Identity, privileged access and Conditional Access assessment
Identity, privileged access and Conditional Access assessment with clear priorities
Understand where account governance and access controls need attention. A scoped, read-only review examines identity lifecycle, privileged roles, multifactor authentication and Conditional Access to inform a prioritized improvement plan.
MIS
CISSP
CHISL
CPHIMS
CDH-E
Will Long Sr. · Founder
MIS · CHISL · CDH-E · CISSP · CPHIMS
Nearly 40 years in IT & cybersecurity
Former VP & CISO, Children’s Health System of Texas
Tim Pelikan · Co-Founder
Credential details pending confirmation
30 years in cybersecurity & data risk
Interviews & industry conversations
Coffee With Closers
Cybersecurity With Discern
“ICA provides distinctive security professionals who excel at building strong client relationships, demonstrate exceptional organization, and deliver practical, risk-based consulting recommendations to our clients.”
Michael Cox, CIPP/US
Chief Privacy Consultant & Founder, SoCal Privacy Consultants
Partner endorsement of ICA’s advisory work
Decide which access gaps need attention first
Administrative roles have accumulated. Departing employees leave uncertain account ownership behind. Different applications follow different access rules, and the identity owner needs to explain which gaps matter most.
This assessment is intended for identity owners, IT directors, CISOs and Microsoft platform leads facing excessive access, administrator exposure or inconsistent joiner and leaver processes. It connects account-control observations to decisions about access cleanup and governance priorities.
Set the directory and application boundaries
The review covers agreed identity lifecycle processes, privileged roles, multifactor authentication (MFA), Conditional Access and account-governance controls. Lifecycle coverage considers how access is granted when people join, reconsidered when responsibilities change and removed when they leave. Privileged access coverage examines selected administrative accounts and the responsibilities those roles carry.
Scoping identifies the directories, tenants, privileged accounts and selected applications to include. In a Microsoft Entra environment, Conditional Access policy scope and exclusions help explain which users and resources a policy addresses. The review considers the features actually present in your environment. Coverage of one tenant or selected applications should not be treated as a review of every identity system.
Compare read-only evidence with intended controls
The engagement uses a read-only control review. Agreed configuration evidence is considered alongside explanations from identity and application owners. Relevant materials may include account inventories, role assignments, MFA settings, Conditional Access policies and records of access approvals or removal. The evidence request is tailored to the agreed scope.
For selected policies, the review can consider assignments, exclusions and whether the policy is enabled, disabled or report-only. These details help distinguish a documented intention from the configuration being reviewed. Evidence limitations remain visible in the findings. Configuration review does not demonstrate that every access path has been tested, and the engagement does not change production policies.
Use the findings to plan account-control improvements
The catalog identifies three typical outputs. Their coverage and level of detail are agreed for the engagement:
Identity-control findings explain observed gaps in lifecycle processes, MFA, Conditional Access and account governance within scope. Identity owners can use these findings to discuss where documented requirements and reviewed evidence differ.
Privilege observations describe concerns about selected administrative roles and account access. They provide a basis for discussing whether privileges remain appropriate and who should decide on changes.
Prioritized improvement plan puts recommended work in an order your team can use for planning. Leadership can weigh the recommendations against operational constraints, while delivery owners identify changes that need their approval.
These outputs support decisions about remediation. They do not include carrying out account cleanup or deploying revised policies.
Prepare owners, evidence and access arrangements
Start scoping with the concern that prompted the assessment and the environments involved. Tenant and directory count, privileged-account population, selected applications and evidence depth affect cost and timing. Available configuration visibility and the people needed to explain access workflows also influence the engagement.
Identify an identity owner and representatives who understand application access and personnel changes. Prepare relevant account-governance procedures and existing access-review records. Agree the evidence-handling arrangements and authorized read-only access before review begins. Supported platforms, the review approach and suitable specialist capacity need confirmation for the proposed package. Access permissions should match the agreed review rather than grant unnecessary administrative power.
Keep identity review separate from broader technical work
This is a focused account-control assessment. Coordinate its scope with the Microsoft 365 Security Configuration Assessment so the same identity settings are not reviewed twice. A broader Microsoft 365 review may be more appropriate when the buying concern extends beyond account security.
Read-only configuration review is distinct from vulnerability scanning and authorized penetration testing. Intrusive testing requires a separately agreed scope and written authorization. Remediation execution, ongoing access administration and continuous monitoring are outside this assessment. The findings reflect selected evidence and coverage; they do not certify compliance or guarantee prevention of account compromise.
Identity assessment questions
Who should consider this assessment?
Identity owners, IT directors, CISOs and Microsoft platform leads concerned about excessive access or inconsistent account processes. It fits a defined need to review identity controls and choose improvement priorities, rather than a request to operate the identity environment.
Will the review cover every directory and application?
Coverage is agreed during scoping. The engagement identifies included directories, tenants, privileged accounts and selected applications. Systems outside those boundaries remain outside the findings, and other platform coverage requires capability confirmation.
What evidence does the review use?
The read-only review uses agreed configuration evidence and relevant account-governance records. Owners help explain intended controls and exceptions. Evidence gaps are identified rather than treated as proof that a control works.
What determines cost and timing?
The number of environments, selected accounts and applications affects effort. Review depth, evidence readiness and access arrangements also matter. Package scope and specialist capacity must be confirmed before price or timing can be established.
How does this differ from a Microsoft 365 assessment?
