Entra ID guides

How to stop consent phishing without blocking legitimate apps: Entra ID app consent policies, the admin consent workflow, and a review process that scales.

How to assign Microsoft 365 licences with group-based licensing in Entra ID: build the groups, set usage location, migrate direct assignments, fix errors.

How to apply your organisation's branding across Microsoft 365 — logos, themes, sign-in pages, and app launcher customisation.

How to find unused service principals in Entra ID — sign-in activity, credentials, assignments — remove them without breaking year-end integrations.

How CAE revokes access tokens in near real time when risk signals change — and what to do to make sure it works.

Cross-tenant synchronization auto-provisions B2B guests between Microsoft Entra ID tenants in a multi-tenant organisation.

How access packages bundle Microsoft 365 access into requestable, governed units — the modern way to provision access at scale.

The two ways to sync on-prem Active Directory to Entra ID — what each does, the scenarios that still force the old tool, and which to use today.

Microsoft has two products for customer identity. Here's the difference and which to pick today.

Administrative Units scope admin roles to subsets of the directory — for delegated administration without tenant-wide privileges.

Two sides of the same coin — app registrations define an app, enterprise apps grant it to your tenant. Here's how they relate.

Authentication contexts let Conditional Access trigger step-up authentication for specific actions, not just specific apps.

How Entra ID B2B brings external users into your tenant as guests — invitations, controls, and lifecycle.

Designing a Conditional Access baseline: the policies, the principles, the order to write them in, and the habits that keep the estate healthy.

How to design and assign custom administrative roles in Microsoft Entra ID for fine-grained least-privilege access.

Entra ID Governance explained: access reviews, entitlement management, lifecycle workflows, separation of duties, P2 vs Suite licensing, and rollout order.

Group types in Entra ID, dynamic groups, and using groups to assign licences automatically.

Lifecycle Workflows automate joiner-mover-leaver tasks based on user attribute triggers.

The realistic options for going passwordless in Microsoft 365 — Authenticator, FIDO2, Windows Hello, and passkeys.

PIM turns standing admin access into just-in-time, approval-gated activation. The model, what it covers, role settings that work, and a rollout that sticks.

SSPR lets users reset their own passwords without calling the help desk. Here's the configuration and rollout.

Entra ID vs Okta as the identity provider: Okta's neutrality and app-integration depth against Entra's Microsoft 365 bundling and Conditional Access.

Entra ID vs Ping Identity (PingOne, PingFederate, ForgeRock): federation depth, hybrid deployment, and CIAM against Entra's bundled workforce identity.

Microsoft's Cloud Infrastructure Entitlement Management (CIEM) product, covering Azure, AWS, and GCP permissions.

The four ways outsiders can collaborate with you in Teams — and the trade-offs between guest, external access, shared channels, and anonymous join.

How to block a compromised Microsoft 365 account in ten minutes: disable sign-in, revoke sessions, reset password and MFA, kill inbox rules and forwarding.

How to block legacy authentication in Entra ID with Conditional Access: find who still uses it, build the block policy, run report-only, then enforce.

How to create an emergency access (break-glass) account in Entra ID: cloud-only, permanent Global Admin, excluded from Conditional Access, FIDO2 keys, alerting.

How to enable guest access in Microsoft Teams: the four switches (Entra, Microsoft 365 groups, Teams, SharePoint), guest permissions, domain lists, testing.

How to enable self-service password reset in Entra ID: scope, methods, registration enforcement, password writeback for hybrid, and Windows lock-screen reset.

How to offboard a user in Microsoft 365: block sign-in, revoke sessions, handle the mailbox and OneDrive, wipe devices, remove licences, delete on schedule.

How to require a compliant or hybrid-joined device with Conditional Access: the Intune compliance policy first, the grant control, exclusions, report-only.

How to require MFA for all users in Entra ID with Conditional Access: the exclusions that matter, report-only rollout, registration campaign, enforcement.

How to reset a user's MFA in Entra ID when they have a new phone or lost their authenticator: re-register, revoke sessions, and issue a Temporary Access Pass.

How to restore a deleted user in Microsoft 365 within the 30-day window: admin center and Graph routes, UPN conflicts, what comes back, and after 30 days.

How to set up Privileged Identity Management for Global Administrator in Entra ID: role settings, convert permanent admins to eligible, approvals, and alerts.

How to plan the hybrid-identity journey from on-premises AD to Entra ID-only — staged, with the right choices at each stage.

