SAMPLE-ENTRA-01 · FICTIONAL DATE 2026-01-12
Example Workshop Ltd · Entra ID and Conditional Access Review
Status: Fictional format sample · Domain label: example.test (reserved fictional domain; no real organisation) · Method: read-only review of supplied evidence; no live access.
Scope
Conditional Access policies, administrator role assignments, authentication methods and user consent settings for one fictional tenant, from administrator-supplied exports.
Executive summary
The fictional tenant has a sound base policy but three gaps that matter most: legacy authentication is not blocked, one broad MFA policy has a large undocumented exclusion group, and administrators hold permanent roles. None of these were tested live; each follows from the supplied exports.
Evidence reviewed
| ID | Source | Coverage | Status |
|---|---|---|---|
| E-01 | Conditional Access policy list export | All 9 policies, with users, apps and conditions | Provided in full |
| E-02 | Role assignment export | Directory roles, active and eligible | Provided; PIM data absent (not licensed) |
| E-03 | Sign-in log summary, 30 days | Legacy authentication and report-only results | Provided; summary only |
| E-04 | Authentication methods policy screenshot | Enabled methods and targets | Provided |
| E-05 | User consent settings screenshot | Consent and admin consent workflow | Provided |
What was not checked
- Device compliance state (no Intune data supplied)
- Guest and cross-tenant settings
- Individual user MFA registration status
- Anything outside the five exports above
Findings
Severity: High means fix first; Medium means plan soon; Low means tidy up.
| ID | Severity | Finding | Evidence | Recommended next step |
|---|---|---|---|---|
| F-01 | High | Legacy authentication is not blocked by any policy | E-01, E-03: no block policy; 112 legacy sign-ins in 30 days from 3 accounts | Confirm the 3 accounts and clients, move them to modern authentication, then block legacy authentication. |
| F-02 | High | "Require MFA, all users" excludes a 41-member group with no owner or review date | E-01 | Name an owner, remove members who no longer need the exclusion, add an expiry review. |
| F-03 | High | 6 Global Administrators hold permanent assignments | E-02 | Microsoft recommends fewer than five Global Administrators and just-in-time access through PIM. Reduce the number and make assignments eligible where licensing allows, or document the exception. |
| F-04 | Medium | Only one emergency access account found; it is excluded from 6 of 9 policies | E-01, E-02 | Create a second account, exclude both consistently, store credentials offline and alert on any sign-in. |
| F-05 | Medium | Users can consent to applications without admin review | E-05 | Restrict user consent and enable an admin consent workflow; review existing grants. |
| F-06 | Low | 3 policies have been in report-only mode for over 180 days | E-01, E-03 | Review the report-only results and enforce, amend or retire each policy. |
Fix first
- Block legacy authentication after confirming the 3 accounts Effort: Low.
- Review and shrink the MFA exclusion group Effort: Low.
- Reduce permanent Global Administrators Effort: Medium.
- Add the second emergency account Effort: Low.
- Restrict user consent and enable admin consent workflow Effort: Medium.
30/60/90-day plan
- First 30 days: Confirm the legacy accounts and block legacy authentication; clean up the exclusion group; add the second emergency account.
- By 60 days: Reduce permanent administrators; restrict user consent; decide on each report-only policy.
- By 90 days: Re-export the settings for a follow-up check, add alerts for emergency account use, and schedule a quarterly review.
Customer decision
- Approval: this sample authorizes no changes; no remediation was performed.
- Limit: findings reflect only the evidence listed above, as supplied at the time.
Limitations
This fictional sample demonstrates format, not a real assessment. It contains no real customer data, gives no security or compliance guarantee, and made no change to any system.