India’s Leading Domain & Web Hosting Provider
Support
Domain & Login
Blog
Microsoft Entra ID & Azure Security Services
Microsoft Entra ID is Microsoft's cloud identity platform that authenticates users, devices and workloads and enforces access policy for Azure, Microsoft 365 and SaaS apps. NTSPL designs Entra ID tenants, Conditional Access, Privileged Identity Management, Key Vault, Defender for Cloud and Microsoft Sentinel for Indian enterprises that need provable control over who can reach what, plus CERT-In-ready logging.
Microsoft Azure services in scope
The Problem Microsoft Entra ID (Conditional Access) and Microsoft Entra Privileged Identity Management (PIM) Solve
Most Azure breaches NTSPL investigates in India do not start with a zero-day. They start with a standing Global Administrator account without MFA, a service principal secret committed to a Git repo two years ago, or a vendor guest account nobody removed after the project ended. The identity plane has become the perimeter, and in many tenants it has grown by accident: three directories after two acquisitions, legacy authentication still allowed for an old scanner, 60-plus users holding Owner on production subscriptions. Auditors from SEBI, RBI or an ISO 27001 body now ask for evidence of least privilege and log retention, not policy documents.
NTSPL starts with an identity attack-path review: we export role assignments, app registrations, sign-in logs and Secure Score, then rank the 20 exposures an attacker would use first. Remediation is sequenced so business users barely notice: Conditional Access policies run in report-only mode for two weeks before enforcement, privileged roles move to PIM with approval and justification, secrets move from app settings into Key Vault with managed identities, and Defender for Cloud plus Microsoft Sentinel give the SOC one queue with Indian-region log storage.
When Entra ID, PIM and Sentinel Are the Right Controls (and When They Are Not)
Signals that point to identity & security on Microsoft Azure
- Your tenant has more than 5 permanent Global Administrators, or any privileged account without phishing-resistant MFA.
- An acquisition has left you with two or more Entra tenants or on-premises AD forests and duplicate identities for the same people.
- A regulator or auditor (SEBI CSCRF, RBI, IRDAI, ISO 27001) has asked for evidence of access reviews, log retention or privileged access controls.
- Defender for Cloud Secure Score is below 50 percent, or you have never looked at it.
- You cannot produce sign-in and admin activity logs for a 180-day window within six hours of a CERT-In reportable incident.
- OT or plant-floor vendors connect through shared VPN accounts or always-on remote desktop tools.
When a different approach is better
- If your users are mostly on Google Workspace and you have negligible Azure footprint, standing up Entra ID as primary IdP adds a second identity plane; federate Entra to your existing IdP instead and secure only the Azure control plane.
- Small teams with under 50 users and one subscription rarely need a full Sentinel deployment; Defender for Cloud alerts plus Entra ID Protection and an email notification workflow give 80 percent of the value at a fraction of ingestion cost.
- If you need a SOC staffed 24x7 but have no internal analysts, Sentinel alone is a tool, not a service; pair it with Microsoft Defender Experts or an MSSP rather than expecting the platform to respond by itself.
Identity and Security Building Blocks: Entra ID, Conditional Access, PIM, Key Vault, Defender for Cloud and Sentinel
| Service | Role in the architecture | Choose it when |
|---|---|---|
| Microsoft Entra ID (Conditional Access) | Evaluates every sign-in against signals such as user risk, device compliance, location and application sensitivity, then grants, blocks or demands phishing-resistant MFA. | You still allow legacy authentication, rely on per-user MFA, or cannot show an auditor which policy protected a specific admin sign-in. |
| Microsoft Entra Privileged Identity Management (PIM) | Converts permanent Entra and Azure RBAC role assignments into time-bound, approval-gated activations with justification and full audit trail. | More than a handful of people hold Global Administrator, Owner or User Access Administrator permanently, or access reviews are done manually in spreadsheets. |
| Azure Key Vault | Stores secrets, keys and certificates with RBAC data-plane permissions, private endpoints, soft delete and purge protection, and serves them to workloads via managed identities. | Connection strings or API keys live in app settings, pipeline variables or config files, or you need customer-managed keys for storage and SQL encryption. |
| Microsoft Defender for Cloud | Provides cloud security posture management with Secure Score and attack-path analysis, plus workload protection plans for servers, SQL, storage, containers and Key Vault. | You have no consolidated view of misconfigurations across subscriptions, or servers and databases lack threat detection and vulnerability assessment. |
| Microsoft Sentinel | Cloud-native SIEM and SOAR on a Log Analytics workspace that correlates Entra sign-ins, Defender alerts, firewall and OT logs into incidents with automated playbooks. | You must retain and query security logs for regulatory periods such as CERT-In's 180 days, or your SOC is triaging alerts from five consoles. |
| Azure Policy | Enforces security guardrails at management-group scope, such as denying public IPs on databases, requiring private endpoints for Key Vault and auditing diagnostic settings. | Security findings keep reappearing after remediation because nothing stops engineers from redeploying the insecure configuration. |
Zero Trust identity and security operations plane
Zero Trust identity and security operations plane
Every user, vendor and workload request is authenticated by Entra ID and evaluated by Conditional Access before reaching Azure resources, with privileged actions activated just-in-time through PIM and secrets resolved from Key Vault via managed identities. Sign-in, audit, resource and Defender telemetry flows into a Sentinel workspace in an Indian region, where analytics rules and Logic App playbooks drive detection and response.
