Auditing Entra ID for the Australian Privacy Act (2026)

Why Entra ID is now a Privacy Act control

Microsoft Entra ID is now the highest-impact privacy control in a Microsoft 365 environment. Every personal information record in SharePoint, OneDrive, Teams, Exchange and Dynamics is gated by an Entra ID token. An unaudited tenant is, in practice, an unaudited privacy posture.

This guide shows how to audit Entra ID against the Privacy Act 1988 (Cth), the Notifiable Data Breaches scheme administered by the Office of the Australian Information Commissioner (OAIC), and the ASD Information Security Manual.

The OAIC describes the Notifiable Data Breaches scheme this way: "The NDB scheme requires organisations covered by the Privacy Act to notify any individuals likely to be at risk of serious harm by a data breach." (oaic.gov.au, accessed 23 May 2026). A compromised privileged Entra ID account or a misconfigured guest invitation policy is one of the most common precursors to an eligible data breach. Yet most Australian mid-market tenants we assess have never had a structured Entra ID audit.

This is the same audit framework that powers the free Entra ID & Identity Assessment scorecard at EDUC4TE and the paid practitioner-led Identity and Access Review. It is structured around three pillars so the output maps cleanly to ASD ISM controls and OAIC reasonable-steps expectations.

The three-pillar audit framework

A defensible Entra ID audit covers three pillars. We treat the tenant as a control surface and inspect each pillar in turn.

Pillar 1 — Privileged accounts (the blast radius)

Privileged Entra ID roles — Global Administrator, Privileged Role Administrator, Privileged Authentication Administrator, Exchange Administrator, SharePoint Administrator, and Conditional Access Administrator — define the blast radius of an identity compromise. The ASD Essential Eight control "Restrict Administrative Privileges" requires, at Maturity Level 2, that "privileged access to systems, applications and data repositories is requested on demand for a limited time, requires approval, and is logged." (cyber.gov.au — Restrict Administrative Privileges, accessed 23 May 2026).

Audit checklist for Pillar 1:

1. Global Administrator count. Microsoft recommends fewer than five permanent assignments. We typically see ten or more in unaudited tenants. Anything above five is a finding.
2. Privileged Identity Management coverage. Per Microsoft Learn: "Privileged Identity Management (PIM) provides time-based and approval-based role activation to mitigate the risks of excessive, unnecessary, or misused access permissions on resources that you care about." (learn.microsoft.com — pim-configure, accessed 23 May 2026). Every privileged role should be eligible-not-active. PIM for Groups went GA tenant-wide for Entra ID P2 customers in 2026.
3. Break-glass design. Two cloud-only break-glass accounts with hardware-stored credentials, excluded from Conditional Access policies, monitored continuously. We test that the team can reach them under a simulated outage.
4. Privileged workstations. Essential Eight Maturity Level 2 expects privileged work performed from a separate operating environment. We confirm the privileged access workstation pattern is in place at least for Global Admins.
5. Access review cadence for privileged roles. Quarterly, automated, with attestation. Manual quarterly is acceptable. Never is a Red finding.

Tie-back to NDB: a single compromised Global Administrator can disclose every personal information record in the tenant. The OAIC treats administrative-credential compromise as a serious-harm trigger when personal information is in scope.

Pillar 2 — Conditional Access (the everyday gate)

Conditional Access is the policy engine that decides who can reach which resource, from where, on what device, and under what risk. Microsoft Learn's refreshed April 2026 guidance is explicit: "Apply Conditional Access policies for every app … Plan to apply a Conditional Access policy to all apps that require restricted access." (learn.microsoft.com — plan-conditional-access, accessed 23 May 2026).

Audit checklist for Pillar 2:

1. MFA coverage. ISM-1546 mandates multi-factor authentication for all users accessing important systems. We expect all interactive users covered, service principals excluded only with documented compensating controls.
2. Legacy authentication blocked. Not in report-only mode — blocked. Legacy authentication bypasses MFA and is the most common Entra credential-stuffing vector seen in OAIC notifications.
3. Sign-in risk policy. Microsoft Entra ID Protection should block high sign-in risk and require MFA for medium. Identity Protection requires Entra ID P2.
4. Device compliance. Conditional Access grant control "require device to be marked as compliant" applied at least to sensitive applications (SharePoint, Exchange, Finance LOB apps).
5. Session controls. Sign-in frequency on admin apps, token protection where supported, and Continuous Access Evaluation on by default. CAE became default-on for new tenants in early 2026.

Each gap maps to a specific ISM control number — we present audit findings as a table with the control, the finding, and the NDB exposure.

Pillar 3 — Guest and external access (the back door)

Guests, B2B collaboration, cross-tenant access and external sharing are the most under-audited part of Entra ID. Microsoft Learn frames the control surface this way: "Cross-tenant access settings give you granular control over how external Microsoft Entra organizations collaborate with you (inbound access) and how your users collaborate with external Microsoft Entra organizations (outbound access)." (learn.microsoft.com — cross-tenant-access-overview, accessed 23 May 2026).

