{"id":43824,"date":"2026-10-20T08:38:07","date_gmt":"2026-10-20T01:38:07","guid":{"rendered":"https:\/\/f-techsolution.com\/?p=43824"},"modified":"2026-10-30T18:43:51","modified_gmt":"2026-10-30T11:43:51","slug":"microsoft-entra-id-dong-vai-tro-gi-trong-microsoft-365","status":"publish","type":"post","link":"https:\/\/f-techsolution.com\/en\/blog\/microsoft-entra-id-dong-vai-tro-gi-trong-microsoft-365\/","title":{"rendered":"Microsoft Entra ID \u0111\u00f3ng vai tr\u00f2 g\u00ec trong Microsoft 365?"},"content":{"rendered":"

Microsoft Entra ID \u0111\u00f3ng vai tr\u00f2 g\u00ec trong Microsoft 365?<\/h1>\n

\"T\u00ecm<\/p>\n

Khi doanh nghi\u1ec7p s\u1eed d\u1ee5ng Microsoft 365, ph\u1ea7n ng\u01b0\u1eddi d\u00f9ng nh\u00ecn th\u1ea5y th\u01b0\u1eddng l\u00e0 Outlook, Teams, OneDrive, SharePoint, Word, Excel ho\u1eb7c PowerPoint. Nh\u01b0ng ph\u00eda sau nh\u1eefng \u1ee9ng d\u1ee5ng \u0111\u00f3 c\u00f2n c\u00f3 m\u1ed9t l\u1edbp r\u1ea5t quan tr\u1ecdng quy\u1ebft \u0111\u1ecbnh ai \u0111\u01b0\u1ee3c \u0111\u0103ng nh\u1eadp, \u0111\u01b0\u1ee3c truy c\u1eadp v\u00e0o \u0111\u00e2u v\u00e0 trong \u0111i\u1ec1u ki\u1ec7n n\u00e0o<\/strong>.<\/p>\n

L\u1edbp \u0111\u00f3 l\u00e0 Microsoft Entra ID.<\/p>\n

Microsoft m\u00f4 t\u1ea3 Microsoft Entra ID l\u00e0 d\u1ecbch v\u1ee5 qu\u1ea3n l\u00fd danh t\u00ednh v\u00e0 quy\u1ec1n truy c\u1eadp tr\u00ean Cloud, d\u00f9ng \u0111\u1ec3 qu\u1ea3n l\u00fd user identity v\u00e0 ki\u1ec3m so\u00e1t quy\u1ec1n truy c\u1eadp v\u00e0o \u1ee9ng d\u1ee5ng, d\u1eef li\u1ec7u v\u00e0 t\u00e0i nguy\u00ean. N\u00f3 c\u0169ng cung c\u1ea5p c\u00e1c kh\u1ea3 n\u0103ng nh\u01b0 authentication, multifactor authentication, user\/group management, application access, role-based access control v\u00e0 Conditional Access.<\/p>\n

C\u00f3 th\u1ec3 hi\u1ec3u \u0111\u01a1n gi\u1ea3n:<\/p>\n

Microsoft 365 cung c\u1ea5p c\u00e1c \u1ee9ng d\u1ee5ng v\u00e0 d\u1ecbch v\u1ee5.<\/strong><\/p>\n

Microsoft Entra ID quy\u1ebft \u0111\u1ecbnh ai \u0111\u01b0\u1ee3c v\u00e0o v\u00e0 \u0111\u01b0\u1ee3c ph\u00e9p l\u00e0m g\u00ec.<\/strong><\/p>\n

V\u00ec v\u1eady, Entra ID kh\u00f4ng ch\u1ec9 l\u00e0 n\u01a1i t\u1ea1o user. N\u00f3 l\u00e0 m\u1ed9t ph\u1ea7n n\u1ec1n t\u1ea3ng c\u1ee7a security v\u00e0 governance trong Microsoft 365.<\/p>\n

Microsoft Entra ID n\u1eb1m \u1edf \u0111\u00e2u trong Microsoft 365?<\/h2>\n

Khi doanh nghi\u1ec7p c\u00f3 m\u1ed9t Microsoft 365 tenant, tenant \u0111\u00f3 \u0111i k\u00e8m v\u1edbi Microsoft Entra ID \u0111\u1ec3 qu\u1ea3n l\u00fd identity.<\/p>\n

