Situ — Enterprise Architecture Studio

It's called Azure AD today. Who knows what Microsoft will call it next year — but the problems are the same ones I've been dealing with for a decade.

The tenant sprawl problem

Most mid-size organisations I walk into have identity chaos they don't know about. Multiple tenants from acquisitions, test tenants that became "temporary" three years ago, developer tenants with production dependencies, partner tenants with guest access nobody tracks.

The first thing I do on any identity engagement is map the actual tenant landscape. Not what the architecture diagram says. What actually exists. I find things: old tenants with active licenses nobody's paying attention to, guest accounts from contractors who left two years ago, service principals with contributor access to production subscriptions.

Cleanup alone can take weeks. And that's before you start improving anything.

Conditional Access is not optional

If you're not using Conditional Access policies, you're running on defaults. The defaults are not good. They let anyone with valid credentials sign in from anywhere on any device. That's not security. That's a welcome mat.

The minimum I configure everywhere:

Require MFA for all users. No exceptions for "it's inconvenient." MFA fatigue is real but the solution is phishing-resistant MFA, not no MFA.
Block legacy authentication. POP3, IMAP, SMTP auth — these protocols don't support modern auth and are the most common vector for password spray attacks. Turn them off. Yes, someone will complain about their old scanner that sends email via SMTP. Give them a connector or tell them to upgrade.
Geographic restrictions where it makes sense. If your company operates in North America, block sign-ins from regions you don't do business in. It's not foolproof, but it eliminates a huge volume of automated attacks.
Require compliant devices for sensitive access. Finance, HR, admin portals — these shouldn't be accessible from personal devices. Intune compliance policies are not hard to set up. The hardest part is the organisational conversation, not the technical configuration.

Guest access is a time bomb

Every guest user in your tenant is an identity you don't control, with access to resources you might have forgotten about. Most organisations have hundreds of guest accounts. Most of them shouldn't exist anymore.

I set up access reviews for guest users. Quarterly, automated, with a simple rule: if the guest hasn't used their access in 90 days, revoke it. The first review always eliminates 30-40% of guest accounts. Nobody notices. That's the problem.

Hybrid identity is still everywhere

Despite Microsoft pushing cloud-native, almost every enterprise I work with runs hybrid: on-prem AD synced to Azure AD via Azure AD Connect. Cloud Kerberos trust, password hash sync, seamless SSO — this stuff works reliably when configured correctly and breaks spectacularly when it's not.

The biggest gotcha I see: attribute flow. On-prem AD attributes that nobody thought about during the initial sync setup become critical years later when a new application expects them in the cloud. Adding attributes to the sync connector is easy. Figuring out which attributes matter and cleaning up decades of inconsistent data in on-prem AD is hard.

My advice: audit your attribute flow annually. Remove what you don't need. Document what you keep. Future you will thank present you when that SaaS integration project doesn't get blocked by missing UPN suffixes or empty department fields.

The principle of least privilege is a process, not a setting

PIM (Privileged Identity Management) exists. Most organisations have it licensed. Most don't use it. Instead, they have 47 global admins, half of whom are break-glass accounts that haven't been rotated in years.

I reduce global admins to 3-4 break-glass accounts (properly monitored, with alerting on any usage) plus PIM-eligible accounts for the actual admins. Everything else goes through just-in-time activation with approval workflows. Yes, it's more clicks for the IT team. Yes, it's worth it.

What I keep telling people

Identity is your security perimeter now. The network perimeter died years ago. If your identity configuration is weak, your entire security posture is weak, regardless of how much you spend on firewalls and endpoint protection.

The good news: Azure AD has excellent capabilities out of the box. Conditional Access, PIM, access reviews, identity protection. Most of what you need is already licensed. The gap isn't technology. It's implementation discipline. Someone has to own identity hygiene as an ongoing responsibility, not a project that ends when the migration is done.