Managed Entra
Entra ID decides who gets into your tenant thousands of times a day. The rules behind those decisions were set up in the portal years ago by someone who now works somewhere else. Managed Entra is a managed service by glueckkanja AG that runs these rules as code: documented, monitored, and you know what's changing before it changes.
The Castle Has No Walls Anymore
For two decades, one simple rule applied: if you're on the corporate network, you belong there. Three developments have pulled the ground out from under it.
- Work Has Moved OutThe data lives at Microsoft, and people are working on trains, at home, at client sites. The wall still protects the building. It's just that nobody works there anymore.
- Every Password Is a Door Through the WallAnyone who can log in is in. The network has no way of knowing whether it's your accountant behind that login or someone who bought her password for a few dollars.
- Attackers Don't Break In. They Log In.Stolen credentials are now a product with a price list and customer support. 97 percent of identity attacks target passwords. To the firewall, it looks like a perfectly ordinary Tuesday morning: someone logging in.
The Invisible Workforce
What's visible is what's in the HR system: people with employee records, onboarding, transfers, offboarding. The larger part isn't there. Guests and partners, admin and shared accounts, enterprise apps, and now agents all have access like everyone else, but no record and no offboarding process. Classic IAM doesn't know them, because the cloud never asks HR.
Every one of these identities passes through the same place: Entra ID.
Three Questions Before a Token Is Issued
In Entra ID, Zero Trust is a policy: Conditional Access applies the same checks to every identity before every app, whether that's employees or guests, apps or agents. We build a baseline that covers everyone, rather than a patchwork of exceptions. Every undocumented exception is a gap, and one is all it takes.
- 1Who are you?Strong authentication: passkeys (FIDO2), Windows Hello for Business, Microsoft Authenticator passkey. SMS and phone call will be dropped from February 2027 anyway.
- 2What are you working on?Only devices that Intune reports as compliant. An identity without a device, such as an agent, carries the verification on its own.
- 3How risky is this right now?User risk, sign-in risk, location, session. If anything looks off, access ends immediately, not at the next login.
One Gap Is All It Takes
The best armor is useless if the visor is left ajar. In Entra environments that have grown organically, there are plenty of gaps: policies that have been sitting in audit-only mode for years, exceptions that became the norm, permanent admins, guests with no sponsor.
Nobody decided any of this. It grew that way because identity was always an afterthought. That's why we don't just set up Entra. We operate it.
Every Change Takes the Same Path
In many organizations, the tenant configuration lives in the heads and mouse clicks of a handful of people. Ours lives in a blueprint we've been developing for over ten years and have been operating as code for three. Every change to your tenant goes through the same five steps, including our own. If someone makes a manual change in the portal anyway, Drift Control restores the target state and notifies you.
- 1Pull RequestEvery change starts as a pull request in the repository. Nowhere else.
- 2Four-Eyes ReviewA second person on our team reviews every change before anything runs.
- 3PlanThe plan shows line by line what will change. If it deviates from expectations, everything stops.
- 4ApprovalIf end users aren't affected, we apply the change and let you know. Otherwise, we ask first.
- 5DeploymentThe pipeline deploys, logs everything, and is repeatable — including into a new tenant.
Why Cloud-Native
The Technology Is There. We Use It.
Entra ID and Intune can do today what used to require a data center: devices join the tenant straight out of the box, users sign in with a passkey, and every access decision is made by a policy, not a VPN. We build on exactly this technology because it's more secure, requires less maintenance, and gets better every month.
Your file servers, printers, and line-of-business applications stay accessible throughout. Windows Hello for Business Cloud Trust and Entra Private Access bridge the gap without any device needing to see a domain controller. If you're hybrid today, we'll work through the migration with you step by step, and it's usually shorter than anyone expects.
- Passkeys Instead of PasswordsPhishing-resistant, signed in within seconds, and the "forgot my password" helpdesk ticket becomes a thing of the past.
- Conditional Access Instead of VPNEvery access request is verified, regardless of where it comes from. The corporate network is just one location among many.
- Entra ID Join Instead of HybridOne directory, one device state, no more group policies fighting with Intune.
- Private Access as a BridgeLegacy applications stay accessible, just via Entra instead of the network.
Every time you choose Hybrid Join over Entra Join, an angel loses its wings.
It's in our pitch deck. We say it with a smile, but we say it every time.
What We Operate
License basis: Entra ID P1 (Microsoft 365 E3) for the foundation. PIM, Access Packages, Access Reviews, and ID Protection require P2 (Microsoft 365 E5).
You know your people. We operate the rest.
Who joins, who leaves, who gets which role — that's your call, or your partner's, and it stays that way. Everything below that is on us: ongoing operations of tenant, users, and access, plus the foundation of Conditional Access, authentication, and Enterprise Applications, running as code and picking up every Microsoft update along the way.
Who joins, who leaves, who holds which role: you know that. We don't.
- User Support
- Identity lifecycle from the HR system
- Creating and maintaining identities
- Partner communication
Ongoing operations: monitoring, alerting, reporting, and integrating Microsoft updates.
- Tenant configuration
- User configuration
- Access configuration
- Global Secure Access
The foundation nobody wants to maintain by hand, which is exactly why we operate it as code.
- Conditional Access
- Authentication and authorization
- Cross-Tenant Access
- Enterprise Applications
How much do you want to hand off?
The same technology in three tiers. You can start with TerraProvider. Workplace Foundation includes it automatically, and Managed Entra gives you both.
