Identity & Zero Trust
Access that is secure for the organisation and effortless for the user.
Attackers would rather log in than break in. A well-designed Entra ID and Active Directory make that hard: strong authentication, access based on context, and admin rights only when they are needed.
Sound familiar?
- Over the years, Conditional Access has grown into a patchwork of exceptions.
- Administrators hold permanent high privileges, in Entra ID and in Active Directory.
- MFA is enabled, but not yet phishing-resistant.
- After a merger or partnership, it is unclear who can access what.
What you get
- An identity architecture with documented decisions
- Conditional Access policies that are understandable and maintainable
- Just-in-time admin rights through Privileged Identity Management
- An overview of attack paths and how they were closed
- Microsoft Entra ID
- Conditional Access
- PIM
- Active Directory
- Entra Cloud Sync
- Microsoft Graph
Identity & Zero Trust
How we approach it
Analyse
Map the current set-up, privileges and attack paths in Entra ID and Active Directory.
Design
Conditional Access, PIM and authentication as one coherent whole, with documented decisions.
Introduce
In phases and measurably, with report-only where possible, so users don’t get locked out.
Verify
Check that the attack paths are really closed, and hand over to your team.
Frequently asked questions
What does Zero Trust mean for identity in practice?
Every sign-in is assessed on who it is, from which device and in which context, instead of trusting someone because they are on the network. In Microsoft environments that means Conditional Access, device compliance from Intune and phishing-resistant authentication.
Do we still need Active Directory?
Often yes, for older applications, file shares or hybrid devices. Then AD needs to be as well secured as Entra ID, because an attacker picks the weakest link. We also look at what can be phased out.
Does Privileged Identity Management also work for on-premises rights?
Yes, with PIM for Groups and a link to Active Directory. When someone activates a group membership, they are in the matching AD group within seconds. We built our own tooling for that.
Which licences are needed?
Conditional Access requires Entra ID P1, Privileged Identity Management Entra ID P2. Both are included in Microsoft 365 E5; P1 is also included in E3 and Business Premium.
Will users get locked out during the roll-out?
We prevent that with report-only policies, pilot groups and documented emergency access (break-glass accounts) before anything is enforced.
Start with a 20-minute intake.
We discuss your situation and tell you honestly whether and how we can help, even if the answer is ‘you don’t need this’. You’ll hear from us within two business days.