Securing Identities at Scale: Conditional Access, Azure Security & Infrastructure as Code with Jonathan Hope [MVP]

Identity has become the new security perimeter. As organizations continue moving workloads to Microsoft 365, Azure, and cloud-native platforms, traditional security models are no longer enough. In this episode of the M365 FM Podcast, Mirko Peters is joined by Microsoft MVP Jonathan Hope to explore how modern organizations can secure identities at scale using Conditional Access, Azure Security, Infrastructure as Code, and Zero Trust principles.Jonathan shares lessons learned from more than a decade working with enterprise infrastructure, virtualization, Azure architecture, and identity management. From his early VMware days to designing cloud-first security architectures, he explains why identity protection is now the most critical component of any modern cybersecurity strategy.UNDERSTANDING WHY IDENTITY IS THE NEW PERIMETERThe conversation explores how the shift to remote work, cloud applications, and hybrid environments transformed security. Traditional firewalls and network boundaries no longer provide sufficient protection when users, applications, and data are accessible from anywhere.Jonathan explains why attackers increasingly focus on identities instead of infrastructure and how compromised accounts can become the entry point for lateral movement, privilege escalation, and data breaches.Topics discussed include:Identity-first security strategiesModern authentication challengesCloud-native access controlsReducing organizational attack surfacesCONDITIONAL ACCESS AS THE MODERN SECURITY CONTROL PLANEOne of the central topics of the episode is Microsoft Entra Conditional Access. Jonathan explains why he considers Conditional Access one of the most powerful security capabilities available in Microsoft 365 today.The discussion covers:How Conditional Access worksReal-time authorization decisionsDevice compliance integrationDefender and risk signal integrationCountry-based access controlsBlocking legacy authenticationProtecting privileged administrator accountsListeners will gain practical guidance on the foundational Conditional Access policies every organization should implement immediately.AZURE SECURITY, ZERO TRUST AND GOVERNANCESecurity is no longer limited to identity teams. Jonathan explains why Azure infrastructure, identity management, governance, and compliance must work together as a unified security strategy.The conversation dives into:Zero Trust architecture principlesLeast privilege access modelsBreak-glass account strategiesSecurity monitoring and alertingLog Analytics and Microsoft SentinelAzure Policy enforcementGovernance versus compliance realitiesThe episode highlights why security requires continuous validation rather than simply checking compliance boxes.INFRASTRUCTURE AS CODE WITH BICEPJonathan shares his journey from manual Azure deployments to Infrastructure as Code using Bicep. He explains how automation improves consistency, security, and operational efficiency while reducing human error.Key topics include:Why manual deployments create riskDesired state configuration conceptsRepeatable Azure deploymentsAzure Policy as CodeVersion control and Git integrationSecurity standardization at scaleBuilding secure Azure environments through automationFor cloud architects and Azure administrators, this section provides valuable insights into modern infrastructure management practices.AI, PASSKEYS AND THE FUTURE OF IDENTITY SECURITYThe episode also explores how artificial intelligence is changing both offensive and defensive security practices. While attackers increasingly leverage AI to create sophisticated phishing campaigns, organizations can use AI-powered security tools to detect threats and improve security operations.Jonathan shares his thoughts on:Security CopilotAI-assisted security operationsPasskeys and phishing-resistant authenticationFIDO2 security keysAuthentication method modernizationMicrosoft’s evolving identity roadmapWHY PASSWORDLESS AUTHENTICATION MATTERSAs the discussion concludes, Jonathan highlights one security improvement every organization should prioritize today: modernizing authentication methods.The move away from SMS-based MFA and weaker authentication methods toward passkeys and phishing-resistant authentication can dramatically improve an organization's security posture while also delivering a better user experience.FINAL THOUGHTSIf your organization relies on Microsoft 365, Entra ID, Azure, Conditional Access, or Zero Trust security principles, this episode delivers practical guidance from real-world experience. Learn how to build stronger identity defenses, automate secure cloud deployments, and prepare your environment for the next generation of cybersecurity challenges.CONNECT WITH M365 FMSubscribe to M365 FM for expert conversations covering Microsoft 365, Azure, AI, Security, Governance, SharePoint, Copilot, Data Management, and the future of modern workplace technology.Become a supporter of this podcast: https://www.spreaker.com/podcast/m365-fm-modern-work-security-and-productivity-with-microsoft-365--6704921/support.