Edit

Share via

Configure Microsoft Entra for increased security (Preview)

In Microsoft Entra, we group our security recommendations into several main areas. This structure allows organizations to logically break up projects into related consumable chunks.

Tip

Some organizations might take these recommendations exactly as written, while others might choose to make modifications based on their own business needs. In our initial release of this guidance, we focus on traditional workforce tenants. These workforce tenants are for your employees, internal business apps, and other organizational resources.

We recommend that all of the following controls be implemented where licenses are available. These patterns and practices help to provide a foundation for other resources built on top of this solution. More controls will be added to this document over time.

Protect identities and secrets

Reduce credential-related risk by implementing modern identity standards.

Check Minimum required license
Applications don't have client secrets configured None (included with Microsoft Entra ID)
Service principals don't have certificates or credentials associated with them None (included with Microsoft Entra ID)
Applications don't have certificates with expiration longer than 180 days None (included with Microsoft Entra ID)
Application Certificates need to be rotated on a regular basis None (included with Microsoft Entra ID)
Enforce standards for app secrets and certificates None (included with Microsoft Entra ID)
Microsoft services applications don't have credentials configured None (included with Microsoft Entra ID)
User consent settings are restricted None (included with Microsoft Entra ID)
Admin consent workflow is enabled None (included with Microsoft Entra ID)
High Global Administrator to privileged user ratio None (included with Microsoft Entra ID)
Privileged accounts are cloud native identities None (included with Microsoft Entra ID)
All privileged role assignments are activated just in time and not permanently active Microsoft Entra ID P2
Passkey authentication method enabled None (included with Microsoft Entra ID)
Security key attestation is enforced None (included with Microsoft Entra ID)
Privileged accounts have phishing-resistant methods registered Microsoft Entra ID P1
Privileged Microsoft Entra built-in roles are targeted with Conditional Access policies to enforce phishing-resistant methods Microsoft Entra ID P1
Require password reset notifications for administrator roles Microsoft Entra ID P1
Block legacy authentication Microsoft Entra ID P1
Temporary access pass is enabled Microsoft Entra ID P1
Restrict Temporary Access Pass to Single Use Microsoft Entra ID P1
Migrate from legacy MFA and SSPR policies Microsoft Entra ID P1
Block administrators from using SSPR Microsoft Entra ID P1
Self-service password reset doesn't use security questions Microsoft Entra ID P1
SMS and Voice Call authentication methods are disabled Microsoft Entra ID P1
Secure the MFA registration (My Security Info) page Microsoft Entra ID P1
Use cloud authentication Microsoft Entra ID P1
All users are required to register for MFA Microsoft Entra ID P2
Users have strong authentication methods configured Microsoft Entra ID P1
User sign-in activity uses token protection Microsoft Entra ID P1
Microsoft Authenticator app shows sign-in context Microsoft Entra ID P1
Microsoft Authenticator app report suspicious activity setting is enabled Microsoft Entra ID P1
Password expiration is disabled Microsoft Entra ID P1
Smart lockout threshold set to 10 or less Microsoft Entra ID P1
Smart lockout duration is set to a minimum of 60 Microsoft Entra ID P1
Add organizational terms to the banned password list Microsoft Entra ID P1
Require multifactor authentication for device join and device registration using user action Microsoft Entra ID P1
Local Admin Password Solution is deployed Microsoft Entra ID P1
Entra Connect Sync is configured with Service Principal Credentials None (included with Microsoft Entra ID)
No usage of ADAL in the tenant None (included with Microsoft Entra ID)
Block legacy Azure AD PowerShell module None (included with Microsoft Entra ID)
Enable Microsoft Entra ID security defaults None (included with Microsoft Entra ID)

