Microsoft Entra
Welcome to Microsoft Entra ID Protection
Microsoft analyzes trillions of signals per day so you can easily identify and address identity risks in your organization. Powered by 65+ Trillion Threat Signals.
| Timestamp | Event Type | Username | Source IP | Result |
|---|
Hybrid Identity & On-Premises Protection
Provide a common identity for users by syncing Active Directory with Microsoft Entra Connect, and detect on-premises threats with Microsoft Defender for Identity.
Directory Connector Accounts
| Active Directory Forest | Connector Health | Last Synchronization |
|---|
Defender for Identity Sensors & Detections
| Sensor | Domain | Version | Status | Open Alerts |
|---|
| User Identity | Client Tenant | Role & Privilege | Department | MFA Status | Status | Actions |
|---|
| Group Name | Client Tenant | Group Type | Members | Description & Role Mapping | Actions |
|---|
8 Enterprise Role-Based Access Control (RBAC) Roles
RBAC Module Privilege Matrix
| RBAC Role | Cloud Infrastructure | User Identities | Security & MFA | Disaster Recovery | Audit Logs |
|---|---|---|---|---|---|
| Super Administrator | Full Control | Full Control | Full Control | Full Control | Full Control |
| Security Administrator | Read Telemetry | Full Control | Full Control | Audit Only | Full Control |
| Server Administrator | Full Control | None | Read Only | Snapshot/Restart | Read Only |
| Client Administrator | Tenant Scoped | Tenant Scoped | Tenant Scoped | Tenant Scoped | Tenant Scoped |
| Backup Administrator | Read Only | None | Read Only | Full Control | Read Only |
| Monitoring Engineer | Read Telemetry | None | SIEM View | Read Only | Read Only |
| Support Engineer | Read Status | Reset Passwords | Re-pair MFA | None | Read Logs |
| Read-Only Auditor | Read Only | Read Only | Read Only | Read Only | Export Reports |
Overview & Zero Trust Policy Engine
0 Enabled • 0 Report-only • 0 Off • 0 Applications Covered
Cryptographically binds session tokens to authorized Windows devices to combat token theft and replay attacks for Exchange Online & SharePoint Online.
Requires administrators to satisfy Phishing-Resistant MFA before executing sensitive actions such as altering Conditional Access policies or deleting tenant credentials.
Utilizes Continuous Access Evaluation to promptly invalidate access tokens when the client IP address deviates from tenant trusted locations in near real-time.
Target apps dynamically using custom security attributes without manual policy bloat.
Microsoft Entra ID supports IPv6 IP ranges for Named Locations. Update your Named Locations with IPv6 ranges to keep location-based policies accurate.
Learn more| Description | Suggested Policy Templates |
|---|---|
| No active security alerts in the last 7 days. | |
| Policy Name | Policy Type | Scope & Conditions | Client Tenant | Enforcement Status | Toggle State |
|---|
Converged Authentication Methods Policy
Manage all authentication methods used for MFA and SSPR in one unified policy and migrate off legacy MFA policies.
| Authentication Method | Target Scope | Security Level | Policy Status |
|---|---|---|---|
| FIDO2 Security Key & Passkeys | All users | Phishing-Resistant | Enabled |
| Microsoft Authenticator (Push + Number Match) | All users | High (Number Matching) | Enabled |
| Certificate-Based Authentication (CBA on Mobile) | All users | Phishing-Resistant (EO 14028) | Enabled |
| Temporary Access Pass (TAP) | All users | Time-Bound (8 hrs) | Enabled |
| Hardware OATH Tokens (FOB) | All users | High | Enabled |
| SMS & Voice Call (Legacy) | Disabled | Deprecated | Disabled |
Overview & Privileged Access Reviews
Ensuring that the right people have the right access to the right resources, at the right time.
Woodgrove | Access Reviews for Azure AD Directory Roles
| Role | Review Scope | Owner / Reviewer | Start Date | End Date | Status | Action |
|---|
Automate Identity Processes (Joiner / Mover / Leaver)
Manual processes are slow for users and error-prone for IT. Automate employee onboarding, department moves, and voluntary offboarding.
Customer & Partner Identity (CIAM)
Personalize and secure access to any application for customers, partners, and external guest accounts.
Identity Providers
| Identity Provider | Client / Application ID | Status |
|---|
Decentralized Identity & Verifiable Credentials
Confidently issue and verify workplace credentials, education status, and certifications using open W3C DID standards.
Verify employment to receive partner discount. No personal phone or home address shared.
Active Verifiable Credentials in Tenant
Cloud Infrastructure Entitlement Management (CIEM)
Comprehensive visibility and control over permissions for any identity and any resource across AWS, Azure, and GCP.
Cloud Entitlement Findings
Non-Human Identities & Service Principals
Workload identities now outnumber human identities 10:1. Secure adaptive access, detect compromised workloads, and enforce app health.
No application health recommendations at this time. All registered workloads are operating nominally.
Workload Identity Inventory
| Workload | Identity Type | Client Tenant | Assigned Permissions | Risk Level | Last Active |
|---|
Microsoft Entra Internet Access (SWG)
Identity-centric Secure Web Gateway (SWG): Protect against web threats and malicious traffic with universal Conditional Access.
Block risky categories and enforce TLS inspection with Universal Conditional Access.
Protects against data exfiltration to unauthorized foreign tenants and personal Microsoft accounts without requiring on-prem proxies.
135a0f48-eb72-4859-8509-0ef1a2791f1abeeff91e-83aa-4c75-8df0-23fcd9ba3263Validates edge connectivity while restoring the original user IP for Conditional Access, risk, and audit logs.
Zero Trust Network Access (ZTNA) & App Discovery
Moving beyond VPNs: securely connect remote users to private apps across on-premises, cloud, and hybrid environments.
None configured
No client process rules configured
Private Application Discovery & Traffic Records
| Discovered Record | Users | Destination IP | Port | Protocol | Last Access | Action |
|---|
Client & Branch Office Connectivity
Connect any device and branch office network through Global Secure Access clients and IPSec VPN tunnels.
Federated & Local Identity Providers
| Identity Provider | Protocol | Primary Tenant Domain | Sync Status | Active Accounts | Status |
|---|---|---|---|---|---|
|
Enterprise MS SQL Native Directory ServerAdminCenterDB |
Encrypted Native Auth | contoso.com |
Zero-Trust Secured | 1 Super Administrator | Active |
| Service Account Name | Client Tenant | Role & Scope | API Key Prefix | Last Used | Status |
|---|
| Timestamp | Event Type | Username | Client | Source IP & Location | Auth Method | Result |
|---|
| User Account | Client Tenant | Device & Workstation | Browser Agent | IP Address & Location | Started At | Status | Action |
|---|
| Client ID | Client Name | Company Legal Name | Contact Person | Email / Phone | Status | Servers | Actions |
|---|
| Hostname | Assigned Client | Server Group | Cloud Infrastructure | Operating System | IP Address | Status | Actions |
|---|
| Group Name | Client Tenant | Total Member Servers | Description & Workload Scope | Actions |
|---|
Client ID Management & Tenant Identifiers
User AuthorityAssign and govern custom Client IDs directly. User-specified identifiers take full precedence over system numbers.
| Current Client ID | Client Name | Company Legal Name | ID Format | Associated Servers | Status | Date Registered | Actions |
|---|
Windows Admin Center (Manage WAC)
GATEWAY ACTIVE Reverse ProxyCentralized Windows Admin Center gateway connection bound to: /wac/
