Edit

Share via

Configure Microsoft Entra for increased security (Preview)

In Microsoft Entra, we group our security recommendations into several main areas. This structure allows organizations to logically break up projects into related consumable chunks.

Tip

Some organizations might take these recommendations exactly as written, while others might choose to make modifications based on their own business needs. In our initial release of this guidance, we focus on traditional workforce tenants. These workforce tenants are for your employees, internal business apps, and other organizational resources.

We recommend that all of the following controls be implemented where licenses are available. These patterns and practices help to provide a foundation for other resources built on top of this solution. More controls will be added to this document over time.

Protect identities and secrets

Reduce credential-related risk by implementing modern identity standards.

Check Minimum required license
Applications don't have client secrets configured Microsoft Entra ID P1
Applications don't have certificates with expiration longer than 180 days Microsoft Entra ID P1
Application Certificates need to be rotated on a regular basis Microsoft Entra ID P1
Enforce standards for app secrets and certificates Microsoft Entra ID P1
Microsoft services applications don't have credentials configured Microsoft Entra ID P1
User consent settings are restricted Microsoft Entra ID P1
Admin consent workflow is enabled Microsoft Entra ID P1
Privileged accounts are cloud native identities Microsoft Entra ID P2
All privileged role assignments are activated just in time and not permanently active Microsoft Entra ID P2
Passkey authentication method enabled None (included with Microsoft Entra ID)
Privileged accounts have phishing-resistant methods registered Microsoft Entra ID P1
Privileged Microsoft Entra built-in roles are targeted with Conditional Access policies to enforce phishing-resistant methods Microsoft Entra ID P1
Require password reset notifications for administrator roles Microsoft Entra ID P1
Block legacy authentication Microsoft Entra ID P1
Temporary access pass is enabled Microsoft Entra ID P1
Migrate from legacy MFA and SSPR policies Microsoft Entra ID P1
Self-service password reset doesn't use security questions Microsoft Entra ID P1
SMS and Voice Call authentication methods are disabled Microsoft Entra ID P1
Secure the MFA registration (My Security Info) page Microsoft Entra ID P1
Use cloud authentication Microsoft Entra ID P1
All users are required to register for MFA Microsoft Entra ID P2
Users have strong authentication methods configured Microsoft Entra ID P1
User sign-in activity uses token protection Microsoft Entra ID P1
Microsoft Authenticator app shows sign-in context Microsoft Entra ID P1
Microsoft Authenticator app report suspicious activity setting is enabled Microsoft Entra ID P1
Password expiration is disabled Microsoft Entra ID P1
Smart lockout threshold set to 10 or less Microsoft Entra ID P1
Add organizational terms to the banned password list Microsoft Entra ID P1
Require multifactor authentication for device join and device registration using user action Microsoft Entra ID P1
Local Admin Password Solution is deployed Microsoft Entra ID P1
Enable Microsoft Entra ID security defaults None (included with Microsoft Entra ID)

Protect tenants and isolation production systems

Check Minimum required license
Permissions to create new tenants are limited to the Tenant Creator role Microsoft Entra ID Free
Guest access is limited to approved tenants Microsoft Entra ID Free
Guests are not assigned high privileged directory roles Microsoft Entra ID Free
Microsoft Entra ID P2 or Microsoft ID Governance for PIM
Guests can't invite other guests Microsoft Entra ID Free
Guests have restricted access to directory objects Microsoft Entra ID Free
App instance property lock is configured for all multitenant applications Microsoft Entra ID Free
Guests don't have long lived sign-in sessions Microsoft Entra ID P1
Guest access is protected by strong authentication methods Microsoft Entra ID Free
Microsoft Entra ID P1 recommended for Conditional Access
Guest self-service sign-up via user flow is disabled Microsoft Entra ID Free
Outbound cross-tenant access settings are configured Microsoft Entra ID Free
Microsoft Entra ID P1 recommended for Conditional Access
Guests don't own apps in the tenant Microsoft Entra ID Free
All guests have a sponsor Microsoft Entra ID Free
Microsoft Entra ID P2 or Microsoft ID Governance for entitlement managed and access reviews
Inactive guest identities are disabled or removed from the tenant Microsoft Entra ID Free
Microsoft Entra ID P2 or Microsoft ID Governance for entitlement managed and access reviews

Protect networks

Protect your network perimeter.

Check Minimum required license
Named locations are configured Microsoft Entra ID P1
Tenant restrictions v2 policy is configured Microsoft Entra ID P1

Protect engineering systems

Protect software assets and improve code security.

Check Minimum required license
Emergency access accounts are configured appropriately Microsoft Entra ID P1
Global Administrator role activation triggers an approval workflow Microsoft Entra ID P2
Global Administrators don't have standing access to Azure subscriptions Microsoft Entra ID P2
Creating new applications and service principals is restricted to privileged users Microsoft Entra ID P1
Inactive applications don't have highly privileged Microsoft Graph API permissions Microsoft Entra ID P1
Inactive applications don't have highly privileged built-in roles Microsoft Entra ID P1
App registrations use safe redirect URIs Microsoft Entra ID P1
Service principals use safe redirect URIs Microsoft Entra ID P1
App registrations must not have dangling or abandoned ___domain redirect URIs Microsoft Entra ID P1
Resource-specific consent to application is restricted Microsoft Entra ID P1
Workload Identities are not assigned privileged roles Microsoft Entra ID P1
Enterprise applications must require explicit assignment or scoped provisioning Microsoft Entra ID P1
Limit the maximum number of devices per user to 10 None (included with Microsoft Entra ID)
Conditional Access policies for Privileged Access Workstations are configured Microsoft Entra ID P1

Monitor and detect cyberthreats

Collect and analyze security logs and triage alerts.

Check Minimum required license
Diagnostic settings are configured for all Microsoft Entra logs Microsoft Entra ID P1
Privileged role activations have monitoring and alerting configured Microsoft Entra ID P2
Privileged users sign in with phishing-resistant methods Microsoft Entra ID P1
All high-risk users are triaged Microsoft Entra ID P2
All high-risk sign-ins are triaged Microsoft Entra ID P2
All user sign-in activity uses strong authentication methods Microsoft Entra ID P1
High priority Microsoft Entra recommendations are addressed Microsoft Entra ID P1
ID Protection notifications enabled Microsoft Entra ID P2
No legacy authentication sign-in activity Microsoft Entra ID P1
All Microsoft Entra recommendations are addressed Microsoft Entra ID P1

Accelerate response and remediation

Improve security incident response and incident communications.

Check Minimum required license
Workload identities based on risk policies are configured Microsoft Entra Workload ID
Restrict high risk sign-ins Microsoft Entra ID P2
Restrict access to high risk users Microsoft Entra ID P2

Related content