Introduction

Securing Azure Entra ID (formerly Azure AD) is crucial for maintaining a robust security posture. This post covers essential security measures and how to implement them effectively.

Cleaning Up App Registrations

Identifying Unused Applications

First, identify app registrations with expired credentials:

# Get app registrations with expired secrets/certificates
Get-AzureADApplication | Where-Object {
$_.PasswordCredentials.EndDate -lt (Get-Date) -or
$_.KeyCredentials.EndDate -lt (Get-Date)
}

Verification Process

  1. Check service principal sign-in logs for the last 30 days
  2. Disable service principals showing no activity
  3. Delete the corresponding app registration

Implementing MFA Requirements

Assessing MFA Status

Navigate to Authentication Methods > User Registration Details to identify users without MFA:

  1. Filter by “Not Capable”
  2. Create exclusion list for service accounts
  3. Document impact before enforcement

Creating Conditional Access Policy

{
"conditions": {
"userRiskLevels": ["high"],
"signInRiskLevels": ["high"],
"applications": {
"includeApplications": ["all"]
}
},
"controls": {
"authenticationStrength": {
"requirementType": "mfa",
"methodsType": "phishingResistant"
}
}
}
  1. Navigate to Enterprise Applications > Consent and permissions
  2. Disable “Users can consent to apps accessing company data”
  3. Enable admin consent workflow

Managing Enterprise Applications

  1. Review enterprise app usage patterns
  2. Document business-critical applications
  3. Implement regular review cycles

Best Practices

  1. Start policies in report-only mode
  2. Monitor impact through Azure Monitor
  3. Implement gradual rollout
  4. Maintain service account exceptions
  5. Document all policy changes

These measures significantly improve your security posture while maintaining operational efficiency.