CreativeTechsBaseline
tenant security posture
CTB-27 · Tier 1 · Silent · M365 · P1

Restrict Entra and Azure portal access to administrators

Huntress Managed CA template · High · FoundationalMaester MT.10081 authority
0
Tenants failing
0
Tenants meeting
0
Measured
REQUIRED
Disposition
The settingWhat we hold this to
CreativeTechs minimum
A CA policy in state ENABLED targeting the Microsoft Azure Management cloud app, All users excluding directory roles and break-glass, grant = Block.
Benchmark position
No published numeric benchmark. Huntress ships 'Restrict Azure Portal Management' as a managed CA template, High · Foundational. Maester MT.1008 tests for the policy's existence and currently PASSES on the CreativeTechs tenant.
Where the switch is
Entra admin centre → Protection → Conditional Access → Policies → New policy → Target resources → Cloud apps → Microsoft Azure Management.
https://entra.microsoft.com
How to verify
Graph: /identity/conditionalAccess/policies → conditions.applications.includeApplications contains '797f4846-ba00-4fd7-ba43-dac1f8f63013'
Across the fleet
Client
State
Evidence
Blackwing
UNKNOWN
No Secure Score evidence — awaiting Maester.
BravicaOne
UNKNOWN
No Secure Score evidence — awaiting Maester.
CMG Law
UNKNOWN
No Secure Score evidence — awaiting Maester.
CreativeTechs
UNKNOWN
No Secure Score evidence — awaiting Maester.
DCG One
UNKNOWN
No Secure Score evidence — awaiting Maester.
Diversified Management Services
UNKNOWN
No Secure Score evidence — awaiting Maester.
Double Z
UNKNOWN
No Secure Score evidence — awaiting Maester.
Electric Pen
UNKNOWN
No Secure Score evidence — awaiting Maester.
Graphiti Associates
UNKNOWN
No Secure Score evidence — awaiting Maester.
Guidance Engineering
UNKNOWN
No Secure Score evidence — awaiting Maester.
India Tree
UNKNOWN
No Secure Score evidence — awaiting Maester.
MIR Corp
UNKNOWN
No Secure Score evidence — awaiting Maester.
Phinney Bischoff
UNKNOWN
No Secure Score evidence — awaiting Maester.
Quiver Dental
UNKNOWN
No Secure Score evidence — awaiting Maester.
RHO Architects
UNKNOWN
No Secure Score evidence — awaiting Maester.
Retail Voodoo
UNKNOWN
No Secure Score evidence — awaiting Maester.
Riverstone
UNKNOWN
No Secure Score evidence — awaiting Maester.
SSF
UNKNOWN
No Secure Score evidence — awaiting Maester.
Slingshot Architecture
UNKNOWN
No Secure Score evidence — awaiting Maester.
Stoke
UNKNOWN
No Secure Score evidence — awaiting Maester.
Turnstyle
UNKNOWN
No Secure Score evidence — awaiting Maester.
Urban Animal
UNKNOWN
No Secure Score evidence — awaiting Maester.
WLIHA
UNKNOWN
No Secure Score evidence — awaiting Maester.
Zak Designs
UNKNOWN
No Secure Score evidence — awaiting Maester.
Why it matters
A standard user has no business in the Entra portal, and portal access is where directory reconnaissance happens after the first account falls.
How we check
Huntress managed CA template 'Restrict Azure Portal Management' (High · Foundational). Maester MT.1008 — currently Passed on our own tenant.
Fix — M365
CA policy targeting the Microsoft Azure Management app → block for everyone outside directory roles.
Fix — Google
Admin console access is already role-gated.
User notices
None for normal users — most have never opened it.
Expected pushback
None.