BANKING & FINANCE

A financial services firm

How a financial services firm locked down every sign in with Entra ID Conditional Access

A 30 person firm went from MFA switched on for some and skipped for others to every sign in checked and trusted, using the Microsoft licensing it already pays for.

Get Results Like TheseRead the Story
Of sign ins checked by Conditional Access
100%Of sign ins checked by Conditional Access
Trust principles using Microsoft licensing th
ZeroTrust principles using Microsoft licensing th
THE CHALLENGE

Where They
Started.

A 30 person financial services firm came to us knowing something was off, but not sure how exposed they really were. They handle sensitive client records every day, yet their sign in security had grown by accident rather than by design. Multi factor was enforced for part of the team and quietly skipped for the rest. No Conditional Access at all, so a valid password from anywhere on any device got in. Several accounts carried far more admin than the work actually required. Accounts from finished projects and former partners could still reach company data. The owner put it plainly. They knew enough to be worried, but not enough to fix it. In their industry a single bad sign in is the kind of scare that gets handled the week after rather than the week before. Our job was to handle it the week before.

  • MFA on for some, off for others
  • A password alone was enough
  • Admin rights everywhere
  • Old guests still active

If this sounds like your environment, the first conversation is free and takes 15 minutes.

Book a Free Consultation
THE WORK

What We
Did.

Before, a valid password from anywhere was enough to get in. Now every sign in is evaluated against who is asking, where they are, and what device they are on. Only a request that clears all of it is granted, and trusted. Before: a valid password from anywhere on any device was enough to get in.

01

Audit the Entra ID environment first

We reviewed every account, every sign in pattern, and every existing policy, then showed the firm exactly where the gaps were in plain language. No jargon, just what is risky and what it takes to fix. We measured identity risk with Microsoft Secure Score so the before and after was on the record.

02

Enforce MFA properly

We closed the half enforced gaps so every user was covered, including admins and service accounts where appropriate. MFA only works when there are no quiet exceptions.

03

Build Conditional Access policies

This is the policy layer that makes MFA actually effective. We built rules that check who is signing in, where they are signing in from, and what device they are using, then grant, challenge, or block accordingly.

04

Cut admin rights to least privilege

We mapped admin roles to what each person genuinely needs and stripped the rest, so a single compromised account cannot do company wide damage.

05

Clean up stale guests

We found every dormant guest account, confirmed which were no longer needed, and removed them, so old relationships could no longer reach current data.

06

Pilot first, then roll out

We tested every policy with a small pilot group before going wide, caught friction early, and made sure nobody got locked out during the change.

We'd scope the same kind of engagement for your business, with timelines and effort against each stage.

Get a Scoped PlanCompare Service Levels
We knew our sign in security was patchy, we just did not know how to fix it without breaking everyone's day. The pilot meant nobody got locked out, and now I can actually explain our security to our clients.
Operations lead · a financial services firmA financial services firm
MORE STORIES

Other businesses we've done this for.

View all case studies →
Banking & Finance

An accounting firm

This 20 person accounting firm was paying more to Microsoft than it should, and the invoice never gave it away. Each line item looked small, so for years it simply got paid. The bill kept going out and the work kept getting done. The waste sat there in plain sight. The owner sensed the Microsoft 365 spend was high but had no easy way to prove it. There was no clear map of who used what, and no time to dig through the admin center line by line. They wanted a straight answer, not a sales pitch. The waste was never hiding. It was just never questioned. Each small line item kept getting paid because no one had the time to add them up.

$2,000A year of wasted licenses removed
Professional Services

A boutique executive search firm

A boutique executive search firm nearly lost the one thing its whole business runs on, the trust in its founder's inbox. Here is exactly how the attack worked, the questions we asked, and every PowerShell step we ran to contain it.

< 24 hoursFrom discovery to containment
Manufacturing

A logistics company

Like a lot of growing operations, this logistics company approved invoices by forwarding emails. Someone then tracked who had signed off in a shared spreadsheet, retyping the same details every day. It worked, right up until the person who knew the spreadsheet went on vacation. The cracks showed in the usual places. Approvals sat unread at the bottom of inboxes. Nobody could say for certain who had signed off, or when, without scrolling back through an email chain. A mistyped number was caught late, if at all. The team did not want yet another subscription, another login, another monthly fee for an approval tool. They wanted the process fixed, inside the tools they already trusted. They thought they needed to buy an approval tool. It turned out they already owned everything they needed.

100%Of approvals logged with who and when

Want Results Like
This for Your Business?

Book a free 15-minute call. We'll tell you honestly how much of what we did for A financial services firm would apply to your setup.

Book a Free ConsultationContact Us
No commitment
Free 15-min call
500+ clients served