Start a project
Menu
ServicesAll servicesCybersecurityCloud EngineeringApplication ServicesEnterprise PlatformsData & AnalyticsAI & Machine LearningInternet of ThingsMobilize Talent
PlatformsAll platformsIdentity and accessPrivileged access and secretsERP, HCM and financeCRM, ITSM and automationHealthcareInsurance and bankingData and integrationCloud and AIIndustrial, utilities and mainframeSkills matrix
Case studiesAll case studiesIdentity and accessPrivileged accessSecurity operationsCloud and infrastructureApplicationsERP and HCMCRM, ITSM and automationIndustry platformsData and analyticsAI and agents
IndustriesAll industriesEnergy, oil & gasHealthcare payersBanking & financial servicesInsurancePublic sectorManufacturingLocations
InsightsField notesLearning tracks
CompanyAbout CohashPortfolioSkills matrixCareersTrust and securityContact
Start a project
access management

Microsoft Entra ID, still Azure AD to most people, with Conditional Access you can explain to an auditor.

We design Conditional Access, clean up app registrations, run Entra ID Governance, and set up Microsoft Entra Agent ID so AI agents get their own identities instead of borrowed service principals.

Talk to a Microsoft Entra ID engineerWhat changed recently
platform dossierMicrosoft Entra IDAccess management
Vendor
Microsoft
Agent identity
Microsoft Entra Agent ID, generally available
Next deadlines
SMS/voice MFA from 1 Feb 2027; Connect Sync 2.6.84.0+ by 7 Apr 2027
Later in 2027
Custom controls in May; SMS/voice for Global Admins, external users from 1 Jul
release watch
  • MemberOf rules have stopped updating03 Nov 2026
  • AgentIdentity.CreateAsManager no longer granted automatically04 Nov 2026
connects with
in short·15-second read

Microsoft Entra ID is what Azure Active Directory is called now.

Cohash designs Conditional Access, runs hybrid sync, cleans up app registrations, and sets up ID Governance and Agent ID. Two dates matter next: Microsoft-provided SMS and voice MFA starts retiring on 1 February 2027, and Connect Sync needs 2.6.84.0 by 7 April 2027.

