Entra Identity Operations Guide

Overview

Cirius Group has two Entra ID (Azure AD) tenants:

Tenant	Domain	ID	Purpose
PROD	ciriusgroup.com	d477c9f8	Internal users, staff, IT operations
DDE	ciriusdde.com	ff1c5d68	Customer-facing AVD published app for Medicare

Human access to Entra admin is through the Microsoft 365 Admin Center or Azure Portal. The same account (your @ciriusgroup.com credentials) can reach both tenants — switch via the tenant switcher in the portal top-right.

Most day-to-day identity operations happen in PROD. DDE is customer-facing and changes there carry higher risk — fewer users, tighter blast radius.

---

User Creation

New Employee — PROD Tenant

1. Open Microsoft 365 Admin Center → Users → Active users → Add a user
2. Fill in:
   • First name, Last name
   • Display name: Firstname Lastname
   • Username: firstname.lastname@ciriusgroup.com
   • Password: auto-generate and force change at first login
3. Click Next → Assign licenses — assign Microsoft 365 Business Premium (the standard license)
4. Click Next → Optional settings — set job title and department
5. Click Next → Finish

After creation:

• The user can log in at https://portal.office.com and will be prompted to change password
• MFA will be required on first login (Conditional Access enforces MFA for all users)
• Entra will sync to on-prem AD within ~30 minutes via Entra Connect

Do not create users in on-prem AD directly unless they are service accounts with no cloud presence. All human users should be cloud-first (created in Entra, synced down via Entra Connect).

Service Accounts

Service accounts that only need Azure access (not on-prem) are created in Entra directly. Service accounts that need on-prem access are created in on-prem AD and sync to Entra.

Naming convention:

• Cloud-only: svc-<purpose>@ciriusgroup.com (e.g., svc-backup-veeam@ciriusgroup.com)
• On-prem synced: svc-<purpose> in AD (syncs as svc-purpose@ciriusgroup.com)

Service accounts should:

• Have a strong randomly-generated password stored in Keeper
• Not have MFA (use a CA exclusion group — see pim-exclusion-list.md)
• Have only the permissions they need — no Global Admin, no Owner on subscriptions

DDE Tenant Users

DDE users are managed separately. Only add someone to DDE if they need to access the DDE AVD published app or manage the DDE Azure environment.

1. Open Azure Portal → switch to DDE tenant (ciriusdde.com)
2. Navigate to Entra ID → Users → New user
3. Create with @ciriusdde.com domain

DDE does not sync with on-prem AD — it is a standalone tenant.

---

Group Management

Key Groups

Group	Purpose	Members
AllStaff	All employees — synced to Twingate	All full-time employees
PrivilegedUsers	IT/admin staff — higher Twingate access tier	Rory, Kevin, Greg
ContractorAccess	Contractors — limited Twingate resources	Active contractors only
M365BPUsers	Microsoft 365 Business Premium licensees	All licensed users
IntuneManaged	Intune enrolled devices policy scope	Device-based membership
ArcticWolfScope	Arctic Wolf monitoring scope	All managed endpoints

Twingate syncs group membership via the Entra connector. Changes to AllStaff, PrivilegedUsers, and ContractorAccess propagate to Twingate within ~5 minutes.

Adding a User to a Group

Azure Portal:

1. Entra ID → Groups → Search for the group
2. Members → Add members → search for the user → Select

PowerShell (if adding many at once):

Connect-MgGraph -Scopes "GroupMember.ReadWrite.All"
$group = Get-MgGroup -Filter "displayName eq 'AllStaff'"
Add-MgGroupMember -GroupId $group.Id -DirectoryObjectId (Get-MgUser -UserId "user@ciriusgroup.com").Id

Removing a User (Offboarding)

When an employee leaves:

1. Revoke active sessions immediately: Entra ID → Users → select user → Revoke sessions (in the top action bar)

2. Disable the account: M365 Admin Center → Users → Active users → select user → Block sign-in

3. Remove from all groups: Entra ID → Users → select user → Groups → remove from all groups (This automatically removes Twingate access)

4. Remove licenses: M365 Admin Center → Users → Active users → select user → Licenses → unassign all

5. Disable on-prem AD account (if they have one): Via Kevin or Greg (T1 Domain Admins) — disable in AD Users and Computers

6. Keep account for 30 days, then delete: Email/SharePoint data can be recovered within 30 days of deletion. Inform Adriana before deletion so she can preserve any compliance-relevant email.

7. Rotate shared passwords: Any shared accounts or passwords the user had access to should be rotated. Check Keeper for any shared secrets.

---

Privileged Identity Management (PIM)

PIM is enabled for all privileged roles. No one has permanent standing access to Global Admin, Privileged Role Admin, or high-risk roles. Roles are activated on demand with justification and time limits.

Activating a PIM Role (Self-Service)

1. Open https://entra.microsoft.com → Identity Governance → Privileged Identity Management → My roles
2. Find the role you need (e.g., Global Administrator)
3. Click Activate
4. Set duration: use the minimum needed (default 1 hour; max 8 hours)
5. Enter justification: brief description of what you're doing and why
6. Click Activate — activation is immediate for most roles; some require approval

Approving a PIM Request

Rory approves PIM requests for others. When an approval request arrives:

1. Entra ID → Identity Governance → Privileged Identity Management → Approve requests
2. Review the justification — if unclear, reject and ask the requester
3. Approve with a comment confirming the business need

PIM-Excluded Accounts

Accounts that are excluded from PIM (have standing access) are listed in compliance/pim-exclusion-list.md. Exclusions require a documented business justification. Break-glass accounts (cirius-breakglass@ciriusgroup.com) are excluded — they need to work when everything else is broken.

