Microsoft Entra ID Reviews

My use cases for Microsoft Entra ID mainly include single sign-on, PIM, and conditional access policies.

The integration of Microsoft Entra ID and its ease of use is helpful for my company. Being included with our Microsoft 365 licensing makes it a much more affordable solution than Okta, for example.

The implementation of Microsoft Entra ID has positively impacted secure access to apps or resources in my environment because it makes them more secure. There are many services that don't support MFA, but adding SSO through Microsoft Entra ID adds MFA and allows us to enforce all of our conditional access policies.

My main use cases for Microsoft Entra ID are that the whole back office platform is based on it. We're using Teams or other tools for our day-to-day usage of Microsoft Entra ID.

The features of Microsoft Entra ID that I appreciate most include security. I find security essential. It's my job and main concern to use a secure platform, and it is also the way that we serve Microsoft customers to make their solution more secure.

The implementation of Microsoft Entra ID has had a positive impact on my secure access to apps or resources in my environment. Generally, productivity is much higher with Microsoft Entra ID than before when we were using the previous platform. I can't give exact metrics, however, I can roughly say that my productivity increased by about 25%.

Microsoft Entra ID's integration capabilities have influenced my zero trust model in that we can onboard users from day one without a password or password reset or complication. On behalf of my customers and Microsoft customers, since Microsoft Entra ID became part of my company, they onboard their staff in a more secure and more convenient way, with less cost. We save lots of cost for them for onboarding their new users. 

Since implementing Microsoft Entra ID, regarding changes in the frequency and nature of identity-related security incidents, when you trust a platform, your hesitation and investigation for incidents is going to be less. Though I can't say an exact number or percentage, I can clearly feel our efforts on incidents are much less than before. Our organization's approach to defending against token theft and nation-state attacks has not changed significantly since implementing Microsoft Entra ID, as we have a big concern about token theft yet know we cannot do anything. We just passively watch the market and expect Microsoft to help us with some solutions, as this is our major concern.

We have not encountered any verified threat actor IP in Microsoft Entra ID protection or any attacker in the middle detection. The features of Microsoft Entra ID benefit my company by saving costs and increasing productivity. These are two major things I can remember. With the Microsoft Entra ID platform, our company productivity is much higher, the performance is much higher, and it means that at the end of the day, we do the job with fewer people, saving costs.

BDO is a network of firms and a firm is what we call a country. So, we are present in about 160 countries. I am involved in BDO Global, which is not really a firm in the sense that we don't deal directly with clients, but BDO Global hosts IT services for all those 160 countries. A couple of those solutions are a worldwide audit solution that our firms use for financial audits for customers. We have a globally running portal solution, which firms are using to collaborate with our customers directly. All these services are basically based on Azure AD for authentication and authorization. This has been a lifesaver for us, because BDO firms are legally independent, so, we don't have a single identity store worldwide, like other big companies potentially do. We created an IAM solution based on Azure AD that ties all 160 dispersed identity stores back into one. We use that to give access to our services that we run globally.

Azure AD doesn't really give you a version. You just need to take the version as-is because it is a service that Microsoft delivers as a SaaS service. So, we don't have a lot of influence over the version that we use.

Besides tying together all authentications for our 160 countries, it has also been instrumental in getting the collaboration going between our firm countries since normally they are quite isolated. Also, their IT firms are quite isolated. So, Azure AD has made sure that we can collaborate with each other in multiple different systems: the global portal, the Audit application, and Office 365. This allows us to collaborate closer together, even though we are still separated as different countries.

Because it is an identity store, it handles all our authentication. We also use it with a combination of conditional access, which is a way to limit people's authentication or authorization based on where they are, the compliance of their device, and on a whole bunch of other variables that we can set. So, it definitely has been influential as well on the security side. Because it is a SaaS, you have central management over that. You can see all the logins and get reports on who signs in from where. 

There is a lot of artificial intelligence in Azure AD that can monitor behavior of users. If users behave in a strange way, then the authentication can be blocked. For example, if you have a user logging in from China, but it looks like the same user is logging in from America just a few seconds apart. That is a seemingly risky behavior that Azure AD flags for you, then you can block that behavior or have the user provide you with a second factor of authentication. So, there are a lot of security features that come with Azure AD too.

