How to maintain IT security across a hybrid workforce

A Brisbane professional services firm we work with had staff in three locations: the office, home, and a client site interstate. All three were accessing the same business applications, the same files, the same email. The question they came to us with was simple: how do we know who is actually allowed in?

That question sits at the heart of modern IT security. The office perimeter is gone. Today, identity is the perimeterand managing it well is what separates businesses that stay secure from those that don’t. For Queensland SMEs running hybrid teams, getting identity and access management right is one of the most practical things you can do for your business security.

Why the old perimeter no longer works

Traditional security relied on a defined boundary: the office network, protected by a firewall. If you were inside, you were trusted. If you were outside, you were blocked. Hybrid work broke that model completely.

Staff now sign in from home broadband, shared Wi-Fi, personal devices, and mobile apps. The ACSC’s Annual Cyber Threat Report confirmed Australian organisations are reporting a cybercrime incident approximately every six minutes. Relying on a firewall to do the heavy lifting is not enough when your users are signing in from dozens of locations.

The shift requires a different approach: verify every sign-in, check every device, and control access based on risk rather than location. That is the Zero Trust model, and Microsoft Entra ID is the tool that puts it into practice for most Australian SMEs running Microsoft 365.

What is Microsoft Entra ID

Microsoft Entra ID is Microsoft’s cloud identity and access management platform. You may know it by its old name, Azure Active Directory (Azure AD), which Microsoft renamed in 2023. If you run Microsoft 365you are already using it. It runs in the background, checking whether a user’s credentials are correct and whether they should be allowed into the app or account they’re trying to reach.

Entra ID is not just an authentication tool. It is the policy engine that decides who gets access to what, under what conditions, and from where. For a hybrid workforce spread across Brisbane offices and home desks, that matters a great deal.

Microsoft 365 includes Entra ID Free as standard. Premium tiers, P1 and P2, unlock the controls that most businesses with a distributed workforce actually need.

Entra ID P1 and P2: what each tier does

Entra ID P1 is included with Microsoft 365 Business Premium, Microsoft 365 E3, and several other plans. It adds Conditional Access policies, granular multi-factor authentication (MFA) controls, hybrid identity support for users moving between on-premises and cloud environments, and self-service password reset. For most SMEs, P1 is the practical baseline for hybrid work security.

Conditional Access is the standout feature at P1. It works through policies that assess the context of each sign-in. Is the user on a known device? Are they signing in from an expected location? Are they accessing a sensitive application? Based on those signals, the policy can allow access, prompt for MFA, or block the request entirely. It gives businesses fine-grained control without creating unnecessary friction for legitimate users.

Entra ID P2 includes everything in P1 and adds two significant capabilities: Identity Protection and Privileged Identity Management (PIM).

• Identity Protection uses risk signals to detect suspicious behaviour in real time. Patterns like impossible travel (signing in from Sydney, then London, five minutes apart) or sign-ins from known malicious IP addresses trigger automatic responses, such as forcing re-authentication or blocking access.
• Privileged Identity Management (PIM) controls administrator accounts. Rather than leaving admin roles permanently assigned, PIM provides just-in-time access: an administrator requests elevated access for a defined period, uses it, and the role is removed. This reduces the window of risk if an admin account is compromised.

P2 suits businesses handling sensitive client data, those in regulated industries like legal, accounting, or healthcare, or any team where admin accounts carry significant risk. Professional services firms in particular benefit from P2’s risk-based controls, given the sensitivity of the data they hold.

How Conditional Access protects hybrid teams

Conditional Access is the practical workhorse of Entra ID security for dispersed teams. It works by applying policies to specific scenarios rather than blanket rules. A few examples of how we configure it for clients:

• Require MFA for any sign-in that originates outside Australia.
• Block access from devices that haven’t been enrolled in Microsoft Intune (device management).
• Require a compliant device for access to financial or client data applications.
• Apply stricter controls to administrator accounts at all times.

The goal is to reduce friction for low-risk sign-ins while adding verification steps where the risk is higher. A staff member signing in from their enrolled laptop in the Brisbane office should have a smooth experience. The same person signing in from an unrecognised device overseas should face extra checks.

From July 2026, Microsoft will also enforce Conditional Access during registration for Windows Hello for Business, tightening the baseline further for organisations already using Entra policies.

What we see at TTA: where hybrid security breaks down

Across the businesses we support in South-East Queensland, the most common gap is not the tools; it’s configuration. Many organisations have Microsoft 365 Business Premium, which includes Entra ID P1, but haven’t turned on Conditional Access policies. The features sit unused while staff sign in with just a username and password.

The second most common gap is unmanaged devices. Staff use personal laptops or phones to access business email and files. Without device compliance policies, there is no way to check whether those devices have up-to-date operating systems, active antivirus, or disk encryption. Conditional Access policies that require device compliance close this gap quickly.