you probably need this if
  • Conditional Access has grown to dozens of policies and nobody can say which one blocked a sign-in.
  • AD FS servers still get patched every month for a handful of relying parties.
  • App registrations are full of client secrets that never expire, owned by people who left years ago.
terms on this page Conditional accessdefinitionRules evaluated at each sign-in that look at conditions such as user, device or location, and then allow, block or demand more proof.explained in a field note →SYNCdefinitionA Databricks SQL command that registers your external Hive tables in Unity Catalog. It doesn't copy data, so it's quick, but it won't take DBFS root tables.explained in a field note →Copilot StudiodefinitionMicrosoft's tool for building chat agents. Anyone who built an agent from inside Teams stored it in Dataverse for Teams, so it's caught by this too.explained in a field note →Entra Connect SyncdefinitionThe Windows program that copies users, groups and password hashes from on-premises Active Directory to Entra ID. You'll still see its old name, Azure AD Connect, in plenty of places.explained in a field note →MFAdefinitionMulti-factor authentication. On top of the password you prove it's you a second way, usually with an app prompt or a security key.explained in a field note →
Ask an engineer facts checked 2026-11-08
how it runs
  1. 01Tenant assessment
  2. 02Policies in report-only mode
  3. 03Hybrid identity and AD FS
  4. 04Workload and agent identities
  5. 05Governance and handover
you keep
  • Every Conditional Access policy written up with who owns it, why it exists and who it leaves out
  • A report-only run of each policy against your sign-ins, so you know who'd get locked out before anyone does
  • Each app registration listed with its owner, its credential expiry dates and the Graph permissions it holds, so stale ones stand out
+ 3 more documents
who does it
Microsoft Entra ID engineer (Conditional Access)Entra ID Governance engineerHybrid identity engineer (Entra Connect, Cloud Sync) Microsoft Certified: Identity and Access Administrator Associate
platforms
proof
43 case studies on this
background
A full business cycle Report-only Pilot ringenforces Staged rings Change in git All users
field note · 12 minConditional access is a policy, not a prayer
azure-ad · release timeline
  1. Jul 2026 Conditional Access and ID Protection for Agents Microsoft rolled out the service plans for these between early July and early August 2026 (MC1395007). You get them with Microsoft Agent 365 or Microsoft 365 E7. If your tenant has neither, sort out licensing before anyone builds agent policies.
  2. Aug 2026 Entra Connect Sync privilege flaw (CVE-2026-65673) An attacker who already has some access could use this flaw to raise its privileges through Entra Connect Sync. Microsoft rated it Important, CVSS 7.8, in August 2026 and lists it as not exploited and not publicly disclosed. The fix is in 2.6.84.0, the minimum build for the April 2027 deadline. That deadline also needs application-based authentication, which you configure separately on existing servers.
  3. Oct 2026 Managed policy for high-risk users turns on automatically In Entra ID P2 tenants without their own enabled user-risk policy, the Microsoft-managed policy "Require remediation for high-risk users" starts in report-only. Unless an admin sets it to Off, it switches to On on the schedule Microsoft gives that tenant. MC1507808, so far seen only in Education tenants, gave the week of 28 October 2026. Check that break-glass accounts were excluded and that users are registered for MFA, because that's how they self-remediate.
  4. 28 Oct 2026 PIM Iteration 2 (beta) APIs retired The beta PIM APIs for Azure resources, Entra roles and groups were retired on 28 October 2026. Scripts and apps that still call them now fail, so move them to the Iteration 3 APIs.
  5. 03 Nov 2026 MemberOf rules have stopped updating Dynamic groups, dynamic administrative units and entitlement auto-assignment policies that still use MemberOf stopped processing changes after 3 November 2026. Membership is frozen in its last state, so new starters miss access and leavers keep it, and any Conditional Access policy scoped to those groups has gone stale with them. Swap in a supported operator or convert the group to assigned membership.
  6. 04 Nov 2026 AgentIdentity.CreateAsManager no longer granted automatically Microsoft set enforcement to start on 4 November 2026, with rollout expected to finish by late November. After that, Entra no longer hands this permission to agent blueprint principals on its own, and an agent that creates agent identities app-only with nothing but the old grant behind it gets a 403. Find those agents in the audit log and have an admin consent to the permission now.
  7. today · Nov 09, 2026
  8. 01 Feb 2027ahead Microsoft-provided SMS and voice MFA starts retiring Rollout starts on 1 February 2027 for ordinary users and on 1 July 2027 for Global Administrators and external users. Microsoft says those are phased start dates and it can't tell you when your tenant gets it, so prepare for February. The people at risk have only SMS or voice registered and sign in where passkeys don't work. Users who still need codes need a telecom provider you contract yourself through Choose Your Own Telephony, which went GA on 30 October 2026, and you pay that provider's message charges plus the Azure hosting.
  9. 07 Apr 2027ahead Entra Connect Sync upgrade and app-based authentication Microsoft wants every Connect Sync server on 2.6.84.0 or later, using application-based authentication, by 7 April 2027. Miss either and sync stops, so changes in on-premises AD stop reaching Entra ID. Older builds retire on their own dates, 2.5.190.0 on 2 February 2027, 2.6.1.0 on 10 March and 2.6.3.0 on 7 July. The newest build right now is 2.6.92.0.
  10. May 2027ahead Conditional Access custom controls retire Custom controls in Conditional Access are on their way out. Since September 2026 you can't add or change one, existing ones run until May 2027, and Microsoft wants everyone moved by 30 April 2027. Most of the work is setting the third-party MFA provider up as an external authentication method and switching each policy back to the normal MFA grant. Test sign-ins before you delete the old references.
  11. no date yetEntra Agent ID generally availableEach agent's identity comes from a blueprint and has a sponsor, and lifecycle workflows keep that sponsor current. Permissions come through access packages, and Conditional Access has its own templates for agents. The agent registry itself is moving into Microsoft Agent 365, while Entra keeps the identity side.
the story · microsoft entra id estate

From the first call to a setup your own team can run.

Here's what usually prompts a call about your Microsoft Entra ID estate, what we do about it and in which order, and where you end up.

