Cloud Identity Assessment: Microsoft 365 / Entra ID
Your tenant controls your email, your files, and every sign-in. We review how it is configured, then with your authorization test it against the techniques real attackers use.
Get a Quote →What is a cloud identity assessment?
For most organizations today, the Microsoft 365 or Entra ID tenant is the real perimeter. It decides who can sign in, from where, with what second factor, and what they can reach once inside. A cloud identity assessment is an authorized, controlled review of that tenant: we examine how its security controls are configured and then, with your permission, run the realistic attack techniques those controls are meant to stop.
The point is not to collect a list of settings. It is to show what a given weakness actually allows. A user without multi-factor enrollment, a legacy protocol that skips conditional access, or an over-permissive app registration each becomes a concrete path we can describe in plain terms, so your team knows exactly what to fix first.
What we review
MFA and Conditional Access
Which users and apps are covered, which are excluded, and where trusted-location or device rules leave a gap.
Privileged Roles
Global Administrator sprawl, standing versus just-in-time access, and the hygiene of break-glass accounts.
Legacy Authentication
Older protocols and clients that can authenticate without passing a second factor or conditional access.
App Registrations and OAuth Consent
Over-scoped application permissions, consent settings, and third-party apps with standing access to mail and files.
Guest and External Sharing
Guest account lifecycle, sharing-link defaults, and cross-tenant access settings.
Identity Hygiene
Dormant accounts, password and lockout policy, and sign-in risk signals already present in the tenant.
How we test
With written authorization and inside the boundaries we agree in the Statement of Work, we validate findings using the same techniques seen in real incidents against cloud tenants: credential-guessing attempts spread slowly across accounts to mirror how an outsider probes a login portal, checks for sign-in paths that avoid multi-factor, review of how access tokens and sessions are issued, and controlled testing of the consent experience your staff would see. Everything is coordinated with your team, rate-limited to avoid disruption, and logged so each action is attributable.
What you provide
Most of the review runs from read-only visibility. For the attack phase we agree the exact access in advance. In short: a read-only directory and security-reader view for the configuration review, an authorized user list, and one or two low-privilege test accounts you create for the access-dependent checks. The full breakdown, including the Google Workspace equivalents, is in our guide to what access a cloud test needs.
Microsoft 365, Entra ID, and Google Workspace
- —Microsoft 365 and Entra ID tenants, including hybrid setups joined to on-prem Active Directory
- —Google Workspace tenants, reviewed against the equivalent identity and sharing controls
- —Conditional access, MFA, privileged roles, OAuth consent, and external sharing
- —Coordinated with your team and scoped to Microsoft and Google testing policies
Priced by the number of tenants in scope. Almost every organization has exactly one; more than one usually means an acquisition. Scope it in the quote builder →
How this differs from an internal network test
If your users, email, and files live mostly in the cloud, the tenant is where an attacker goes first, and a traditional internal network test will miss most of that surface. If you still run on-prem servers and Active Directory, the two tests complement each other: the internal network test covers the on-prem side, and this covers the cloud identity plane. We will advise on the right combination during scoping.
Based in New York. Working Nationwide.
Grid32 is headquartered in Jersey City, New Jersey and tests cloud identity environments for organizations across the United States. Every engagement is led by senior, U.S.-based, certified engineers, and is conducted remotely, so geography is never a constraint. We are particularly experienced with the regulatory expectations facing financial institutions, law firms, and healthcare organizations that have moved to Microsoft 365.