Entrazure
“Our insurer wants MFA everywhere and our network is flat”
The pressure rarely comes from an internal ambition to be more secure. It comes from outside: a cyber insurance renewal with a control questionnaire attached, a prospective customer’s security review that has become a condition of the contract, or an incident at a peer organization that made the board ask a direct question.
The internal picture, when someone finally looks, is usually recognisable. A VPN that grants broad network access once a user is connected. Eleven or twelve accounts holding permanent Global Administrator. Service accounts whose passwords live in a document because rotating them broke something once. Guest accounts from a project that ended in 2022. Conditional access policies that exist, with an exclusion group that has quietly grown to forty members.
None of this happened through negligence. Each item was a reasonable accommodation made under time pressure, and the accommodations accumulated. The question now is which of them to fix first, with a finite budget and a deadline set by someone else.
Why the usual answer fails
The maturity roadmap. The standard consulting response is a zero trust assessment across five or six pillars, scored against a maturity model, producing a two-year roadmap with workstreams. The assessment itself consumes a meaningful part of the budget and several months. At the end of it, the twelve permanent Global Administrators are still permanent, because removing them was scheduled into phase two. A maturity score measures activity. An attacker measures standing privilege.
Buying the architecture. The second response is procurement. A network access product, a microsegmentation platform, an identity governance suite, each with its own console and its own agent. The estate is now more complicated and no less exposed, because the control that would have mattered most, eliminating permanent administrative rights, is a set of decisions rather than a purchase. Microsoft Entra ID already carries most of what is needed. Adding products before using what is licensed is a way of converting a governance problem into a budget problem.
MFA as theatre. Multifactor authentication gets enabled, announced, and reported as complete, while legacy authentication protocols that cannot present a second factor remain permitted. Anyone who wants to bypass the prompt simply uses one. The same pattern repeats with conditional access exclusion groups, created for one executive traveling in one region and never reviewed. A control with an unexamined exception list is a control on paper.
Network-first sequencing. Considerable budget goes into segmenting the network while identity remains the actual path most intrusions travel. Segmentation is worth doing. It is worth doing second, because the compromised credential with standing subscription Owner does not care how many subnets you have.
How we sequence it
Identity first, because identity is the perimeter. Conditional access policies written as code and deployed through a pipeline, so they are reviewable and reproducible rather than clicked into the portal. Legacy authentication blocked. Phishing-resistant methods for administrators before anyone else. Device compliance through Intune as a condition of access to the things that matter. Break-glass accounts created, excluded, stored offline and tested before enforcement.
Standing privilege removed. Permanent Global Administrator and subscription Owner assignments converted to eligible roles through Privileged Identity Management, with approval, justification and time limits. Access reviews scheduled on a cycle so the guest account from 2022 is a matter of routine rather than of archaeology. Workload identities moved to federated credentials, which removes the long-lived secrets that never get rotated.
Then the network and the data plane. Hub-and-spoke topology, private endpoints on PaaS services so data planes are not reachable from the public internet, Azure Firewall or an NVA with rules that are readable, and the VPN replaced as a broad-access mechanism rather than kept alongside the new model. This is platform work, and it belongs in the same structure as everything else, which is what the Azure landing zone engagement establishes. Content permissions are part of the same posture, and they become urgent the moment an assistant can search across them, which is the argument in our Copilot rollout approach.
Detection sized honestly. Defender XDR deployed as one posture across endpoint, identity, Office and cloud apps rather than four consoles, and Microsoft Sentinel with an ingestion design that reflects what you will actually investigate. Sentinel bills per gigabyte, and a security program that becomes a cost incident loses its mandate.
Every control mapped to the question it answers. The insurance questionnaire, the customer security review, the SOC 2 control, the Law 25 obligation. Evidence produced by the platform on a schedule, not assembled the week before an audit. Where the requirement is formal certification rather than a questionnaire, that work continues into compliance architecture, and clinical environments carry stricter data segmentation again, described in our healthcare work.
An exclusion register with expiry dates. Every exception written down with an owner, a reason and a date it is reviewed. This is a small artefact and it is the one that keeps the posture from decaying back to where it started.
The engagement that delivers it
Six weeks. Week one is the posture review: policies as they exist, privilege inventory, legacy authentication, exclusions, guests, service accounts, and the questionnaire you are being held to. Weeks two and three deploy conditional access in report-only mode, measure the impact, fix the legitimate breakages and then enforce, alongside the privileged access model. Weeks four and five cover network and data plane changes and the detection layer. Week six is evidence, handover and the exclusion register.
Security architecture on the engagement is led by certified security architects, and the output is written to be read by an auditor and an insurer, not only by an engineer. You keep the policies as code, the privilege model, the access review schedule, the exclusion register and the control-to-question mapping.
At enterprise and government scale, namespace and digital territory intelligence is a separate layer of the same problem, and we act as MSSP and reseller for Klarvant where it applies. Where the estate is mid-migration, the identity and network model should be built into the target rather than retrofitted, which is why it is designed inside the VMware exit plan when one is running.
Questions we get
Where do we start if we can only do one thing?
Remove standing privilege. Convert permanent Global Administrator and subscription Owner assignments to eligible roles activated through Privileged Identity Management, with approval and justification. It is the single control that most reduces the blast radius of a compromised account, it costs nothing in additional products, and it can be done in days rather than quarters.
We already turned on MFA. Are we covered?
Only if legacy authentication is blocked. Protocols that cannot present a second factor bypass the prompt entirely, so an estate with MFA enabled and legacy auth still permitted is protected in appearance rather than in fact. We check that first, along with the exclusion groups, which are the other common place a policy quietly stops applying.
Do we need to microsegment the network?
Eventually, and less urgently than most vendors suggest. Identity is where the majority of intrusions actually travel, so identity controls buy more risk reduction per week of effort. Network segmentation matters and it comes after conditional access, privileged access and device compliance are real, not before.
Our cyber insurance renewal asks for specific controls. Can you evidence them?
Yes, and that is usually the practical driver. Each control we implement is mapped to the question it answers on an insurance or customer questionnaire, and the evidence is generated by the platform rather than assembled by hand. Screenshots taken the week before an audit are not evidence, they are a snapshot of a good week.
What about service accounts and automation?
They are usually the weakest part of an estate and the least discussed. We move pipelines and applications to workload identities with federated credentials so there is no long-lived secret to rotate or leak, inventory what remains, and put an expiry and an owner on each one.
Will this break how people work?
Some of it will, if it is deployed carelessly. We run policies in report-only mode first, measure who would have been blocked and why, fix the legitimate cases, then enforce. Break-glass accounts are created, excluded, stored offline and tested before any policy goes live, because the fastest way to lose the program is to lock out the administrators.