V\u00ed d\u1ee5 m\u1ed9t nh\u00e2n vi\u00ean c\u00f3 t\u00e0i kho\u1ea3n:<\/p>\n

name@company.com<\/code><\/p>\n

Account \u0111\u00f3 c\u00f3 th\u1ec3 \u0111\u01b0\u1ee3c s\u1eed d\u1ee5ng \u0111\u1ec3 truy c\u1eadp Outlook, Teams, SharePoint, OneDrive, Microsoft 365 Apps v\u00e0 nhi\u1ec1u \u1ee9ng d\u1ee5ng kh\u00e1c.<\/p>\n

Entra ID gi\u00fap Microsoft x\u00e1c \u0111\u1ecbnh:<\/p>\n

User l\u00e0 ai?<\/p>\n

Account c\u00f2n active kh\u00f4ng?<\/p>\n

User thu\u1ed9c group n\u00e0o?<\/p>\n

C\u00f3 MFA kh\u00f4ng?<\/p>\n

\u0110ang \u0111\u0103ng nh\u1eadp t\u1eeb thi\u1ebft b\u1ecb n\u00e0o?<\/p>\n

\u1ee8ng d\u1ee5ng n\u00e0o \u0111ang \u0111\u01b0\u1ee3c truy c\u1eadp?<\/p>\n

User c\u00f3 admin role hay kh\u00f4ng?<\/p>\n

C\u00f3 policy n\u00e0o c\u1ea7n \u00e1p d\u1ee5ng tr\u01b0\u1edbc khi cho ph\u00e9p truy c\u1eadp kh\u00f4ng?<\/p>\n

Do \u0111\u00f3, Entra ID g\u1ea7n nh\u01b0 l\u00e0 c\u1eeda ki\u1ec3m so\u00e1t danh t\u00ednh<\/strong> c\u1ee7a m\u00f4i tr\u01b0\u1eddng Microsoft 365.<\/p>\n

Vai tr\u00f2 \u0111\u1ea7u ti\u00ean: Qu\u1ea3n l\u00fd user v\u00e0 group<\/h1>\n

Use case d\u1ec5 hi\u1ec3u nh\u1ea5t l\u00e0 qu\u1ea3n l\u00fd ng\u01b0\u1eddi d\u00f9ng. IT Admin c\u00f3 th\u1ec3 t\u1ea1o user m\u1edbi, th\u00eam user v\u00e0o group, qu\u1ea3n l\u00fd domain, license v\u00e0 nhi\u1ec1u thu\u1ed9c t\u00ednh identity kh\u00e1c trong Entra ID. Microsoft c\u0169ng x\u00e1c nh\u1eadn Entra ID h\u1ed7 tr\u1ee3 qu\u1ea3n l\u00fd user, group, license v\u00e0 domain nh\u01b0 m\u1ed9t ph\u1ea7n c\u1ee7a identity administration.<\/p>\n

V\u00ed d\u1ee5 khi nh\u00e2n vi\u00ean m\u1edbi v\u00e0o c\u00f4ng ty:<\/p>\n

IT t\u1ea1o account.<\/p>\n

G\u00e1n license.<\/p>\n

Th\u00eam v\u00e0o Sales Group.<\/p>\n

Th\u00eam v\u00e0o c\u00e1c Teams ho\u1eb7c SharePoint c\u1ea7n thi\u1ebft.<\/p>\n

C\u1ea5p quy\u1ec1n \u1ee9ng d\u1ee5ng.<\/p>\n

Khi nh\u00e2n vi\u00ean chuy\u1ec3n ph\u00f2ng ban, membership c\u00f3 th\u1ec3 thay \u0111\u1ed5i.<\/p>\n

Khi nh\u00e2n vi\u00ean ngh\u1ec9 vi\u1ec7c, sign-in c\u00f3 th\u1ec3 b\u1ecb block v\u00e0 access \u0111\u01b0\u1ee3c thu h\u1ed3i.<\/p>\n

\u0110\u00e2y l\u00e0 n\u1ec1n t\u1ea3ng c\u1ee7a m\u00f4 h\u00ecnh:<\/p>\n

Joiner \u2192 Mover \u2192 Leaver<\/strong><\/p>\n

N\u1ebfu identity lifecycle kh\u00f4ng r\u00f5, doanh nghi\u1ec7p r\u1ea5t d\u1ec5 \u0111\u1ec3 l\u1ea1i quy\u1ec1n truy c\u1eadp kh\u00f4ng c\u00f2n c\u1ea7n thi\u1ebft.<\/p>\n

