Secure Infrastructure · Microsoft Security & Cloud
Microsoft Security & Cloud Services
Secure Microsoft 365, Azure, identities, endpoints, applications and cloud environments with practical security engineering. ITTCsec helps organisations assess, design, implement and continuously improve security across their Microsoft environment, from identity to infrastructure.
Delivered from our base in Utrecht, available to organisations across the Netherlands.
The problem
Running Microsoft 365 and Azure does not make an organisation secure by default. The platform ships secure-capable, not secure-by-default: Conditional Access starts empty, PIM has to be turned on, and Sentinel connects to data sources without writing its own detection rules. Left alone, a tenant runs for years on whatever got configured during initial rollout, usually under deadline pressure and rarely revisited since.
Business impact
Credential-based attacks remain the most common way into an organisation, and Microsoft 365 is usually the identity plane attackers hit first, since it is the front door to email, files and everything else behind them. A misconfigured tenant does not just risk a breach; it risks one that goes undetected, because the same Sentinel connection that could have caught it was never given detection content to act on.
We assess, configure and operate the Microsoft security stack so it enforces the Zero Trust posture it is capable of, rather than sitting half-configured behind default settings.
Microsoft Entra ID & identity security
Conditional Access, identity governance and access reviews configured to enforce least privilege by default, not left on the defaults that ship with a new tenant.
Microsoft 365 security
Exchange Online, SharePoint, Teams and OneDrive hardened together: mail flow security, data protection settings and administrative access reviewed as one tenant, not separate silos.
Microsoft Defender suite
Defender for Endpoint, Office 365, Identity and Cloud configured to work together under Defender XDR, not as isolated point tools nobody has tuned since rollout.
Microsoft Sentinel
SIEM engineering, KQL analytics rules and workbooks mapped to MITRE ATT&CK, tuned for signal rather than alert fatigue. Covered in depth on our Security Operations page.
Azure security
Azure architecture, RBAC, network and workload security reviewed and hardened, with Defender for Cloud configured to give real posture visibility, not a dashboard nobody checks.
Zero Trust architecture
Identity, device, network and data verification designed around Microsoft's own control set, not a slide describing Zero Trust in the abstract.
Conditional Access & MFA
Access policies that account for device compliance, location and sign-in risk, not a blanket MFA prompt applied identically to every user and every app.
Privileged Identity Management & PAM
Time-bound, justified elevation replacing standing Global Admin rights, so a compromised account cannot simply act as one.
Guest & external identity governance
Access reviews and lifecycle controls for the guest and B2B accounts that accumulate quietly in most tenants and rarely get revisited.
Intune & device compliance
Mobile and endpoint management aligned to your actual device fleet, with policies that hold up under audit rather than existing only on paper.
Active Directory & hybrid identity
On-premises and hybrid AD hardening: tiered administration, legacy protocol removal, and closing the paths that let a single compromised workstation become domain admin.
The Microsoft security challenge
Owning the licensing is not the same as using it well. These are the gaps we see most often, across tenants of every size.
Excessive permissions accumulated over years, never reviewed
Inconsistent MFA enforcement across users, apps and admin roles
Conditional Access left on default or partially built policies
Privileged accounts with standing access instead of time-bound elevation
Guest and external identities that were never revisited after onboarding
Legacy authentication protocols still enabled and still exploitable
Identity lifecycle gaps: leavers who keep access, joiners provisioned manually
Cloud configuration drift between what was designed and what is actually deployed
Insufficient monitoring, or monitoring that generates volume without signal
Endpoint exposure from inconsistent EDR coverage and policy enforcement
Alert overload that trains analysts to tune out the alerts that matter
No clear ownership of security governance across the Microsoft estate
Zero Trust, translated into Microsoft controls
Zero Trust is an architecture principle, not a product. We apply its three tenets directly to the controls Microsoft already gives you:
Verify explicitly
Conditional Access policies evaluated on identity, device compliance, location and sign-in risk together, not credentials alone.
Use least privilege
PIM replacing standing admin rights with time-bound, justified elevation, and RBAC scoped to what a role actually needs.
Assume breach
Defender and Sentinel configured to detect lateral movement and privilege abuse, on the assumption a single account will eventually be compromised.
The ITTCsec Microsoft Security Assessment
A structured entry point for organisations who want a clear, evidence-based read on where their Microsoft environment actually stands before committing to a larger programme. Depending on scope, it typically reviews Microsoft 365 security posture, Entra ID configuration, MFA and Conditional Access coverage, privileged and guest identities, administrative roles, Defender configuration, Sentinel and logging coverage, and Azure security posture where Azure is in use. Exact scope is agreed with you before the engagement starts, rather than assumed from a fixed package.
Compliance alignment
Microsoft security controls generate real evidence for broader compliance work: Conditional Access policies and PIM records map onto access-control requirements, and Defender/Sentinel logging maps onto monitoring and incident-detection obligations under NIS2, the Dutch Cyberbeveiligingswet and ISO 27001, as well as frameworks like NIST CSF and CIS Controls. Deploying Microsoft products does not, by itself, make an organisation compliant with any of these; the controls have to be configured, monitored and evidenced as part of a working governance programme, which is the layer we help build.
