A global investment firm sees, every day, what is really set in its Microsoft 365 E5

The challenge

• A large tenant. Hundreds of security settings in Microsoft 365 E5, and no easy way to know at any moment what is set and what changed.
• Complex access policy. Conditional Access built on large user groups. A user or app left out of a group stays unprotected, with no alert.
• App identities. Apps with client secrets and powerful permissions, and no single view of them.
• New threats all the time. When a new attack is published, the team needs to know fast whether it applies to them.

What we did together

The OnCloud team ran working sessions with the firm’s security team, and Griffin31 checked every day what had changed in the tenant.

1. 1Every setting, checked daily

   Every day Griffin31 checks 208 controls across 6 Microsoft products: Entra ID, Intune, Defender, Exchange, SharePoint and Teams.

   The benefit: The security team sees what is really configured, and every fix is confirmed by the next day’s check.

2. 2Conditional Access, redesigned

   In working sessions we planned a move from policies scoped to groups to policies that apply to everyone, with defined exclusions. Plus Protected Actions, Strict Location for service accounts, and Copilot access based on the user’s insider-risk level.

   The benefit: A new user or app is protected from day one, instead of being left outside the policy.

3. 3Emergency access accounts

   Break-glass accounts were set up as recommended, and the daily check confirmed it.

   The benefit: Even if an access policy fails, the organization is never locked out of its own tenant.

4. 4Only healthy devices get in

   Conditional Access that requires a compliant device, and a Windows PC joined to the organization.

   The benefit: A stolen password or token is not enough to sign in from a device the organization does not manage.

5. 5Every new threat, tested against the tenant

   For each new threat we checked which protections were already in place and what was missing: Storm-2949, the OAuth supply chain, and WinRAR with ransomware. The Storm-2949 review confirmed that device-code sign-in is blocked and admins sign in with FIDO2.

   The benefit: Instead of a generic alert, the team gets a short list of what to close in its own tenant. Blocking Win32 API calls from Office macros was later switched on too.

6. 6App identities

   An Entra app-registration review tool we built, Workload Identities licensing guidance, and a Sentinel alert rule for risky apps.

   The benefit: One view of the apps with powerful permissions, and the groundwork to protect them with Conditional Access.

7. 7Copilot and Power Platform

   Key governance findings: DLP for Copilot agents, connector restrictions, and control over email sent from Power Automate.

   The benefit: Control over the ways data can leave through AI and automation tools.

What changed