The problem
Portal changes are easy to make and easy to lose track of. I wanted an identity baseline where I could review the change, understand the decision and test the recovery path before enforcing access controls.
What I built
Four Conditional Access policies in Terraform, two passkey-protected emergency accounts, and Sentinel detections in a separate Terraform root. The policies cover legacy authentication, MFA, high-risk sign-ins and user risk. User-risk remediation stayed in report-only mode.
I configured PIM in the portal and tested a one-hour Conditional Access Administrator activation through to expiry. PIM was not managed by Terraform.
The lab ran from July to August 2026 on trial Entra ID P2 licences. It is now shut down. The scope is identity only: Conditional Access, break-glass access, PIM and Sentinel rules. No endpoint, device or networking controls were built.
Decisions and trade-offs
- Recovery comes first. Both emergency accounts had to work before I enabled enforcement.
- Two exclusion groups provide separate paths for excluding the emergency accounts from Conditional Access.
- Identity and detections use separate Terraform roots and local state files.
- CI checks formatting and validity in both roots. It does not run a plan or apply.
- Device management was deliberately excluded because the provider approach and available lab devices did not support a credible test.
What I verified
MFA and emergency access were tested with real sign-ins. PIM activation was tested live. Sentinel rules fired for an emergency-account sign-in and an exclusion-group change. The password-spray query ran, but no spray was generated to trigger that rule. Other Conditional Access checks used What If.
What I would do differently
Move state to a remote backend with locking. Add workload identity for CI plans with review before apply. Move PIM into code and remove the deploying administrator’s standing Global Admin access.
Links
Read the repository for code, decision records, evidence and limitations.