Audit
We review Entra ID: users without MFA, the list of administrators, unused accounts, legacy protocols, existing policies and Secure Score. You receive a prioritised list of risks and what can be done with your current licence.
Microsoft Entra ID
We manage your company's identities in Microsoft Entra ID: single sign-on to Microsoft 365 and other systems, MFA for everyone, conditional access by device and location, and synchronisation with on-premises Active Directory. We enable, configure and manage it.
Built for ISO 27001NIS2 DORA
- MFA for everyone
- Conditional access
- SSO to business systems
Identity is the new perimeter, and it is usually unprotected
- 100 % of users on MFA, with no exceptions for executives
- SAML / OIDC single sign-on to SaaS systems
- P1 conditional access is included in Business Premium
- 1 minute to revoke access in all systems when someone leaves
Almost every company with a Microsoft 365 tenant already has Microsoft Entra ID, formerly Azure AD. The problem is that it usually still runs on default settings: some users have no MFA, administrator rights are held by people who do not need them every day, accounts of former employees are not disabled, and accounting, CRM or HR systems are accessed with separate passwords that nobody manages centrally. An attacker does not need to break into your servers. One successful phishing email is enough, and they sign in as your employee from anywhere in the world.
We turn Entra ID into the central place for access control. We enable MFA for everyone without exceptions (Microsoft Authenticator, FIDO2 keys, passkeys) and create conditional access policies that check the device, location and risk before letting anyone in. We connect SaaS systems through SAML or OIDC so an employee signs in once, and when they leave, access disappears everywhere the same minute. If you have on-premises Active Directory, we synchronise it through Entra Connect and define which side is authoritative. We separate administrator accounts from daily ones, and with a P2 licence we grant privileges only temporarily through PIM. We tell you in advance what depends on the licence: Free, P1 or P2, compared in the table below.
What we enable
Eight features that we configure and document, according to your licence.
MFA for everyone
Microsoft Authenticator with number matching, and FIDO2 keys or passkeys for administrators and executives. We keep SMS only as a fallback.
Conditional access
Policies by user, device, location and app: we block legacy protocols, require a managed device for sensitive data and restrict sign-ins from unexpected countries.
SSO to business systems
We connect CRM, HR, document and other SaaS systems through SAML or OIDC so employees sign in with their Microsoft account and Entra ID policies apply everywhere.
Entra Connect
Synchronisation with on-premises Active Directory: password hash synchronisation or pass-through authentication, hybrid device join, and a clear source of truth for where users are created.
Administrator protection
Separate administrator accounts without a mailbox, a break-glass account kept in a vault, and with P2, Privileged Identity Management, where rights are granted temporarily and with approval.
Identity Protection
With P2, risk assessment of sign-ins and users: leaked passwords, impossible travel, anonymous networks. When risk reaches a threshold, we require MFA or a password change.
Lifecycle and reviews
Onboarding and offboarding by process, rule-based groups, and with Entra ID Governance, periodic access reviews approved by managers, not by IT.
Global Secure Access
Private Access instead of a classic VPN to internal systems, and Internet Access for web traffic, with the same conditional access rules.
Entra ID Free, P1 and P2
What you can enable with each licence, and which Microsoft 365 subscription already includes it.
| Entra ID Free | Entra ID P1 | Entra ID P2 | |
|---|---|---|---|
SSO to Microsoft 365 and SaaS systems | |||
MFA (Authenticator, FIDO2, passkeys) | |||
Entra Connect synchronisation with on-premises AD | |||
Conditional access | |||
Hybrid device join and dynamic groups | |||
Identity Protection (risk assessment) | |||
Privileged Identity Management (PIM) | |||
Included in | Microsoft 365 Business Basic and Standard | Microsoft 365 Business Premium and E3 | Microsoft 365 E5, or purchased separately |
How we implement it
No downtime and no locked-out executives on Monday morning.
Policy design
We create the policies and enable them in report-only mode so we can see what would be blocked without interrupting anyone. We agree on exceptions: service accounts, printers, legacy applications.
Phased rollout
We enable MFA and policies in groups, starting with IT and management. Employees receive a short guide, and the helpdesk is on standby that day. Then we connect SaaS systems through SSO and, if needed, Entra Connect.
Maintenance
Every month we review risky sign-ins, administrator rights and inactive accounts, and every quarter we run access reviews with managers. We assess and apply Microsoft changes to Entra ID, so you do not have to.
Entra ID is the foundation, and Microsoft 365 security comes next
Identity protection is the first step. The next ones are Defender for Office 365 for email, Intune for devices and Purview for data. We bring all of it together in one Microsoft 365 security service.
Frequently asked questions
How is Entra ID different from on-premises Active Directory?
On-premises AD manages computers and users on the office network and requires a VPN from outside. Entra ID runs in the cloud, manages access to Microsoft 365 and SaaS systems from anywhere, and offers MFA, conditional access and risk assessment that on-premises AD does not have. Both can work together through Entra Connect.
Can we work with Entra ID only, without on-premises AD?
Yes, if you have no legacy systems that require domain membership. Computers join Entra ID directly and are managed through Intune, with files in SharePoint and OneDrive. In our experience, companies of up to a few dozen employees move to cloud-only in a single migration project.
What does conditional access do?
These are rules checked on every sign-in: who is signing in, from which device, from where and to what. For example, from an unmanaged computer allow only the browser without downloads, require MFA from abroad, and let administrators in only from managed devices. It requires a P1 licence, which is included in Business Premium.
Does Entra ID help meet NIS2 and ISO 27001 requirements?
Yes. Access control, MFA, access reviews and audit logs are what these requirements ask for. We provide a configured Entra ID with documented policies as evidence for the audit, and the access review records show that the controls work continuously.
Do we need a P2 licence?
For most companies, P1 from Business Premium is enough: MFA, conditional access, hybrid join. P2 is worth it when you have many administrators or IT contractors and want to grant privileges temporarily through PIM, or when you need automated risk assessment. P2 is bought only for the users who need it.
Related services
Microsoft Power Platform
We build business apps and automate processes with Microsoft Power Platform tools, most of which are already in your Microsoft 365 licence.
Microsoft 365 administration
We take over the day-to-day administration of your Microsoft 365 tenant: users and licences, Teams and SharePoint permissions, mail rules, Secure…
Microsoft 365 licences
We select and supply Microsoft 365 licences as a Microsoft CSP partner: Business Basic, Standard, Premium and Enterprise plans and the Copilot add-on.
Expertise confirmed by certifications
This service is delivered by specialists with valid international certifications. Their expertise is confirmed by independent organisations, not by us.
-
Certified Information Security Manager
Security governance, policies and incident processes following the ISACA methodology.
-
Lead Cloud Security Manager
Cloud security is managed following ISO/IEC 27017 and 27018 practices.
-
Certified Data Privacy Solutions Engineer
Personal data is handled according to privacy by design and GDPR requirements.
Get an Entra ID deployment quote
Tell us how many users you have and whether you use on-premises Active Directory, and within 1 business day we will propose a plan and the licences you need.
We reply within 1 business day