Vai tr\u00f2 th\u1ee9 hai: X\u00e1c th\u1ef1c \u0111\u0103ng nh\u1eadp<\/h1>\n

M\u1ed7i l\u1ea7n ng\u01b0\u1eddi d\u00f9ng \u0111\u0103ng nh\u1eadp Microsoft 365, h\u1ec7 th\u1ed1ng c\u1ea7n x\u00e1c \u0111\u1ecbnh ng\u01b0\u1eddi \u0111\u00f3 c\u00f3 th\u1ef1c s\u1ef1 l\u00e0 ch\u1ee7 t\u00e0i kho\u1ea3n hay kh\u00f4ng. Entra ID qu\u1ea3n l\u00fd authentication cho c\u00e1c t\u00e0i kho\u1ea3n Microsoft 365.<\/p>\n

Ph\u01b0\u01a1ng th\u1ee9c c\u01a1 b\u1ea3n l\u00e0 username v\u00e0 password, nh\u01b0ng doanh nghi\u1ec7p kh\u00f4ng n\u00ean ch\u1ec9 d\u1ef1a v\u00e0o password. Microsoft h\u1ed7 tr\u1ee3 nhi\u1ec1u ph\u01b0\u01a1ng th\u1ee9c x\u00e1c th\u1ef1c, trong \u0111\u00f3 MFA l\u00e0 m\u1ed9t l\u1edbp r\u1ea5t quan tr\u1ecdng \u0111\u1ec3 b\u1ea3o v\u1ec7 account. Microsoft khuy\u1ebfn ngh\u1ecb b\u1eadt MFA cho administrator account v\u00e0 c\u00f3 th\u1ec3 \u00e1p d\u1ee5ng MFA th\u00f4ng qua Conditional Access ho\u1eb7c c\u00e1c c\u01a1 ch\u1ebf ph\u00f9 h\u1ee3p kh\u00e1c.<\/p>\n

V\u00ed d\u1ee5, n\u1ebfu password c\u1ee7a nh\u00e2n vi\u00ean b\u1ecb l\u1ed9 qua phishing nh\u01b0ng attacker kh\u00f4ng v\u01b0\u1ee3t qua b\u01b0\u1edbc MFA, kh\u1ea3 n\u0103ng truy c\u1eadp tr\u00e1i ph\u00e9p c\u00f3 th\u1ec3 b\u1ecb gi\u1ea3m \u0111\u00e1ng k\u1ec3.<\/p>\n

V\u00ec sao MFA \u0111\u1eb7c bi\u1ec7t quan tr\u1ecdng v\u1edbi Microsoft 365?<\/h2>\n

Microsoft 365 ch\u1ee9a r\u1ea5t nhi\u1ec1u d\u1eef li\u1ec7u doanh nghi\u1ec7p.<\/p>\n

Email.<\/p>\n

File.<\/p>\n

Chat.<\/p>\n

Meeting.<\/p>\n

Customer information.<\/p>\n

T\u00e0i li\u1ec7u n\u1ed9i b\u1ed9.<\/p>\n

N\u1ebfu m\u1ed9t account b\u1ecb compromise, attacker c\u00f3 th\u1ec3 truy c\u1eadp nhi\u1ec1u h\u1ec7 th\u1ed1ng c\u00f9ng l\u00fac.<\/p>\n

\u0110\u1eb7c bi\u1ec7t v\u1edbi admin account, h\u1eadu qu\u1ea3 c\u00f2n l\u1edbn h\u01a1n.<\/p>\n

Microsoft khuy\u1ebfn ngh\u1ecb t\u1ea5t c\u1ea3 administrator account ph\u1ea3i \u0111\u01b0\u1ee3c b\u1ea3o v\u1ec7 b\u1eb1ng MFA v\u00e0 h\u1ea1n ch\u1ebf s\u1ed1 l\u01b0\u1ee3ng account c\u00f3 privileged role.<\/p>\n

Vai tr\u00f2 th\u1ee9 ba: Conditional Access<\/h1>\n

MFA tr\u1ea3 l\u1eddi c\u00e2u h\u1ecfi:<\/p>\n

\u201cC\u00f3 c\u1ea7n x\u00e1c minh th\u00eam kh\u00f4ng?\u201d<\/strong><\/p>\n

