Microsoft Entra ID in Your SOC 2 Scope

Microsoft Entra ID (formerly Azure Active Directory) serves as the identity platform for engineering teams using Microsoft 365 or Azure. For SOC 2, it sits at the center of CC6.1 (logical access) — controlling who can authenticate to your applications, your Azure infrastructure, and integrated SaaS tools.

The key controls auditors verify: Is MFA enforced for all users? Are Conditional Access policies in place to block risky sign-ins? Are privileged roles limited and reviewed? Entra ID has native capabilities for all of these — the issue is enabling and configuring them correctly.

Option A: Enable Security Defaults (Starter Configuration)

For smaller organizations or teams just starting their SOC 2 journey, Microsoft's Security Defaults provide a baseline set of MFA requirements with a single toggle:

Azure Portal → Entra ID → Properties → Manage Security Defaults → Enable

Security Defaults enforce:

• MFA registration required for all users within 14 days
• MFA required for all admin role holders
• Block legacy authentication protocols

Security Defaults are free and available on all Entra ID tiers. However, they don't allow customization — no exceptions, no Conditional Access. For more granular control, use Conditional Access policies (requires P1 or P2 license).

Option B: Conditional Access Policies (Production Configuration)

Conditional Access gives you policy-based MFA enforcement with conditions, exceptions, and sign-in risk integration. For SOC 2, create these policies:

Policy 1 — Require MFA for All Users

Name: Require MFA — All Users

Assignments:
  Users: All users (except break-glass emergency account)
  Cloud apps: All cloud apps
Conditions: (none required)
Access controls:
  Grant: Require multi-factor authentication
State: On

Policy 2 — Block Legacy Authentication

Legacy protocols (SMTP, IMAP, POP3, Exchange ActiveSync) bypass MFA. Block them:

Name: Block Legacy Authentication
Assignments:
  Users: All users
  Cloud apps: All cloud apps
Conditions:
  Client apps: Exchange ActiveSync, Other clients
Access controls:
  Block access
State: On

Policy 3 — Require MFA for Azure Management

Any access to the Azure portal or Azure Resource Manager API requires MFA:

Name: Require MFA — Azure Management
Assignments:
  Users: All users
  Cloud apps: Microsoft Azure Management
Access controls:
  Grant: Require MFA + Require compliant device (if MDM enrolled)
State: On

Monitor MFA Registration

Enabling MFA enforcement is necessary but not sufficient. You need to verify that users are actually registered. Export the MFA registration report monthly:

Entra ID → Users → Authentication Methods Activity → Registration Details

Or via Microsoft Graph API:

GET https://graph.microsoft.com/v1.0/reports/authenticationMethods/userRegistrationDetails

This report shows every user, their registered authentication methods, and whether they can complete MFA. For SOC 2 evidence, retain this report monthly and document any users who failed to register with the follow-up action taken.

Privileged Identity Management (PIM)

For organizations with Azure P2 licenses, Privileged Identity Management provides just-in-time access to privileged roles — a stronger access control story for SOC 2 auditors.

Instead of permanent Global Administrator assignments, PIM gives users "eligible" assignments that must be explicitly activated for a limited time window (e.g., 8 hours), with MFA verification and optional justification required at activation.

For SOC 2: Global Administrator, Privileged Role Administrator, and Security Administrator should be PIM-managed roles. The activation logs in PIM provide automatic evidence of privileged access usage.

SecureSpect + Entra ID

SecureSpect connects to Microsoft Entra ID via App Registration with client-credentials OAuth2 — a read-only service principal that queries Microsoft Graph for user authentication status and Conditional Access policy state. No user credentials stored. Once connected, SecureSpect monitors MFA registration across all users and flags accounts without MFA enrolled — mapped to CC6.1 evidence — continuously.