Endpoint security protects the device. Identity is what an attacker actually wants — and a stolen session token never touches a managed machine. AllTech builds and runs the Entra ID and Intune side of Microsoft 365: who can sign in, from what device, under what conditions, and what happens when those conditions stop being true.
Microsoft 365 ships open. A new tenant will happily let anyone sign in from any device, anywhere in the world, with a password alone — and it will do it without generating a single complaint. Nothing breaks. That's the difficulty. There is no error message for a tenant that has no conditional access policies; there's just a quiet gap between what you assume is happening and what's actually enforced.
The gap usually shows up in the same few places. MFA is on for most people, but not the service account nobody remembers creating. Legacy authentication is still enabled because turning it off might break the scanner in accounting. Personal phones sync company mail with nothing in the way. Six people are Global Administrators because that's what "make them an admin" did at the time.
None of that is negligence. It's what happens when a tenant grows one request at a time over five years and nobody's job was to look at the whole thing.
Users, groups, and roles built on a structure that still makes sense at twice your headcount. Licensing assigned by group rather than by hand. Administrative roles scoped to what the job actually needs — most people who need to reset a password do not need to be a Global Administrator.
The rules that decide whether a sign-in succeeds: MFA where it matters, blocked sign-ins from countries you don't do business in, restricted access from unmanaged devices, and session controls for the accounts that would hurt most. Built with break-glass accounts and a rollout order that doesn't lock anybody out of their own tenant.
Phishing-resistant methods where they'll be adopted — Microsoft Authenticator number matching, Windows Hello for Business, FIDO2 keys for privileged accounts. Legacy authentication protocols disabled, once we've found what still depends on them.
Windows and macOS enrollment, iOS and Android for the phones that touch company mail. Baseline security configuration, BitLocker and FileVault enforcement, disk encryption key escrow, and app deployment that does not require an engineer at the desk.
Compliance policies that define what a trusted device is — encrypted, patched, protected, and up to date — tied back into conditional access so a non-compliant machine loses access instead of quietly keeping it. Autopilot for new hardware: unbox, connect to Wi-Fi, sign in, and the laptop configures itself.
Risky sign-in and risky user detections routed into the same SOC that watches your endpoints. Impossible-travel logins, anonymized IP addresses, and anomalous session tokens are the ones we want to hear about at 3 a.m., not on the next monthly report.
A documented sequence: disable the account, revoke active sessions and refresh tokens, remove licenses, convert the mailbox, wipe or retire the device. Session revocation is the step most people skip, and it is the one that decides whether a departed employee actually lost access.
Identity alerts land with the same Managed SOC that watches your endpoints, so a risky sign-in gets a human rather than a dashboard entry.
A meaningful share of the security incidents we open across our client base start in Microsoft 365 rather than on an endpoint. Sign-ins from anonymized IP addresses. Logins from places no employee had traveled to. A session token behaving in a way that meant multi-factor authentication had already been skipped.
None of those touched a managed laptop. The device was fine. The antivirus was green.
That is the argument for treating identity as its own layer with its own controls, rather than as a setting inside the email product. Conditional access is what turns a stolen password into a failed sign-in, and device compliance is what stops a valid password on an unmanaged machine from being good enough. It is also why identity detections belong with endpoint detections, in front of the same analysts.
The average small-business tenant has several. Microsoft's own guidance is fewer than five, with none of them used for daily work. We usually find at least one that belonged to a former MSP.
Enabled for most staff, missing on the shared mailbox, the service account, and the executive who requested an exemption in 2022 that was never revisited.
Basic auth protocols that predate MFA and bypass it entirely. Almost always left enabled for one device — a scanner, a copier, an old line-of-business app — and almost always forgotten once that device is replaced.
Enrollment and compliance are two different things. A device can be in Intune, reporting cheerfully, and still be unencrypted and three months behind on patches. Without a compliance policy tied to conditional access, nothing acts on that.
No app protection policy, no separation between work mail and everything else on the phone, no way to remove company data if the phone is lost or the employee leaves.
The account was disabled. The active session token wasn't revoked, and it stays valid until it expires on its own.
We inventory the tenant as it stands: admin roles, MFA coverage, conditional access policies, legacy auth, enrolled devices, guest accounts, and licensing. You get the findings whether or not you hire us for the remediation.
Policies drafted against your actual working patterns — who travels, who works from home, which devices are company-owned, what the field staff use. Break-glass accounts created and documented before anything is enforced.
Policies deploy in report-only mode first. We watch what would have been blocked for a week or two and fix the surprises before they become help desk tickets. Every environment has at least one.
Staged rollout by group, IT first, then department by department. Communication sent ahead of each stage so people know what is changing and why.
Devices move into Intune in batches, existing hardware first, Autopilot for everything purchased after. Compliance policies come on in report-only mode too, then enforce.
Ongoing administration: onboarding, offboarding, policy changes, license management, and identity alerts monitored by the SOC alongside your endpoints.
Entra ID is identity: accounts, groups, sign-ins, and the rules that govern them. Intune is device management: enrollment, configuration, patching, and compliance. They're most useful together — Intune decides whether a device is trustworthy, and Entra ID uses that answer to decide whether to allow the sign-in.
Sometimes, and less often than expected. Conditional access requires Entra ID P1, which is included in Business Premium — a license many businesses already own and haven't fully deployed. We'll tell you what you're already paying for before we suggest anything new.
That's the risk the rollout process is designed around. Every policy runs in report-only mode first so we can see the effect before it's real, break-glass accounts are in place before enforcement, and the rollout is staged by group rather than tenant-wide overnight.
Yes. App protection policies let us protect company data inside the Outlook and Teams apps without managing the whole phone. Company data can be wiped remotely; personal photos and messages are untouched and out of scope.
MFA is the single highest-value control and it is not the whole job. Token theft and MFA-fatigue attacks both work against accounts with MFA enabled. Conditional access, device compliance, and session controls are what close that gap.
Most environments run hybrid for a while, and that is fine. We handle Entra Connect sync, password hash or pass-through authentication, and — where it makes sense — a path toward retiring the on-prem domain controller entirely.
Yes, and it is a common starting point. The first task is a full admin-access audit: who has privileged access, which partner relationships are still delegated, and what gets removed.
Tenant design, migration, licensing, and ongoing administration.
Device compliance decides what's trusted; EDR decides what's happening on it.
Identity-aware access to internal applications, without a VPN.
Risky sign-in alerts are only useful if someone reads them at 3 a.m.
Most credential theft starts with a message that got through.
We'll audit your Entra ID configuration — admin roles, MFA coverage, conditional access, legacy authentication, and device compliance — and show you the gaps in plain language. Findings are yours either way, no pressure.
Trusted by dozens of businesses
AllTech