Conditional Access \u0111i xa h\u01a1n.<\/p>\n

N\u00f3 tr\u1ea3 l\u1eddi:<\/p>\n

\u201cTrong \u0111i\u1ec1u ki\u1ec7n n\u00e0y, user c\u00f3 n\u00ean \u0111\u01b0\u1ee3c ph\u00e9p truy c\u1eadp kh\u00f4ng?\u201d<\/strong><\/p>\n

Microsoft m\u00f4 t\u1ea3 Conditional Access l\u00e0 policy engine c\u1ee7a m\u00f4 h\u00ecnh Zero Trust. N\u00f3 c\u00f3 th\u1ec3 \u0111\u00e1nh gi\u00e1 c\u00e1c t\u00edn hi\u1ec7u nh\u01b0 user, device, location, application v\u00e0 risk tr\u01b0\u1edbc khi \u0111\u01b0a ra quy\u1ebft \u0111\u1ecbnh cho ph\u00e9p, y\u00eau c\u1ea7u ki\u1ec3m so\u00e1t b\u1ed5 sung ho\u1eb7c ch\u1eb7n truy c\u1eadp.<\/p>\n

V\u00ed d\u1ee5 doanh nghi\u1ec7p c\u00f3 th\u1ec3 t\u1ea1o policy:<\/p>\n

N\u1ebfu user \u0111\u0103ng nh\u1eadp v\u00e0o Microsoft 365 t\u1eeb thi\u1ebft b\u1ecb kh\u00f4ng compliant \u2192 y\u00eau c\u1ea7u MFA ho\u1eb7c ch\u1eb7n.<\/p>\n

N\u1ebfu admin \u0111\u0103ng nh\u1eadp \u2192 lu\u00f4n y\u00eau c\u1ea7u MFA.<\/p>\n

N\u1ebfu sign-in c\u00f3 risk cao \u2192 ch\u1eb7n ho\u1eb7c y\u00eau c\u1ea7u x\u1eed l\u00fd b\u1ed5 sung.<\/p>\n

N\u1ebfu user truy c\u1eadp \u1ee9ng d\u1ee5ng nh\u1ea1y c\u1ea3m \u2192 ch\u1ec9 cho ph\u00e9p t\u1eeb thi\u1ebft b\u1ecb \u0111\u01b0\u1ee3c qu\u1ea3n l\u00fd.<\/p>\n

\u0110\u00e2y l\u00e0 l\u00fd do Entra ID \u0111\u00f3ng vai tr\u00f2 r\u1ea5t l\u1edbn trong hybrid work.<\/p>\n

Security kh\u00f4ng c\u00f2n ch\u1ec9 d\u1ef1a v\u00e0o vi\u1ec7c user \u0111ang \u1edf trong v\u0103n ph\u00f2ng hay ngo\u00e0i v\u0103n ph\u00f2ng.<\/p>\n

Identity v\u00e0 context tr\u1edf th\u00e0nh trung t\u00e2m c\u1ee7a quy\u1ebft \u0111\u1ecbnh truy c\u1eadp.<\/p>\n

Conditional Access c\u00f3 s\u1eb5n cho m\u1ecdi g\u00f3i kh\u00f4ng?<\/h2>\n

Kh\u1ea3 n\u0103ng Conditional Access ph\u1ee5 thu\u1ed9c v\u00e0o license Microsoft Entra ph\u00f9 h\u1ee3p. Microsoft hi\u1ec7n n\u00eau r\u1eb1ng Microsoft Entra ID P1 h\u1ed7 tr\u1ee3 Conditional Access, v\u00e0 m\u1ed9t s\u1ed1 g\u00f3i Microsoft 365 nh\u01b0 Business Premium ho\u1eb7c E3 c\u00f3 th\u1ec3 bao g\u1ed3m P1; c\u00e1c t\u00ednh n\u0103ng n\u00e2ng cao h\u01a1n c\u00f3 th\u1ec3 c\u1ea7n P2 ho\u1eb7c Microsoft Entra Governance t\u00f9y ch\u1ee9c n\u0103ng.<\/p>\n

V\u00ec v\u1eady, tr\u01b0\u1edbc khi x\u00e2y security roadmap, IT n\u00ean ki\u1ec3m tra license thay v\u00ec m\u1eb7c \u0111\u1ecbnh tenant \u0111\u00e3 c\u00f3 \u0111\u1ea7y \u0111\u1ee7 m\u1ecdi kh\u1ea3 n\u0103ng Entra.<\/p>\n