Protect tenants and isolation production systems

Check Minimum required license
Permissions to create new tenants are limited to the Tenant Creator role None (included with Microsoft Entra ID)
Guest access is limited to approved tenants Microsoft Entra ID Free
Guests are not assigned high privileged directory roles Microsoft Entra ID Free
Microsoft Entra ID P2 or Microsoft ID Governance for PIM
Guests can't invite other guests Microsoft Entra ID Free
Guests have restricted access to directory objects Microsoft Entra ID Free
App instance property lock is configured for all multitenant applications Microsoft Entra ID Free
Guests don't have long lived sign-in sessions Microsoft Entra ID P1
Guest access is protected by strong authentication methods Microsoft Entra ID Free
Microsoft Entra ID P1 recommended for Conditional Access
Guest self-service sign-up via user flow is disabled Microsoft Entra ID Free
Outbound cross-tenant access settings are configured Microsoft Entra ID Free
Microsoft Entra ID P1 recommended for Conditional Access
Guests don't own apps in the tenant None (included with Microsoft Entra ID)
All guests have a sponsor Microsoft Entra ID Free
Inactive guest identities are disabled or removed from the tenant Microsoft Entra ID Free
All entitlement management policies have an expiration date Microsoft Entra ID P2 or Microsoft ID Governance for entitlement managed and access reviews
All entitlement management assignment policies that apply to external users require connected organizations Microsoft Entra ID P2 or Microsoft ID Governance for entitlement managed and access reviews
All entitlement management packages that apply to guests have expirations or access reviews configured in their assignment policies Microsoft Entra ID P2 or Microsoft ID Governance for entitlement managed and access reviews
Manage the local administrators on Microsoft Entra joined devices None (included with Microsoft Entra ID)

Protect networks

Protect your network perimeter.

Check Minimum required license
Named locations are configured Microsoft Entra ID P1
Tenant restrictions v2 policy is configured Microsoft Entra ID P1

Protect engineering systems

Protect software assets and improve code security.

Check Minimum required license
Emergency access accounts are configured appropriately Microsoft Entra ID P1
Global Administrator role activation triggers an approval workflow Microsoft Entra ID P2
Global Administrators don't have standing access to Azure subscriptions Microsoft Entra ID P2
Creating new applications and service principals is restricted to privileged users Microsoft Entra ID P1
Inactive applications don't have highly privileged Microsoft Graph API permissions Microsoft Entra ID P1
Inactive applications don't have highly privileged built-in roles Microsoft Entra ID P1
App registrations use safe redirect URIs Microsoft Entra ID P1
Service principals use safe redirect URIs Microsoft Entra ID P1
App registrations must not have dangling or abandoned domain redirect URIs Microsoft Entra ID P1
Resource-specific consent to application is restricted Microsoft Entra ID P1
Workload Identities are not assigned privileged roles Microsoft Entra ID P1
Enterprise applications must require explicit assignment or scoped provisioning Microsoft Entra ID P1
Limit the maximum number of devices per user to 10 None (included with Microsoft Entra ID)
Conditional Access policies for Privileged Access Workstations are configured Microsoft Entra ID P1

Monitor and detect cyberthreats

Collect and analyze security logs and triage alerts.

Check Minimum required license
Diagnostic settings are configured for all Microsoft Entra logs Microsoft Entra ID P1
Privileged role activations have monitoring and alerting configured Microsoft Entra ID P2
Privileged users sign in with phishing-resistant methods Microsoft Entra ID P1
All high-risk users are triaged Microsoft Entra ID P2
All high-risk sign-ins are triaged Microsoft Entra ID P2
[All risky workload identities are triaged]
All user sign-in activity uses strong authentication methods Microsoft Entra ID P1
High priority Microsoft Entra recommendations are addressed Microsoft Entra ID P1
ID Protection notifications enabled Microsoft Entra ID P2
No legacy authentication sign-in activity Microsoft Entra ID P1
All Microsoft Entra recommendations are addressed Microsoft Entra ID P1

Accelerate response and remediation

Improve security incident response and incident communications.

Check Minimum required license
Workload identities based on risk policies are configured Microsoft Entra Workload ID
Restrict high risk sign-ins Microsoft Entra ID P2
Restrict access to high risk users Microsoft Entra ID P2

Related content