身元と入場管理

Access sprawl is invisible until it isn't: ex-contractors still in the tenant, service principals with owner-level roles, MFA enforced on some apps and not others, and nobody able to say who can reach what. Audits catch it; attackers catch it first.

We map who and what accesses which system, then implement in order of risk: MFA and conditional access first, app SSO via Entra ID second, role and service-principal cleanup third. Break-glass accounts, PIM-style elevation and a recurring access-review cadence are set up so the posture holds after we hand over — documented to the standard security review boards expect.

協働

指名デリバリーリード + チーム

時期

Hardening in 2–3 weeks; full rollout scoped per estate