Azure AD Security Assessment: A Practical Guide for 2026

An Azure AD security assessment is a structured review of how your Microsoft cloud identity tenant is configured: who can sign in, how they authenticate, who holds privileged roles, which apps and service accounts have access, and whether anyone would notice misuse. Microsoft renamed Azure AD to Microsoft Entra ID in 2023, but the product, the licensing and the risks are the same, and many auditors, insurers and clients still use the old name. If you run a law firm, an energy business or another regulated organization, this guide shows what a good assessment covers, which free tools to start with, and where a one-time check stops being enough.

TL;DR

• An Azure AD (Entra ID) assessment checks identity management, governance, operations, authentication, security and hybrid configuration, not just whether MFA is on.
• Start with free tools: Microsoft's own Secure Score and CISA's ScubaGear, which tests your tenant against published baselines.
• The gaps that matter most: administrators without MFA, too many permanent Global Administrators, legacy authentication, and unprotected workload identities.
• Assessments are point-in-time configuration checks. Pair them with monitoring and a repeat schedule, or the results go stale.
• For regulated firms, the output should map to SOC 2, HIPAA, CMMC or similar frameworks so it counts as audit evidence.

Table of Contents

• What an Azure AD security assessment actually covers
• Why identity is the first place to look
• The seven areas to review
• Free tools to start with
• What a tool will not tell you
• How to run the assessment: a six-step process
• How often to repeat it
• Our perspective: where identity assessments go wrong
• When to bring in outside help
• Azure AD security best practices checklist
• FAQ
• Sources

What an Azure AD security assessment actually covers

The name causes some confusion, so define the scope first. Three things get called an "Azure AD assessment":

1. A cloud tenant configuration review. This looks at Microsoft Entra ID itself: authentication methods, Conditional Access, roles, applications, logging.
2. A hybrid review. If you still run on-premises Active Directory synchronized to the cloud, the review also covers the connection between the two, including legacy protocols and privileged accounts that exist in both places.
3. An on-premises Active Directory assessment. Several of the pages that rank for this topic are really about Windows Server Active Directory: Kerberos delegation, Group Policy, trusts. That is a related but different exercise.

Microsoft's open Azure AD assessment reference on GitHub describes the checks used in its Configuration Assessment workshop around identity and access management areas. Microsoft's on-demand assessment guidance groups findings into six categories: identity management, governance, operations, authentication, security and hybrid configuration. That is a useful skeleton for any review, whether you do it yourself or hire it out.

Why identity is the first place to look

For most mid-sized organizations, Entra ID is the front door to email, documents, billing systems and client data. One compromised administrator account can expose all of it.

Microsoft's own research, summarized in its Defender for Identity security posture documentation, is that most identity attacks rely on common misconfigurations in Active Directory and the continued use of legacy components such as the NTLMv1 protocol. In other words, attackers rarely need anything exotic. They need a gap that an assessment would have flagged.

For a law firm, that gap is privileged client communications and matter files. For an oil and gas operator, it is contracts, lease data and sometimes a path from the corporate network toward operational systems. Either way, identity is where the review should begin.

The seven areas to review

1. Authentication and MFA

Microsoft now enforces mandatory MFA for sign-ins to the Azure portal, the Microsoft Entra admin center and the Intune admin center, with a second phase beginning October 1, 2025 for Azure CLI, Azure PowerShell and similar tools. That covers administrative portals. It does not mean your ordinary users, your service accounts or your mailbox access are protected.

Check these items:

• Is MFA required for every user, enforced through Conditional Access rather than per-user toggles?
• Do administrators use phishing-resistant methods, such as FIDO2 security keys, instead of SMS codes?
• Is legacy authentication blocked? Protocols that cannot do MFA let an attacker skip it.
• Are smart lockout settings sensible? Microsoft's configuration guidance recommends a lockout threshold of 10 or fewer attempts with a duration of 60 seconds or more.

2. Privileged access

Count your Global Administrators. Then count how many hold the role permanently. A typical finding in mid-market tenants is five or more standing Global Administrators, including a few former IT contractors.

The fix is usually:

• Reduce Global Administrators to a small number and use narrower built-in roles for day-to-day tasks.
• Move to just-in-time activation with Privileged Identity Management (PIM), which generally requires Entra ID P2 licensing, per Microsoft's assessment guidance.
• Keep two emergency "break-glass" accounts, excluded from normal policies, monitored closely and tested.
• Separate administrator accounts from everyday email and browsing accounts.

3. Conditional Access

Conditional Access is where policy meets reality. Review which policies exist, which users and apps they exclude, and whether any exclusions have outlived their reason. Common weaknesses are broad exclusion groups that nobody owns, policies left in report-only mode for years, and no policy covering risky sign-ins.

Microsoft's Entra security guidance treats risk-based Conditional Access for both user and workload identities as among the highest-impact recommendations.

