Security is always an important concern in any organization, but what happens when the services and features that you try to secure are always changing. What you used to know as secure and best practice may not be the best idea this year. So this session will look at all the things that you should do, and then some things that you should consider doing to improve the security of your M365/Entra ID tenant. Your task, should you choose to accept it, will be to leave the conference with a better understanding of what you need to do next, and the comfort to know that it does not need to be that difficult. The session will cover better Entra ID tokens and why they matter, and then how you manage tokens with a series of features including Conditional Access, Authentication Methods migration and External Authentication Methods, passkeys and Authentication Strengths. We will also cover Privileged Identity Management (PIM), break-glass emergency accounts, Global Secure Access, password reset, device management and more.

For more than a decade, hybrid identity has followed a familiar pattern. We create and manage identities in Active Directory, synchronise them to the cloud directory—Azure AD, now Microsoft Entra ID—and then use Entra ID as the identity platform for Microsoft’s cloud services. The trade-off is that Active Directory remains the source of authority, so attributes synchronised to the cloud are effectively read-only in Entra ID. In 2026, Microsoft began changing that model in stages. First, synchronised identities could be edited in Entra ID. Later updates added the ability to write those changes back to Active Directory. In other words, Microsoft started to turn the established hybrid identity model of the past ten-plus years on its head. That gives us a genuinely modern identity platform and two possible paths. We can use this capability as a step towards retiring Active Directory altogether, or we can move day-to-day identity management into Entra ID while continuing to synchronise the objects back to Active Directory. Either way, the direction of management no longer has to be from on-premises to the cloud. And there is another important outcome: this can help us remove the last Exchange Server. Traditionally, when hybrid identities flow from Active Directory through Entra ID to Exchange Online Directory Services, we have needed either an Exchange Server or recipient management tools that write to Active Directory. That has been the supported way to manage Exchange Online attributes. If we cut over Exchange identity administration to Exchange Online, we can finally remove that last Exchange Server as well. In this session, I’ll show you what has changed, how the new model works and what it means for your hybrid identity and Exchange strategy.