Microsoft Entra ID Reviews

BDO is a network of firms and a firm is what we call a country. So, we are present in about 160 countries. I am involved in BDO Global, which is not really a firm in the sense that we don't deal directly with clients, but BDO Global hosts IT services for all those 160 countries. A couple of those solutions are a worldwide audit solution that our firms use for financial audits for customers. We have a globally running portal solution, which firms are using to collaborate with our customers directly. All these services are basically based on Azure AD for authentication and authorization. This has been a lifesaver for us, because BDO firms are legally independent, so, we don't have a single identity store worldwide, like other big companies potentially do. We created an IAM solution based on Azure AD that ties all 160 dispersed identity stores back into one. We use that to give access to our services that we run globally.

Azure AD doesn't really give you a version. You just need to take the version as-is because it is a service that Microsoft delivers as a SaaS service. So, we don't have a lot of influence over the version that we use.

Besides tying together all authentications for our 160 countries, it has also been instrumental in getting the collaboration going between our firm countries since normally they are quite isolated. Also, their IT firms are quite isolated. So, Azure AD has made sure that we can collaborate with each other in multiple different systems: the global portal, the Audit application, and Office 365. This allows us to collaborate closer together, even though we are still separated as different countries.

Because it is an identity store, it handles all our authentication. We also use it with a combination of conditional access, which is a way to limit people's authentication or authorization based on where they are, the compliance of their device, and on a whole bunch of other variables that we can set. So, it definitely has been influential as well on the security side. Because it is a SaaS, you have central management over that. You can see all the logins and get reports on who signs in from where. 

There is a lot of artificial intelligence in Azure AD that can monitor behavior of users. If users behave in a strange way, then the authentication can be blocked. For example, if you have a user logging in from China, but it looks like the same user is logging in from America just a few seconds apart. That is a seemingly risky behavior that Azure AD flags for you, then you can block that behavior or have the user provide you with a second factor of authentication. So, there are a lot of security features that come with Azure AD too.

We primarily use Microsoft Entra ID for application registration, especially for Software as a Service applications, which are prevalent in managing the power grid. These applications support various needs, such as managing contingent workers in our 24/7 operation. While we still utilize some on-premise applications, we prioritize cloud-based solutions for their high availability and accessibility. Furthermore, we are actively exploring B2B collaboration features in Entra ID to manage guest accounts, which offers significant cost savings on licensing and enhances ease of use for external users. Optimizing guest access privileges is a compelling business case for utilizing Entra ID effectively.

Microsoft Entra ID has helped by simplifying our management of permissions for APIs. We are not directly exposing credentials, as we use tokens instead. It has made management easier and more secure, especially in a multi-user environment.

The implementation of Microsoft Entra ID significantly improved secure access to applications and resources in our environment, primarily through the widespread use of single-sign-on. Managing API permissions became much easier, as application registration often involves calling an API to utilize services without directly exposing credentials, relying instead on token-based authentication. This streamlined approach benefits end-users by simplifying access while remaining transparent to them. Ultimately, my role focuses on ensuring a smooth and user-friendly experience, even if the underlying technology remains unseen by the end-users.

Our company strongly emphasizes passwordless authentication, primarily through device-bound passkeys in Microsoft Authenticator. While administrators with high-privileged accounts utilize YubiKeys and passwords for tasks like accessing Microsoft Graph, we are actively transitioning all other users towards passwordless methods such as Windows Hello biometrics. This approach streamlines authentication and enhances security. Though initial deployment in 2022 presented challenges due to hardware limitations and the lingering effects of the COVID-19 pandemic, the technology has significantly improved and provides a simple and effective user experience.

I rely on Microsoft Entra ID for syncing customers' on-premises Active Directory to the Microsoft 365 stack. I also use it for managing multi-factor authentication and other enterprise applications for our customers.

Microsoft is at the core of any customer I work with. Microsoft is the core of their identity, communication, and business applications. Microsoft acts as a one-stop shop for calling, meetings, collaboration, AI, and business applications like Dynamics 365 and Outlook. Many services are bundled, providing potential cost savings for organizations.

Conditional access is an additional feature of Entra ID. It allows organizations to say that these devices are allowed to connect without MFA or with MFA and meet certain compliance standards based on what is set in Intune. There are a lot of things that can prevent devices from connecting to your environment unless certain conditions are met. That is a big thing around the security of Entra ID.