Select any component
Zero Trust identity and security operations plane: click any of its 9 components to see its role and the design choice NTSPL makes for it, or trace the 7-step primary path.
Entra and SecOps Engineering Decisions: Tenant Strategy, Conditional Access Personas and Log Tiering
Tenant strategy after acquisitions
Multiple tenants are justified only by hard legal separation, such as a regulated subsidiary that must keep separate administration. Otherwise consolidate. Where consolidation must wait, use Entra cross-tenant synchronization and a multitenant organization to give users one identity across tenants for Teams and app access. Migrating mailboxes and devices is the slow part, so we move identities first, then apps, then Microsoft 365 workloads in waves of 500 to 1,500 users.
Conditional Access design pattern
We build 12 to 18 policies grouped by persona rather than 60 per-app rules that nobody can reason about. Each policy starts in report-only mode for at least 14 days and is checked in the Conditional Access insights workbook before enforcement. Authentication strengths separate admins (FIDO2 or Windows Hello for Business only) from staff (Authenticator push with number matching). Named locations are used for risk context, never as a reason to skip MFA.
PIM activation rules
Set activation duration by blast radius: Global Administrator 1 to 2 hours with approval from a second admin; Azure Owner on production 4 hours with ticket number justification; Reader roles stay permanent. Use PIM for Groups so a single activation grants a bundle of Azure roles. Require MFA on activation even when the user already passed MFA at sign-in. Expect 2 to 3 weeks of friction while engineers adapt, then normal throughput.
Sentinel log tiering and retention
Ingestion is the dominant Sentinel cost, so classify sources before connecting them. Entra sign-in and audit logs, Defender alerts and Azure Activity stay in the analytics tier with 90 days interactive retention. Firewall, DNS and proxy flows go to a cheaper tier with long-term retention to meet CERT-In's 180 days and SEBI audit look-backs. Estimate ingestion per source for 30 days in a pilot before choosing a commitment tier.
Key Vault topology
One vault per application per environment limits the blast radius of a mis-assigned role and avoids hitting per-vault throttling limits during deployments. Enable purge protection on any vault holding customer-managed encryption keys, because losing that key makes the encrypted data unrecoverable. Use Key Vault references in App Service and Functions instead of copying secrets, and rotate certificates through Key Vault integration with your CA rather than by hand.
How NTSPL Rolls Out Conditional Access, PIM and Sentinel in a Live Tenant
Identity attack-path export
Pull role assignments, app registrations, service principal credentials and 30 days of sign-in logs, then rank the 20 exposures an attacker would use first.
Break-glass and legacy-auth closure
Create two FIDO2-protected cloud-only emergency accounts with a Sentinel alert on use, then block legacy authentication after checking sign-in logs for dependent devices.
Conditional Access in report-only mode
Deploy the persona-based policy set in report-only for at least 14 days, review the insights workbook, fix breaking apps and enforce in waves.
PIM conversion of privileged roles
Convert permanent Entra directory roles and production Azure Owner and Contributor assignments to eligible, with activation limits, approvers and MFA on activation.
Secrets to Key Vault and managed identities
Move application secrets into per-app Key Vaults with private endpoints, switch consumers to managed identities or Key Vault references, then rotate the old secrets.
Defender for Cloud and Sentinel onboarding
Enable Defender plans per workload tier, connect Entra, Activity and Defender data to a Sentinel workspace in Central India, and tune analytics rules against two weeks of real alerts.
What you receive
Defending the Identity Plane: Phishing-Resistant MFA, Consent Control and Secretless Workloads
The threat cases here are token theft, MFA fatigue, consent phishing via malicious OAuth apps, abused service principal secrets and lateral movement through over-permissioned Azure RBAC. Controls therefore centre on phishing-resistant authentication for admins, removing standing privilege, eliminating static secrets in favour of managed identities, blocking user consent to unverified apps, and detecting anomalous sign-ins quickly enough to revoke sessions before data leaves the tenant.
- Authentication strengths requiring FIDO2 keys for privileged roles, so stolen passwords and push fatigue cannot elevate an attacker
- Admin consent workflow with user consent disabled for unverified publishers, closing the OAuth consent-phishing route
- Continuous access evaluation so revoked sessions and disabled users lose access in minutes rather than at token expiry
- Workload identity federation for GitHub Actions and Azure DevOps, removing long-lived client secrets from pipelines
- Key Vault purge protection and RBAC data-plane roles, preventing a compromised operator from deleting encryption keys
Entra Licensing, Defender Plans and Sentinel Ingestion: Where the Identity Security Budget Goes
Cost here is driven by licences and data, not compute. Conditional Access needs Entra ID P1 and PIM plus risk-based policies need P2 or Entra ID Governance, usually covered by Microsoft 365 E3 or E5 bundles. Defender for Cloud bills per protected resource per plan, and Sentinel bills per GB ingested and retained. Key Vault charges per operation and per HSM key. The common overspend is ingesting verbose firewall logs into the analytics tier.
