The settings underneath everything else. Not policies, not authentication methods — the defaults your tenant shipped with, that nobody revisits. Who can consent to an app. What a guest can read. Who can register an application, create a tenant, or move a subscription out of your directory. Then the Azure side: who has elevated access, what's logged, what's governed. Most of it is free, and most of it is one toggle.
Read this first — two systems, one door
Microsoft Entra and Azure are separate permission systems. An Entra role grants you nothing over Azure resources. An Azure role grants you nothing in Entra. People assume otherwise constantly, and the assumption is usually harmless — right up until it isn't.
There is exactly one door between them: Entra ID → Properties → Access management for Azure resources. A Global Administrator sets it to Yes and is assigned User Access Administrator at root scope, which means every subscription and every management group in the tenant. It is self-service, it is per-user, and it does not switch itself back off.
- Audit before you change anything. Every control here has a "who's using this today" query. That query is the difference between a change and an outage.
- One setting at a time. There is no report-only mode for tenant settings. Flip six at once and you won't know which one broke things.
- Tell the helpdesk first. What breaks here shows up as a confused user, not an error message.
- Elevated access is for a task, not a posture. On for the job, off afterwards. That applies to your work in this dojo too.
- Entra reverts in seconds. Azure often doesn't. A deleted role assignment has to be rebuilt by hand. A transferred subscription can't simply come home.
Full guidance: Secure your Microsoft Entra identity infrastructure ↗
Size up your environment
Three questions. The Azure answer matters most — say no and ten controls disappear rather than scoring against subscriptions you don't own. If you've been through another dojo, your licence mix is already filled in.
Which licences do you have in the tenant? Select all that apply.
Do you run Azure subscriptions?
"Not sure" counts as yes, deliberately. A subscription you've forgotten about is worse than one you're managing — and this dojo will help you find it.
Do you collaborate with external organisations?
Walk out with a plan
Your deployment plan lists every in-scope control with its status, MITRE references and Microsoft Learn source. The PowerShell script contains the audit queries and configuration for your in-scope controls, in belt order — with every read ready to run and every write commented out. For most of these controls the audit is the work: it tells you who is relying on a setting before you change it for everybody at once.