Cloud, Network & Identity Security
Identity and access management (IAM) security
Assessment and hardening of Active Directory, Microsoft Entra ID, SSO and MFA, with help putting the right access controls in place.
Key areas covered
- Coverage
- Active Directory, Microsoft Entra ID (Azure AD), Okta and Google Workspace, cloud IAM, and business application access
- Approach
- Assessment with read-only access, followed by hands-on hardening support where you want it
- Reference standards
- NIST SP 800-63, CIS Controls (account and access management), Microsoft security baselines
- You receive
- Prioritised findings, attack-path analysis, remediation plan and implementation support
Overview
About identity and access management (IAM) security
Most breaches today start with an identity: a stolen password, a phished session, an over-privileged service account or an admin account that nobody remembered to remove. Attackers do not need to break in when they can log in.
Our IAM security service assesses how identities and access are managed across Active Directory, Microsoft Entra ID, cloud platforms and business applications, then helps you put the right controls in place: single sign-on, multi-factor authentication, privileged access management and regular access reviews. It pairs naturally with network penetration testing, which shows how attackers abuse identity weaknesses in practice.
A typical starting point
You need to know who can access what, close risky admin access, enforce MFA everywhere, or clean up Active Directory and Entra ID.
What’s covered
What an IAM security review covers
Area 01
Active Directory
- Privileged groups, delegation and attack paths to domain admin
- Stale, inactive and orphaned accounts
- Service accounts, Kerberoastable accounts and password policies
- Legacy protocols such as NTLMv1 and insecure LDAP
- Group Policy and tiered administration
Area 02
Microsoft Entra ID and cloud identity
- Conditional Access and MFA coverage
- Global and privileged administrator assignments
- Guest users, app registrations and consent grants
- Sign-in risk and audit logging
- Cloud IAM roles in AWS, Azure and Google Cloud
Area 03
Authentication and SSO
- Single sign-on design and coverage across business applications
- Phishing-resistant MFA options, such as passkeys and FIDO2 security keys
- Password policy aligned to NIST SP 800-63 guidance
- Session lifetime and token protection
Area 04
Privileged access and governance
- Privileged access management (PAM) and just-in-time administration
- Joiner, mover and leaver processes
- Periodic access reviews and role design
- Break-glass accounts and emergency access
The security problem
Identity risks attackers rely on
Missing or weak MFA
Accounts without multi-factor authentication, or with methods that are easy to bypass, are the easiest target.
Too many administrators
Excessive privileged accounts, and admins using them for everyday work, multiply the impact of one compromise.
Stale and orphaned accounts
Accounts of former staff, old service accounts and unused guests that nobody monitors.
Legacy protocols and misconfigurations
Legacy authentication, weak Active Directory settings and risky delegation that bypass modern controls.
Our approach
How an IAM security engagement works
Step 1: Scoping
We agree the directories, tenants, cloud accounts and applications in scope, and your priorities.
Step 2: Data collection
With read-only access, we collect configuration and permission data using established tools such as BloodHound and Microsoft’s own reporting.
Step 3: Analysis and attack paths
We identify misconfigurations and map the paths an attacker could take from an ordinary account to full control.
Step 4: Prioritised roadmap
Findings are ranked by risk and effort, with quick wins first, such as MFA gaps and unused admin accounts.
Step 5: Hardening support
Where you want it, we help your team implement changes: Conditional Access, MFA rollout, admin tiering, PAM and access reviews.
Step 6: Verification
We re-check the environment and confirm that risky paths have been closed.
Standards and references we work to
- NIST SP 800-63
- NIST’s Digital Identity Guidelines for authentication and identity assurance.
- CIS Critical Security Controls
- Account management and access control management safeguards.
- Microsoft security baselines
- Recommended settings for Active Directory, Entra ID and Microsoft 365.
- MITRE ATT&CK
- Credential access and privilege escalation techniques used to explain attack paths.
Good to know
MFA is essential, but not all MFA is equal
SMS codes and simple push approvals can be phished or abused through MFA fatigue. We help you prioritise phishing-resistant methods for administrators and high-risk users first.
Good to know
Assessment first, tools second
Buying an identity product does not fix a messy directory. We start with what you have, close the biggest gaps, and only then recommend whether a new tool is worth the investment.
What you receive
What you receive from an IAM review
Executive summary
Your identity risk in plain language, with the most important actions.
Prioritised findings
Each misconfiguration with affected accounts or settings, risk rating and the fix.
Attack-path analysis
How an attacker could move from an ordinary account to administrative control, and where to break the chain.
Remediation roadmap
Quick wins, medium-term changes and longer-term improvements in a realistic sequence.
Implementation support
Hands-on help applying changes, if included in scope.
Sample finding
Administrator accounts can sign in without MFA
Microsoft Entra ID tenant: 4 of 11 privileged accounts
CIS Microsoft 365 Foundations Benchmark; NIST SP 800-63B
- What we found
- Four privileged administrator accounts are excluded from the MFA Conditional Access policy and can sign in with a password alone.
- Evidence
- Conditional Access policy export and sign-in logs showing single-factor administrator sign-ins during the last 30 days. Screenshots attached.
- Business impact
- One phished or reused password would give an attacker control of email, files and every user account in the tenant.
- Fix
- Require phishing-resistant MFA for all administrator roles, remove the exclusion group, use dedicated admin accounts and enable just-in-time role activation.
- Status
- OpenFixed, verified at retest
Before we start
What we need to review identity and access
- A read-only account for Active Directory, and Global Reader or Security Reader access for Microsoft Entra ID.
- Read-only access to cloud IAM in scope.
- An IT contact who knows the directory and the main business applications.
- Any existing policies on access approvals, joiners and leavers.
Not sure you have everything?
We confirm exactly what identity and access management needs from your side during the scoping call, before any work is agreed.
Book a scoping callFAQ
Questions about identity and access management
Still have a question?
Ask about scope, timing or cost for identity and access management, even if you are not ready to commission work yet.
Contact our teamDo you need domain admin rights?
No. Almost all of the assessment uses an ordinary, read-only account. That also shows you how much an attacker could learn from any compromised user account.
Can you help us roll out MFA and single sign-on?
Yes. After the assessment we can help your team design and roll out MFA, Conditional Access and single sign-on in stages, so users are not locked out and business applications keep working.
Will the assessment affect users?
No. Data collection is read-only. Changes are only made during the hardening phase, with your approval and in planned windows.
How is this different from a penetration test?
A penetration test shows what an attacker can do from a starting point, often including identity attacks. An IAM assessment reviews the whole identity estate systematically and helps you fix it. Many organisations run both: network penetration testing to prove the risk, IAM to remove it.
Related services
Often combined with identity and access management
- Network and infrastructure penetration testing (VAPT)External, internal and Active Directory testing.Read more
- Cloud security assessmentAWS, Azure and Google Cloud posture review.Read more
- Managed detection and response (MDR) and endpoint securityEndpoint protection, EDR/XDR and managed response.Read more
Talk to us about identity and access
Tell us what has prompted the conversation. We will reply to arrange a short, no-obligation scoping call for identity and access management.