Checklists · 2026-09-19

Microsoft Entra ID hardening checklist

Download as Markdown

Before you change anything

• Review the sign-in logs for legacy authentication and list every account and device still using it
• Identify service accounts, printers and applications on POP, IMAP, SMTP AUTH or Exchange ActiveSync with basic auth
• Move those senders onto dedicated accounts or a proper SMTP relay before anything is blocked
• Keep Security Defaults enabled if the tenant needs no exceptions
• Build Conditional Access policies in report-only mode first where exceptions are required

Break-glass accounts

• Create two cloud-only Global Administrator accounts in the .onmicrosoft.com domain, not synced from on-premises Active Directory
• Exclude both from every Conditional Access policy, including the MFA ones
• Use long random passwords, stored offline and physically, split so no one person holds a whole credential
• Alert on any sign-in to either account
• Test both accounts on a schedule

Block legacy authentication

• Create a Conditional Access policy targeting All users
• Set client apps to Exchange ActiveSync clients and Other clients
• Set the access control to Block
• Exclude the two break-glass accounts from the policy
• Confirm in the sign-in logs that legacy protocol traffic has stopped

Multi-factor authentication

• Manage every MFA setting in the converged Authentication methods policy
• Enforce MFA for administrators first, through Conditional Access rather than the per-user MFA toggles
• Extend the MFA requirement to All users
• Set FIDO2 security keys, passkeys or Windows Hello for Business as the primary method
• Turn on number matching and additional context for Microsoft Authenticator
• Keep SMS and voice calls as fallback methods only

Administrator and user privilege

• Reduce Global Administrators to fewer than five
• Assign the least-privileged role that does the job: Helpdesk Administrator, User Administrator, Exchange Administrator, Security Reader or Global Reader
• Turn on Privileged Identity Management so privileged roles are eligible rather than permanent, where Entra ID P2 is licensed
• Set Users can register applications to No
• Set Restrict access to the Microsoft Entra admin centre to Yes, treating it as tidiness rather than a security boundary
• Decide deliberately on who may create security groups and Microsoft 365 groups
• Restrict user consent for applications and enable the admin consent workflow
• Set Guest user access to the most restrictive option and restrict who may invite guests
• Review guests regularly and expire them with access reviews where the licensing allows
• Roll the AZUREADSSOACC Kerberos decryption key every 30 days wherever that computer account exists in Active Directory
• Exclude privileged on-premises accounts from directory synchronisation

Logging and rollout

• Route sign-in and audit diagnostic settings to a Log Analytics workspace, a storage account or a SIEM
• Keep the logs for as long as the organisation's obligations require, set up before an incident rather than during one
• Require MFA on sign-in risk at medium and above, where Entra ID P2 is licensed
• Require a secure password change on user risk at high, where Entra ID P2 is licensed
• Run every new policy in report-only mode and read the impact before enabling it
• Confirm the break-glass exclusions survived each policy change

Frequently asked questions

What should I do first when taking over an Entra ID tenant?

Create two cloud-only break-glass Global Administrator accounts before changing anything else, then block legacy authentication, then enforce MFA. Break-glass accounts come first because a Conditional Access policy can lock out every administrator including the person who wrote it. The full order is in our walkthrough of securing a tenant.

Why block legacy authentication before enforcing MFA?

Legacy protocols such as POP and IMAP cannot present a second factor, so they bypass MFA rather than failing it. Until legacy auth is blocked with a Conditional Access policy targeting Exchange ActiveSync clients and Other clients, an MFA requirement is not actually enforced.

How many Global Administrators should a tenant have?

Fewer than five, per Microsoft's guidance. Everyone else gets the least-privileged role that does their job. Global Reader is the read-only twin of Global Administrator and covers most of what people ask Global Administrator for.

Is Security Defaults enough on its own?

Security Defaults is a reasonable baseline for a tenant that needs no exceptions. Once the tenant needs exceptions, move to Conditional Access and build the policies in report-only mode first, because Security Defaults and Conditional Access cannot both be on.