  1. chapter 01 · where it hurts

    Why teams reach out

    • Conditional Access has grown to dozens of policies and nobody can say which one blocked a sign-in.
    • AD FS servers still get patched every month for a handful of relying parties.
    • App registrations are full of client secrets that never expire, owned by people who left years ago.
  2. chapter 02 · what we change

    How we solve it

    • Conditional Access design
    • Hybrid identity
    • App registrations and workload identities
    • Entra ID Governance
    • Entra Agent ID
    • Moving off AD FS
  3. chapter 03 · how it runs

    Our approach

    • Tenant assessment
    • Policies in report-only mode
    • Hybrid identity and AD FS
    • Workload and agent identities
    • Governance and handover
  4. chapter 04 · where you end up

    What changes

    • Each policy now has an owner and a written reason.
    • Each agent now has a sponsor and only the Graph permissions it needs, and a Conditional Access policy for agents covers it.
    • Every Conditional Access policy written up with who owns it, why it exists and who it leaves out
    • A report-only run of each policy against your sign-ins, so you know who'd get locked out before anyone does
what we do

Our Microsoft Entra ID work

6 kinds of Microsoft Entra ID work, each run by engineers who have done it on live tenants.

  1. A policy set built from Microsoft's templates, tested in report-only mode, with break-glass accounts and every exclusion documented.

  2. Entra Connect or Entra Cloud Sync configured or rebuilt, with sync scope, source anchor and password hash sync decisions written down.

  3. An inventory of app registrations and service principals, owners assigned, stale secrets removed, and federated credentials used where they fit.

  4. Lifecycle workflows, access packages and access reviews connected to HR, so joiners and leavers run without tickets.

  5. Agent identity blueprints, sponsors and owners, access packages for agents acting for users and on their own, and Conditional Access templates for risky or autonomous agents.

  6. Federated domains converted to cloud authentication, relying parties moved to Entra ID, and the AD FS servers retired.

capability 01 / 06in production

Conditional Access design

A policy set built from Microsoft's templates, tested in report-only mode, with break-glass accounts and every exclusion documented.

talk to an engineer about this →
capability 02 / 06in production

Hybrid identity

Entra Connect or Entra Cloud Sync configured or rebuilt, with sync scope, source anchor and password hash sync decisions written down.

talk to an engineer about this →
capability 03 / 06in production

App registrations and workload identities

An inventory of app registrations and service principals, owners assigned, stale secrets removed, and federated credentials used where they fit.

talk to an engineer about this →
capability 04 / 06in production

Entra ID Governance

Lifecycle workflows, access packages and access reviews connected to HR, so joiners and leavers run without tickets.

talk to an engineer about this →
capability 05 / 06in production

Entra Agent ID

Agent identity blueprints, sponsors and owners, access packages for agents acting for users and on their own, and Conditional Access templates for risky or autonomous agents.

talk to an engineer about this →
capability 06 / 06in production

Moving off AD FS

Federated domains converted to cloud authentication, relying parties moved to Entra ID, and the AD FS servers retired.

talk to an engineer about this →
typical situations

Microsoft Entra ID situations we walk into

We pieced these together from Microsoft Entra ID situations that come up a lot. They're patterns. You won't find a specific client in them.

case file 01

Seventy Conditional Access policies, and three nobody will touch

composite · not a client story
  1. Beforethe situation

    A tenant has grown to seventy Conditional Access policies across several reorganizations. Three exclude a group with 900 members, MFA prompts vary by app for no clear reason, and the helpdesk can't say which policy blocked a sign-in.

  2. What we dothe work

    We export every policy and a month of sign-in logs, then map each policy to the users and apps it actually hits. A smaller set built from Microsoft's templates runs in report-only mode beside the old one. When the results match expectations, groups switch over one at a time.

  3. Afterwhere you end up

    Each policy now has an owner and a written reason. Exclusions are written down and reviewed, and when someone gets blocked, the helpdesk can open the sign-in log and point to the one policy that did it.

case file 02

Agents running on old app registrations that can read every mailbox

composite · not a client story
  1. Beforethe situation

    Business units built Copilot Studio and custom agents on ordinary app registrations. Several hold application permissions such as Mail.ReadWrite across the tenant, their secrets never expire, and one agent creates agent identities through the automatic CreateAsManager grant.

  2. What we dothe work

    We inventory agents and their Graph permissions, assign sponsors, and move each agent to Entra Agent ID with a blueprint and an access package. For the agent that creates identities, an admin grants AgentIdentity.CreateAsManager through admin consent and we test app-only creation before enforcement.