4. Workload identities and applications

This is the area most reviews skip. Service principals, app registrations and automation accounts are non-human identities. They often hold broad permissions, use long-lived secrets and sit outside user-focused MFA policies. Microsoft's guidance cited above flags the failure to apply Conditional Access to these identities as a common oversight, because it gives an attacker a quiet route for lateral movement.

Review:

• Every app registration and enterprise application, and who owns it.
• Credentials that never expire or have not been rotated. Microsoft's configuration guidance suggests rotating application certificates every 180 days.
• User accounts used as service accounts. Microsoft recommends migrating these to workload identities.
• Third-party applications with consent to read mail or files.

One practical example: a document management or reporting tool that signs in to Microsoft 365 on your behalf. Before you connect any such tool, understand how its sign-in is configured. This walkthrough on enabling Microsoft single sign-on for a business intelligence platform shows the kind of app registration and permission choices that end up in your tenant, and that an assessor will later ask you to justify.

5. Hybrid identity

If you synchronize on-premises Active Directory to Entra ID, an attacker who controls one side can often reach the other. Check the sync account's permissions, whether password hash synchronization or federation is used, which on-premises accounts hold cloud admin roles, and whether NTLMv1 or other legacy protocols remain enabled. The on-premises half is where Defender for Identity's posture assessments help.

6. Governance and lifecycle

Access reviews and offboarding are boring and decisive. Look for guest accounts from past matters or projects, disabled employees who still hold licenses and group memberships, and shared mailboxes with no owner. Law firms with many outside collaborators tend to accumulate guests quickly.

7. Logging and operations

Confirm that sign-in and audit logs are retained long enough to investigate an incident, that privileged role activations raise alerts, and that someone is responsible for reading them. Microsoft's guidance expects diagnostic settings to be configured for all Entra logs, and your cyber insurer will probably ask the same.

Free tools to start with

You do not need to buy anything to get a first view.

A few details worth knowing. Microsoft's Secure Score assessment guidance says the initial automated assessment setup takes roughly two hours, and some remediation features, such as PIM and risk-based Conditional Access, depend on P1 or P2 licenses.

CISA's ScubaGear tool is free and available from GitHub and the PowerShell Gallery. CISA finalized the Microsoft 365 baselines in December 2023, and it released ScubaGear to help organizations assess M365 services against them. The baselines leave out policies that cannot be verified through automation, so the list that remains is short enough for a mid-market team to act on. CISA also supplies rationale statements that help you explain the business impact of each control to leadership.

What a tool will not tell you

Automated assessments are configuration checks, not detectors. They tell you that a policy is missing today. They do not tell you whether an attacker is signing in right now. Microsoft's Zero Trust assessment documentation describes automated posture evaluation, and practitioners pair it with real-time alerting, such as a SIEM, to see active attacks.

Tools also cannot weigh business context. ScubaGear may recommend a setting that would break a workflow at your firm. A person has to decide whether to adopt it, delay it or accept the risk, and document that decision. That documentation is what auditors want to see.

How to run the assessment: a six-step process

1. Define scope and owners. List tenants (including old ones from acquisitions), connected on-premises domains and the business units in scope. Name one executive sponsor.
2. Collect a baseline. Run Secure Score and ScubaGear, export Conditional Access policies, role assignments and the application inventory. Do this in a read-only way.
3. Triage findings by exploitability. Administrators without phishing-resistant MFA and active legacy authentication come before cosmetic items.
4. Map to your obligations. Tie each finding to the control it affects in SOC 2, HIPAA, PCI DSS or CMMC. A finding that violates a contract requirement outranks one that merely departs from best practice.
5. Remediate in waves. Quick wins first (block legacy authentication, trim admin roles), then policy changes tested in report-only mode, then structural work like PIM and app cleanup.
6. Document and schedule the next review. Keep the evidence: before and after screenshots, exported policies, risk acceptances with approvers.

Test Conditional Access changes carefully. A badly scoped policy can lock out your administrators, which is why the break-glass accounts matter.

How often to repeat it

Treat identity posture as a cycle, not a project. Tenants change every time someone registers an app, adds a guest or grants a role. Microsoft's Secure Score and Defender dashboards provide near-real-time visibility, and Secure Score statuses refresh about every 24 hours according to the on-demand assessment documentation. A workable cadence for a mid-sized organization:

• Monthly: review Secure Score changes, new Global Administrator assignments and new app consents.
• Quarterly: access reviews for privileged roles and guests, and review of Conditional Access exclusions.
• Annually, or after a major change: a full independent assessment, including hybrid components and a validation test.

If you want to see how identity checks fit into a wider program, our guides on security assessments for mid-market companies and cybersecurity maturity assessments show how an identity review sits among other control areas. When your workloads run in Azure, cloud penetration testing tests whether the configuration holds up against a real attacker rather than a checklist.