It helps allow devices regardless of having an active VPN connection. You can enable your remote employees to access corporate resources without having massive security walls. It not only allows those devices to connect to the network seamlessly, it also allows them to connect securely. It is not that they have unfettered access to your network. You are securing things down where they are only allowed access to certain resources.

The implementation of device-bound passkeys in Microsoft Authenticator helps with phishing-resistant authentication. It helps ensure that every employee that you have is actually that person. It ensures that they are entering the PIN from their phone via the Microsoft Authenticator app and they are who they are. Even if their password is compromised, you still have another level of security for device access. It is not just access to a phone. They have to have pass lock screen access and access to the Microsoft Authenticator app to approve those notifications and type in that secondary code. Requiring a user to enter a two-digit code that is showing on their screen ensures only authorized access. It has been helpful in all cases. I deal with multiple customers, and most of them have hit security issues due to people pressing a random authentication key as approved, not knowing what they are pressing, even though they know it is an authentication prompt. Having that ensures that they are who they say they are.

This constant reauthentication to applications helps with organization security. We are not letting you sign in once and remain signed in for 30 days. If that device gets compromised, your corporate security is at risk. Lowering that authentication threshold to every 24 hours or 12 hours and making a user reauthenticating helps to make sure that they are who they are.

Token Replay detection has a big impact in terms of malware. Some people click on random PDFs in their email attachments and things get through. This is happening even at a larger scale, for example with Linus Tech Tips. Someone clicked an email, and they clicked an application that ran the machine and gathered every authentication token for everything the user had access to. They happen to have access to their YouTube account and other things without MFA. Being able to detect if a token is being reused potentially from another IP, with a snap of a finger, is a great feature. If a token is compromised, you can block it.

Since implementing Entra ID, identity-related security incidents have gone down drastically. 

We implement standardized conditional access policies for our customers using Microsoft Entra ID, mainly for security, governance, and conditional access. We also sync on-premises Active Directory accounts to Microsoft Entra ID to manage groups and Azure resources like Azure Virtual Desktop.

We started our journey with Entra from a security standpoint, using features like PIM and Microsoft Defender for Cloud. It has improved our security posture, especially in healthcare, where security is paramount. We have to ensure that our data is secure for HIPAA compliance. 

It improves our user account management and initial access. We can see a lot of stuff using Microsoft Lighthouse because we're an MSP, so we use Lighthouse to gain visibility into the tenants and accounts. We can dive into the financial side and get reports. It's highly granular and easier from an organizing standpoint.

We use the Microsoft security stack, including Defender, Purview, etc., so we get a security score and recommendations on ways to fill in the gaps. We get some ideas on how to tweak the Entra tenant or the environment better. But we're following Microsoft's guidelines with reporting or recommendations.

We implemented FIDO 2.08 for phishing resistance, so we use security keys like the UBP. We're passwordless now. It depends on our customers' licensing, such as whether they have an E1 or E3 or whichever Microsoft 365 license they have. We're moving them to a passwordless architecture or, at minimum, improving phishing resistance with an MFA authenticator. 

We primarily use Entra to monitor risky users or detect questionable sign-ons. We get alerts if a user logs in outside a trusted location or from a different IP address we don't recognize. We have recommendations or conditional access policies to detect or block risky sign-ons. 

We had more risky log-ins detected than normal, so we updated our conditional access policies to say that if we see more risky log-ins in the next 24 hours, we'll lock it down in the next 12 hours to fine-tune the conditional access policies and that kind of stuff. We're trying to standardize or make everything the same, depending on pricing or cost. We're trying to move everybody to the standard baseline for just what we try to deploy for the next of this year. 

It's had a tremendous impact on our security. We can set granular permissions and different levels of access for various teams. We can govern the Entra side of the house or the Azure public cloud side and other teams like marketing, HR, finance, or any of those groups as needed. 

Entra helps us advance our zero-trust strategy. We have to follow CIS standards and HIPAA because we're in healthcare and PCI DSS. We're implementing Microsoft's best practices for their security framework. It makes a big difference when we're deploying new infrastructure for new clients and everything.

It has allowed us to use other SaaS products that will authenticate with Office 365 as well as other Microsoft products and non-Microsoft products, so we can have a single sign-on experience for our users. Rather than them needing to have multiple usernames and passwords, they just use whatever they have as their main username and password to log onto their machine.

