Microsoft Defender, Entra ID and zero trust security for Microsoft 365
Microsoft Defender is Microsoft's family of security products for devices, email, identities and cloud apps, and most Microsoft 365 organisations already own part of it. Arke Technologies, in Johannesburg, configures Defender, Entra ID and Intune to zero trust principles for organisations, public bodies and schools across South Africa, then monitors and reports under an SLA.
Zero trust security for Microsoft 365
Zero trust security grants no user, device or network trust by default, however it connects. NIST describes the architecture in SP 800-207, and Microsoft reduces it to three principles, each a set of tenant settings:
- Verify explicitly. Entra ID conditional access checks every sign-in against the user, the health of the device, the location and the risk.
- Least privilege. People get the access their role needs, administrators get elevated rights only when needed, and access is reviewed.
- Assume breach. Devices are managed and encrypted, data is labelled, logs are kept, and Defender watches for an attacker already inside.
With staff at home, schools in cloud classrooms and councillors on tablets, identity, not the office network, is now the perimeter.
Identity and access management with Entra ID
Identity and access management (IAM) makes sure the right people, and only they, reach the right systems. IAM in cyber security matters because attacks on Microsoft 365 so often begin with a stolen or guessed credential rather than a software flaw. Microsoft Entra ID, formerly Azure Active Directory, is the identity and access management system behind every tenant, and can be the single sign-on (SSO) point for Salesforce, HubSpot, Zoho, Google Workspace and your other applications.
What is MFA? Multi-factor authentication (MFA) asks for two or more kinds of proof at sign-in: something you know, such as a password; something you have, such as a phone app or security key; or something you are, such as a fingerprint. A stolen password alone no longer opens the account, and we move administrators first, then everyone, to phishing-resistant passkeys, security keys or Windows Hello for Business.
Password management. NIST's digital identity guidelines (SP 800-63B) favour long passphrases screened against breached-password lists over forced periodic changes. Entra ID password protection enforces the screening, Windows LAPS rotates every device's local administrator password, and staff use an approved password manager.
Account security on Microsoft's platform also means watching sign-in logs and risky sign-in alerts rather than trusting appearances: company branding puts your logo on the sign-in page, but phishing kits can copy it. Cloud identity management reaches beyond Microsoft too. AWS, Google Cloud and Azure each have an IAM layer, and IAM in cloud computing works best when all trust one identity source, so cloud access management, identity management security and security access management become one policy.
Privileged identity management and privileged access management
Privileged accounts are what attackers want most: a Global Administrator can read every mailbox and switch off every control. Privileged identity management (PIM) in Entra ID removes standing administrator rights: administrators activate eligible roles just in time, for a limited period, with MFA, a justification and, for sensitive roles, an approval, and each activation is logged. Privileged access management (PAM) is the wider discipline: vaulting shared and service-account credentials, recording privileged sessions and controlling access to servers, network devices and cloud consoles.
The benefits of privileged access management are concrete:
A smaller blast radius. A phished administrator account holds no rights until activated.- Evidence. Every elevation is logged, as auditors expect under ISO/IEC 27001 control 8.2, which supports POPIA section 19 safeguards.
- Fewer standing administrators. Tier 0, the accounts and servers that control identity itself (Global Administrators, domain controllers and Entra Connect servers), is held by a handful of accounts.
- Emergency access that works. Two monitored, tested break-glass accounts, so a faulty policy never locks you out.
AWS privileged access management follows the same logic: no daily use of the root account, MFA on it, roles instead of long-lived access keys, and temporary, approved elevation; see Amazon Web Services.
Devices, ransomware and patching with Defender and Intune
Managed devices are the second pillar of zero trust. Intune enrols every laptop and phone, applies encryption and security baselines and reports compliance, and conditional access blocks devices that fail. Defender for Endpoint, or Defender for Business, then protects each device.
Microsoft Defender ransomware protection works in layers: controlled folder access stops untrusted programs changing protected folders, attack surface reduction rules block techniques ransomware relies on, and endpoint detection and response can isolate an infected device. OneDrive's version history is not a backup; see ransomware and endpoint protection and backup and disaster recovery.
Patch management is where many estates slip: Defender's vulnerability management shows which missing patches attackers exploit, and Intune deploys fixes in rings, pilot group first (device management). Sensitivity labels and data loss prevention in Microsoft Purview matter more once Microsoft 365 Copilot can surface anything a user can open; see Copilot readiness.
Securing Business Central and other Microsoft cloud apps
Dynamics 365 Business Central, Microsoft's ERP for small and mid-sized organisations, is one of the Dynamics 365 applications rather than an alternative to them (the usual Microsoft Dynamics 365 vs Business Central question), and it signs users in through Entra ID, so the controls above protect your ledger too. Inside Microsoft Dynamics 365 Business Central, permission sets and security groups decide who may post journals, approve payments or change master data, and security filters limit users to the records they need. During setup we document them in a permissions grid, roles against sensitive actions, so segregation of duties is visible at a glance.
Master data management in Business Central needs particular care, because changed supplier bank details are a favourite fraud: field monitoring and the change log record who changed what, and the audit trail contains the evidence auditors ask for. Integrations call the Business Central API (the v2 endpoints) through Entra app registrations with the narrowest permissions, and trial and sandbox environments get production's controls.
Microsoft's licensing guide for Business Central sets out who needs which licence: you license full users on Essentials or Premium (Premium adds the manufacturing and service management modules), Team Members licences suit approvers, and Business Central pricing is per user per month. Report layouts, Excel exports and Power BI reports carry its data out of the system, so export rights belong in the review. Implementation, CRM links and work by Business Central developers or a functional consultant sit with our ERP implementation and support service.
Licensing and what it costs
Last reviewed: September 2026.
Microsoft 365 security has two cost lines: licences and work. Microsoft Entra ID licensing decides much of what is possible: conditional access needs Entra ID P1 or above, included in Business Premium, E3 and E5, while Privileged Identity Management, risk-based policies and access reviews need Entra ID P2, included in E5 or added per user. We supply Microsoft 365 licences monthly or annually and itemise each one; see our Microsoft 365 pricing guide.
The work is a hardening project quoted after the assessment, then management per user per month under an SLA; published South African managed IT rates run from about R180 to R400 per user per month (matnet.co.za, September 2026). The biggest driver is usually the gap between the protection you license and the protection switched on, so the assessment comes before any change to your licence budget, not after it.
Governance, compliance, procurement and continuity
- Reporting. A monthly service review: Secure Score trend, incidents by priority (P1 to P4, against targets agreed in your SLA), privileged activations, access reviews and your risk register, updated each month.
- Change control. Policy changes approved against documented runbooks, with a named service lead and escalation path.
- Compliance. Controls that support POPIA section 19, ISO/IEC 27001-aligned evidence, King IV Principle 12 (King V Principle 10) reporting and PFMA or MFMA audits; see POPIA compliance.
- Procurement. Arke Technologies (Pty) Ltd is a Level 1 B-BBEE contributor (sworn affidavit available on request). Company documents, our Central Supplier Database (CSD) registration details and SARS tax compliance status are available on request, and we complete SBD forms when a bid requires them; see company facts. The hardening project is bought on a proposal and purchase order, and ongoing management under an SLA.
- Continuity. Every setting lives in your tenant and is documented, and you own your data, credentials and documentation. If you change provider, we hand back administrator roles, break-glass accounts and the configuration record. We work remote-first from Stoneridge Office Park, Greenstone Hill, for clients across South Africa, including Midrand and Sandton: one accountable technology partner for identity, devices, email and data.