Our perspective: where identity assessments go wrong

We see the same pattern in regulated organizations. The assessment is run, a long report is delivered, and six months later half the findings are still open because no one owns them. The technical content was fine. The missing piece was leadership.

Three convictions shape how we approach Entra ID reviews:

• Findings need an owner and a date. A finding without a named person and a target quarter is a note, not a remediation plan. We translate each one into a roadmap item that a managing partner or operations director can approve.
• Evidence beats scores. A Secure Score of 80 percent means little to a client's security questionnaire or an auditor. A dated export of your Conditional Access policies, a role-assignment review and a documented risk acceptance mean a great deal.
• Identity is a business risk, not an IT chore. For a law firm, a compromised partner mailbox is an ethics and client-trust problem. For an energy operator, an over-privileged account can become a safety and continuity problem. Leadership should see the risk in those terms.

Smaller organizations rarely have a full-time security leader to drive that process, which is the gap a virtual CISO fills. The assessment is the start of the work, and the ongoing governance is what makes it stick.

— vCISO

When to bring in outside help

You can run the first pass yourself with the free tools above. Consider outside support when:

• A client, insurer or regulator has asked for evidence of identity controls and you need it in audit-ready form.
• You are preparing for SOC 2, HIPAA, PCI DSS or CMMC and need Entra ID findings mapped to specific controls. Our overview of CMMC Level 2 requirements shows how identity and access controls feature in that framework.
• Your IT team is two or three people and remediation competes with daily support.
• You have a hybrid environment and no one fully understands what is synchronized where.
• Leadership wants a prioritized plan and budget rather than a list of settings.

CISOSafe provides virtual CISO services, security risk assessments, policy and controls development and audit readiness support for law firms, oil and gas companies, energy operators and other regulated organizations. We pair hands-on advisory with an AI-powered platform that automates penetration testing, compliance intake and reporting, so identity findings flow into a board-ready roadmap instead of a spreadsheet. If you want a second set of eyes on your tenant, talk to us about a vCISO engagement.

Azure AD security best practices checklist

Use this as a one-page summary after your assessment.

• Require MFA for all users through Conditional Access, with phishing-resistant methods for administrators.
• Block legacy authentication.
• Limit permanent Global Administrators and use PIM where licensed.
• Maintain two monitored break-glass accounts.
• Apply risk-based policies to users and workload identities.
• Inventory app registrations; remove unused ones and rotate secrets and certificates.
• Review guests and stale accounts at least quarterly.
• Send Entra logs to a retained, monitored location and alert on privileged role activation.
• Remove NTLMv1 and other legacy components in hybrid environments.
• Keep a dated evidence file for auditors.

FAQ

Is Azure AD the same as Microsoft Entra ID?

Yes. Microsoft renamed Azure Active Directory to Microsoft Entra ID, with plan names changing on October 1, 2023. Capabilities in the existing plans stayed the same, so an "Azure AD assessment" today means a review of your Entra ID tenant. Details are on Microsoft's rename page.

What is the difference between an Azure AD audit and a security assessment?

An audit usually checks your configuration against a fixed standard and produces evidence of compliance or deviation. An assessment is broader: it ranks risks, considers how an attacker would move through your environment and recommends a remediation order. Many organizations need both, and the same data feeds each.

Can we do an Azure AD security assessment for free?

Yes, for a first pass. Microsoft Secure Score and the Zero Trust Assessment cost nothing beyond your existing licensing, and CISA's ScubaGear is a no-cost tool. The limits are interpretation and prioritization, and some remediation features need P1 or P2 licenses.

How long does an assessment take?

Setting up Microsoft's automated assessment takes about two hours, per Microsoft's documentation. A full review, with interviews, policy analysis, hybrid checks and a remediation plan, takes longer, and the timeline depends on tenant size and complexity.

Does passing an assessment mean we are secure?

No. It means your configuration met the criteria on the day it was tested. Identity changes constantly, and assessments do not detect active attacks. Pair them with monitoring, repeat reviews and an incident response plan.

Sources

• New name for Azure Active Directory, Microsoft Entra
• Azure AD On-Demand Assessment, Microsoft Learn
• Assessment Reference, AzureAD/AzureADAssessment Wiki
• Microsoft Defender for Identity security posture assessments
• Mandatory multifactor authentication for Azure and admin portals
• Configure Microsoft Entra for increased security
• Microsoft Entra security guidance, Zero Trust response and remediation
• Operate Microsoft Entra Private Access, automated posture assessment
• CISA: Microsoft 365 and Entra ID assessment tools
• CISA finalizes Microsoft 365 secure configuration baselines

Recommended

• Cloud Pentesting: Audit Ready Evidence for Regulated SMBs with Human + AI Validation
• Security Assessment for Mid-Market Companies: 2026 Guide
• Vendor Security Due Diligence: A Practical Guide