Key Takeaways

• Stale user accounts are one of the most exploited attack vectors in SMB Microsoft environments
• MFA non-enrollment leaves accounts exposed even with strong passwords
• Over-permissioned app registrations are a common and overlooked vulnerability
• Conditional Access policies are the single most effective control for protecting cloud identities
• Azure AD sign-in logs tell you whether you have already been compromised

Why Your Microsoft Identity Layer Is the Priority

Azure Active Directory is the front door to your entire Microsoft 365 environment, email, SharePoint, Teams, OneDrive, and any other connected applications. If an attacker gains access to a single account, particularly an admin account, they can read every email in your organization, exfiltrate files, and cause damage that takes months to remediate. Most SMBs configure Microsoft 365 once during setup and never revisit the security settings. This audit takes less than ten minutes and will surface the issues that matter most.

Step 1: Find and Disable Stale User Accounts

Former employees, temporary contractors, and test accounts that were never properly offboarded are a persistent attack vector. An attacker who obtains credentials for a dormant account from a data breach database can often access your environment undetected because the account raises no behavioral alerts.

• Navigate to Azure Active Directory > Users > All Users
• Filter by 'Sign-in status: Enabled' and sort by 'Last sign-in'
• Flag any account with no sign-in activity in the past 30 days
• Confirm with managers whether these users are still active
• Disable immediately rather than deleting, you can recover a disabled account if needed

Step 2: Audit Multi-Factor Authentication Enrollment

MFA is the single most effective control against credential-based attacks, blocking over 99% of automated account compromise attempts according to Microsoft's own data. Yet in most SMB environments, MFA enrollment is incomplete. Check your actual enrollment rates, not just your policy. A single admin account without MFA is a critical vulnerability regardless of how strong the password is. Enable it today.

• Go to Azure Active Directory > Users > Per-user MFA (or Microsoft Entra ID > Security > MFA)
• Identify all users with 'Disabled' or 'Enabled but not enforced' MFA status
• Prioritize enforcement for all admin accounts first, then all other users
• Set a deadline of 72 hours for compliance, MFA enrollment takes under five minutes per user

Step 3: Review App Registrations and Permissions

Every application connected to your Azure AD tenant, including third-party integrations, automation tools, and old pilot software, has permissions to access your data. Unused app registrations with broad permissions are a significant and commonly overlooked attack surface.

• Navigate to Azure Active Directory > App Registrations > All Applications
• Identify any application not in active use and remove it
• For active apps, review the API permissions assigned and apply the principle of least privilege
• Look for any apps with 'Mail.ReadWrite' or 'Files.ReadWrite.All' permissions that you did not intentionally grant

Step 4: Check Your Conditional Access Policies

Conditional Access is Microsoft's most powerful identity security tool. It lets you define rules about when and under what conditions users can access your environment. Without it, a user can sign in from any country, on any device, with any browser. With it, you can block sign-ins from outside the US, require compliant devices, and challenge logins from unfamiliar locations.

• Navigate to Azure Active Directory > Security > Conditional Access > Policies
• Verify you have at least a baseline policy requiring MFA for all users
• Consider adding a policy that blocks sign-ins from countries you do not operate in
• Ensure no policies include a broad exclusion that undermines your controls

Step 5: Review Sign-In and Audit Logs

Your Azure AD sign-in logs are a historical record of every access attempt to your environment. If you have not reviewed them recently, you may find evidence of existing compromise. Look specifically for failed sign-in attempts (which suggest a brute-force or password-spray attack), successful sign-ins from unusual locations or IP addresses, and sign-ins at unusual hours. If you see successful sign-ins from a foreign country you do not operate in, treat it as an active incident and contact your IT security resource immediately.

After the Audit: Next Steps

Running this audit once is valuable. Running it on a quarterly schedule is a security program. Set a calendar reminder for 90 days from today to repeat these five checks. Additionally, consider enabling Microsoft Secure Score, a free tool within the Microsoft 365 admin center that continuously evaluates your configuration against best practices and gives you an actionable priority list of improvements. Most SMBs can improve their Secure Score by 20-30 points with changes that take less than an hour to implement.

Frequently Asked Questions

How do I audit Azure AD security quickly?

Five checks take about ten minutes: find and disable stale user accounts, verify MFA enrollment for every user, review app registrations and their permissions, confirm you have baseline Conditional Access policies, and scan the sign-in logs for suspicious activity. These five checks surface the issues that matter most in a typical SMB environment.

Why are stale user accounts a security risk?

Dormant accounts belonging to former employees or old contractors can be accessed with credentials from breach databases, and because the account raises no behavioral alerts, the intrusion often goes undetected. Disable them rather than deleting, since a disabled account can be recovered if needed.

How effective is multi-factor authentication?

MFA blocks over 99% of automated account compromise attempts according to Microsoft's own data. A single admin account without MFA is a critical vulnerability no matter how strong the password is, so enforce it for admins first and then all users.

What are Conditional Access policies?

Conditional Access lets you define rules about when and under what conditions users can access your environment. At minimum, require MFA for all users, and consider blocking sign-ins from countries you do not operate in. Watch for broad exclusions that quietly undermine your policies.

What should I look for in Azure AD sign-in logs?

Look for failed sign-in attempts that suggest brute-force or password-spray attacks, successful sign-ins from unusual locations or IP addresses, and sign-ins at unusual hours. A successful sign-in from a foreign country you do not operate in should be treated as an active incident.

How often should I repeat this security audit?

Quarterly. Set a calendar reminder for 90 days out, and enable Microsoft Secure Score in the Microsoft 365 admin center for continuous evaluation. Most SMBs can improve their Secure Score by 20-30 points with changes that take less than an hour.