Microsoft Entra ID Protection Reviews

The primary use case for Entra ID Protection is to have control and proper naming conventions of all assets within my estate. It helps me control access, assign resource groups, better secure production environments, and be compliant.

The valuable features of Entra ID Protection include providing me visibility of my entire estate, managing access, and having a level of control. I use it to control and manage my assets, assign resources, and ensure compliance in my environments.

Just for authentication purposes. To authenticate other services on behalf of Microsoft.

We use Microsoft. Everyone uses Windows, and we collaborate on Teams. So sometimes it's necessary to use Microsoft. The only Microsoft features I use are logging in via Microsoft authentication or Microsoft Active Directory. 

We have a ton of services available, like Jenkins or Outline for documentation. It becomes difficult to manage users across all these services. If new developers are onboarded, someone has to add them to each service individually. So we've aligned with Microsoft Active Directory. We've integrated our other software with Microsoft, and we log into other software using Microsoft. That's very helpful. If someone leaves the company, we just block their Microsoft account. If someone joins, we just create their Microsoft account.

I am a Security Operations Center (SOC) analyst and manage Microsoft Entra ID for four clients. I act as an administrator for accounts, including Microsoft XDR, within my company.

For me, automatization is most valuable. Microsoft Entra ID can detect if a user is at risk and then execute actions based on the risk level. 

Additionally, it has a good scalability potential, allowing for the management of both small and large user bases efficiently.

The most valuable feature of the solution is the granular control of identity and access in terms of giving access based on additional context and authentication context. For example, the tool has conditional access policies, like identity protection, which is time-based access given to the administrators so that they can perform any administrative control or configuration that is time-bound, and it automatically expires according to that flow. There is also identity governance, so the tool has quite interesting identity-related features that are quite robust in protecting many enterprise client decisions.

So far, the tool has been good. I have dealt with our company's clients' technical and functional requirements. So far, the tool has always serviced all our needs, so I don't see any shortcomings in it.

The challenge in the tool was related to hybrid connectivity, like with Azure AD Connect, which I now think is Microsoft Entra ID's predecessor. Azure AD Connect was replaced by Microsoft Entra ID. There were many issues with the tool's sync process. During the configuration of networks, the process was quite resource-intensive. I think Microsoft understood the concerns of the users associated with the tool, and that is why it released a new kit into the block, like Microsoft Entra Cloud Sync, to replace its shortcomings. Microsoft Entra Cloud Sync is for enterprises that would love to have hybrid configurations.

Microsoft Entra ID Protection needs to offer better hybrid connectivity to users. There are two products under Microsoft Entra ID, which are like brothers or cousins, and I feel that matching them up should not be an uphill task for us, like when we have a scenario where we try to integrate with a tool from a different vendor through APIs and so many other configurations that need to be done. The tool can just unify and make the process as quick as possible with a few clicks to deal with the configuration.

I want the tool's licensing model to be made easier.

I primarily use Microsoft Entra ID Protection to manage identities for applications, including single sign-on capabilities for third-party and in-house applications. I leverage its features for conditional access and identity management.

I find the most valuable feature to be conditional access. It allows for comprehensive security controls, network security, and application label security. It enables me to set policies for signing security user sign-in risks and specific application access. 

Additionally, having a single sign-on feature with Entra ID ensures seamless access to various applications, even those with significant security constraints. Microsoft offers extensive use cases, including app security and IP restrictions, enhancing our overall enforcement capabilities.

We are using Azure AD for many purposes, such as DLP, multifactor authentication security, and linking it with Microsoft Office 365 into software distribution, configurations, and budgets.

A significant portion of my solutions still requires transitioning to the cloud. This is particularly common when attempting to migrate certain infrastructures and taking the initial steps toward adopting cloud technologies. Many companies, particularly those in the healthcare and energy sectors, require a hybrid approach that combines on-premise and cloud services to ensure data residency and meet their specific needs.

The vendor used for the cloud depends on the developer's requirements.

Azure AD offers a unified interface for efficiently managing user access. However, it is important to supplement it with other solutions for areas such as wireless and media communication, physical security, and similar aspects. Relying solely on the default configuration or base solution may not suffice for various requirements, necessitating the inclusion of additional components.

The unified interface provided by Azure AD positively impacts the consistency of the user's sign-on experience. It is possible to achieve this consistency across various platforms such as Google and Amazon. However, it is essential to consider that certain scenarios may require additional solutions that are specifically tailored to about twelve different brands or specialized functionalities like zero-trust or stability measures. These solutions should seamlessly integrate with the custom interfaces, such as SaaS platforms, that are already integrated with identity solutions. By connecting your Azure AD with these complementary solutions, you can effectively combine the three components and bridge the gap between the initial Microsoft solution and the specific requirements of your company and the service provider. It becomes evident that a comprehensive approach is necessary, going beyond the initial solution to meet all the necessary requirements.