- Check existing Microsoft 365 E3 or E5 entitlements before buying standalone Entra P1 or P2 licences
- Enable Defender for Servers Plan 2 only on internet-facing and crown-jewel VMs; Plan 1 or CSPM-only for the rest
- Route high-volume network logs to a lower-cost Sentinel log tier and keep analytics tier for identity and alerts
- Use the Sentinel free data sources (Azure Activity, Office 365 audit) and Defender XDR benefit before paying for overlapping connectors
- Move to a Sentinel commitment tier once 30-day average ingestion is stable above the first tier threshold
Microsoft Sentinel vs Splunk vs a SOC-as-a-service: which SIEM fits an Azure-heavy Indian enterprise?
Choose on three criteria. Data gravity: if 70 percent or more of your security signal comes from Entra ID, Microsoft 365, Defender and Azure, Sentinel ingests much of it at low or no cost and correlates natively, while Splunk charges full ingestion for the same data. Existing investment: if you already run Splunk Enterprise Security with years of tuned detections and SPL-skilled analysts, keep it and forward Azure logs, because rewriting detections in KQL costs more than the licence saving for the first 2 years. Staffing: if you have fewer than 3 analysts, neither tool will help without people; buy a managed SOC that operates your Sentinel workspace so the data and detections remain yours if you change provider. For most mid-size Indian firms standardizing on Microsoft 365, Sentinel wins on total cost.
Key facts about identity & security on Microsoft Azure
Identity & Security on Microsoft Azure in Practice
3 identity & security scenarios from Diversified business group, Asset management company, Pulp and paper manufacturing: the starting position, the services chosen, the architecture, the rollout and the measured outcome.
Three directories become one: identity consolidation after two acquisitions
Asset manager evidences SEBI CSCRF controls from one Azure security stack
Paper mill replaces shared vendor VPN with identity-based OT access
IT services firm brings 43 Azure subscriptions under one policy hierarchy
HR policy assistant in Teams answers 15,000 employees in 4 languages
Private bank triages 12,000 customer emails a day with a Foundry agent
Jewellery chain makes ERP and POS backups immune to ransomware deletion
Identity & Security on Microsoft Azure: Frequently Asked Questions
What licence do we need for Conditional Access and PIM?
Conditional Access requires Microsoft Entra ID P1, and PIM, risk-based Conditional Access and access reviews require Entra ID P2 or Entra ID Governance. Microsoft 365 E3 includes P1 and E5 includes P2, so many Indian enterprises already own the entitlement. Only the users who actually activate privileged roles or are covered by risk policies need P2, which keeps incremental licence spend modest.
How is Microsoft Sentinel priced, and how do we keep the bill predictable?
Sentinel is billed on data ingested into the workspace and on retention beyond the included period, either pay-as-you-go per GB or through daily commitment tiers. Predictability comes from measuring 30 days of real ingestion by source in a pilot, sending high-volume firewall and proxy logs to a cheaper tier, and setting a daily cap alert on the workspace. NTSPL provides a per-connector INR estimate before onboarding.
We run on-premises Active Directory today. How do we move to Entra ID without disruption?
You do not replace AD on day one. Entra Connect cloud sync or Connect Sync synchronizes identities with password hash sync, which also enables leaked-credential detection. Users keep their existing passwords. Apps then move from AD FS or Kerberos to Entra single sign-on in waves, and AD FS is decommissioned once the last relying party is migrated. Typical mid-size migrations take 8 to 14 weeks.
Can we keep security logs in India to satisfy CERT-In and the DPDP Act?
Yes. Create the Log Analytics workspace behind Sentinel in Central India (Pune) or South India (Chennai) and its data at rest stays in that region. CERT-In's April 2022 directions require ICT system logs to be maintained for 180 days within Indian jurisdiction, and incidents to be reported within 6 hours. NTSPL configures retention and an incident-reporting playbook to meet both.
Does this help with SEBI's Cybersecurity and Cyber Resilience Framework (CSCRF)?
It covers a large share of the identity, logging and monitoring controls. PIM and access reviews evidence least privilege, Conditional Access logs prove MFA on privileged access, Defender for Cloud regulatory compliance dashboards track configuration baselines, and Sentinel provides continuous monitoring and incident records. NTSPL maps each CSCRF requirement applicable to your entity category to a specific Azure evidence source; governance and process controls remain your responsibility.
How long before we see a measurable improvement in Secure Score?
Most tenants gain 15 to 25 points within the first 4 weeks, because the highest-weighted recommendations are quick fixes: MFA for admins, blocking legacy authentication, enabling Defender plans and removing public network access on storage and databases. The remaining gains are slower as they require application changes, such as moving secrets to Key Vault and replacing service principal secrets with managed identities.