For every organization, how it manages its external identities is critical. There are two main categories: MS Entra B2B and B2C tenants; the first, usually known as the workforce tenant, covers the organization’s internal identities, while B2C covers clients/partners who access the organization’s services.
This article will help you to get an idea of why IAM best practices are important for organizations to adopt, but I would also suggest reading the CAF Identity and access management design area article to immerse yourself more deeply.
Let’s get started
I assume everyone who reads this article is familiar with terms such as Multi-Factor Authentication (MFA), the principle of Least Privilege. Conditional Access Policies (CAPs); Privileged Identity Management PIM); applying Azure policies; resource locks; secure application access using App registrations and managed identities; and, last but not least, auditing.
That said, I will explain, in a nutshell, which of the above it is, highlighting the licenses, roles, and administrative effort required for an organization to apply them.
Multi-Factor Authentication (MFA)
Multi-Factor Authentication (MFA) improves your tenant security by requiring two or more ways to verify identity. After entering a password, users may approve the sign-in using Microsoft Authenticator, which helps block attackers. All users, especially admins, should use MFA. Microsoft Entra Conditional Access can enforce MFA based on user identity, app, location, and sign-in risk.
The principle of Least Privilege
The principle of Least Privilege gives users, apps, and services only the permissions they need to do their work. For example, if someone only needs to view resources, they should not be able to delete or change them.
Conditional Access Policies (CAP)
Conditional Access policies allow organizations to control access based on user, device, location, and sign-in risk. For example, you can use multi-factor authentication (MFA) to block access from risky locations. Administrators must regularly update these policies while ensuring emergency (break-glass) accounts remain accessible.
Privileged Identity Management (PIM)
Microsoft Entra Privileged Identity Management (PIM) helps organizations manage access to important resources. Instead of giving admins permanent permissions, PIM allows them to activate those permissions only when needed.
Organizations can require approval, MFA, or a justification before granting access. PIM also tracks who has special roles and when they use them, reducing the risk of permanent admin access.
To use PIM, you usually need Microsoft Entra ID P2 or a proper governance license. Admins must set up assignments and regularly monitor activity.
Azure Policies
Azure Policies help organizations manage Azure resources by setting rules for what resources can be deployed, requiring specific tags, or enforcing security policies. You can apply these policies at various levels: management groups, subscriptions, or individual resources to ensure consistent management.
An important step is to test new policies first before applying them to avoid interrupting ongoing work.
Resource Locks
Azure resource locks can prevent accidental deletions or changes, mainly in production environments. There are two main types of locks:
- CanNotDelete: It prevents deletion but allows changes.
- ReadOnly: Prevents both deletions and modifications.
You can apply these locks at several levels, such as subscription, resource group, or resource. Azure provides these locks for free, but administrators need permission to manage them and check for exceptions. It’s important to test the locks before applying them.
App registrations and managed identities
Apps need their own identities and permissions to access resources. Microsoft Entra app registrations create the app’s identity, while service principals represent the app.
For Azure services, managed identities are a good choice since Azure manages their credentials. You can use them to access Azure Key Vault or Azure Storage account services.
It’s a best practice for admins to set permissions, limit access to what’s needed, and check app credentials. Use certificates instead of long-lasting client secrets.
Auditing and monitoring
The audit process tracks resource access and changes, provided security policies are in place. Microsoft Entra logs identity activities, while azure activity log records actions.
These logs can identify suspicious sign-ins and monitor compliance. You can send them to Azure Monitor or Microsoft Sentinel for analysis and alerts.
You can use basic logging for free, but some special features might cost money. Admins need to decide how long to keep logs, set up alerts, and make sure only authorized people can see the logs.
Summarizing my thoughts
IAM requires frequent checks on permissions, policies, privileged access, app identities, and audit logs. Focus on the biggest risks first. Test changes before applying them and track any exceptions.
The aim is to ensure secure access while allowing people and apps to work. By using identity controls with Azure governance, organizations can limit unnecessary access and maintain security.