This assessment concentrates on identity lifecycle and access controls. The Microsoft 365 Security Configuration Assessment addresses a broader configuration concern. Agree which engagement owns overlapping identity controls before commissioning both.
Does the improvement plan include changing policies?
The plan recommends priorities. Your organization retains responsibility for approving and implementing account or policy changes. Implementation and any subsequent validation require separate agreement; retesting is not included by default.
Give account-security work a defined starting point
Bring a clear identity concern and the environments it affects. A scoped review can give your team identity-control findings, privilege observations and an improvement plan grounded in selected evidence. Discuss the right boundaries before committing resources to access changes.
Decide which access gaps need attention first
Administrative roles have accumulated. Departing employees leave uncertain account ownership behind. Different applications follow different access rules, and the identity owner needs to explain which gaps matter most.
This assessment is intended for identity owners, IT directors, CISOs and Microsoft platform leads facing excessive access, administrator exposure or inconsistent joiner and leaver processes. It connects account-control observations to decisions about access cleanup and governance priorities.
Set the directory and application boundaries
The review covers agreed identity lifecycle processes, privileged roles, multifactor authentication (MFA), Conditional Access and account-governance controls. Lifecycle coverage considers how access is granted when people join, reconsidered when responsibilities change and removed when they leave. Privileged access coverage examines selected administrative accounts and the responsibilities those roles carry.
Scoping identifies the directories, tenants, privileged accounts and selected applications to include. In a Microsoft Entra environment, Conditional Access policy scope and exclusions help explain which users and resources a policy addresses. The review considers the features actually present in your environment. Coverage of one tenant or selected applications should not be treated as a review of every identity system.
Compare read-only evidence with intended controls
The engagement uses a read-only control review. Agreed configuration evidence is considered alongside explanations from identity and application owners. Relevant materials may include account inventories, role assignments, MFA settings, Conditional Access policies and records of access approvals or removal. The evidence request is tailored to the agreed scope.
For selected policies, the review can consider assignments, exclusions and whether the policy is enabled, disabled or report-only. These details help distinguish a documented intention from the configuration being reviewed. Evidence limitations remain visible in the findings. Configuration review does not demonstrate that every access path has been tested, and the engagement does not change production policies.
Use the findings to plan account-control improvements
The catalog identifies three typical outputs. Their coverage and level of detail are agreed for the engagement:
Identity-control findings explain observed gaps in lifecycle processes, MFA, Conditional Access and account governance within scope. Identity owners can use these findings to discuss where documented requirements and reviewed evidence differ.
Privilege observations describe concerns about selected administrative roles and account access. They provide a basis for discussing whether privileges remain appropriate and who should decide on changes.
Prioritized improvement plan puts recommended work in an order your team can use for planning. Leadership can weigh the recommendations against operational constraints, while delivery owners identify changes that need their approval.
These outputs support decisions about remediation. They do not include carrying out account cleanup or deploying revised policies.
Prepare owners, evidence and access arrangements
Start scoping with the concern that prompted the assessment and the environments involved. Tenant and directory count, privileged-account population, selected applications and evidence depth affect cost and timing. Available configuration visibility and the people needed to explain access workflows also influence the engagement.
Identify an identity owner and representatives who understand application access and personnel changes. Prepare relevant account-governance procedures and existing access-review records. Agree the evidence-handling arrangements and authorized read-only access before review begins. Supported platforms, the review approach and suitable specialist capacity need confirmation for the proposed package. Access permissions should match the agreed review rather than grant unnecessary administrative power.
Keep identity review separate from broader technical work
This is a focused account-control assessment. Coordinate its scope with the Microsoft 365 Security Configuration Assessment so the same identity settings are not reviewed twice. A broader Microsoft 365 review may be more appropriate when the buying concern extends beyond account security.
Read-only configuration review is distinct from vulnerability scanning and authorized penetration testing. Intrusive testing requires a separately agreed scope and written authorization. Remediation execution, ongoing access administration and continuous monitoring are outside this assessment. The findings reflect selected evidence and coverage; they do not certify compliance or guarantee prevention of account compromise.
Identity assessment questions
Who should consider this assessment?
Identity owners, IT directors, CISOs and Microsoft platform leads concerned about excessive access or inconsistent account processes. It fits a defined need to review identity controls and choose improvement priorities, rather than a request to operate the identity environment.
Will the review cover every directory and application?
Coverage is agreed during scoping. The engagement identifies included directories, tenants, privileged accounts and selected applications. Systems outside those boundaries remain outside the findings, and other platform coverage requires capability confirmation.
What evidence does the review use?
The read-only review uses agreed configuration evidence and relevant account-governance records. Owners help explain intended controls and exceptions. Evidence gaps are identified rather than treated as proof that a control works.
What determines cost and timing?
The number of environments, selected accounts and applications affects effort. Review depth, evidence readiness and access arrangements also matter. Package scope and specialist capacity must be confirmed before price or timing can be established.
How does this differ from a Microsoft 365 assessment?
This assessment concentrates on identity lifecycle and access controls. The Microsoft 365 Security Configuration Assessment addresses a broader configuration concern. Agree which engagement owns overlapping identity controls before commissioning both.
Does the improvement plan include changing policies?
The plan recommends priorities. Your organization retains responsibility for approving and implementing account or policy changes. Implementation and any subsequent validation require separate agreement; retesting is not included by default.
Give account-security work a defined starting point
Bring a clear identity concern and the environments it affects. A scoped review can give your team identity-control findings, privilege observations and an improvement plan grounded in selected evidence. Discuss the right boundaries before committing resources to access changes.