---

Conditional Access

Current CA Policies

Policy	What it does
Require MFA — All Users	MFA on every sign-in for all users except service accounts in the exclusion group
Require Compliant Device	Intune-compliant device required for access to M365 apps
Block Legacy Auth	Blocks SMTP Auth, POP3, IMAP — legacy protocols that bypass MFA
Block Non-Corporate Locations	Optional: limits access to defined named locations
Require PIM Activation	Privileged roles require PIM activation — no standing access

Troubleshooting a CA Block (User Can't Sign In)

When a user reports they can't sign in or are being blocked:

Step 1 — Look at the sign-in log:

1. Entra ID → Monitoring → Sign-in logs
2. Filter by user and last 24h
3. Click the failed sign-in entry → Conditional Access tab
4. The CA policies section shows which policy blocked the sign-in and why

Step 2 — Common causes and fixes:

Error	Cause	Fix
"Your device must be managed"	Device not Intune-enrolled	Enroll in Intune (Company Portal app)
"More information required"	MFA not set up	Complete MFA registration at https://aka.ms/mfasetup
"Access blocked" on a service account	Service account not in CA exclusion group	Add to CA-ExcludedServiceAccounts group (requires justification)
"You don't meet the access requirements"	Compliant device CA — device compliance failed	Check Intune → device compliance state for the specific failure
Sign-in blocked during DR/outage	CA policy too strict for emergency	Use break-glass account per break-glass-procedure.md — don't disable CA policies

Step 3 — What you should NOT do:

• Do not disable a CA policy to fix one user's access issue
• Do not add a user to the MFA exclusion group without a documented reason
• Do not adjust named locations without understanding the policy's intent

If you need to create a temporary CA exception during an emergency, document the change before making it, set an explicit expiry time, and log it in compliance/risk-acceptance-register.md.

Adding a Named Location

Named locations are used to restrict or allow access from specific IP ranges (e.g., office public IPs).

1. Entra ID → Security → Conditional Access → Named locations → New location
2. Choose IP ranges location or Country location
3. Enter the IP CIDR or select countries
4. Name it descriptively: e.g., Livermore Office - Comcast
5. Reference in CA policies as needed

---

Multi-Factor Authentication

Resetting MFA for a User

If a user loses their authenticator and cannot sign in:

1. Entra ID → Users → select user → Authentication methods
2. Click Require re-register multifactor authentication — this forces the user to re-register MFA on next sign-in
3. Alternatively, click the trash icon next to their existing authenticator to remove it and let them re-add

The user will need to complete MFA re-registration before they can access anything. If they are fully locked out (can't receive any MFA), use the break-glass account to access admin functions in the interim.

MFA Registration Policy

New users are prompted to register MFA on first login via the MFA Registration Policy in Identity Protection. This is set to require all users to register within 14 days.

---

Entra Connect (On-Prem Sync)

Entra Connect syncs on-prem Active Directory to Entra ID. It runs on a domain-joined server in the PROD environment (check architecture/network-topology.md for the server name).

Sync Cycle

Default sync cycle is 30 minutes. To trigger an immediate sync:

# Run on the Entra Connect server
Import-Module ADSync
Start-ADSyncSyncCycle -PolicyType Delta

For a full sync (rare — use only after major schema changes):

Start-ADSyncSyncCycle -PolicyType Initial

What Syncs and What Doesn't

Syncs	Does Not Sync
User accounts (enabled/disabled)	Cloud-only users created in Entra
Security groups (some — depends on OU filter)	Microsoft 365 groups
User attributes (displayName, department, title)	Azure AD Roles
Password hash sync (SSPR enabled)	Device objects

If a user created on-prem isn't showing in Entra, check:

1. Is their OU included in the sync scope? (Check Entra Connect → Directory Extensions → OU filter)
2. Did a sync cycle run after creation? (Trigger manually as above)
3. Are there attribute errors? Check Entra Connect Health → Sync Errors

Entra Connect Health Alerts

Entra Connect Health is monitored and will send email alerts to IT admin if sync fails for >3 cycles. If you receive a sync health alert:

1. RDP to the Entra Connect server
2. Check the Application Event Log for ADSync errors
3. Common fix: restart the Microsoft Azure AD Sync service

---

Troubleshooting Reference

Symptom	Where to Look	Likely Cause
User can't sign in	Sign-in logs → CA tab	CA policy, MFA issue, account disabled
New user not syncing from on-prem	Entra Connect Health → Sync Errors	OU filter, attribute error, sync not run
Group membership not reflecting in Twingate	Twingate admin → Users	Entra group sync delay (~5 min)
PIM role not activating	PIM → Pending activations	Approval required; approver needs to action
Break-glass login needed	Break-glass procedure	Use cirius-breakglass@ciriusgroup.com — see break-glass-procedure.md
AccessDenied on Azure resource	Azure RBAC / PIM	Role not assigned or PIM not activated for that scope

---

Related Documents

• Break-Glass Procedure — when Entra access itself fails
• Twingate Operations — Twingate group sync and access tiers
• Conditional Access policies → PIM exclusion list
• Three-Layer Access Architecture

---

Document History

Date	Change	Author
May 2026	Initial draft — user creation, group management, offboarding, PIM, CA troubleshooting, Entra Connect sync.	Rory