Blog & Guides
Practical cybersecurity articles, step-by-step guides, and quick-reference cheat sheets — from Active Directory hardening to Microsoft 365 and zero trust. Written by someone who's done the work. No hype, no fluff.
3 results for “break-glass account” · Clear
Conditional Access Baseline Policies Every Microsoft 365 Tenant Needs in 2026
Every Microsoft 365 tenant should run a baseline of roughly eight to ten Conditional Access policies — block legacy authentication, require MFA for all users, phishing-resistant MFA for admins, compliant or managed devices, block device code flow, sign-in and user-risk policies, session controls, guest MFA, and a break-glass exclusion group — deployed in report-only first, piloted with a ring group, then enforced. This guide gives the named set, the safe rollout order, the P1/P2 licensing reality, the enforcement changes that landed in June and July 2026, and the production gotchas that lock teams out of their own tenant.
How to Configure Microsoft Entra PIM for Just-in-Time Admin Access
Microsoft Entra Privileged Identity Management (PIM) removes standing admin rights by making a role eligible instead of permanently active: the admin activates it just-in-time, for a time-boxed window, subject to MFA, justification and optional approval. This step-by-step guide covers licensing (Entra ID P2 or Entra ID Governance), prerequisites and break-glass accounts, assigning eligible roles, configuring activation settings, the end-user activation experience, validation, and Access Reviews — plus the production gotchas that lock teams out of their own tenant.
Entra ID Conditional Access Gaps: 10 Misconfigurations That Quietly Defeat MFA
The most common Entra ID Conditional Access gaps are policies that exclude too much, sit in report-only forever, ignore legacy authentication, skip device and risk signals, and leave break-glass accounts unmanaged. Here's how to find and close each one.