Combining Intune compliance with Conditional Access gives you device-aware access control — the heart of zero trust.

How Intune manages Mac devices — enrolment via Apple Business Manager, configuration, app deployment, and compliance.

Windows Autopilot provisions new PCs straight to the end user with zero IT touch. Here's how it works.

The Microsoft 365 Apps Cloud Policy service applies Office app policies to users regardless of device, replacing per-device Group Policy.

What changes when Microsoft 365 is deployed at enterprise scale — plans, identity, governance, and lifecycle.

Naming conventions and expiration policies keep group sprawl manageable. Here's how each works.

Three closely-related concepts that confuse a lot of users. Here's the model.

A complete offboarding workflow for departing users — account, data, licence, and audit handling.

A clean joiner workflow for Microsoft 365 — provisioning, access, training, and first-week experience.

A practical tour of the Microsoft 365 security and compliance stack — Defender, Purview, Entra, and how they fit together.

How to design, deploy, and operate service principals safely — credentials, permissions, and lifecycle.

Defender for Identity detects identity-based attacks against on-prem Active Directory and Entra ID. Here's how it works.

How to plan and roll out Defender for Identity sensors — DCs, AD FS, Entra Connect, and tuning.

Connect Health monitors the hybrid-identity infrastructure — Entra Connect, AD FS, and AD DS.

Microsoft's SSE platform — Internet Access and Private Access for zero-trust network access. Here's what it does.

How access reviews keep group memberships and role assignments healthy over time — periodic recertification at scale.

The Entra ID Recommendations dashboard surfaces tenant-specific improvement actions based on Microsoft's analysis.

How Entra ID's password protection blocks weak and breached passwords — for both cloud and on-prem AD accounts.

Entra Verified ID is Microsoft's decentralised identity / verifiable credential service. Here's the model and the use cases.

Microsoft Intune explained: what it manages, how policies work, how enrollment and compliance fit together, and where it sits in Microsoft 365.

How to control Microsoft Sentinel costs — ingestion tuning, commitment tiers, retention, and data tiering.

How Microsoft Sentinel ingests Microsoft 365 signals and extends Defender XDR into a full SIEM.

How to onboard Microsoft Sentinel — workspace setup, data connectors, and starting analytic rules.

Microsoft Tunnel provides per-app VPN for managed mobile devices — the Intune-integrated way to access on-prem resources.

A practical migration playbook for moving from Google Workspace to Microsoft 365 — workloads, tools, and pitfalls.

How to move mailboxes from Exchange Server to Exchange Online — the migration types, hybrid deployment, and the realistic plan.

How to support multiple languages across a Microsoft 365 tenant — UI, content, communications, and accessibility.

Two products, one name — the differences between work and consumer OneDrive, and why mixing them is a bad idea.

What comes back when you restore a deleted Microsoft 365 group: the 30-day window, the order things reappear, what does not return, and after the window.

What still needs on-premises Active Directory in a Microsoft 365 organisation — Kerberos, file servers, RADIUS, printing — what replaces each, and the order.

How to set up SAML single sign-on between a third-party app and Microsoft Entra ID.

How SCIM auto-provisions users from HR and identity systems into Entra ID and downstream SaaS apps.

SharePoint Advanced Management adds governance, oversharing controls, and Copilot-ready controls to SharePoint Online.

The layered controls that decide who outside your organisation can access SharePoint and OneDrive content — and a sane baseline configuration.

How Teams Phone supports shared, deskless phones for reception, warehouses, and shop floors.

Entra Suite explained: Internet Access, Private Access, Verified ID, ID Governance, and Identity Protection in one licence — what each does and when it pays.

Microsoft's cloud printing service for Microsoft 365 — what it does, how to deploy it, and the limits.

How LinkedIn Learning shows up in Viva Learning: free curated content vs a full subscription, admin setup on both sides, SSO, assignment sync, and the gaps.

What Microsoft 365 is: what's in the suite, who each plan is for, how the pieces fit together, and what changed since the Office 365 days.

What Microsoft Entra ID is: the identity service behind every Microsoft 365 sign-in, how it relates to Active Directory, and the licensing tiers that matter.

What SharePoint is: the platform behind Microsoft 365 file storage, team sites, intranets, Teams, and OneDrive — how it works and how to run it well.

What Windows 365 is: how Cloud PCs work, the licensing tiers, how it connects to Intune and Entra ID, and when it beats AVD or a physical laptop.

Microsoft's managed Windows update service — what it does, where it differs from Windows Update for Business, and when to use it.