  3. Afterwhere you end up

    Each agent now has a sponsor and only the Graph permissions it needs, and a Conditional Access policy for agents covers it. When the November permission change rolls through, nothing in production hits a 403.

case studies

Microsoft Entra ID case studies

All case studies
migration Identity and access

On-premises Active Directory to cloud-first Microsoft Entra ID

We shrink on-premises Active Directory one application at a time, moving groups, users and app authentication to Microsoft Entra ID as each app is ready.

read the case study
migration Identity and access

AD FS federation to Entra ID authentication

Converting federated domains from AD FS to Entra ID cloud authentication, moving relying parties app by app and retiring the AD FS farm.

read the case study
consolidation Identity and access

Identity integration after a merger or carve-out

We give people access on day one after a merger or divestiture. Then directories, identity providers and governance get merged or separated, on a plan.

read the case study
consolidation Identity and access

Consolidating Okta and Entra ID after years of running both

Picking one primary identity provider after years of running Okta and Microsoft Entra ID side by side, then moving apps, MFA and provisioning to it.

read the case study
migration Identity and access

SAP Identity Management replacement with Entra ID or SailPoint

SailPoint or Microsoft Entra for SAP integration after IdM? How we'd choose, provision ECC and S/4HANA, and keep GRC working before 2027 end of maintenance.

read the case study
modernization Security operations

Service account, API key and non-human identity cleanup

Tracking down every service account, app registration, API key and AI agent, putting an owner on each and moving them to short-lived, federated credentials.

read the case study
approach

How a Microsoft Entra ID engagement runs

We don't start a step until the last one has produced something you can check.

  1. step 01

    Tenant assessment

    We export Conditional Access policies, app registrations, sign-in logs and sync settings, then map gaps and exclusions before changing anything.

  2. step 02

    Policies in report-only mode

    We run new Conditional Access policies in report-only mode against real sign-ins first, so you see what they'd block before they enforce anything.

  3. step 03

    Hybrid identity and AD FS

    Entra Connect or Cloud Sync set up or rebuilt, federated domains moved to cloud authentication through staged rollout, and AD FS relying parties moved app by app.

  4. step 04

    Workload and agent identities

    We give service principals owners and federated credentials, and move agents onto Entra Agent ID with sponsors and access packages as the November 2026 consent change rolls out.

  5. step 05

    Governance and handover

    We tie lifecycle workflows and access reviews to HR data, and write up the policies and break-glass procedures so your team can run them without us.

ai on microsoft entra id

Where AI fits on Microsoft Entra ID, and where it needs guardrails.

Microsoft Entra Agent ID is generally available, and it extends blueprints, sponsors, access packages and Conditional Access to agents. In preview there's also an MCP Server for Enterprise that answers read-only directory questions through Graph. Two things need doing. Move agents off broad app registrations, and prepare for the CreateAsManager consent change on 4 November 2026.

AI agentasks for data or an action
Scoped identityonly the access it needs
MCP serverthe one door into the platform
Logged, approveda person signs off on writes
Microsoft Entra IDdoes the work

Microsoft runs the MCP Server for Enterprise at mcp.svc.cloud.microsoft/enterprise. It's read-only, in preview, and it honors the user's roles and granted scopes. Log it through Graph activity logs filtered on its appId. Any write should go through Graph instead, with a scoped agent identity and approval.

Microsoft Entra Agent ID

Agent identity blueprints, sponsor lifecycle workflows, and access packages for agents (acting for a user or on their own). For us the work is moving agents off plain app registrations, assigning each one a sponsor and scoping its Graph permissions.

Conditional Access and ID Protection for Agents

Agent policies rolled out from July 2026 (MC1395007) and require Microsoft Agent 365 or Microsoft 365 E7. Check licensing first. We then build the policies from Microsoft's templates and leave them in report-only mode.

The CreateAsManager change on 4 November 2026

AgentIdentity.CreateAsManager stops being granted automatically (MC1506728). Agents that create agent identities need admin consent or they fail with a 403. We find those agents and test app-only creation before enforcement.

MCP Server for Enterprise

Microsoft's preview MCP server turns natural-language questions into read-only Graph calls on users, groups, apps and devices, and each user gets 100 calls per minute. Helpdesk and audit reporting fit it well. Turn on Graph activity logs and you can trace each call, so we do.

architecture

People and agents take different routes into Entra ID. Here's where each one ends up

Users come in from Active Directory through sync and from HR through inbound provisioning, so every workforce identity ends up in Entra ID. Each sign-in to Microsoft 365, Dynamics 365, SaaS apps or Azure goes through Conditional Access. AI agents get their own identities in Entra Agent ID instead of borrowing an app registration.

