AllTech
The laptop was clean.
The account wasn't.
Endpoint security protects the device. Identity is what an attacker actually wants — and a stolen session token never touches a managed machine. AllTech builds and runs the Entra ID and Intune side of Microsoft 365: who can sign in, from what device, under what conditions, and what happens when those conditions stop being true.
Most tenants are secure by accident, not by design.
Microsoft 365 ships open. A new tenant will happily let anyone sign in from any device, anywhere in the world, with a password alone — and it will do it without generating a single complaint. Nothing breaks. That's the difficulty. There is no error message for a tenant that has no conditional access policies; there's just a quiet gap between what you assume is happening and what's actually enforced.
The gap usually shows up in the same few places. MFA is on for most people, but not the service account nobody remembers creating. Legacy authentication is still enabled because turning it off might break the scanner in accounting. Personal phones sync company mail with nothing in the way. Six people are Global Administrators because that's what "make them an admin" did at the time.
None of that is negligence. It's what happens when a tenant grows one request at a time over five years and nobody's job was to look at the whole thing.
Identity, devices, and the policies between them.
Entra ID tenant design
Users, groups, and roles built on a structure that still makes sense at twice your headcount. Licensing assigned by group rather than by hand. Administrative roles scoped to what the job actually needs — most people who need to reset a password do not need to be a Global Administrator.
Conditional access
The rules that decide whether a sign-in succeeds: MFA where it matters, blocked sign-ins from countries you don't do business in, restricted access from unmanaged devices, and session controls for the accounts that would hurt most. Built with break-glass accounts and a rollout order that doesn't lock anybody out of their own tenant.
MFA and passwordless
Phishing-resistant methods where they'll be adopted — Microsoft Authenticator number matching, Windows Hello for Business, FIDO2 keys for privileged accounts. Legacy authentication protocols disabled, once we've found what still depends on them.
Intune device management
Windows and macOS enrollment, iOS and Android for the phones that touch company mail. Baseline security configuration, BitLocker and FileVault enforcement, disk encryption key escrow, and app deployment that does not require an engineer at the desk.
Device compliance and Autopilot
Compliance policies that define what a trusted device is — encrypted, patched, protected, and up to date — tied back into conditional access so a non-compliant machine loses access instead of quietly keeping it. Autopilot for new hardware: unbox, connect to Wi-Fi, sign in, and the laptop configures itself.
Identity monitoring
Risky sign-in and risky user detections routed into the same SOC that watches your endpoints. Impossible-travel logins, anonymized IP addresses, and anomalous session tokens are the ones we want to hear about at 3 a.m., not on the next monthly report.
Offboarding that finishes
A documented sequence: disable the account, revoke active sessions and refresh tokens, remove licenses, convert the mailbox, wipe or retire the device. Session revocation is the step most people skip, and it is the one that decides whether a departed employee actually lost access.
Identity alerts land with the same Managed SOC that watches your endpoints, so a risky sign-in gets a human rather than a dashboard entry.
The device was fine. The account was being used by someone else.
A meaningful share of the security incidents we open across our client base start in Microsoft 365 rather than on an endpoint. Sign-ins from anonymized IP addresses. Logins from places no employee had traveled to. A session token behaving in a way that meant multi-factor authentication had already been skipped.
None of those touched a managed laptop. The device was fine. The antivirus was green.
That is the argument for treating identity as its own layer with its own controls, rather than as a setting inside the email product. Conditional access is what turns a stolen password into a failed sign-in, and device compliance is what stops a valid password on an unmanaged machine from being good enough. It is also why identity detections belong with endpoint detections, in front of the same analysts.
The same six findings, in almost every tenant.
Global Administrators nobody can account for
The average small-business tenant has several. Microsoft's own guidance is fewer than five, with none of them used for daily work. We usually find at least one that belonged to a former MSP.
MFA enforced by policy, not in practice
Enabled for most staff, missing on the shared mailbox, the service account, and the executive who requested an exemption in 2022 that was never revisited.
