Microsoft Entra ID security assessment

What a Microsoft Entra ID security assessment covers

MagenX reads your Microsoft Entra ID tenant through Microsoft Graph, together with the Azure subscriptions you connect, using read access only. It shows where conditional access really requires multi-factor authentication, who holds which roles and whether permanently, who each policy leaves out, and which Azure resources face the internet. The tenant is read across 30 areas, from conditional access, MFA coverage and named locations to privileged roles, PIM, guest accounts, emergency access accounts, token lifetime, authentication methods, application permissions and admin consent. The Azure estate adds 24 checks in six categories: Azure Compute (10), Azure Network (5), Cloud Identity (3), Azure Privilege (3), Azure Hybrid Connectivity (2) and Azure Data Exposure (1).

The tenant is one of four layers. Its findings sit in the same console as your directory, network and firewall findings, so your team works from one list. A weakness that starts on premises and ends in the cloud shows up once, with both halves in view, instead of as two tickets for two teams.

MFA, conditional access, privileged roles and guests

Registered for MFA and required to use it are two different things. A tenant can show every account registered and still accept password-only sign-ins through a policy exclusion, legacy authentication left open, or a policy stuck in report-only mode. MagenX reports registration and enforcement separately and names every user, group, role and application a policy excludes.

Whether conditional access actually requires multi-factor authentication for each account, beyond whether the account registered a method
Conditional access policies, their state (on, report-only or off), and the users, groups, roles and applications excluded from each one
Whether conditional access blocks legacy authentication, and every legacy sign-in from the last seven days, with the account and the client
Privileged roles held permanently, separated from roles that are only eligible through Privileged Identity Management
The accounts that synchronise your directory to the cloud, the roles they hold, and the users who exist on both sides
Named locations and the trust placed in them, risky users and risk detections, and your emergency access accounts: how many you have, whether they use strong authentication, and which policies exclude them
Guest accounts that have not signed in, applications with broad permissions, and the admin consent granted to them
Token lifetime policies, who may invite guests or register applications, and the partner tenants in cross-tenant access
Azure virtual machines, network security group rules open to any source, public IP addresses, VPN and ExpressRoute links to on-premises networks, privileged role assignments, Defender for Cloud coverage, and storage accounts, SQL servers and key vaults reachable from the internet

Hybrid accounts, matched on both sides

Hybrid accounts are where cloud assessments usually go wrong, because the directory and the tenant each hold half of the same person. MagenX ties every synchronised administrator to the exact on-premises account it came from, and flags any it cannot match with certainty for review.

When the on-premises half is weak, you see both halves in one finding: a cloud administrator whose directory account is disabled, unused for 90 days, or open to a password reset by a helpdesk group outside Tier 0. Every synchronised Global Administrator is also reported on its own, and rated higher when its on-premises password never expires or conditional access does not require MFA for it.

Azure: virtual machines, exposure and hybrid links

For the Azure subscriptions you connect, MagenX covers the compute and network layer: virtual machines, network security group rules open to any source, public IP addresses, VPN and ExpressRoute links to on-premises networks, privileged role assignments at every scope, Defender for Cloud coverage, and storage accounts, SQL servers and key vaults reachable from the internet. Each VPN link is shown with the on-premises address ranges it carries.

Findings, evidence and follow-ups

Every Entra ID and Azure finding comes with its evidence and a remediation, and can be assigned to a person or a group with a due date. Compare any two scans to see which cloud findings are new and which were fixed.

What it does not do

It never writes to the tenant and never tests a conditional access policy with a live sign-in. It reads identity and access configuration together with the sign-in and audit logs, and never touches mailboxes, files or messages.

FAQ

What is the difference between registered and enforced multi-factor authentication?

Registration means an account has a second factor ready. Enforcement means conditional access requires it at sign-in. MagenX reports them separately, because a tenant with high registration can still accept password-only sign-ins through a policy exclusion, legacy authentication or a report-only policy.

Is Azure included, or only the directory?

Both. Internet-facing virtual machines and data services, VPN links to your network and privileged role assignments are reported right beside the directory findings.

Which permissions does it need in the tenant?

Read access only: read scopes on Microsoft Graph and read access to the Azure subscriptions you want assessed. MagenX writes nothing to the tenant.

Can it run without an internet connection?

The cloud layer needs a route to Microsoft's sign-in, Graph and Azure management endpoints. On an estate with no route out, the cloud layer stays off and the other three layers run as usual.

How are hybrid accounts matched?

Each synchronised administrator is tied to the exact on-premises account it was synchronised from. Any account that cannot be matched with certainty is flagged for review.