Illustrative scenario: the organization below is a fictional composite. It reflects problems and fixes we commonly see in Microsoft 365, Intune, Purview and Azure environments. Names and figures are examples, not a specific client.
This credit union privileged access case study covers a common exam outcome: findings on who holds admin rights, how those accounts sign in, and how long activity logs are kept. The credit union already owned Microsoft 365 E5. It just was not using the parts that answer those questions.
At a glance
Item
Detail
Industry
Financial services, credit union (fictional: Harborview Community Credit Union)
Size
95 staff, 5 branches
Microsoft licensing
Microsoft 365 E5 (includes Microsoft Entra ID P2 and Purview Audit Premium)
Challenge
Examiner findings on standing admin access, weak admin authentication, and short log retention
Permanent Global Administrators cut from 9 to 2 break-glass accounts, 100% of admin sign-ins phishing-resistant, findings closed at follow-up
The challenge
The credit union’s last examination came back with three findings tied to Microsoft 365. Examiners wanted to see that privileged access was limited and reviewed, that administrators used strong authentication, and that the credit union could produce activity logs for a reasonable look-back period during an investigation.
The CEO and the board’s supervisory committee wanted the findings closed before the follow-up review in five months. The two-person IT team was already stretched with a core banking upgrade, so they asked us to plan and run the work with them.
What we found
Nine accounts held Global Administrator permanently, including the CEO, a former IT manager’s account that was still enabled, and an account used by a previous IT vendor.
Admins signed in with SMS codes or the Authenticator app with simple push approval. Nothing phishing-resistant.
No emergency access accounts. If Conditional Access broke, nobody could get back in.
Audit logs were on defaults. Nobody had confirmed what was retained, and the team had never run an audit search.
No access reviews. Group and role membership had not been checked since the tenant was set up.
What we changed
1. Move admins to Privileged Identity Management
We built a role map with the IT team: who needs which role, and how often. Most daily work only needed User Administrator, Exchange Administrator or Helpdesk Administrator. In Microsoft Entra admin center > ID Governance > Privileged Identity Management, we converted every permanent assignment to eligible, set a four-hour maximum activation, and required a justification and ticket number. Global Administrator activation also requires approval from a second admin. Microsoft documents the model in What is Microsoft Entra Privileged Identity Management?
The former employee’s account and the old vendor account were disabled the first day, then deleted after a 30-day hold.
2. Phishing-resistant MFA for admin roles
Each admin received two FIDO2 security keys, one carried and one locked in a branch safe. A Conditional Access policy targeting directory roles requires the built-in Phishing-resistant MFA authentication strength, so a stolen password plus an approved push prompt is no longer enough to activate or use a role.
3. Two break-glass accounts
We created two cloud-only emergency access accounts on the onmicrosoft.com domain with permanent Global Administrator, FIDO2 keys stored in separate locations, and exclusions from Conditional Access policies that could lock everyone out. An alert fires to the IT team and the CEO whenever either account signs in. We test them quarterly.
4. Audit log retention that matches the policy
Microsoft Purview Audit Premium, included in E5, keeps Microsoft Entra ID, Exchange, SharePoint and OneDrive audit records for one year by default for licensed users. We added an audit log retention policy that keeps all admin activity and other workloads for the same year, and documented the 10-year add-on as an option if the credit union’s records schedule ever requires it. Microsoft explains the defaults in Manage audit log retention policies. We also showed the team how to run and export an audit search so they can answer an examiner’s request on the spot.
5. Monthly access reviews
We set up recurring access reviews in Microsoft Entra ID Governance for every privileged role and for the security groups that grant access to the member data SharePoint sites. Reviewers are the IT manager and the COO. If a reviewer does not respond, access is removed automatically.
Results
In this scenario, at the follow-up review:
Permanent Global Administrator assignments went from 9 to 2, and both are break-glass accounts.
100% of admin role activations in PIM used a FIDO2 key, with a written justification on record.
One year of audit history was available and searchable, with a documented retention policy.
Five monthly access review cycles were completed, removing 14 stale group memberships.
Microsoft Secure Score rose from 47% to 78%.
All three Microsoft 365-related findings were closed.
Lessons for your business
Check what you already license. Many financial institutions on E5 pay for PIM, access reviews and Audit Premium without turning them on.
Standing admin access is the finding. Eligible, time-bound, approved activation is what examiners and auditors want to see.
Phishing-resistant MFA starts with admins. Roll it out to the smallest, highest-risk group first, then extend it.
Evidence beats screenshots. PIM history, access review results and audit exports are timestamped records you can hand over.
Which license do we need for Privileged Identity Management?
