Azure and Entra ID Hardening for a Managed Hosting Provider
Cross-tenant admin paths into customer environments closed, with every privileged action now approved and logged.
Client name withheld by agreement- Client
- Data center and managed hosting provider
- Region
- Salt Lake City, Utah
- Year
- 2025
- Duration
- 10 weeks
- Scope
- 4 Entra ID tenants · 210 customer subscriptions · 9,400 identities
- Practice
- AI, Cloud & Digital Trust
The challenge
What was at stake.
A data center and managed hosting provider runs Azure environments for 210 customer subscriptions across four Entra ID tenants. Its engineers used delegated admin relationships that gave them standing access to every customer at once.
A recent attack on a peer provider had started with one stolen engineer token. Customers were asking how the provider would stop the same thing happening to them.
What we did
The approach, step by step.
- 01
Every path into customers mapped
We traced delegated admin relationships, service principals and guest accounts to show which engineer identities could reach which customer tenants.
- 02
Standing access removed
Granular delegated admin with time-bound roles, just-in-time elevation and approval workflows replaced always-on administrator rights.
- 03
Tokens protected
Phishing-resistant MFA, compliant-device requirements and token protection policies were enforced for every privileged session.
- 04
Customer-facing evidence
A per-customer access report shows who touched each environment, when and why, ready for customer audits.
Outcomes
What changed, in numbers.
- 0
- standing admin paths into customer tenants
- 210
- customer subscriptions under time-bound access
- 9,400
- identities under conditional access
- 100%
- of privileged actions approved and logged
We can now show any customer exactly who accessed their environment and why. That has become a selling point.
Services delivered
Related engagements
More work in AI, Cloud & Digital Trust.
-
Denver, Colorado · 15 weeks
AI, Cloud & Digital Trust · 2025SOC 2 Type II for a Legal E-Discovery PlatformAn unqualified Type II report covering Security and Confidentiality, delivered before the Am Law 100 renewal cycle.
-
Seattle, Washington · 22 weeks
AI, Cloud & Digital Trust · 2026 · OngoingISO/IEC 42001 and Adversarial Testing for a Contact-Center AI ProviderVoice agents that can no longer be talked into reading back card numbers, and an AI management system heading for certification.
-
Houston, Texas · 24 weeks
AI, Cloud & Digital Trust · 2024Cloud Security Platform for a Genomics LaboratoryPetabytes of patient genomes locked behind one set of guardrails, with no slowdown in sequencing turnaround.
Let’s talk about your version of this.
Share what you are up against. A senior practitioner who has delivered this kind of work will reply within one business day.