It is SaaS based, but we sync up from our on-prem into Azure AD.

With COVID-19 at the moment, this solution is a good example of where we needed to move a lot of our traffic from our on-prem authentication into the cloud. Last year, before I joined the company, we had to setup our VPN differently. It was easy enough for us to do because our machines were already joined to Azure AD. We just split the traffic and stopped having to rely on our on-prem VPN for our Office 365 traffic. We were just good to go into the Internet because we had all the features setup, e.g., MFA and Conditional Access, which made life a lot easier.

It has made our security posture better. There are always improvements to be made, but we feel more secure because of the way that things have been setup and how everything integrates together.

We are using Azure Active Directory (AD) for:

• Application authentication, which is single sign-on. 
• Multi-factor authentication (MFA). 
• Conditional access for people coming in from non-trusted networks, which are interlinked. 
• Azure AD B2B. 

These are the four big items that we are using.

The flexibility around accessing company systems from anywhere at any time has proven to be very helpful. Organizations decided during the COVID-19 pandemic, on a very short notice, to announce that everyone should be working from home. The good part was that our company was already working under Azure Active Directory, and most of our applications were under Azure at that time. For us, it was a very seamless transition. There were no major impacts on the migration nor did we have to do any special setups or need to configure networks. So, it was a very seamless experience for our users, who used to come into our office, to access systems. They started working from home and there was no difference for them. We did not have to do anything special to support that transition from working from the office to working from home. It was seamless. There was no impact to the end users.

Bringing our many hundreds of applications onto Azure Active Directory single sign-on authentication has had a big impact on users' productivity, usage, and adoption of enterprise applications because they don't need to log in. It is the same credentials and token being used for days and months when people use our systems with hundreds of applications being integrated. From a user perspective, it is quite a seamless experience. They don't need to remember their username, passwords, and other credential information because you are maintaining a single sign-on token. So, it is a big productivity enhancement. Before, we were not using a single sign-on for anything. Now, almost 90 to 95 percent of applications are on Azure Active Directory single sign-on.

We use Microsoft Entra ID for risk management of our users and compliance policies. We focus on automating processes, managing user identities, and placing them in appropriate groups with specific access roles. 

We do a lot of risk management for our users. We have a lot of compliance policies and custom assignments. We try to automate as much as possible. There are a lot of policies that take our users, identify where they should be, what back roles they should have, and put them where they need to be.

The management and risk assessments have become much easier. We can identify and address potential security threats quickly, especially given our mobile college student population. We have a lot of college students who are very mobile. It works with our CyFlare and security suite. This integration lets us know right away when we have somebody trying to impersonate. We get the notification right away. We can assess our risk factors and automatically put that user in a high-risk area. We can then initiate a contact to know what is going on. Are they in Mexico and Davenport, Iowa at the same time or did they put a VPN in?

We have a much better level of comfort. Everybody does not have admin rights. We need such a level of control considering the number of users that are out there. We had to get that in a bundle, and they have done a good job with that.

Microsoft Entra ID has allowed us to move forward with the zero-trust model. Unless you have control over your users and your authentication mechanisms, you have no control. It is our main portal coming into our security suite. They would not get to the security suite till they got through Microsoft Entra ID.

We have just stepped into the passkey. We like its simplicity. Our users are much happier that they are not thumbprinting, fingerprinting, and typing code numbers in. We are still a little leery, just because it could be a stolen device or stolen pass. Once they have that device in their hand, they are already halfway there. Between Entra ID, our policies and risk assessments, and the passkey system, we are on our way.

Implementing Microsoft Entra ID has not changed our organization's approach to defending against token theft and nation-state attacks a whole lot. Our security team has things locked down, and we have our network segmented, so you cannot jump. We do penetration testing almost daily. We have Entra ID and Defender. We monitor all that through API connections. We monitor any phishing and risk factors for our users and any anomalies in baselines.

So far, we find it working very well in terms of the detections, the risks, the events, and the logs that it sends us. Intercepting these attacks in the middle, seeing that the keys have been hit, and going into a more managed identity has helped. It gives us a feeling of security.

There has not been any reduction in the incidents. We have the same number of incidents, maybe an increase. However, we are catching them, and we know where they are coming from, so we can be more proactive instead of reactive.