People and agents take different routes into Entra ID. Here's where each one ends up Users come in from Active Directory through sync and from HR through inbound provisioning, so every workforce identity ends up in Entra ID. Each sign-in to Microsoft 365, Dynamics 365, SaaS apps or Azure goes through Conditional Access. AI agents get their own identities in Entra Agent ID instead of borrowing an app registration. 01 · SOURCES 02 · MICROSOFT ENTRA 03 · RESOURCES Connect or Cloud Sync inbound provisioning agent identity scoped Graph access Conditional Access group membership SAML · SCIM RBAC Active Directory users · groups · devices HR system Workday · SuccessFactors AI agents Copilot Studio · customagents Ex Microsoft Entra ID Conditional Access ·ID Governance Ex Entra Agent ID blueprints · sponsors Microsoft 365 Exchange · SharePoint ·Teams D365 Dynamics 365 group teams · securityroles SaaS apps SAML · OIDC · SCIM Azure resources RBAC role assignments © Cohash · cohash.com
01 · SOURCES02 · MICROSOFT ENTRA03 · RESOURCES Active Directory: users · groups · devices ActiveDirectory users · groups· devices HR system: Workday · SuccessFactors HR system Workday ·SuccessFactors AI agents: Copilot Studio · custom agents AI agents Copilot Studio· custom agents Microsoft Entra ID: Conditional Access · ID Governance Microsoft EntraID Conditional Access· ID Governance Entra Agent ID: blueprints · sponsors Entra Agent ID blueprints ·sponsors Microsoft 365: Exchange · SharePoint · Teams Microsoft 365 Exchange ·SharePoint · Teams Dynamics 365: group teams · security roles Dynamics 365 group teams ·security roles SaaS apps: SAML · OIDC · SCIM SaaS apps SAML · OIDC · SCIM Azure resources: RBAC role assignments Azure resources RBAC roleassignments Connect or Cloud Sync inbound provisioning agent identity scoped Graph access Conditional Access group membership SAML · SCIM RBAC © Cohash · cohash.com
use cases

Typical Microsoft Entra ID projects

The work teams usually bring us, and the platforms Microsoft Entra ID has to talk to while we do it.

  1. AZU-01 Conditional Access has grown into dozens of overlapping policies common request
  2. AZU-02 AD FS is still running and you want it gone common request
  3. AZU-03 Nobody owns half the app registrations, and their secrets never expire common request
  4. AZU-04 Someone built agents in Copilot Studio on app registrations with far more permissions than they need common request
  5. AZU-05 You need access reviews that tie back to HR data common request
  6. AZU-06 Dynamic groups still use MemberOf, or Entra Connect Sync is below 2.6.84.0 common request
Microsoft Entra ID · connected platforms
OktaSailPointSaviyntCyberArkMicrosoft Dynamics 365Microsoft Power Platform
you keep

What a Microsoft Entra ID engagement leaves behind

These are working documents, written against your configuration, so your team can run them without us.

  • guide01

    Every Conditional Access policy written up with who owns it, why it exists and who it leaves out

    yours to keep
  • report02

    A report-only run of each policy against your sign-ins, so you know who'd get locked out before anyone does

    yours to keep
  • document03

    Each app registration listed with its owner, its credential expiry dates and the Graph permissions it holds, so stale ones stand out

    yours to keep
  • runbook04

    AD FS relying-party migration tracker with a cutover date per app

    yours to keep
  • design05

    A blueprint for each kind of agent you run, and someone named as its sponsor. Access goes through packages

    yours to keep
  • tests06

    Break-glass account procedure, tested and signed off

    yours to keep
talent and delivery · microsoft entra id

Certified engineers, wherever you need them.

Some clients want a project team, some want a couple of engineers on theirs. Either works. Onsite, nearshore or offshore, with handovers across time zones that keep things moving.

Onsite

Engineers at your sites in the US

Nearshore

Overlapping hours with US teams

Offshore

Overnight progress on your backlog

All time zones

Coverage handed over across time zones

24-hour coverage · US Central time
OnsiteUS business hours
Nearshoreoverlapping US hours
Offshoreovernight progress
Combinedhandover, not hand-off
certifications our engineers hold
  • Microsoft Certified: Identity and Access Administrator AssociateMicrosoft
roles we staff
  • Microsoft Entra ID engineer (Conditional Access)
  • Entra ID Governance engineer
  • Hybrid identity engineer (Entra Connect, Cloud Sync)
  • Entra app integration developer (MSAL, Graph)
  • Identity architect for Microsoft 365 and Azure
  • Entra ID administrator
due diligence · microsoft entra id

Questions to ask any partner, including us.

