Blue Heron Digital Services

Blue Heron Digital Services, LLC · Lakeland, FL

Entra ID Identity Check

Upload the CSVs you can download yourself from the Entra admin center. You get a score out of 100 and the risk categories those files support. We reply within 2 business days.

  1. 1Download the users list, the MFA registration report, and role assignments. The clicks are below.
  2. 2Drop them here with your email. There is no Microsoft sign-in.
  3. 3The free page shows the score and category counts. Names and the cleanup steps are in the paid Cloud Cost Audit. You make the changes yourself.

Looking for a cloud bill? Use Cloud Bill Check.

Send the CSVs

Email and at least one CSV. No Microsoft sign-in.

The free page shows a score and category counts. Names and the cleanup steps stay in the paid Cloud Cost Audit. Scott replies within 2 business days.

Where to download each file

Needed

Users list

Names, whether the account is enabled, guests, and the last interactive sign-in.

  1. 1Open the Microsoft Entra admin center at entra.microsoft.com and sign in as an admin. This site never asks you to sign in to Microsoft.
  2. 2Select Identity, then Users, then All users. If you do not see Identity, select Show more.
  3. 3Select Columns, or Manage view, and include Account enabled, User type, and Last interactive sign-in.
  4. 4Select Download users.
  5. 5When the file is ready, download the CSV.

You do not create an app registration, and you do not give this website a Microsoft password.

Needed for the MFA score

MFA registration details

Who has registered multifactor authentication.

  1. 1In the Entra admin center, select Protection. If you do not see it, select Show more.
  2. 2Select Authentication methods.
  3. 3Select User registration details.
  4. 4Select Download and save the CSV.

Without this file the score does not include MFA. The other checks still run.

Needed for admin count

Role assignments

Who holds Global Administrator and other directory roles.

  1. 1Select Identity, then Roles and admins. If you do not see it, select Show more, then Roles & admins.
  2. 2On the Roles and administrators page, select Download assignments.
  3. 3Download the CSV. It lists the role and the member.

More than four Global Administrators lowers the score. Two break-glass admins is a common target. The paid note explains the clicks.

Optional

Sign-in logs

Shows legacy clients such as IMAP, POP, and SMTP.

  1. 1Select Identity, then Monitoring & health, then Sign-in logs.
  2. 2Leave the date range at the last 7 days. That is enough to see legacy clients.
  3. 3Select Download and save the CSV.

This file can be large. It is optional. Skip it if the portal will not export it.