) became Microsoft Entra ID. Same directory, same tenants, same settings, new name. Every Azure AD security practice below applies unchanged to Entra ID, and our detailed hardening guidance lives in the Entra ID security best practices guide.

The Azure AD security audit checklist

These are the areas where our scans find real exposure in nearly every tenant, in the order an attacker would care about them:

MFA coverage, measured from the data. Not "does a policy exist" but which enabled users can still sign in with a password alone. Exclusions accumulate; verify coverage, not intent.
Conditional Access exclusions. Review every policy's exclusion list quarterly. Every exclusion needs a name, a reason, and an expiration.
Legacy authentication. Block it with Conditional Access and confirm in sign-in logs. SMTP AUTH basic still survives in most tenants and password spray targets it around the clock.
Privileged roles and PIM. Two to four human Global Administrators plus break-glass, everything else PIM-eligible instead of permanently active, no privileged roles on guest accounts.
App registrations and service principals. Inventory permissions, delete what nothing uses, replace client secrets with certificates or managed identities, rotate anything old.
User consent settings. Restrict user consent to applications and turn on the admin consent workflow; consent phishing walks straight past MFA.
Stale accounts and guests. Enabled accounts with no sign-in for 90 days are unmonitored attack surface. Disable or document every one.
Audit and sign-in log retention. Confirm retention actually covers your investigation window before you need it.

Each of these maps to checks in our engine and to the misconfigurations we catalog on the Microsoft 365 misconfigurations page, with CISA SCuBA control mappings on the SCuBA compliance page.

An audit is a snapshot. Azure AD keeps moving.

The uncomfortable part of Azure AD security is that the audit above starts going stale the day you finish it. Admins add exclusions under pressure, roles get granted during projects, Microsoft moves defaults. That decay is security drift, and the fix is not a bigger annual audit, it is continuous drift management: baseline the tenant, detect divergence as it happens, and close each gap while it is one item instead of a backlog. Senserva runs nearly 700 checks across Entra ID, Microsoft 365, Intune, and Defender continuously, with validated remediation for what it finds.

The seven Entra ID gaps we find in almost every tenant

These are not exotic. Across the tenants Senserva has audited, the same handful of gaps come back again and again, because each one is created by a reasonable decision that nobody revisited.

Legacy authentication still reachable

IMAP, POP, SMTP AUTH, and older Exchange endpoints bypass Conditional Access entirely, so an MFA policy you trust does not apply on the path attackers actually use. It is usually left on for one printer or one line-of-business app, and then forgotten for years.

Standing global administrators

Permanent admin rights are the single biggest blast-radius multiplier in Entra ID. Most tenants have more global admins than they can name, several of them people who needed the role once. Privileged Identity Management exists precisely so the role is held for an hour, not a year.

Guests who never left

Guest invitations have no natural end. A partner project finishes, the people move on, and the accounts stay with whatever group memberships they were given. Guests are also the population least likely to be covered by Conditional Access, which is exactly the combination in the conversation above.

Consent grants nobody reviewed

A user consenting to an app can hand it mailbox or file access without an admin ever seeing the request. The grant outlives the app, the project, and often the vendor. Illicit consent is one of the most common footholds in Microsoft 365 precisely because it looks like normal use.

App registrations with long-lived secrets

Client secrets and certificates that never expire, or expire in ten years, are credentials sitting in whatever pipeline or config file needed them. Expired secrets are noisy and get fixed; the dangerous ones are the working secrets nobody owns.

Break-glass accounts that are not ready

Every tenant should have emergency access accounts excluded from Conditional Access. Most either do not have them, or have them without alerting on their use, or have them with credentials nobody has verified since the day they were created. An untested break-glass account is a story you tell yourself.

Report-only policies that were never enforced

Conditional Access report-only mode is the right way to test a policy. It is also where policies go to die. A tenant with a careful policy set, half of it in report-only, is protected exactly as much as a tenant with no policy set.

Senserva evaluates every one of these against your real tenant, ranks them by what your logs show is actually happening, and hands you the fix with the control it satisfies. That is the difference between a checklist and an audit: every Conditional Access policy against every user, and the sign-in logs read next to the configuration.

Ask Claude what is wrong with your Entra ID, in plain language

Senserva ships a market-leading MCP, so Claude, or the AI you already use, can drive the whole product against your tenant: read the configuration, reason across it, and draft the fix. Identity questions are where it earns its keep, because the answer usually spans three consoles.

You can do exactly this today without registering: the MCP demo mode runs on the same sample data, no tenant and no key required.

You

Which of my users are not covered by any Conditional Access policy?

Fourteen. Eleven are guests from three partner domains, invited between March and June and never assigned a policy. Two are service accounts excluded from the MFA policy in 2024, and one is a break-glass account, which is correct. Nine of the fourteen have signed in from outside the United States in the last 14 days, and one of those has a mailbox forwarding rule to an external address.

You

That last one first. What can that account reach?

It is a member of two groups with SharePoint access to Finance and HR, and it holds a delegated Mail.ReadWrite grant from an app registration whose secret expired last month, so the app is failing but the grant remains. Three findings chain here: no Conditional Access coverage, an external forwarding rule, and a standing delegated grant. Senserva ranks the chain Critical, above 40 isolated Highs, because the logs show the sign-ins and the configuration shows the reach.

You

Draft the fix and show me what it changes.

Ready to review: a Conditional Access policy that covers all guests with MFA and a compliant-device requirement, the forwarding rule removed, and the stale grant revoked. Each one lists the users affected, the rollback, and the control it satisfies (SCuBA MS.AAD.1.1v1 and MS.EXO.4.1v1). Nothing runs until you approve it, and the next scan proves each gap closed.

Demonstration conversation against the built-in sample tenant, not live customer data.

Everything Claude and the Senserva MCP can do The SDK, for your own workflows

Frequently asked questions

Is Azure AD the same as Entra ID?

Yes. Microsoft renamed Azure Active Directory to Microsoft Entra ID in 2023. It is the same identity service; only the name and portal branding changed. Security guidance written for Azure AD applies to Entra ID.

How do I run an Azure AD security audit?

Work the checklist above: measure MFA coverage from sign-in data, review Conditional Access exclusions, confirm legacy authentication is blocked, inventory privileged roles and app permissions, and check stale accounts and log retention. Or run a scan: Senserva audits all of it in minutes and ranks what it finds by risk.

What are the most common Azure AD security mistakes?

Hollow MFA policies (broad exclusions), standing Global Administrator assignments instead of PIM, unrestricted user consent to applications, long-lived service principal secrets, and stale enabled accounts. None of them fire an alert, which is why they survive.

How often should Azure AD security be reviewed?

Continuously. A quarterly review leaves a full quarter for drift to accumulate unseen. Continuous monitoring produces a short list of fresh findings each cycle, each one minutes to fix because it is small and has an obvious owner.

Go deeper

Entra ID security best practices | Microsoft 365 misconfigurations | Security drift | One wrong click by an admin