4.4Identities, MFA & M365 security (Entra ID)
In the cloud, identity is the new perimeter. There is no office wall around your data anymore — anyone with the right sign-in can reach it from anywhere — so protecting who signs in is the core of cloud security. Microsoft's cloud identity service, Microsoft Entra ID, manages accounts, groups and access for Microsoft 365 and beyond. The most important control it offers is multi-factor authentication (MFA): requiring a second proof of identity (a phone approval, a code, a biometric) on top of the password.
Why does MFA matter so much? Because passwords leak — through phishing, reuse and breaches — and a stolen password alone opens the door. MFA closes it: even with the correct password, an attacker cannot sign in without the second factor. It blocks the overwhelming majority of account-takeover attacks and is often free with the basic identity service, which makes it the single highest-return security measure a small organization can deploy. Around it, sensible practices reinforce identity: unique strong passwords (ideally a password manager), least-privilege roles so admin accounts are few and protected, and reviewing sign-in activity. Make MFA mandatory, protect administrator accounts most of all, and you have addressed the largest slice of cloud risk with modest effort.
Section vocabulary
- Identity as perimeter
- In the cloud, security centers on protecting sign-ins, since there is no physical network boundary.
- Microsoft Entra ID
- Microsoft's cloud identity service managing accounts, groups and access.
- MFA (multi-factor authentication)
- Requiring a second proof of identity beyond the password.
- Account takeover
- An attacker signing in as a user, usually via a stolen or guessed password — what MFA blocks.
- Privileged account
- An administrator identity, protected most strongly because it can change everything.
Which measure blocks most account attacks?
In practice — Prioritize identity protection
- Explain, in one sentence, why a stolen password alone is not enough to sign in once MFA is on.
- Decide which accounts must have MFA first (hint: administrators) and then everyone else.
- List two supporting habits: unique strong passwords and few, well-protected admin accounts.
- Note what reviewing sign-in activity could reveal.
Key takeaways
- In the cloud, identity is the perimeter — protecting sign-ins is central to security.
- Entra ID manages cloud accounts, groups and access.
- MFA blocks the vast majority of account takeovers — a stolen password no longer suffices.
- Enforce MFA everywhere (admins first), use unique strong passwords, and keep few, protected admin accounts.
Frequently asked questions
If we have strong passwords, do we still need MFA?
Yes — strong passwords help, but they are not enough on their own, because the most common attacks do not guess passwords, they steal them. Phishing pages, reused credentials exposed in unrelated breaches, and malware all hand attackers a valid password without any brute force. Against that, password strength is irrelevant: the credential is simply known. MFA defends the one thing passwords cannot — it demands a second factor the attacker does not have, so even a correct, stolen password fails to sign in. That is why MFA blocks the overwhelming majority of account takeovers and is considered essential, not optional, especially for cloud accounts reachable from anywhere.
Which accounts should we protect first?
Administrator (privileged) accounts, without question. They can create and delete users, change security settings, and reach all data, so a compromised admin account is a full breach rather than a single-user problem. Enforce MFA on every administrator first, keep the number of admins as small as practical, and avoid using admin accounts for everyday work. Then extend MFA to all users, since any account is a foothold. The principle is least privilege applied to identity: fewer powerful accounts, each strongly protected, dramatically shrinks what an attacker can achieve even if one password is stolen.