Put these to anyone bidding on your Microsoft Entra ID work. The ones who've done it answer differently from the ones who've read about it.

  1. Q1

    Before you enforce a new Conditional Access policy, how will you show us who it would have locked out?

    Report-only mode records what a policy would have done on real sign-ins. Skip it, and service accounts and legacy clients get locked out on a Monday morning.

  2. Q2

    Do any of our agents still depend on the automatic AgentIdentity.CreateAsManager grant, and which ones?

    The automatic grant started going away on 4 November 2026 and is expected to be gone by late November. Any agent that creates agent identities without a signed-in user and relies only on that grant gets 403 errors once enforcement reaches its tenant. Find them before the business does.

  3. Q3

    How will you protect our break-glass accounts, and who signs in to test them?

    Emergency access accounts sit outside most policies, so they need protection of their own. If nobody tests one by signing in on a schedule, its first real test will be the outage it was created for.

  4. Q4

    Which of our licenses actually cover Conditional Access for Agents, and how will you check?

    Agent 365 and Microsoft 365 E7 both include it. Check which one you actually hold before anyone starts writing agent policies.

  5. Q5

    How will you move AD FS relying parties without a single big-bang cutover?

    Staged rollout moves groups of users to cloud authentication while AD FS still serves the rest. Claim rules on each relying party have to be rebuilt in Entra ID, and custom rules take longest.

01Is Azure AD the same as Microsoft Entra ID?

It is. Microsoft renamed Azure Active Directory to Microsoft Entra ID. We kept the page address for people still searching for Azure AD.

02Our agents create their own identities. What breaks now that CreateAsManager isn't automatic?

Look in the audit log for "Add Service Principal" events where an application, not a user, created an agent identity. Those agents are the ones at risk as the automatic grant goes away, from 4 November 2026 through late November. Have an admin grant the permission through admin consent, then test app-only creation so nobody meets a 403 in production.

03Should we use Entra ID Governance or SailPoint?

It works well when most of your applications already sign in through Entra ID. If there's a big on-premises estate, or complex ERP rules, you often need a dedicated IGA platform. We check your application list and audit scope before saying which.

04Should we stay on Entra Connect Sync or move to Cloud Sync?

That comes down to your forests, your custom sync rules and your writeback needs.

05Do we have to upgrade Entra Connect Sync before April 2027?

Yes, if you still run Connect Sync. Each server needs 2.6.84.0 or later and application-based authentication by 7 April 2027, or sync stops. Check the version on every server, staging ones too, and plan the upgrade with a rollback. In the Azure public cloud, 2.6.91.0 also adds a guided move to Cloud Sync if you'd rather leave.

06Some of our users still get MFA codes by text. What happens to them in 2027?

Microsoft starts retiring its own SMS and voice delivery on 1 February 2027, and Global Administrators and external users follow from 1 July. If some users still need codes by text or phone, you contract a provider through Choose Your Own Telephony and pay its charges. Most tenants are better off moving those users to passkeys or the Authenticator app first and keeping SMS for the few who can't.

07Some of our groups still use MemberOf rules. What happens to them?

They stopped recalculating after 3 November 2026 and kept whatever members they had on that day. Nothing got deleted, which is why it's easy to miss. Export your dynamic group rules, find the ones with MemberOf, and rewrite them or switch them to assigned membership, then check any Conditional Access policy or license assignment that hangs off them.

services

Related services

Projects on Microsoft Entra ID usually end up touching one of these, so they're worth a look.

you are hereMicrosoft Entra ID
fact-checked Checked against vendor and official documentation last checked 2026-11-08 content fingerprint 8010bb5d
  1. 01Book a 30-minute working sessionsenior engineer
  2. 02Talk to an engineer about your setupreply within 24 hours
  3. 03See how similar projects wentcase studies
Reviewed by the Cohash team Microsoft Entra ID is a trademark of its owner, used here to identify the platform. how we handle facts and data →
next step

Tell us what you're running. We'll tell you what we'd do first.

A 30-minute working session with a senior engineer. No slides.

Book a working session See the case studies
useful to bring
  • The platform and the version you're on
  • Where you need to get to, and by when
  • What's custom: rules, plugins, integrations
  • Any audit finding or deadline driving it