Identity, the number one vector for data breaches
The figures have been circulating for several years in incident reports: a large majority of data breaches involve a compromised identity. What strikes even more is the repetition. Incident response teams almost systematically fall back on the same ten design or exploitation errors in Identity and Access Management (IAM) systems.
None of these errors stem from a sophisticated attack. They are organizational blind spots: outdated password policy, forgotten service account, access review checked without being read. These flaws naturally group into three families: authentication, authorization, and governance. This structure directly aligns with the principles of a Zero Trust architecture applied to Microsoft Entra ID and Azure, where every access must be verified, limited in time, and justifiable.
Why This List Matters
80% of recorded data breaches involve an identity. Correcting these ten points does not guarantee the absence of incidents, but drastically reduces the exploitable attack surface.
Authentication: Four Still-Too-Common Pitfalls
The first family of errors concerns how a user proves their identity before accessing a resource.
- MFA via SMS or voice call: this channel remains vulnerable to SIM-swapping. It should be replaced with phishing-resistant multifactor authentication — FIDO2 keys or Windows Hello for Business — configurable via authentication methods in Microsoft Entra ID.
- Obsolete password policies: a minimum of 8 characters without reuse control no longer meets the standards expected in 2026. Password strategies based on length, blocking common passwords (Password Protection), and gradual transition to passwordless authentication should become the norm.
- Shared service accounts: without an identified owner or individual audit trail, these accounts allow an attacker to hide behind a common identity. Each service must have a dedicated identity, ideally an Azure managed identity rather than a shared account.
- Absence of session re-authentication: a stolen access token that remains valid for several months is a permanent open door. Conditional access policies must enforce login frequency and limited session lifetime, re-verified regularly rather than validated once and for all.
Caution with SMS as a Second Factor
SMS remains supported by many organizations for compatibility reasons, but Microsoft explicitly recommends disabling it in favor of phishing-resistant methods in Entra ID authentication method policies.
Authorization: When Privileges Become a Weapon
The second pillar concerns what identities are authorized to do once authenticated — and this is often where the blast radius of a compromise explodes.
- Permanent admin access: an account with permanently elevated rights transforms a one-time compromise into total takeover. Privileged Identity Management (PIM) in Entra ID directly addresses this risk through Just-In-Time role activation, limited in time and subject to approval.
- Explosion in the number of roles: hundreds of custom roles created over time without review end up becoming unreadable. No one knows exactly what a role actually authorizes anymore, creating authorization blind spots.
- Absence of access reviews: rights inherited from a previous position often survive a role change. Access Reviews from Entra ID Governance allow automating this periodic control, provided they are actually used.
- Rushed access reviews: a review may exist on paper, but validations are performed mechanically, without real examination. The control becomes cosmetic and provides no real protection.
- Generic permissions (wildcard): using a wildcard character in an IAM policy, particularly in AWS IAM, massively expands the scope of a compromised account. The principle of least privilege requires explicit permissions and precise scoping, never open scope by default.
PIM Priority
If only one action must be taken quickly, it is enabling PIM on high-privilege Entra ID roles (Global Administrator, Privileged Role Administrator). The impact on risk reduction is immediate and measurable.
Governance: Mastering the Identity Lifecycle
The third pillar goes beyond the technical question to touch on organizational processes for managing the identity lifecycle.
Orphaned accounts illustrate a classic failure of the Joiner-Mover-Leaver (JML) process: an employee leaving the organization sometimes retains access for several weeks. This late offboarding constitutes an attack surface in its own right, particularly critical when the departure is contentious.
The absence of an inventory of non-human identities arguably represents the most underestimated blind spot currently. Robots, applications, and service identities far exceed the number of human identities in most cloud environments — a ratio often cited at around 45 to 1. These machine identities proliferate without clear owner, without secret rotation, and without periodic review.
Microsoft Entra Workload ID and Azure managed identities help reduce this debt by eliminating static secrets in favor of identities managed by the platform. Without a prior inventory, no security strategy is possible: you cannot protect what is not accounted for.
Machine Identities: A Growing Risk
The volume of non-human identities is growing faster than most IAM teams' governance capabilities. Regular audits of service identities, applications, and service principals are essential, not optional.
Summary of Ten Errors by Pillar
| Pillar | Error | Recommended Remedy |
|---|---|---|
| Authentication | MFA via SMS/call | FIDO2, Windows Hello for Business |
| Authentication | Weak password policy | Password Protection, enforced length |
| Authentication | Shared service accounts | Dedicated managed identities |
| Authentication | No re-authentication | Conditional Access, limited session duration |
| Authorization | Permanent admin | PIM, Just-In-Time activation |
| Authorization | Explosion of roles | Role rationalization and audit |
| Authorization | No access review | Access Reviews Entra ID Governance |
| Authorization | Generic permissions (wildcard) | Least privilege, explicit scoping |
| Governance | Orphaned accounts | Automated JML process |
| Governance | Unaccounted non-human identities | Entra Workload ID, regular audit |
Key Takeaways
- Identity remains the primary vector for unauthorized access: correcting these ten errors directly reduces the probability of incident.
- Phishing-resistant authentication (FIDO2, Windows Hello for Business) should replace SMS and voice calls as the second factor.
- PIM and Access Reviews from Entra ID Governance transform one-time controls into continuous discipline.
- The Joiner-Mover-Leaver process must cover immediate offboarding, not just employee onboarding.
- Non-human identities now outnumber human identities in volume: without an inventory, no governance is possible.
None of these fixes require a miracle product. They demand consistent and regular application of mechanisms already available in Microsoft Entra ID — PIM, Access Reviews, Conditional Access, Workload ID. The roadmap for 2026 hinges less on purchasing a new tool than on disciplined execution of these ten controls.