We primarily use Microsoft Entra ID for application registration, especially for Software as a Service applications, which are prevalent in managing the power grid. These applications support various needs, such as managing contingent workers in our 24/7 operation. While we still utilize some on-premise applications, we prioritize cloud-based solutions for their high availability and accessibility. Furthermore, we are actively exploring B2B collaboration features in Entra ID to manage guest accounts, which offers significant cost savings on licensing and enhances ease of use for external users. Optimizing guest access privileges is a compelling business case for utilizing Entra ID effectively.

Microsoft Entra ID has helped by simplifying our management of permissions for APIs. We are not directly exposing credentials, as we use tokens instead. It has made management easier and more secure, especially in a multi-user environment.

The implementation of Microsoft Entra ID significantly improved secure access to applications and resources in our environment, primarily through the widespread use of single-sign-on. Managing API permissions became much easier, as application registration often involves calling an API to utilize services without directly exposing credentials, relying instead on token-based authentication. This streamlined approach benefits end-users by simplifying access while remaining transparent to them. Ultimately, my role focuses on ensuring a smooth and user-friendly experience, even if the underlying technology remains unseen by the end-users.

Our company strongly emphasizes passwordless authentication, primarily through device-bound passkeys in Microsoft Authenticator. While administrators with high-privileged accounts utilize YubiKeys and passwords for tasks like accessing Microsoft Graph, we are actively transitioning all other users towards passwordless methods such as Windows Hello biometrics. This approach streamlines authentication and enhances security. Though initial deployment in 2022 presented challenges due to hardware limitations and the lingering effects of the COVID-19 pandemic, the technology has significantly improved and provides a simple and effective user experience.

I rely on Microsoft Entra ID for syncing customers' on-premises Active Directory to the Microsoft 365 stack. I also use it for managing multi-factor authentication and other enterprise applications for our customers.

Microsoft is at the core of any customer I work with. Microsoft is the core of their identity, communication, and business applications. Microsoft acts as a one-stop shop for calling, meetings, collaboration, AI, and business applications like Dynamics 365 and Outlook. Many services are bundled, providing potential cost savings for organizations.

Conditional access is an additional feature of Entra ID. It allows organizations to say that these devices are allowed to connect without MFA or with MFA and meet certain compliance standards based on what is set in Intune. There are a lot of things that can prevent devices from connecting to your environment unless certain conditions are met. That is a big thing around the security of Entra ID.

It helps allow devices regardless of having an active VPN connection. You can enable your remote employees to access corporate resources without having massive security walls. It not only allows those devices to connect to the network seamlessly, it also allows them to connect securely. It is not that they have unfettered access to your network. You are securing things down where they are only allowed access to certain resources.

The implementation of device-bound passkeys in Microsoft Authenticator helps with phishing-resistant authentication. It helps ensure that every employee that you have is actually that person. It ensures that they are entering the PIN from their phone via the Microsoft Authenticator app and they are who they are. Even if their password is compromised, you still have another level of security for device access. It is not just access to a phone. They have to have pass lock screen access and access to the Microsoft Authenticator app to approve those notifications and type in that secondary code. Requiring a user to enter a two-digit code that is showing on their screen ensures only authorized access. It has been helpful in all cases. I deal with multiple customers, and most of them have hit security issues due to people pressing a random authentication key as approved, not knowing what they are pressing, even though they know it is an authentication prompt. Having that ensures that they are who they say they are.

This constant reauthentication to applications helps with organization security. We are not letting you sign in once and remain signed in for 30 days. If that device gets compromised, your corporate security is at risk. Lowering that authentication threshold to every 24 hours or 12 hours and making a user reauthenticating helps to make sure that they are who they are.

Token Replay detection has a big impact in terms of malware. Some people click on random PDFs in their email attachments and things get through. This is happening even at a larger scale, for example with Linus Tech Tips. Someone clicked an email, and they clicked an application that ran the machine and gathered every authentication token for everything the user had access to. They happen to have access to their YouTube account and other things without MFA. Being able to detect if a token is being reused potentially from another IP, with a snap of a finger, is a great feature. If a token is compromised, you can block it.

Since implementing Entra ID, identity-related security incidents have gone down drastically. 

We implement standardized conditional access policies for our customers using Microsoft Entra ID, mainly for security, governance, and conditional access. We also sync on-premises Active Directory accounts to Microsoft Entra ID to manage groups and Azure resources like Azure Virtual Desktop.