The single pane of glass significantly influences the consistency of the security policies you enforce. To maintain compliance and ensure information security, it is necessary to implement frameworks like the seven-zero-one compliance framework. Regularly reviewing the security posture is crucial since circumstances evolve over time, and new threats emerge. It is imperative to continually enhance security tools and automate response mechanisms, allowing you more time to explore new security approaches and stay ahead of potential vulnerabilities.

The assessment of Azure AD's admin center for managing identity and access tasks in an organization is positive. It is considered a good tool that offers simplicity and is not overly complex. However, it requires the use of the Azure client and additional identity solutions for developers. The interface is well-designed and continuously evolving with frequent updates.

The assessment of the Azure AD admin center for managing all identity and access tasks in an organization is positive. It is considered to be a good tool that is user-friendly and not overly complex. However, it is important to utilize the Azure client and explore other identity options, especially for developers. The interface is well-designed, with frequent updates that require testing of previews to implement new solutions and improve the overall experience. In comparison to on-premise solutions, the admin center is much simpler, eliminating the need for multiple consoles and specialized configurations for each user.

The solution has significantly improved my organization by simplifying the configuration process, as now we only need to perform a single-user setup. In comparison to competitors, where user administration and onboarding used to be more complex, the process has become much simpler. Previously, setting up a user involved configuring them in multiple systems such as Exchange, Active Directory, and accounts. However, in the cloud environment, setting up a user involves only a single step, and they instantly gain access to applications like Teams, SharePoint, and OneDrive, as well as cloud storage. Additionally, dynamic groups are available, making the entire process even more streamlined and user-friendly.

We utilize the Azure AD conditional access feature to enforce finely tuned and adaptive access controls. This feature is crucial, especially when dealing with traveling users, as it provides an additional layer of security intelligence within the company. It helps address the issue of hackers gaining unauthorized access to user accounts and allows us to track and monitor their activities. To enhance security and protect against identity theft, we also leverage the licensing for Azure AD P1 and P2, which includes conditional access as a key component. By implementing these measures, we strive to ensure the utmost security for our company's identity infrastructure.

The conditional access feature plays a crucial role in enhancing the robustness of a zero-trust strategy in user verification. It ensures that every access attempt is thoroughly assessed by checking for known or unfamiliar logging locations. Additionally, it prompts users to provide additional authentication factors, such as a code sent to their phone or an email, to ensure proper verification. By implementing these measures, conditional access strengthens the authentication process, making it particularly valuable in situations where stringent security measures are required.

I used the Azure AD conditional access feature in conjunction with the Microsoft Endpoint Manager.

When evaluating Azure AD's verified ID in terms of privacy and identity data controls, it is crucial to ensure that your company has the appropriate applications and data management practices in place. This includes disabling protocols such as SMB version two or NTLMA within the organization. Additionally, it is important to protect legacy applications and protocols by utilizing the pure configuration of the cloud. By taking these measures, you can effectively safeguard privacy and maintain control over identity data within Azure AD.

I use the Azure AD permission management feature.

The level of visibility and control provided by Azure AD in managing identity permissions across Microsoft, Amazon, and Google Cloud is significant. However, it goes beyond simply having a column for testing and user logs. Additional information is often required, especially when generating reports for external identities. The existing capabilities are not sufficient, and there is a need for more detailed segmentation in this area to effectively manage and monitor permissions.

The permission management feature is highly beneficial for reducing the risk surface associated with identity permissions. It addresses the issue of leaving individuals with perpetual access to resources, which is a common problem in many companies. When a user leaves a position, there is often a failure to thoroughly review and revoke their authorizations, creating a security vulnerability. In order to mitigate this risk, it is preferable to create new users and assign fresh permissions, while retaining the old permissions and authorizations for other users. Although this approach requires additional work, it significantly improves security measures.

Azure AD has proven to be a time-saving solution for IT administrators and HR departments. It greatly expedites the onboarding and offboarding processes by automating them, leading to faster and more efficient results. In the best cases, HR departments can take charge of the initial onboarding process, allowing administrators to focus on more critical user configurations instead of being burdened with repetitive tasks. This separation of responsibilities enables HR to initiate the process, while IT can provide templates and support, ensuring that clients are seamlessly integrated into the workflow without the need for direct involvement from the IT department.

In my previous experience, this solution has saved me numerous hours. For example, when a new person was scheduled to join the company, it would typically take me around eight hours to handle tasks such as machine preparation, configuring user permissions, installing the required software, and other related activities. This could easily occupy an entire workday. However, if I delegate those tasks to the solution, I believe I could potentially reclaim approximately eight hours of my time, equivalent to a full workday, and utilize it for other IT administrative responsibilities.

While the solution has helped us save money in terms of user management and improved security through the portal, it hasn't directly impacted licensing or other expenses.

Azure AD has greatly improved the employee user experience in our organization. They now have the convenience of resetting their passwords from anywhere, whether they are within the company premises or working remotely. This eliminates the need for excessive contact with the IT support department or relying on specific personnel, giving users more freedom and independence to access their accounts and perform necessary actions.