Vai tr\u00f2 th\u1ee9 t\u01b0: Qu\u1ea3n l\u00fd admin role<\/h1>\n

Entra ID kh\u00f4ng ch\u1ec9 qu\u1ea3n l\u00fd end user.<\/p>\n

N\u00f3 c\u00f2n qu\u1ea3n l\u00fd administrator role.<\/p>\n

Microsoft Entra RBAC cho ph\u00e9p c\u1ea5p c\u00e1c role kh\u00e1c nhau v\u1edbi m\u1ee9c quy\u1ec1n kh\u00e1c nhau, v\u00ed d\u1ee5 qu\u1ea3n l\u00fd user, \u1ee9ng d\u1ee5ng, Exchange, SharePoint ho\u1eb7c c\u00e1c th\u00e0nh ph\u1ea7n kh\u00e1c. Microsoft khuy\u1ebfn ngh\u1ecb \u00e1p d\u1ee5ng nguy\u00ean t\u1eafc least privilege<\/strong>: administrator ch\u1ec9 n\u00ean nh\u1eadn \u0111\u00fang quy\u1ec1n c\u1ea7n thi\u1ebft, trong ph\u1ea1m vi c\u1ea7n thi\u1ebft v\u00e0 trong th\u1eddi gian c\u1ea7n thi\u1ebft.<\/p>\n

\u0110i\u1ec1u n\u00e0y quan tr\u1ecdng v\u00ec m\u1ed9t l\u1ed7i r\u1ea5t ph\u1ed5 bi\u1ebfn l\u00e0 c\u1ea5p Global Administrator qu\u00e1 r\u1ed9ng.<\/p>\n

V\u00ed d\u1ee5 Helpdesk ch\u1ec9 c\u1ea7n reset password.<\/p>\n

Kh\u00f4ng c\u1ea7n Global Admin.<\/p>\n

Ng\u01b0\u1eddi qu\u1ea3n l\u00fd Exchange kh\u00f4ng nh\u1ea5t thi\u1ebft ph\u1ea3i c\u00f3 to\u00e0n quy\u1ec1n v\u1edbi to\u00e0n tenant.<\/p>\n

Partner ch\u1ec9 c\u1ea7n h\u1ed7 tr\u1ee3 m\u1ed9t ph\u1ea7n c\u0169ng kh\u00f4ng n\u00ean m\u1eb7c \u0111\u1ecbnh \u0111\u01b0\u1ee3c c\u1ea5p quy\u1ec1n cao nh\u1ea5t.<\/p>\n

Global Administrator n\u00ean \u0111\u01b0\u1ee3c gi\u1edbi h\u1ea1n<\/h2>\n

Microsoft khuy\u1ebfn ngh\u1ecb gi\u1eef s\u1ed1 l\u01b0\u1ee3ng Global Administrator d\u01b0\u1edbi 5 ng\u01b0\u1eddi \u0111\u1ec3 gi\u1ea3m attack surface. C\u00e1c account n\u00e0y c\u0169ng c\u1ea7n \u0111\u01b0\u1ee3c b\u1ea3o v\u1ec7 b\u1eb1ng MFA. \u0110\u00e2y l\u00e0 m\u1ed9t nguy\u00ean t\u1eafc r\u1ea5t th\u1ef1c t\u1ebf. M\u1ed9t tenant c\u00f3 10\u201315 Global Admin th\u01b0\u1eddng l\u00e0 d\u1ea5u hi\u1ec7u c\u1ea7n review quy\u1ec1n.<\/p>\n

Vai tr\u00f2 th\u1ee9 n\u0103m: Privileged Identity Management<\/h1>\n

V\u1edbi m\u00f4i tr\u01b0\u1eddng c\u1ea7n security cao h\u01a1n, Microsoft cung c\u1ea5p Privileged Identity Management \u2013 PIM.<\/p>\n

PIM gi\u00fap administrator kh\u00f4ng c\u1ea7n gi\u1eef privileged role \u1edf tr\u1ea1ng th\u00e1i active m\u1ecdi l\u00fac.<\/p>\n