We started our journey with Entra from a security standpoint, using features like PIM and Microsoft Defender for Cloud. It has improved our security posture, especially in healthcare, where security is paramount. We have to ensure that our data is secure for HIPAA compliance. 

It improves our user account management and initial access. We can see a lot of stuff using Microsoft Lighthouse because we're an MSP, so we use Lighthouse to gain visibility into the tenants and accounts. We can dive into the financial side and get reports. It's highly granular and easier from an organizing standpoint.

We use the Microsoft security stack, including Defender, Purview, etc., so we get a security score and recommendations on ways to fill in the gaps. We get some ideas on how to tweak the Entra tenant or the environment better. But we're following Microsoft's guidelines with reporting or recommendations.

We implemented FIDO 2.08 for phishing resistance, so we use security keys like the UBP. We're passwordless now. It depends on our customers' licensing, such as whether they have an E1 or E3 or whichever Microsoft 365 license they have. We're moving them to a passwordless architecture or, at minimum, improving phishing resistance with an MFA authenticator. 

We primarily use Entra to monitor risky users or detect questionable sign-ons. We get alerts if a user logs in outside a trusted location or from a different IP address we don't recognize. We have recommendations or conditional access policies to detect or block risky sign-ons. 

We had more risky log-ins detected than normal, so we updated our conditional access policies to say that if we see more risky log-ins in the next 24 hours, we'll lock it down in the next 12 hours to fine-tune the conditional access policies and that kind of stuff. We're trying to standardize or make everything the same, depending on pricing or cost. We're trying to move everybody to the standard baseline for just what we try to deploy for the next of this year. 

It's had a tremendous impact on our security. We can set granular permissions and different levels of access for various teams. We can govern the Entra side of the house or the Azure public cloud side and other teams like marketing, HR, finance, or any of those groups as needed. 

Entra helps us advance our zero-trust strategy. We have to follow CIS standards and HIPAA because we're in healthcare and PCI DSS. We're implementing Microsoft's best practices for their security framework. It makes a big difference when we're deploying new infrastructure for new clients and everything.

It has allowed us to use other SaaS products that will authenticate with Office 365 as well as other Microsoft products and non-Microsoft products, so we can have a single sign-on experience for our users. Rather than them needing to have multiple usernames and passwords, they just use whatever they have as their main username and password to log onto their machine.

It is SaaS based, but we sync up from our on-prem into Azure AD.

With COVID-19 at the moment, this solution is a good example of where we needed to move a lot of our traffic from our on-prem authentication into the cloud. Last year, before I joined the company, we had to setup our VPN differently. It was easy enough for us to do because our machines were already joined to Azure AD. We just split the traffic and stopped having to rely on our on-prem VPN for our Office 365 traffic. We were just good to go into the Internet because we had all the features setup, e.g., MFA and Conditional Access, which made life a lot easier.

It has made our security posture better. There are always improvements to be made, but we feel more secure because of the way that things have been setup and how everything integrates together.

We are using Azure Active Directory (AD) for:

• Application authentication, which is single sign-on. 
• Multi-factor authentication (MFA). 
• Conditional access for people coming in from non-trusted networks, which are interlinked. 
• Azure AD B2B. 

These are the four big items that we are using.

The flexibility around accessing company systems from anywhere at any time has proven to be very helpful. Organizations decided during the COVID-19 pandemic, on a very short notice, to announce that everyone should be working from home. The good part was that our company was already working under Azure Active Directory, and most of our applications were under Azure at that time. For us, it was a very seamless transition. There were no major impacts on the migration nor did we have to do any special setups or need to configure networks. So, it was a very seamless experience for our users, who used to come into our office, to access systems. They started working from home and there was no difference for them. We did not have to do anything special to support that transition from working from the office to working from home. It was seamless. There was no impact to the end users.

Bringing our many hundreds of applications onto Azure Active Directory single sign-on authentication has had a big impact on users' productivity, usage, and adoption of enterprise applications because they don't need to log in. It is the same credentials and token being used for days and months when people use our systems with hundreds of applications being integrated. From a user perspective, it is quite a seamless experience. They don't need to remember their username, passwords, and other credential information because you are maintaining a single sign-on token. So, it is a big productivity enhancement. Before, we were not using a single sign-on for anything. Now, almost 90 to 95 percent of applications are on Azure Active Directory single sign-on.