Why ITTCsec for Microsoft security
This is hands-on cybersecurity engineering, not a reseller relationship. Our expertise spans identity, cloud security and security operations, applied through a business-focused security architecture rather than a vendor-driven one. We work with SMEs and growing companies as often as larger organisations, scoping engagements to what a business actually needs rather than a fixed enterprise package, delivered from Utrecht across the Netherlands and Europe.
Microsoft AI Cloud Partner Program
ITTCsec is a member of the Microsoft AI Cloud Partner Program, supporting our continued development of Microsoft cloud, security, identity and AI capabilities. Programme membership reflects an active, verified partner profile with Microsoft (Partner ID 7157438, Netherlands); it is not a Solutions Partner designation, Gold Partner status, Microsoft certification of ITTCsec as a company, or endorsement by Microsoft, and we do not present it as one.
How this engagement runs
Assess
Review your current Microsoft 365, Entra ID and Azure configuration against real attack patterns, not a generic checklist.
Design
Define the target configuration and Zero Trust architecture that fits how your organisation actually operates.
Prioritise
Sequence findings by real risk and effort, so the highest-impact gaps close first.
Implement
Configure the controls directly: Conditional Access, PIM, Defender and Sentinel tuning, hands-on.
Validate
Confirm the configuration actually holds up, rather than assuming it does once it is deployed.
Improve
Feed findings back in as your Microsoft environment and the threat landscape change.
Who this is for
- Organisations running Microsoft 365 E3/E5 or Azure who suspect they are under-using their licensing
- IT teams who inherited a tenant configured years ago by someone no longer at the company
- Businesses preparing for NIS2, ISO 27001 or a customer security questionnaire that specifically asks about Entra ID and Conditional Access
- Hybrid environments bridging on-premises Active Directory and Entra ID
- Organisations that have deployed Sentinel or Defender but have low confidence in what they would actually catch
What you get
- An executive security summary a board or leadership team can act on
- Prioritised findings with risk ratings, not an undifferentiated list
- A remediation roadmap sequenced by real risk and effort
- Technical improvement recommendations your team or MSP can implement directly
- Configuration changes implemented and validated where the engagement includes implementation
Frequently asked questions
What Microsoft security services does ITTCsec provide?
Assessment, configuration and ongoing engineering across Microsoft Entra ID, Microsoft 365, Defender, Sentinel and Azure: identity security, tenant hardening, threat detection and cloud security posture, built around your actual environment rather than a generic template.
Can ITTCsec assess our Microsoft 365 security?
Yes. A Microsoft Security Assessment reviews tenant configuration, identity security, Conditional Access, privileged and guest access, and Defender coverage, and produces a prioritised, risk-rated remediation roadmap rather than a generic scorecard.
Can you review Microsoft Entra ID and Conditional Access?
Yes, this is one of the highest-leverage reviews we run. Most tenants we assess have Conditional Access on default or partially built policies, PIM never enabled and guest access that was never revisited after the first external project.
Can ITTCsec help implement Microsoft Sentinel?
Yes: onboarding the right log sources, writing analytics rules tuned to your environment rather than vendor defaults, building workbooks that get used, and setting up automation that reduces manual triage instead of adding another alert queue.
Do you work with Microsoft Defender?
Yes, across the Defender suite: Endpoint, Office 365, Identity and Cloud, configured to work together under Defender XDR rather than as separate point tools left on their installation defaults.
Can you help secure Azure environments?
Yes. Azure security work typically covers identity and RBAC, network and workload security, logging and monitoring, and Defender for Cloud configuration, benchmarked against known misconfiguration patterns and your specific architecture.
What is a Microsoft Security Assessment?
A structured review of your Microsoft 365 and Azure security posture, covering identity, Conditional Access, privileged and guest access, Defender configuration and Sentinel coverage. It produces an executive summary, prioritised findings with risk ratings, and a remediation roadmap your team or MSP can act on. Exact scope is agreed per engagement.
Can Microsoft security controls support NIS2 or ISO 27001?
Yes, as evidence and technical controls, not as compliance on their own. Conditional Access policies, PIM records and Defender/Sentinel logging map directly onto access-control, monitoring and incident-detection requirements in both frameworks, but deploying Microsoft products alone does not make an organisation compliant. See our Governance, Risk & Compliance page for how that governance layer fits together.
Does ITTCsec work with SMEs?
Yes, most of who we work with. You do not need an enterprise-sized Microsoft estate for this to matter: a focused Microsoft 365 hardening review for a 20-person company is scoped very differently from a full Sentinel deployment for a 500-person one, and we price and scope accordingly.
Is ITTCsec a Microsoft partner?
ITTCsec is a member of the Microsoft AI Cloud Partner Program. This reflects programme membership, not a Solutions Partner designation, Gold Partner status or Microsoft certification of ITTCsec as a company, and we do not claim otherwise.
Talk to a security engineer about microsoft security & cloud services.
Member of the Microsoft AI Cloud Partner Program. Whether you're licensed for E5 and using a fraction of it, or still deciding what Microsoft security capability you actually need, we can help you find the gap.