Microsoft 365 & Entra ID
Zero Trust Hardening

Engagement Overview

Executive Summary

The organization had a standard Microsoft 365 deployment with no meaningful identity security controls. MFA was enabled for approximately 40% of users via the legacy per-user toggle, but was not enforced via policy — meaning users could skip registration indefinitely. Legacy authentication protocols (Basic Auth, IMAP, POP3) remained active, providing a direct MFA bypass path since these protocols don't support modern authentication.

Four users held Global Admin privileges using their daily-driver accounts with shared credentials. This configuration represented a critical identity-based attack surface. A credential phishing campaign or password spray would likely succeed — and with no MFA enforcement and active legacy auth, an attacker would gain full mailbox and potentially tenant-wide access without triggering a second factor.

The Zero Trust project addressed these risks through MFA enforcement via Conditional Access, deployment of 12 CA policies for risk-based access control, complete blocking of legacy authentication, admin account separation with Privileged Identity Management (PIM), and Intune device compliance enforcement — executed over four weeks with each CA policy deployed in report-only mode before enforcement.

Phase 1 — Tenant Assessment

MFA Enrollment Audit

Legacy Authentication Analysis

# PowerShell — Query legacy auth sign-ins from Entra ID logs
Connect-MgGraph -Scopes "AuditLog.Read.All"
Get-MgAuditLogSignIn -Filter "clientAppUsed eq 'Exchange ActiveSync' or clientAppUsed eq 'IMAP4' or clientAppUsed eq 'POP3' or clientAppUsed eq 'Other clients'" -Top 500

Key risk: Any user with an active legacy auth session could be compromised via phishing or password spray, and MFA would not protect them because the legacy protocol bypasses it entirely.

Privileged Account Audit

Phase 2 — MFA Enforcement

Authentication Method Policy

# Configure Authentication Methods Policy via Microsoft Graph
Update-MgPolicyAuthenticationMethodPolicy -AuthenticationMethodConfigurations @(
    @{
        Id = "MicrosoftAuthenticator"
        State = "enabled"
        IncludeTargets = @(@{ TargetType = "group"; Id = "all_users" })
    },
    @{
        Id = "Sms"
        State = "disabled"
    }
)

Phased MFA Enforcement

Phase 3 — Conditional Access Policy Deployment

All 12 policies were deployed using a staged approach: Report-Only (1 week) → Enforce with Exclusion Group (1 week) → Full Enforcement.

Conditional Access Policy Matrix

Phase 4 — Privileged Identity Hardening

Admin Account Separation

Privileged Identity Management (PIM)

PIM Workflow Example:
1. Admin needs to modify tenant-level setting
2. Admin signs into Entra ID with dedicated admin account
3. Admin requests PIM activation for Global Admin role
4. Admin provides MFA + written justification
5. Approval granted (or auto-approved for non-GA roles)
6. Role active for up to 8 hours, then automatically revoked
7. Full audit trail logged in Entra ID audit logs

Phase 5 — Device Compliance (Intune)

Compliance Policy Requirements

Metrics & Outcomes

Attack Scenario: Before vs. After

Scenario: Attacker sends phishing email with fake M365 login page to harvest credentials.

Findings & Remediation

MITRE ATT&CK Coverage

Tools Used

This write-up reflects a real-world engagement. Organization details have been anonymized. Security configurations and outcomes are based on actual deployment results.