Audit checklist for Pillar 3:

1. Cross-tenant access defaults reviewed in the last 12 months. Microsoft tightened outbound defaults in December 2025. If your tenant has never been touched, it is on a configuration from before the change.
2. Guest access reviews scheduled. Per Microsoft Learn: "Microsoft Entra access reviews enable organizations to efficiently manage group memberships, access to enterprise applications, and role assignments." (learn.microsoft.com — access-reviews-overview, accessed 23 May 2026). The ML reviewer recommendations feature went GA in February 2026.
3. Guest expiry / inactivity cleanup. Automatic 90-day expiry is the strongest control. Manual cleanup is acceptable but rarely happens. ISM-1503 expects expiry.
4. B2B invitation restrictions. Allow-list of trusted partner domains, not "anyone with an email address". Defaults are too open.
5. External sharing visibility in monthly reporting. If no one can tell you how many active guests exist this month, the audit fails.

Privacy mapping: every guest is an Entra ID identity, but the personal information they touch belongs to your organisation under the Privacy Act. APP 6 (use and disclosure) and APP 11 (security) both apply.

Reading the Identity Secure Score against Australian benchmarks

Microsoft publishes Identity Secure Score inside the Entra admin centre. As Microsoft puts it: "Identity Secure Score is a percentage that functions as an indicator for how aligned you are with Microsoft's best practice recommendations for security." (learn.microsoft.com — identity-secure-score, accessed 23 May 2026).

Microsoft's public benchmark, updated March 2026, places the Australian mid-market average at around 38%. We treat the score as a useful trend indicator, but not as a sufficient audit deliverable on its own, because:

• It does not map findings to Privacy Act obligations or NDB triggers.
• It excludes business context — for example, whether your privileged accounts protect personal information or reference data.
• It treats some "improvements" as equivalent when their NDB consequence differs widely.

The EDUC4TE audit framework cross-references Identity Secure Score recommendations against the ASD ISM and the OAIC reasonable-steps guidance, so the finding is regulator-ready, not just Microsoft-ready.

Mapping findings to ASD ISM controls

The ASD ISM (November 2025 release at cyber.gov.au — Information Security Manual) is the most defensible audit anchor for Australian organisations. We map every Entra ID finding to one or more of:

• ISM-1175 — Privileged access management. Maps to Pillar 1 findings on PIM coverage, Global Admin count, and approval workflows.
• ISM-1546 — Multi-factor authentication. Maps to Pillar 2 findings on MFA coverage and legacy auth.
• ISM-1647 — Time-bound privileged access. Maps to PIM activation duration findings.
• ISM-1503 — Guest account expiry. Maps to Pillar 3 expiry and cleanup findings.

Audit deliverables include the ISM control number on every Red finding. This is what makes the report defensible to an internal auditor or an OAIC enquiry.

The 90-day remediation sequence

Once the audit is complete, sequence remediation by NDB exposure, not by ease.

Days 0–30 — privileged accounts. Drop Global Admin count below five. Move privileged roles into PIM as eligible-not-active. Stand up two break-glass accounts. Block legacy authentication tenant-wide.

Days 30–60 — Conditional Access. Enforce MFA for all users. Add sign-in risk policy. Require device compliance for sensitive apps. Turn on Continuous Access Evaluation.

Days 60–90 — guest and external access. Review cross-tenant access settings. Schedule recurring access reviews with the ML recommendations feature. Set guest expiry to 90 days. Tighten B2B invitation policy to allow-list.

This sequence intentionally front-loads the privileged-account remediation because that is the finding with the highest NDB consequence per hour of effort.

When to re-audit

Run the full audit at least annually. Run the free Entra ID scorecard quarterly to track drift. Trigger an ad-hoc audit any time you:

• Change Microsoft 365 licensing tiers (P1 to P2 unlocks PIM and Identity Protection).
• Onboard a managed service provider with delegated access.
• Begin a Microsoft 365 Copilot rollout — Copilot will surface anything your identity controls miss.
• Receive an OAIC enquiry or a regulator notification on a related matter.
• Complete a merger, acquisition, or divestiture.

Microsoft 365 Copilot changes the calculus. Copilot returns content based on the user's Entra ID permissions, so every standing over-permission becomes a discoverability problem. Our Copilot security roadmap treats Entra ID hygiene as the prerequisite gate.

Bottom line

Entra ID is the privacy control in a Microsoft 365 tenant. A defensible audit runs across three pillars, maps every finding to the ASD ISM and NDB exposure, and repeats at least quarterly. Start with the free Entra ID & Identity Assessment. It takes five minutes and uses the same scoring structure as our practitioner Identity and Access Review.

Then go deeper on the four operational spokes — Conditional Access patterns, the PIM rollout playbook, access reviews, and guest and external access hygiene.

Related guides

For the underlying mechanics referenced throughout this pillar, see the companion deep-dives: just-in-time privileged access with Azure AD PIM maps each PIM control to ASD Essential Eight Maturity Levels, and B2B guest access governance for Australian organisations covers entitlement management and access packages under the Privacy Act 1988.

Sources referenced in this article: Microsoft Learn — Privileged Identity Management, Conditional Access planning, Access Reviews overview, Identity Secure Score, and Cross-tenant access overview (all accessed 23 May 2026). ASD Information Security Manual (November 2025 release) and Restrict Administrative Privileges Essential Eight guidance (cyber.gov.au, accessed 23 May 2026). OAIC Notifiable Data Breaches scheme (oaic.gov.au, accessed 23 May 2026).