Fabrikam Health: Contractor Access and the Legacy Authentication Trap
Fabrikam Health has 3,200 employees and 800 contractors. Its on-premises Active Directory Domain Services is synchronized to Microsoft Entra ID with Entra Connect. Contractors receive accounts through a manual helpdesk ticket, and their managers are not recorded anywhere. Sixty percent of sign-ins come from personal phones. Guests from 40 partner organizations collaborate in Teams. One line-of-business scheduling application still authenticates with SMTP AUTH using per-user credentials. Security defaults are enabled tenant-wide. An audit found nine stale guest accounts with access to a finance SharePoint site, twelve users holding permanent Global Administrator assignments - one of them a helpdesk technician - and contractors whose access survived contract end by up to seven months. Leadership approved a passwordless pilot and wants legacy authentication blocked, but the clinical director warns that blocking it will stop automated appointment reminders for 4,000 patients per day.
1. Recommend a priority order for the identity governance fixes - PIM, guest access reviews, entitlement management, lifecycle workflows - and justify the sequencing.
Read the worked answer
Sequence by blast radius first, then by data dependency.
1. Privileged Identity Management. Twelve permanent Global Administrators is the highest-severity finding and the fastest to remediate. Convert to eligible assignments with time-bound activation, approval for Global Administrator, MFA on activation, and an access review of the role. One compromised helpdesk account currently means tenant takeover.
2. Access reviews for guests. Nine stale guests with finance access are an active exposure. Run a quarterly review scoped to guest accounts with finance-site access, reviewer set to the sponsoring business owner, and "auto-remove on no response" - the setting that actually closes the gap.
3. Entitlement management access packages. Contractors should request access through a package tied to the contract, with approval and an expiration date, so access cannot outlive the engagement. This also creates the sponsor/owner metadata that step 2 depends on.
4. Lifecycle workflows. Automating joiner, mover, and leaver tasks requires an authoritative HR or contract source, which the manual helpdesk process does not provide. Build the source before automating.
Why this order. PIM and guest reviews deliver value immediately with existing data. Entitlement management creates the ownership records, and lifecycle workflows need an upstream system of record; doing them first stalls the whole program.
2. Design the Conditional Access rollout, including what to do about the SMTP AUTH scheduling application, and explain why security defaults must be replaced rather than supplemented.
Read the worked answer
Why replace security defaults. They are a fixed baseline - require MFA for all users, block legacy authentication, restrict admin portals - designed for tenants with no licensing or expertise. They cannot express device compliance, per-application conditions, named locations, or risk-based rules, and a tenant cannot run both: enabling Conditional Access requires disabling security defaults.
Rollout. Create two break-glass accounts excluded from all policies, stored offline and monitored. Build policies in report-only mode first, scoped to a pilot group of IT and 50 contractors, for at least two weeks, and read the report-only sign-in logs before enforcement. Then enforce in order: require MFA for all users; require compliant or hybrid-joined device for access to finance SharePoint and admin portals; block legacy client authentication ("Other clients" condition); sign-in risk policy if Entra ID P2 is licensed.
The SMTP AUTH problem. Conditional Access does not evaluate SMTP AUTH, so a CA policy cannot block it - a common and costly misconception. Disabling legacy auth tenant-wide while this app still uses it will silently stop the reminders. Correct sequence: migrate the application to OAuth 2.0 client credentials, or move to a dedicated service principal, and disable SMTP AUTH per mailbox. Only then enforce the block. Run the block in report-only against the scheduling service account first to confirm it disappears from legacy sign-ins.
3. Select passwordless methods for three populations - privileged administrators, shared clinical workstations, and staff on personal phones - and defend each choice.
Read the worked answer
Match the method to device ownership and required assurance.
Privileged administrators: FIDO2 security keys. Phishing-resistant, hardware-bound, works on any machine, and does not depend on a device the admin may not control. Pair with PIM activation requiring the key. The alternative, Windows Hello for Business, is strong but binds to a specific managed device.
Shared clinical workstations: FIDO2 keys or Windows Hello for Business on managed devices. Authenticator phone sign-in is unsuitable because staff should not enroll personal phones on shared machines, and a shared phone is an anti-pattern. Windows Hello for Business on a properly managed, hybrid-joined clinical device is reasonable where the workstation is single-user; where it is genuinely shared, a security key per clinician is cleaner.
Staff on personal phones: Microsoft Authenticator with phone sign-in. Already the majority sign-in pattern, and acceptable for email and collaboration, but pair it with Conditional Access requiring a compliant managed device for high-sensitivity resources such as finance SharePoint.
Onboarding. Temporary Access Pass for first-time credential registration, so a new contractor can register a method without a password being issued. Document fallback: helpdesk verification process and the break-glass accounts remain password-based with hardware key protection.