ProductTerraProviderThe Terraform provider for Microsoft 365 that we use ourselves. Community Edition is free for up to 100 users. | SubscriptionWorkplace FoundationOur blueprint as a subscription, continuously updated. You run the repository and pipeline. | Managed ServiceManaged EntraWe deploy, alert, and report. The repository sits with us; the Technical Account Manager sits in your calendar. | |
|---|---|---|---|
| Tenant configuration as code, with Terraform or OpenTofu | included | included | included |
| Ready-made blueprint: identity and Conditional Access baseline, continuously updated | not included | included | included |
| Operated by us: deploy, alert, report, service review | not included | not included | included |
| RealmJoin: 80+ runbooks for operations | not included | not included | included |
| You bring | Terraform or OpenTofu, Git and CI/CD, deep Entra knowledge. | Evaluating blueprint changes, setting parameters, maintaining your own code. | Basic Entra knowledge for first-level support. No Terraform, no Git. |
| Evidence | Terraform and OpenTofu, disaster recovery for tenant configuration | 10+ years of blueprint development, 150+ releases | KQL alerts, monthly report, Technical Account Manager |
- Tenant configuration as code, with Terraform or OpenTofu
- Ready-made blueprint: identity and Conditional Access baseline, continuously updated
- Operated by us: deploy, alert, report, service review
- RealmJoin: 80+ runbooks for operations
You bring: Terraform or OpenTofu, Git and CI/CD, deep Entra knowledge.
Terraform and OpenTofu, disaster recovery for tenant configuration
- Tenant configuration as code, with Terraform or OpenTofu
- Ready-made blueprint: identity and Conditional Access baseline, continuously updated
- Operated by us: deploy, alert, report, service review
- RealmJoin: 80+ runbooks for operations
You bring: Evaluating blueprint changes, setting parameters, maintaining your own code.
10+ years of blueprint development, 150+ releases
- Tenant configuration as code, with Terraform or OpenTofu
- Ready-made blueprint: identity and Conditional Access baseline, continuously updated
- Operated by us: deploy, alert, report, service review
- RealmJoin: 80+ runbooks for operations
You bring: Basic Entra knowledge for first-level support. No Terraform, no Git.
KQL alerts, monthly report, Technical Account Manager
Managed Entra includes Workplace Foundation and TerraProvider. Book with us and you get all three.
Your Path to Managed Entra
- Kickstarter WorkshopKickstarter WorkshopOne day on-site: Zero Trust, your Conditional Access blueprint, Identity Governance. You leave with a clear target picture.
- ParameterizationParameterizationTwo to four weeks: the blueprint becomes your blueprint, with the exceptions you've consciously chosen to keep. Everything as code before anything goes live.
- OnboardingOnboardingOne day: SLA, priorities P1 through P4, escalation paths, named contacts on both sides. The blueprint then rolls out in waves — report-only first, then enforced.
- OperationsOperationsA base fee plus a fixed monthly per-user charge, Technical Account Manager, monthly service review, Drift Control, and evergreen updates.
One Day On-Site
Kickstarter Workshop
Before we build anything as code, we look at your tenant as it stands today, together with you. You bring the Admin Center and the people who know where the exceptions are. We bring the blueprint.
Zero TrustPrincipleWhich access you're trusting today without realizing it.
Conditional AccessBlueprintWhich silos your tenant needs and which exceptions stay.
Identity GovernanceRoles and GuestsWho needs which role, for how long, and who vouches for whom.
Target PictureOutcomeA document you can share internally, and a fixed-price proposal.
Questions We Hear in the First Conversation
Answered briefly. If your question isn't here, ask us below.
Our IT team handles that itself.
For employees with HR records, usually yes. For guests, admin accounts, apps, and agents, ownership is rarely clear, and Microsoft keeps changing the rules. Entra and Intune together cover 18 ongoing subject areas — in our experience, that's 1.5 to 3 full-time roles. We operate many tenants from a single blueprint and spot patterns earlier than any individual team can.
Will we lose control over our tenant?
Your tenant stays your tenant, the logs stay with you, and you see every change in the plan before it happens. There is one rule, though: only we modify the foundation components. Otherwise it wouldn't be operations — it would just be two teams working in parallel.
What licenses do we need?
Entra ID P1, meaning Microsoft 365 E3, for the foundation. PIM, Access Packages, Access Reviews, and ID Protection require P2, meaning E5. The licenses stay with you.
We're still hybrid.
Hybrid with Entra Connect Sync is no problem. Hybrid Join on devices is something we replace with Managed Intune, step by step.
What's not included?
End-user support, including MFA enrollment. A role model for business units and cleaning up old permissions are separate projects we're happy to tackle with you. The joiner-mover-leaver process from your HR system stays with your IAM.
What happens if we want to deviate from the blueprint?
It becomes a custom override: documented in code, a deliberate decision. It falls outside the evergreen process, and we'll tell you what that costs before you commit to it.
What about agents?
With Agent 365, every agent gets its own identity in Entra, with a sponsor and permissions scoped like a human account. We treat them like admin accounts: Access Packages, review, Conditional Access. We're still finalizing the service scope. Nobody hands a new employee a corporate credit card with no limit on day one — and the same should go for an agent.
What does Managed Entra cost?
A base fee plus a per-user fee for each active user per month. Standard requests and monitoring are included; projects run separately. The Kickstarter Workshop is available at a fixed price.
Who works is settled. The question now is where.
Further Reading
Autopilot Device Preparation Becomes the Standard, Hybrid Join Falls Behind
Since September, Microsoft has recommended Autopilot Device Preparation as the standard for user-driven Windows deployments. The new approach is genuinely ...
Who Built These Agents?
E7 bundles E5, Copilot, the Entra Suite and Agent 365. But a license doesn't clean up your tenant. Who is ...
The End of MFA via SMS
Why organizations should move to phishing-resistant and passwordless authentication now.
AuthCodeFix aka ConsentFix
Just before year's end, ConsentFix emerges: a clever OAuth-based attack that abuses legitimate authentication flows to steal the authorization code, ...