A third pattern we see: administrator accounts with permanent elevated access. PIM at P2 level addresses this, but even at P1, restricting who holds admin roles and reviewing those assignments regularly makes a meaningful difference. If you’re unsure what your current Entra ID configuration looks like, an IT security assessment is a practical starting point.

Passkeys and the move away from passwords

Microsoft Entra is pushing hard toward passwordless authentication, and 2026 has brought two practical milestones. Registration campaigns in Entra now prompt users to set up passkeys (FIDO2 keys) at sign-in, helping businesses drive adoption without requiring manual enrolment drives. Phishing-resistant MFA is also now available on Linux desktops, bringing Linux support in line with Windows and macOS.

For SMEs, the direction is clear: traditional passwords paired with SMS-based MFA is the floor, not the ceiling. Passkeys and authenticator-app MFA are more resistant to phishing and credential theft. Businesses that haven’t reviewed their MFA methods recently should add this to the list.

Microsoft Azure and cloud scalability

Entra ID lives within the broader Microsoft Azure platform, one of the most widely used cloud computing environments globally. Azure provides the underlying infrastructure for Microsoft 365 and supports hybrid deployments where some resources remain on-premises while others run in the cloud.

For Australian businesses, Azure’s scalability remains a practical advantage. You pay for what you use and scale up or down as the business changes. Azure also supports hybrid identity environments, meaning businesses with on-premises Active Directory can synchronise identities with Entra ID using Entra Connect, keeping a single source of truth for user accounts across both environments.

If you’re considering a broader cloud migrationunderstanding your identity configuration should be an early step. Entra ID is the foundation that everything else builds on.

A practical checklist for hybrid IT security

If you’re reviewing your current setup, these are the questions worth asking:

• Is MFA enabled for all users, not just administrators?
• Are Conditional Access policies active and configured for your risk profile?
• Are staff devices enrolled and checked for compliance before accessing business data?
• Are administrator roles assigned permanently, or managed through PIM?
• Have you reviewed who holds privileged access in the last 90 days?
• Are your MFA methods phishing-resistant (authenticator app or passkey) rather than SMS-only?

If the answer to more than two of these is “not sure”, that’s a useful signal. The ACSC Essential Eight framework provides a structured baseline that covers many of these controls, and it’s what we use as a benchmark when assessing clients across Brisbane and South-East Queensland.

Frequently asked questions

What is the difference between Microsoft Entra ID and Azure Active Directory?

They are the same product. Microsoft renamed Azure Active Directory (Azure AD) to Microsoft Entra ID in 2023. The features, tiers, and licensing structure remain in place under the new name. If you’re already running Microsoft 365, you’re already using Microsoft Entra ID in the background.

Do I need Entra ID P1 or P2 for my small business?

For most SMEs running a hybrid workforce, Entra ID P1 is the practical baseline. It includes Conditional Access and MFA controls, which cover the most common gaps. P2 is worth considering if you handle sensitive client data, have staff with administrator access, or operate in a regulated industry. P1 is included in Microsoft 365 Business Premium.

What is Conditional Access and why does it matter?

Conditional Access is a policy engine inside Microsoft Entra ID. It checks the context of each sign-in (device, location, user risk, application being accessed) and decides whether to allow access, require MFA, or block the request. For hybrid teams signing in from many locations, it replaces the old model of trusting anyone on the office network.

What is Privileged Identity Management and does my business need it?

Privileged Identity Management (PIM) is an Entra ID P2 feature that controls administrator accounts. Instead of staff holding permanent admin roles, PIM provides just-in-time access for a defined period. If a compromised account has permanent admin access, attackers can move freely. PIM limits that window significantly. It’s most relevant for businesses with multiple admin accounts or those in regulated industries.

How do I know if our current Entra ID setup is configured correctly?

The most reliable way is a security assessment that reviews your Conditional Access policies, MFA methods, device compliance rules, and admin account configuration. Many businesses have the right licences but haven’t activated the controls. We carry out these assessments regularly across South-East Queensland businesses and can identify gaps quickly.

Where do I start if we haven’t set up any of this yet?

Start with MFA for all users. That single step removes the most common entry point for attackers. Next, enable Conditional Access policies that require MFA for risky sign-ins and block non-compliant devices. Both steps are available in Microsoft 365 Business Premium without additional cost. From there, a broader IT security assessment will show what else needs attention.

How do we get started?

We’re Microsoft-accredited and work with businesses across Brisbane and South-East Queensland to configure Entra ID, Conditional Access, and the broader Microsoft 365 security stack. If you’re not sure where your current setup sits, start with a conversation. Get in touch with us and we’ll take it from there.