- Client
- Global professional-services enterprise
- Sector
- Professional Services
- Services
- Identity Architecture, Discovery & Assessment
- Year
- 2025
- Timeline
- Discovery and target-state design
- Read time
- 4 min read
0
Live-environment changes made during discovery
Read-only
Discovery toolkit built on the Microsoft Graph API
1
Committed phase, discovery through design sign-off
01 · The challenge
What we walked into
A multinational professional-services enterprise set out to move the authority for its identity estate from on-premises Active Directory into Microsoft Entra ID. Inverting the source of authority is among the most consequential changes an organisation can make, because it disturbs the attribute flows and automation a business has quietly depended on for years.
The business needed a clear picture of its current environment before anyone reached for a design, and an evidence base strong enough that every finding could be defended line by line.
02 · Our approach
How we got there
- 01
Fix the premise
We opened by fixing the premise and the target state, so every question asked afterwards had a purpose and every figure was substantiated against its raw source before it was allowed to shape a decision.
Framing
- 02
Build the tooling
We developed a read-only discovery toolkit on the Microsoft Graph API, gathering tenant configuration, privileged access, licensing, and synchronisation state without any risk of altering the live environment.
Repeatable rigour
- 03
Interrogate the flags
A security flag that appeared to show privileged accounts without multi-factor authentication turned out to describe non-human service accounts that the obvious remediation would have broken. We corrected the design before any change reached the live estate.
Evidence over alerts
- 04
Design sign-off
When the programme needed the work brought forward, we compressed the remaining discovery and design into a single committed phase that still concluded at a clean sign-off, without loosening the standard of evidence behind it.
Sooner, same standard
03 · The outcome
What changed
The programme moved into design with an evidence base the client could trust, a corrected set of assumptions, and every open question answered against the evidence.
Gaps caught before the build
The synchronisation required to support the target model had never been fully put in place, a gap that would otherwise have surfaced as a failure part-way through the build.
Clear answers to hard questions
Asked whether a third-party on-premises multi-factor solution could be retired, we set out how the decision depends on usage and intent, so the choice could be made against the full picture.
Repeatable evidence
The current-state picture was quick to assemble and can be refreshed whenever the client wants a fresh look.
Technologies
- Microsoft Entra ID
- Microsoft Graph API
- Active Directory
A note on confidentiality
Much of our work takes place in regulated and security-sensitive sectors, where the details of a client's environment are confidential by default. In line with our commitments to those clients, identifying details in this case study have been anonymised or generalised, while the work, the decisions, and the outcomes are described as delivered.
If you would like to know more about this engagement, we are happy to discuss it further and can share additional information on request.