A bank's security review of its Microsoft Entra tenant produces four requirements:
- Every user must satisfy multifactor authentication before performing Azure management operations. - Sign-ins that use legacy authentication protocols must be blocked outright. - Holders of privileged directory roles must authenticate with a phishing-resistant method, not merely any second factor. - Two emergency access accounts must remain able to sign in if the policies themselves cause an outage.