Thay v\u00e0o \u0111\u00f3, h\u1ecd c\u00f3 th\u1ec3 tr\u1edf th\u00e0nh eligible<\/strong> v\u00e0 ch\u1ec9 activate role khi c\u1ea7n, trong m\u1ed9t kho\u1ea3ng th\u1eddi gian gi\u1edbi h\u1ea1n.<\/p>\n

Microsoft khuy\u1ebfn ngh\u1ecb s\u1eed d\u1ee5ng PIM \u0111\u1ec3 cung c\u1ea5p just-in-time access, c\u00f3 th\u1ec3 k\u1ebft h\u1ee3p MFA, approval v\u00e0 th\u1eddi h\u1ea1n role activation.<\/p>\n

V\u00ed d\u1ee5 IT Manager b\u00ecnh th\u01b0\u1eddng kh\u00f4ng c\u1ea7n Global Admin.<\/p>\n

Khi ph\u1ea3i th\u1ef1c hi\u1ec7n m\u1ed9t thay \u0111\u1ed5i \u0111\u1eb7c bi\u1ec7t, h\u1ecd activate role trong m\u1ed9t gi\u1edd.<\/p>\n

Sau \u0111\u00f3 quy\u1ec1n t\u1ef1 h\u1ebft h\u1ea1n.<\/p>\n

C\u00e1ch n\u00e0y gi\u00fap gi\u1ea3m standing privileged access.<\/p>\n

Vai tr\u00f2 th\u1ee9 s\u00e1u: Qu\u1ea3n l\u00fd \u1ee9ng d\u1ee5ng v\u00e0 access<\/h1>\n

Nhi\u1ec1u doanh nghi\u1ec7p hi\u1ec7n kh\u00f4ng ch\u1ec9 d\u00f9ng \u1ee9ng d\u1ee5ng Microsoft.<\/p>\n

H\u1ecd c\u00f2n k\u1ebft n\u1ed1i:<\/p>\n

CRM.<\/p>\n

HRM.<\/p>\n

Expense system.<\/p>\n

Project management.<\/p>\n

SaaS kh\u00e1c.<\/p>\n

Microsoft Entra ID c\u00f3 th\u1ec3 \u0111\u00f3ng vai tr\u00f2 identity provider cho nhi\u1ec1u \u1ee9ng d\u1ee5ng b\u1eb1ng Single Sign-On ho\u1eb7c c\u00e1c c\u01a1 ch\u1ebf x\u00e1c th\u1ef1c kh\u00e1c.<\/p>\n

Microsoft c\u0169ng cung c\u1ea5p kh\u1ea3 n\u0103ng qu\u1ea3n l\u00fd application access trong Entra ID.<\/p>\n

\u0110i\u1ec1u n\u00e0y gi\u00fap doanh nghi\u1ec7p gi\u1ea3m vi\u1ec7c m\u1ed7i \u1ee9ng d\u1ee5ng c\u00f3 m\u1ed9t b\u1ed9 username\/password ho\u00e0n to\u00e0n t\u00e1ch bi\u1ec7t.<\/p>\n

Khi nh\u00e2n vi\u00ean ngh\u1ec9 vi\u1ec7c, vi\u1ec7c disable account trung t\u00e2m c\u00f3 th\u1ec3 gi\u00fap thu h\u1ed3i access nhanh h\u01a1n \u1edf c\u00e1c \u1ee9ng d\u1ee5ng \u0111\u00e3 t\u00edch h\u1ee3p ph\u00f9 h\u1ee3p.<\/p>\n

Vai tr\u00f2 th\u1ee9 b\u1ea3y: Theo d\u00f5i sign-in v\u00e0 audit<\/h1>\n

M\u1ed9t h\u1ec7 th\u1ed1ng identity t\u1ed1t kh\u00f4ng ch\u1ec9 ki\u1ec3m so\u00e1t truy c\u1eadp. N\u00f3 c\u00f2n c\u1ea7n kh\u1ea3 n\u0103ng theo d\u00f5i.<\/p>\n

Microsoft Entra ghi nh\u1eadn sign-in activity v\u00e0 cung c\u1ea5p sign-in logs \u0111\u1ec3 IT c\u00f3 th\u1ec3 xem ai \u0111\u0103ng nh\u1eadp, d\u00f9ng application n\u00e0o v\u00e0 truy c\u1eadp resource g\u00ec. C\u00e1c log n\u00e0y c\u0169ng \u0111\u01b0\u1ee3c d\u00f9ng \u0111\u1ec3 troubleshooting sign-in error v\u00e0 theo d\u00f5i activity trong tenant.<\/p>\n

