Entra ID, MFA, Conditional Access, token theft, and privileged access. Identity is the number one breach vector in Microsoft 365 and the first pillar of tenant security.
The exclusion added during a migration, the policy stuck in report-only, the tenant that never got the baseline. Here are the gaps attackers find first, and the 16-policy baseline that closes them.
Microsoft-managed Conditional Access policies land in tenants automatically, Entra ID preps device-bound passkeys, Ignite floods Teams with Copilot, and Intune unveils two paid add-on capabilities.
PIM extends just-in-time access to groups with Conditional Access enforcement, Graph activity logging enters preview, Windows Server 2012 R2 hits end of support, and Teams stacks up eight features.
Azure AD gains IPv6 support that can break location-based Conditional Access, GDAP milestones shift with an update promised by February 15, cross-tenant sync previews, and Teams retires the wiki.
Microsoft sets a February 27, 2023 date to enable Authenticator number matching by default, Teams Premium adds Advanced Virtual Appointments, users can delete chats, and SharePoint URL rename hits GA.
Azure AD P2 auto-remediates risky users; P1 only detects them. This Power Automate flow sweeps every customer tenant for risk detections and opens a PSA ticket the moment a new one lands.
Five Azure AD MFA controls most tenants never touch: number matching, location context, authentication strengths, and two registration reports that catch attacker-added MFA methods.
June 2022 for MSPs: Temporary Access Pass reaches GA for passwordless onboarding, Microsoft walks back the July 11 legacy CSP renewal block, and Teams ships seven features.
Pair Azure AD PIM with GDAP security groups and your techs activate customer access for a few hours instead of holding it forever. The full 2022-era setup, screenshot by screenshot.
GDAP forces a question DAP never asked: which Azure AD roles do your techs actually need per customer? A practical baseline, the architecture behind it, and what to do about Global Admin.
GDAP replaces permanent Global Admin access to every customer tenant with granular, time-bound roles. Here is what changes for MSPs, announced November 2021.
Per-user MFA, Conditional Access, and Security Defaults each report enrollment differently. Here is how they interact, plus a PowerShell script that documents MFA across every customer tenant.
