Working together · Expertise
Identity is the new perimeter. Let's make it hold.
Most incidents start with a stolen sign-in. We design Microsoft Entra ID, Conditional Access and privileged access so that access is earned on every request, using the Microsoft licences you already pay for before anyone suggests a new product.
Who it is for
Is this you?
- Firms on Microsoft 365 that hold E3, E5 or Entra ID P1 or P2 licences and are not sure how much of them they use
- Firms where administrators hold rights they rarely need, or where test and temporary accounts have piled up
- Firms that let staff or contractors work from personal devices and need to decide what those devices can reach
- Firms moving away from VPN-based access towards a Zero Trust model
Available through Foundation Advisory
What you get
What is included
An identity review
Entra ID, Conditional Access, sign-in methods and administrator roles reviewed against how your firm really works, with findings ranked by risk.
Phishing-resistant sign-in
A plan to move administrators first, then everyone, to sign-in methods that cannot be relayed through a fake website, such as passkeys and security keys.
Just-in-time privileged access
Permanent administrator rights replaced with rights that are requested, time-limited and logged, using Privileged Identity Management (PIM).
Device conditions as gates
Conditional Access that checks a device's state before granting access, without forcing every personal device into full management.
Session protection
Continuous access evaluation and session controls set up for what they are designed to do, so a stolen session is cut off rather than left running.
Emergency access done properly
Break-glass accounts that are separate, monitored and tested, so an outage or misconfiguration cannot lock you out.
How it works
From first conversation to results
Read-only review
We review your tenant configuration with read-only access and map it against the five common gaps.
Design
A target design and a phased plan, starting with the changes that remove the most risk for the least disruption.
Pilot
Changes are tested on a pilot group in report-only mode first, so nobody is locked out.
Roll out and evidence
Your IT team or provider makes the changes with our guidance; we check the result and record it.
What this is not
- We work with what you have. If a new product is genuinely needed, we will say so and explain why; we do not resell it.
- Your IT team or provider makes the configuration changes. We design, guide and verify.
Related thinking
Read more
The VPN Trap: Why Legacy Remote Access Is a Board-Level Risk
Hairpinning, split-tunnelling, encrypted blind spots and ransomware access brokers, and the alternatives that work.
Top 10 · Identity and accessIdentity and Access Management: Top 10 Must-Do Actions
The ten identity controls to put in place first, from phishing-resistant sign-in to least privilege.
Strategy · Identity and accessJust-in-Time Privileged Access Strategy
Replacing standing admin rights with Entra PIM, plus on-premises, multi-cloud and PAM product options.
White paper · Identity and accessThe Evolution of Authentication: From Local Passwords to Hardware-Backed Identity
Standards-referenced technical history of authentication, from local passwords and RADIUS to federation, passkeys and device-bound credentials.
Questions
Common questions
We already have multi-factor authentication. Is that not enough?
It stops most password attacks, but text codes and push prompts can be relayed through convincing fake sign-in pages. Phishing-resistant methods close that gap, and administrators should move first.
Do we need E5?
Not necessarily. We start with what you hold and show what it can do. Sometimes a targeted add-on is worth it; often the capability is already there and switched off.
Can staff use personal devices?
Usually, with the right conditions. A device can be required to meet a minimum standard before it reaches sensitive data, without your firm managing the whole device.
Start with a conversation
Tell us about your organisation, your regulators and what is worrying you. We will say plainly whether we can help, and how.
Book a conversation