Entra ID and Conditional Access Hardening

A Conditional Access baseline that closes MFA gaps without locking anyone out, rolled out in report-only first.

Duration: 2 to 3 weeks
Price: $3,500 per tenant
Access: Scoped admin roles through a named account you issue, with MFA, revoked at the end.

Who it is for

MSPs that manage Microsoft 365 tenants and know some clients still have accounts without MFA or legacy authentication open.

Scope

Review of sign-in logs and existing policies.
Conditional Access baseline: MFA for all users, legacy authentication blocked, admin protection, device compliance.
Risk-based policies where Entra ID P2 is licensed.
Break-glass accounts.
Report-only rollout, then enforcement.
Privileged Identity Management where licensed.
Documentation and handover.

Your logoEntra ID and Conditional Access Hardening |Prepared for |Rev. 1

1. Identity exposure

ID	Finding	Severity	Effort
E-01	37 users with no MFA registration	Critical	4h
E-02	Legacy authentication used by 2 service accounts	High	2h
E-03	6 permanent Global Administrators	High	1h
E-04	No break-glass account excluded from policies	Medium	30m
E-05	Policy "Require MFA" left in report-only	Medium	30m

Enforcement waits until the 37 users have registered MFA and the 2 service accounts are moved off legacy authentication. Create the break-glass accounts before any policy is enforced.

Your logo on the cover. Client data redacted.

Duration: 2 to 3 weeks.
Price: $3,500 per tenant.

Book a 20-minute call