# Microsoft Entra ID hardening checklist

## Before you change anything

- [ ] Review the sign-in logs for legacy authentication and list every account and device still using it
- [ ] Identify service accounts, printers and applications on `POP`, `IMAP`, `SMTP AUTH` or Exchange ActiveSync with basic auth
- [ ] Move those senders onto dedicated accounts or a proper SMTP relay before anything is blocked
- [ ] Keep `Security Defaults` enabled if the tenant needs no exceptions
- [ ] Build Conditional Access policies in `report-only` mode first where exceptions are required

## Break-glass accounts

- [ ] Create two cloud-only Global Administrator accounts in the `.onmicrosoft.com` domain, not synced from on-premises Active Directory
- [ ] Exclude both from every Conditional Access policy, including the MFA ones
- [ ] Use long random passwords, stored offline and physically, split so no one person holds a whole credential
- [ ] Alert on any sign-in to either account
- [ ] Test both accounts on a schedule

## Block legacy authentication

- [ ] Create a Conditional Access policy targeting `All users`
- [ ] Set client apps to `Exchange ActiveSync clients` and `Other clients`
- [ ] Set the access control to `Block`
- [ ] Exclude the two break-glass accounts from the policy
- [ ] Confirm in the sign-in logs that legacy protocol traffic has stopped

## Multi-factor authentication

- [ ] Manage every MFA setting in the converged `Authentication methods` policy
- [ ] Enforce MFA for administrators first, through Conditional Access rather than the per-user MFA toggles
- [ ] Extend the MFA requirement to `All users`
- [ ] Set FIDO2 security keys, passkeys or Windows Hello for Business as the primary method
- [ ] Turn on number matching and additional context for Microsoft Authenticator
- [ ] Keep SMS and voice calls as fallback methods only

## Administrator and user privilege

- [ ] Reduce Global Administrators to fewer than five
- [ ] Assign the least-privileged role that does the job: `Helpdesk Administrator`, `User Administrator`, `Exchange Administrator`, `Security Reader` or `Global Reader`
- [ ] Turn on Privileged Identity Management so privileged roles are eligible rather than permanent, where Entra ID P2 is licensed
- [ ] Set `Users can register applications` to `No`
- [ ] Set `Restrict access to the Microsoft Entra admin centre` to `Yes`, treating it as tidiness rather than a security boundary
- [ ] Decide deliberately on who may create security groups and Microsoft 365 groups
- [ ] Restrict user consent for applications and enable the admin consent workflow
- [ ] Set `Guest user access` to the most restrictive option and restrict who may invite guests
- [ ] Review guests regularly and expire them with access reviews where the licensing allows
- [ ] Roll the `AZUREADSSOACC` Kerberos decryption key every 30 days wherever that computer account exists in Active Directory
- [ ] Exclude privileged on-premises accounts from directory synchronisation

## Logging and rollout

- [ ] Route sign-in and audit diagnostic settings to a Log Analytics workspace, a storage account or a SIEM
- [ ] Keep the logs for as long as the organisation's obligations require, set up before an incident rather than during one
- [ ] Require MFA on sign-in risk at medium and above, where Entra ID P2 is licensed
- [ ] Require a secure password change on user risk at high, where Entra ID P2 is licensed
- [ ] Run every new policy in `report-only` mode and read the impact before enabling it
- [ ] Confirm the break-glass exclusions survived each policy change