Azure Active Directory Identity Protection enables synchronization between my on-premises user accounts and the cloud. By using Azure Active Directory, I can enforce restrictions and create policy rules. I can also identify the devices connected to Azure Directory and apply policies accordingly. The usage of this feature is extensive, with a large number of users utilizing its capabilities. I feel that it forms the core of Microsoft's security infrastructure, acting as a central portal for managing the security of Microsoft solutions.

Most things can be managed through Azure Active Directory, which functions as a security and reporting hub for all Microsoft solutions. This is especially helpful when checking logs or accessing various features within Microsoft. By going directly to Azure Active Directory, I can easily search and utilize any Microsoft feature. It serves as the main entry point for accessing Microsoft solutions.

The single pane of glass, when it comes to administration, is really good and helpful. For example, if there are any cases where I need to check something about user devices, logs, or access management—such as revoking access, giving access, or creating groups—all of these tasks are easily accessible. As an IT infrastructure manager, I mainly work in the cloud, so the Azure Active Directory is my go-to resource. Having the Azure portal open most of the time makes it convenient for me to access the Azure Active Directory directly. Instead of navigating through Office.com and its admin panel, I can have a comprehensive view from Azure Active Directory, which serves as the main pilot for my tasks. This seamless integration is essential because it eliminates the need to switch between different portals. Whether I'm dealing with infrastructure-related matters or user management, I have one centralized portal where I can efficiently switch between tasks. It simplifies my work and enhances my productivity. Regarding security and access control, I also find Azure Active Directory very valuable since I handle security matters. If there are any security logs or incidents, I can easily manage and address them using Azure Active Directory. This capability further streamlines my responsibilities and ensures a smooth workflow.

Initially, there was limited control. However, when we examine the recent features available in Active Directory, for instance, controlling access to company resources from personal devices due to COVID, we find an increased need for such control. Active Directory offers a way to manage this type of access effectively. One of the features that I particularly appreciate is controlled access, which allows us to apply security controls based on whether the device is part of the company directory or not. By combining this feature with cloud app security, we gain even more control over user access at the device level. Using these features, we can decide whether users are allowed to download content on their laptops or restrict access to specific mobile devices. If it's a company device, full access is granted; otherwise, access is limited. This kind of bundled approach is very convenient for security personnel responsible for the company's security, providing a one-stop shop for managing access controls. Moreover, this system allows granular control over individual users as well. For example, higher-level executives like the CEO may require different policies compared to regular users. We can easily create open policies for certain users, granting them unrestricted access to personal devices. Overall, the conditional access module of Active Directory offers a comprehensive and effective solution for managing access controls and security measures within the company.

Traditionally, we used to make a good device compliant by simply adding it to the domain and then applying GPOs from it. However, after Azure Active Directory, there is an additional level of authentication, which occurs with Azure AD joined devices. When a device is Azure AD joined, we can blindly trust it because only company devices can join Azure AD. Nevertheless, there are still potential issues and loopholes that may arise. For example, even if it is a company-managed device, there is a chance that it was mistakenly added by an administrator and later given to an unauthorized person, granting them access to company resources. To address these concerns, we use conditional access policies. With these policies, we can verify multiple steps: Is it an Azure AD joined device? Is it a hybrid joined device? Is it located in the correct area? Is the user associated with the device authorized to access company resources? Based on these checks, we determine which applications the user should have access to. This multi-layered security approach is crucial and is known as zero trust security. We need to authorize users at each level, and this is made possible through the implementation of conditional access policies. This module showcases the beauty and effectiveness of this approach.

Azure Active Directory has helped save time for our IT administrators. It significantly reduces the time required for management tasks. I no longer need to log in to the ADA server or manually disable accounts. Checking the logs is now a simple process. Accessing the Active Directory is easy from anywhere, whether it's through email or from home—it doesn't matter.

Azure Active Directory has had a significant impact on the employee user experience within our organization. One feature that stands out is the password reset process. Previously, whenever I needed to reset an employee's password, I had to go to the ADA server and reset it from there. This process used to take around 15 to 20 minutes, especially if the password had expired or any other issues arose. Additionally, if I wasn't at my computer, I would have to spend at least an hour sitting in front of it to provide access or reset the password and then share the new credentials with the employee. Moreover, the passwords I generated were temporary, which meant employees had to reset them again. However, with the introduction of the password reset portal in Azure Active Directory, our workload has been significantly reduced. This portal allows us to provide users with an option to reset their passwords securely without compromising account security. It has proven to be one of the best features I've experienced in Azure Active Directory.

I have been using Microsoft Entra ID Protection primarily for identity and privileged access management. It provides multifactor authentication and accessor capabilities, managing specific conditional access for applications.

The tool offers multifactor authentication, which provides an additional layer of security for authentication.