Advanced: Entra ID Security Controls, Implemented

Baseline → Advanced → Pro
Advanced includes Baseline and fixes the low-friction gaps it finds. It also assesses every feature in your license plan, including those no standard requires, and implements them or adds them to the roadmap.

Baseline tells you what is wrong. Advanced is for the companies where the finding was never the hard part. You already suspect the answer. What you do not have is someone with the time, the seniority and the tenant access to go and fix it.

This is an offer for companies using Microsoft Entra ID as their primary identity provider, who want their identity setup configured to actually resist an attack rather than merely to pass a checklist. Which controls exist for me to configure depends on your Microsoft licenses, which the Baseline page sets out in a table.

Low friction and high friction. A control is low friction when it needs little training and only small changes to how people work, or affects only a few people, for example phishing-resistant MFA for administrators or blocking legacy authentication. It is high friction when many users or whole processes have to change, for example MFA for all B2B guests, access reviews or privileged access approval. Advanced does the low-friction controls; which ones are included is agreed in writing when I quote the implementation. The high-friction ones are chosen at scope selection and delivered in Pro.

The Advanced security package

How the engagement runs

1. Initial scope alignment. A 30-minute conversation: introductions and your overall requirement, plus a first read on whether this is the right tier. No charge, no obligation.

2. Kickoff meeting. Bring both a business and a technical representative. We go through what is actually in scope and what is not, in enough depth to start scoping the engagement itself.

3. Read-only access first. You create a service principal with reader permissions, scoped to configuration data. No mailboxes, no files, no user content. The analysis runs on that alone, and you can revoke it at any point.

4. Collection and analysis. Entra ID, and the external access settings of Teams, SharePoint and OneDrive, are read and analysed against Microsoft best practice and recognised control frameworks. Automation gives the breadth: every setting gets read, which a person reviewing a tenant by hand does not manage.

5. Expert validation and sequencing. Every finding, and the reasoning behind it, is reviewed by a CISM and CEH certified consultant with more than a decade of experience in the field. The findings are then turned into an order of work, weighed against your license, your appetite for user friction and what your own team can absorb.

6. Quote and agreement on what gets implemented. The findings now show which licenses you hold, which controls are already switched on and how mature your organisation is, so this is where I quote the implementation. We agree in writing which low-friction controls I change, in which window, and what the rollback is. Nothing is switched on in a production tenant as a surprise.

7. Implementation, then hand-over. The read-only access stays read-only. For the implementation window you grant a separate, time-limited change role, preferably to me. If you prefer, you make the changes yourselves with me guiding on screen. The role is removed at hand-over, and every change is logged and has a written rollback. The agreed low-friction controls are configured, tested and documented. The engagement closes with a walkthrough of what changed, what is left, and in which order to take it.

Security controls that pay for themselves

IT security is not only a cost. Many treat security initiatives as purely risk-reducing, with no tangible return, and that is not correct. Several of the controls implemented in Advanced remove friction and administrative work at the same time as they close a gap.

• Phishing-resistant MFA for your most privileged administrators. Global administrators, security administrators and the other tier 0 roles sign in with passkeys or security keys. These accounts are the first thing an attacker goes for, and only a handful of people are affected, so the risk drops sharply without changing how the rest of your staff sign in. A passkey is also quicker than a password and a code.
• Single sign-on. One authentication for the applications that already support it, set up without training or a new way of working. Fewer passwords to remember, fewer to reset, and a shorter lead time to a working new starter.
• Joiner and leaver basics, built into Entra. Dynamic groups and group-based licensing give a new starter the right access and license from day one, and a tested leaver routine removes the account, sessions, sign-in methods and license on the last day. It uses native Entra settings only. Triggering it automatically from your HR system is part of Pro.
• Security metrics and reporting. Once the controls exist, they can be measured. A small set of metrics read from your tenant, such as Secure Score and MFA coverage, is part of the hand-over, so you can show your posture to customers, your board and your insurer instead of asserting it. It is a snapshot, not an ongoing reporting service.

Timeframe, and what this is not

Advanced is a project with an end. There is no subscription, no retainer and nothing recurring to sign. You revoke the access when the work is done.

Advanced is priced as Baseline plus the implementation, which I quote from the findings. The review follows the Baseline timing: deliverables are ready within a week of the access being in place. The implementation typically takes one to four weeks, depending on the size of your estate and how many controls are agreed.

Advanced does not include the high-friction controls and features, which need many users or whole processes to change. Major migrations, such as on-premises Active Directory to Entra ID, count as high-friction. It does not redesign your processes or train your staff either. Those sit in Pro.

Not included in any tier:

• License purchases and third-party fees. I tell you which license unlocks a control and what it would cost. Buying it, and any vendor fees, is yours.
• Changes inside other vendors’ applications. If an application lacks the support a connection needs, that is for its vendor. I document it and the system gets a manual step.
• Certification or audit attestation. The work maps to recognised standards but does not certify you against them.

Frequently asked questions

Book a 30-minute conversation

Thirty minutes, no charge, no obligation. If Advanced is more than you need, I will tell you which tier is the right one.