Production patterns for Microsoft Entra ID. Written by an Identity Admin, for Identity Admins.
A focused, opinionated handbook for the people who actually run Microsoft Entra ID at production scale. No theory, no marketing — just the patterns, runbooks, and checklists that survive contact with reality.
Start here → 00-quickstart.md gives the 5-phase rollout sequencing for a new or existing tenant.
Every other chapter answers a specific operational question:
- Is my Conditional Access posture defensible? →
01-conditional-access-baseline.md - Can my privileged access pass an audit? →
02-pim-playbook.md - My users got AiTM-phished at 3 AM. Now what? →
03-incident-runbooks.md - What are the 12 default settings I have to fix on day one? →
04-hardening-checklist.md - Which PowerShell cmdlets matter post-MSOnline retirement? →
05-powershell-essentials.md - A user can't sign in. Where do I start? →
06-troubleshooting-kql.md
| Role | What you'll get out of it |
|---|---|
| Identity Admin (Entra) | A shippable baseline for CA, PIM, hardening, and incident response |
| Cloud Security Engineer | KQL detections, threat patterns, and remediation scripts |
| Cybersecurity Architect | Design patterns that map to MCRA, MCSB, and Zero Trust |
| SOC analyst (Tier 2/3) | Triage runbooks for AiTM, token theft, consent phishing |
| Auditor / CISO | Compliance-ready posture (NIS2, DORA-relevant identity controls) |
- First-time deployment → Start with
04-hardening-checklist.md, then01-conditional-access-baseline.md. - Existing tenant audit → Run the audit scripts in
scripts/, review against04-hardening-checklist.md. - Incident response → Jump straight to
03-incident-runbooks.md. - Daily operations → Bookmark
05-powershell-essentials.mdand06-troubleshooting-kql.md.
| # | Document | What it answers |
|---|---|---|
| 00 | Quick Start Checklist | The 5-phase rollout sequencing — what to ship on day 1 / 3 / 7 / 14 / 30 |
| 01 | Conditional Access Baseline | The 15 policies every production tenant should ship |
| 02 | PIM Playbook | Eligible vs Active, MFA-on-activation, audit, common traps |
| 03 | Incident Runbooks | AiTM, token theft, consent phishing, service principal abuse |
| 04 | Hardening Checklist | The 12 defaults to change before going to prod |
| 05 | PowerShell Essentials | Microsoft Graph SDK after MSOnline / AzureAD retirement |
| 06 | Troubleshooting & KQL | Sign-in logs, AADSTS error codes, top detection queries |
The recommendations in this handbook follow a small number of opinionated principles:
- Phishing-resistant MFA over "any MFA". SMS and voice are no longer acceptable for privileged paths. Number matching is the floor, not the ceiling. FIDO2 / Windows Hello / certificate-based authentication for admins.
- Eligible-by-default, active-by-exception. No standing privileged access. PIM activation with MFA-on-activation and approval workflow for tier-0 roles.
- Report-only first, enforce second. Every Conditional Access policy ships in report-only mode for at least one week before enforcement. No exceptions.
- Block legacy authentication everywhere. Microsoft research shows 99%+ of password spray attacks use legacy auth protocols (IMAP, POP3, SMTP basic, older Office clients).
- Audit what you cannot prevent. If a control cannot be enforced today (legacy app, vendor constraint), it must be detected. KQL detections in
scripts/. - Microsoft Graph PowerShell SDK. MSOnline retired May 2025, AzureAD retired July 2025. All scripts in this repo use
Microsoft.Graphmodules.
- Not a study guide for the SC-300 exam. It maps to identity admin practice, not to skills-measured percentages. If you want exam prep, use the Microsoft Learn study guide.
- Not a tutorial. It assumes you know what a Conditional Access policy is, what a service principal does, and how to read a sign-in log.
- Not Microsoft-endorsed. These are operational patterns from real environments. Always validate against current Microsoft Learn documentation.
Every page cites Microsoft Learn or Microsoft Security Blog as the primary source. Threat intelligence is cited from Microsoft Threat Intelligence (MSTI), Microsoft Defender Research, and named threat actors using Microsoft's weather-based naming taxonomy.
Issues and pull requests welcome. If you spot a stale Microsoft Learn link, a deprecated cmdlet, or a recommendation that no longer reflects 2026 reality, open a PR.
MIT. See LICENSE.