Skip to content
North Ark

Identity modernisation

Identity that stops attackers at the front door and lets your people straight in.

Attacks often start with an identity: a reused password, an admin account with standing rights, a legacy protocol that skips MFA. We move identity to Microsoft Entra ID, design Conditional Access that is tested before it is enforced, and remove the weak paths in.

Start with a Microsoft 365 security assessment
Empty open-plan office at dusk, with windows looking over a river city.

What we engineer

  • Active Directory to Microsoft Entra ID, including the path to cloud-only identity where it fits
  • Hybrid identity with Entra Connect or Entra Cloud Sync, cleaned up and documented
  • Conditional Access policy sets, piloted in report-only mode before enforcement
  • MFA and passwordless sign-in: Microsoft Authenticator, passkeys, FIDO2 keys and Windows Hello for Business
  • Privileged Identity Management, admin role separation and protected break-glass accounts
  • App registration and service principal hygiene: owners, secrets, permissions and expiry
  • Legacy authentication removal, with every dependency found first
A checklist of six security findings, four ticked as closed and two still open, connected to three areas of work: identity, endpoint and detection.

How it runs

  1. Assess: sign-in logs, admin roles, hybrid identity health and legacy protocol use.
  2. Design: the target identity model and Conditional Access policy set, agreed with your team.
  3. Pilot: policies in report-only mode, then enforced for IT and a pilot group.
  4. Roll out: enforcement in rings, with a clear support path for users who get stuck.
  5. Hand over: policies documented and kept as code, with a review cycle.

Why it matters for compliance

Identity controls carry much of the weight in the Essential Eight, APRA CPS 234 and cyber insurance questionnaires: MFA, restricted administrative privileges and removal of legacy protocols. The work produces evidence you can show.

Questions buyers ask

Can we get rid of Active Directory completely?

Sometimes. It depends on the applications and devices that still need it. We show you what depends on AD and plan the steps towards cloud-only identity where it makes sense.

Will Conditional Access lock people out?

Not if it is rolled out properly. Policies run in report-only mode first, break-glass accounts are excluded and tested, and enforcement is rolled out in rings.

Which MFA method should we use?

Phishing-resistant methods such as passkeys, FIDO2 keys and Windows Hello for Business for administrators and higher-risk users, and Microsoft Authenticator with number matching for everyone else as a minimum.

What licences do we need?

Conditional Access needs Entra ID P1, included in Microsoft 365 Business Premium and E3. Privileged Identity Management needs Entra ID P2, included in E5.

Can you manage identity for us afterwards?

Yes. Identity and Conditional Access are part of Managed Microsoft 365 and security.

Related

Start a conversation

Close the easiest way in.

Tell us how people sign in today.

Talk to an Engineer