Legacy authentication still on
Basic auth protocols that predate MFA and bypass it entirely. Almost always left enabled for one device — a scanner, a copier, an old line-of-business app — and almost always forgotten once that device is replaced.
Devices enrolled but not compliant
Enrollment and compliance are two different things. A device can be in Intune, reporting cheerfully, and still be unencrypted and three months behind on patches. Without a compliance policy tied to conditional access, nothing acts on that.
Personal phones with full mailbox access
No app protection policy, no separation between work mail and everything else on the phone, no way to remove company data if the phone is lost or the employee leaves.
Ex-employees with live sessions
The account was disabled. The active session token wasn't revoked, and it stays valid until it expires on its own.
How we roll this out without locking anyone out.
- 1
Assess
We inventory the tenant as it stands: admin roles, MFA coverage, conditional access policies, legacy auth, enrolled devices, guest accounts, and licensing. You get the findings whether or not you hire us for the remediation.
- 2
Design
Policies drafted against your actual working patterns — who travels, who works from home, which devices are company-owned, what the field staff use. Break-glass accounts created and documented before anything is enforced.
- 3
Pilot
Policies deploy in report-only mode first. We watch what would have been blocked for a week or two and fix the surprises before they become help desk tickets. Every environment has at least one.
- 4
Enforce
Staged rollout by group, IT first, then department by department. Communication sent ahead of each stage so people know what is changing and why.
- 5
Enroll
Devices move into Intune in batches, existing hardware first, Autopilot for everything purchased after. Compliance policies come on in report-only mode too, then enforce.
- 6
Operate
Ongoing administration: onboarding, offboarding, policy changes, license management, and identity alerts monitored by the SOC alongside your endpoints.
This is the right fit if
Common questions
What's the difference between Entra ID and Intune?
Entra ID is identity: accounts, groups, sign-ins, and the rules that govern them. Intune is device management: enrollment, configuration, patching, and compliance. They're most useful together — Intune decides whether a device is trustworthy, and Entra ID uses that answer to decide whether to allow the sign-in.
Do we need to buy new licenses?
Sometimes, and less often than expected. Conditional access requires Entra ID P1, which is included in Business Premium — a license many businesses already own and haven't fully deployed. We'll tell you what you're already paying for before we suggest anything new.
Will this lock people out?
That's the risk the rollout process is designed around. Every policy runs in report-only mode first so we can see the effect before it's real, break-glass accounts are in place before enforcement, and the rollout is staged by group rather than tenant-wide overnight.
Can employees still use their personal phones?
Yes. App protection policies let us protect company data inside the Outlook and Teams apps without managing the whole phone. Company data can be wiped remotely; personal photos and messages are untouched and out of scope.
We already have MFA. Isn't that enough?
MFA is the single highest-value control and it is not the whole job. Token theft and MFA-fatigue attacks both work against accounts with MFA enabled. Conditional access, device compliance, and session controls are what close that gap.
What about our on-premises Active Directory?
Most environments run hybrid for a while, and that is fine. We handle Entra Connect sync, password hash or pass-through authentication, and — where it makes sense — a path toward retiring the on-prem domain controller entirely.
Can you take over a tenant from our previous provider?
Yes, and it is a common starting point. The first task is a full admin-access audit: who has privileged access, which partner relationships are still delegated, and what gets removed.
Identity is one layer
Microsoft 365 & Cloud
Tenant design, migration, licensing, and ongoing administration.
Learn moreEndpoint Security
Device compliance decides what's trusted; EDR decides what's happening on it.
Learn moreZero Trust Access (ZTNA)
Identity-aware access to internal applications, without a VPN.
Learn moreManaged SOC
Risky sign-in alerts are only useful if someone reads them at 3 a.m.
Learn moreEmail Security
Most credential theft starts with a message that got through.
Learn moreFind out who can actually get into your tenant.
We'll audit your Entra ID configuration — admin roles, MFA coverage, conditional access, legacy authentication, and device compliance — and show you the gaps in plain language. Findings are yours either way, no pressure.