PIM requires Microsoft Entra ID P2 or Microsoft Entra ID Governance for the users who use it. Microsoft 365 E5 includes Entra ID P2. Business Premium includes P1 only, so you would add P2 for admins.
Should break-glass accounts be excluded from MFA?
They should be excluded from Conditional Access policies that could lock you out, but they should still use strong authentication. A FIDO2 key stored securely is a good fit, along with sign-in alerts and regular testing.
How long does Microsoft 365 keep audit logs?
Audit (Standard) keeps records for 180 days. Audit (Premium) keeps Entra ID, Exchange, SharePoint and OneDrive records for one year by default for E5-licensed users, and you can create retention policies for other activity. Ten-year retention needs an add-on license.
Illustrative scenario: the organization below is a fictional composite. It reflects problems and fixes we commonly see in Microsoft 365, Intune, Purview and Azure environments. Names and figures are examples, not a specific client.
This credit union privileged access case study covers a common exam outcome: findings on who holds admin rights, how those accounts sign in, and how long activity logs are kept. The credit union already owned Microsoft 365 E5. It just was not using the parts that answer those questions.
At a glance
The challenge
The credit union’s last examination came back with three findings tied to Microsoft 365. Examiners wanted to see that privileged access was limited and reviewed, that administrators used strong authentication, and that the credit union could produce activity logs for a reasonable look-back period during an investigation.
The CEO and the board’s supervisory committee wanted the findings closed before the follow-up review in five months. The two-person IT team was already stretched with a core banking upgrade, so they asked us to plan and run the work with them.
What we found
What we changed
1. Move admins to Privileged Identity Management
We built a role map with the IT team: who needs which role, and how often. Most daily work only needed User Administrator, Exchange Administrator or Helpdesk Administrator. In
Microsoft Entra admin center > ID Governance > Privileged Identity Management, we converted every permanent assignment to eligible, set a four-hour maximum activation, and required a justification and ticket number. Global Administrator activation also requires approval from a second admin. Microsoft documents the model in What is Microsoft Entra Privileged Identity Management?The former employee’s account and the old vendor account were disabled the first day, then deleted after a 30-day hold.
2. Phishing-resistant MFA for admin roles
Each admin received two FIDO2 security keys, one carried and one locked in a branch safe. A Conditional Access policy targeting directory roles requires the built-in Phishing-resistant MFA authentication strength, so a stolen password plus an approved push prompt is no longer enough to activate or use a role.
3. Two break-glass accounts
We created two cloud-only emergency access accounts on the
onmicrosoft.comdomain with permanent Global Administrator, FIDO2 keys stored in separate locations, and exclusions from Conditional Access policies that could lock everyone out. An alert fires to the IT team and the CEO whenever either account signs in. We test them quarterly.4. Audit log retention that matches the policy
Microsoft Purview Audit Premium, included in E5, keeps Microsoft Entra ID, Exchange, SharePoint and OneDrive audit records for one year by default for licensed users. We added an audit log retention policy that keeps all admin activity and other workloads for the same year, and documented the 10-year add-on as an option if the credit union’s records schedule ever requires it. Microsoft explains the defaults in Manage audit log retention policies. We also showed the team how to run and export an audit search so they can answer an examiner’s request on the spot.
5. Monthly access reviews
We set up recurring access reviews in Microsoft Entra ID Governance for every privileged role and for the security groups that grant access to the member data SharePoint sites. Reviewers are the IT manager and the COO. If a reviewer does not respond, access is removed automatically.
Results
In this scenario, at the follow-up review:
Lessons for your business
We cover this ground in our MFA enablement service, our Microsoft 365 security assessment, and our NIST CSF assessment for mapping controls to exam language.
Frequently asked questions
Which license do we need for Privileged Identity Management?
PIM requires Microsoft Entra ID P2 or Microsoft Entra ID Governance for the users who use it. Microsoft 365 E5 includes Entra ID P2. Business Premium includes P1 only, so you would add P2 for admins.
Should break-glass accounts be excluded from MFA?
They should be excluded from Conditional Access policies that could lock you out, but they should still use strong authentication. A FIDO2 key stored securely is a good fit, along with sign-in alerts and regular testing.
How long does Microsoft 365 keep audit logs?
Audit (Standard) keeps records for 180 days. Audit (Premium) keeps Entra ID, Exchange, SharePoint and OneDrive records for one year by default for E5-licensed users, and you can create retention policies for other activity. Ten-year retention needs an add-on license.
Facing an exam or audit with Microsoft 365 findings? Request a free Microsoft 365 security assessment and we will map each finding to a fix.