Entra ID Security Checklist: What We Check in 8 Areas
The controls we review in a Microsoft Entra ID security audit, grouped into 8 areas, with the severity we assign when a check fails. Use it as a self-review, or let us run all of it read-only in your tenant.
Below are key checks from each area. Your report lists every one of the 72 checks with its result, the evidence behind it and how to fix it.
Identity & Authentication
Who can sign in, and how hard it is to steal that sign-in.
Privileged Access
How much standing admin power exists, and who holds it.
Conditional Access
Whether your policies actually reach every user, app and risk.
Applications & Consent
Which apps can read your mail and files, and who let them in.
External Collaboration
Guests and partner tenants that can reach your data.
Devices
The identity side of devices: registration and join settings.
Monitoring & Threat Protection
Whether attacks would be seen and acted on.
Directory & Domains
Tenant-wide settings, domains and directory sync.
Six forensic checks on 30 days of logs
Password spray
One source trying the same few passwords against five or more accounts.
Brute force
Ten or more failures against one account, and whether the attacker then got in.
MFA fatigue
Three or more denied MFA prompts in a row: someone has the password.
Impossible travel
Sign-ins from two countries within three hours.
Legacy authentication
Sign-ins that skip MFA through old protocols, by user.
Foreign and admin foreign sign-ins
Sign-ins from outside your home country, admins flagged separately.
Risky admin changes
Privilege escalation, Conditional Access changes, new app credentials, consent grants, off-hours changes.
Most-targeted accounts
An exposure score per account so you know whose protection to raise first.
Checking this by hand takes days. We do it for you, read-only.
Many of these checks need data from several admin portals and PowerShell modules, and the sign-in checks need thousands of log rows. The audit collects all of it with read-only access and gives you the result as a ranked, fix-ready report.
