Identity and administrator access · Microsoft Entra ID
Redgate Protection works with internal IT teams on Entra ID: reviewing Conditional Access policies, moving administrator roles to just-in-time activation with Privileged Identity Management, planning emergency-access accounts, and writing a sign-in review procedure your team can keep running.
Configuration and documentation for your team to operate. Not monitoring, incident response or penetration testing.
01 · Services
Each produces configuration you can see in the Entra admin centre and a document explaining why it’s set that way. Take them in any order, though most teams start with the policy review.
A structured review of your Conditional Access policies: what each one does, who it excludes, and where the gaps are.
Licence dependency: Conditional Access needs Entra ID P1 or a plan that includes it.
Replace always-on administrator rights with roles people activate when they need them, for a limited time, with a reason recorded.
Licence dependency: Privileged Identity Management needs Entra ID P2 or an equivalent governance licence.
A plan, and accounts, for the day normal administrator sign-in doesn’t work: an MFA outage, a misconfigured policy, or a locked-out admin.
The credentials stay with you. We never keep them.
A short, repeatable routine for reading sign-in and audit logs, so unusual activity is noticed by your team on a regular basis.
A procedure for your team to run. Not a monitoring service. Risk-based reports depend on your licence level.
02 · Just-in-time admin
The same administrator over one illustrative week. With a permanent role, the rights are there every hour. With an eligible role in PIM, they exist only during the activations the work needed.
Some roles and service accounts can’t use activation sensibly. The configuration notes which ones, and why.
03 · Emergency access
Emergency-access accounts exist so a mistake in a policy, or an outage, doesn’t lock every administrator out of the tenant. They’re only safe when they’re treated as a controlled procedure.
Cloud-only, not tied to any one person, with the highest role kept to these two.
Excluded only from the policies that could lock them out, and documented.
Any sign-in by an emergency account notifies named people straight away.
Credentials stored securely by you, and a test sign-in recorded at agreed intervals.
The exact design depends on your tenant and authentication methods. We describe the trade-offs; your team decides and holds the credentials.
04 · Worksheet
A printable worksheet for listing every administrator role holder, how the role is assigned, how they sign in, and whether they still need it. It includes checks for emergency-access accounts and an action table.
It prints in landscape, so each row has room. Fill it in from the Entra admin centre’s role assignments. You don’t need special tools.
05 · About
Redgate Protection concentrates on identity: the policies that decide who can sign in, and the roles that decide who can change your tenant. It works alongside internal IT teams and leaves them with configuration and procedures they own.
06 · Contact
Tell us roughly how many users and administrators you have, and which of the four areas you’d like to start with.
Don’t include passwords, access tokens, recovery codes, sensitive logs or confidential incident details.
Not for emergencies. If you’re responding to an active incident, contact your incident-response provider directly.