M\u1ed9t sign-in c\u00f3 th\u1ec3 \u0111\u01b0\u1ee3c ph\u00e2n t\u00edch theo ba y\u1ebfu t\u1ed1 c\u01a1 b\u1ea3n:<\/p>\n

Who<\/strong> \u2013 user n\u00e0o \u0111\u0103ng nh\u1eadp.<\/p>\n

How<\/strong> \u2013 d\u00f9ng application\/client n\u00e0o.<\/p>\n

What<\/strong> \u2013 truy c\u1eadp resource n\u00e0o.<\/p>\n

\u0110\u00e2y l\u00e0 ngu\u1ed3n th\u00f4ng tin r\u1ea5t quan tr\u1ecdng khi c\u00f3 v\u1ea5n \u0111\u1ec1 ki\u1ec3u:<\/p>\n

User kh\u00f4ng \u0111\u0103ng nh\u1eadp \u0111\u01b0\u1ee3c.<\/p>\n

MFA th\u1ea5t b\u1ea1i.<\/p>\n

Conditional Access block.<\/p>\n

Sign-in t\u1eeb location l\u1ea1.<\/p>\n

\u1ee8ng d\u1ee5ng kh\u00f4ng \u0111\u01b0\u1ee3c c\u1ea5p quy\u1ec1n.<\/p>\n

Audit log kh\u00e1c sign-in log th\u1ebf n\u00e0o?<\/h2>\n

Sign-in logs t\u1eadp trung v\u00e0o vi\u1ec7c \u0111\u0103ng nh\u1eadp. Audit logs gi\u00fap theo d\u00f5i nh\u1eefng thay \u0111\u1ed5i trong directory.<\/p>\n

For example:<\/p>\n

Ai t\u1ea1o user?<\/p>\n

Ai thay \u0111\u1ed5i group?<\/p>\n

Ai g\u00e1n role?<\/p>\n

Ai thay \u0111\u1ed5i c\u1ea5u h\u00ecnh?<\/p>\n

Microsoft Entra monitoring and health s\u1eed d\u1ee5ng sign-in v\u00e0 audit logs \u0111\u1ec3 gi\u00fap t\u1ed5 ch\u1ee9c ph\u00e2n t\u00edch activity, troubleshooting v\u00e0 theo d\u00f5i security c\u1ee7a tenant.<\/p>\n

Vai tr\u00f2 th\u1ee9 t\u00e1m: Identity Protection v\u00e0 risk<\/h1>\n

\u1ede c\u00e1c license ph\u00f9 h\u1ee3p, Microsoft Entra c\u00f3 th\u1ec3 \u0111\u00e1nh gi\u00e1 risk li\u00ean quan \u0111\u1ebfn user ho\u1eb7c sign-in. Microsoft Entra ID Protection s\u1eed d\u1ee5ng sign-in data \u0111\u1ec3 x\u00e1c \u0111\u1ecbnh risky users v\u00e0 risk events.<\/p>\n

V\u00ed d\u1ee5, m\u1ed9t sign-in c\u00f3 pattern b\u1ea5t th\u01b0\u1eddng c\u00f3 th\u1ec3 \u0111\u01b0\u1ee3c \u0111\u00e1nh d\u1ea5u \u0111\u1ec3 IT \u0111i\u1ec1u tra.<\/p>\n

Khi k\u1ebft h\u1ee3p v\u1edbi Conditional Access, doanh nghi\u1ec7p c\u00f3 th\u1ec3 x\u00e2y policy ph\u1ea3n \u1ee9ng d\u1ef1a tr\u00ean risk.<\/p>\n

For example:<\/p>\n

Risk cao \u2192 block.<\/p>\n

Risk trung b\u00ecnh \u2192 y\u00eau c\u1ea7u MFA.<\/p>\n

Risk th\u1ea5p \u2192 cho ph\u00e9p theo policy b\u00ecnh th\u01b0\u1eddng.<\/p>\n

\u0110i\u1ec1u n\u00e0y gi\u00fap security chuy\u1ec3n t\u1eeb rule t\u0129nh sang m\u00f4 h\u00ecnh d\u1ef1a tr\u00ean t\u00edn hi\u1ec7u.<\/p>\n

Microsoft Entra ID v\u00e0 Microsoft 365 Security li\u00ean quan th\u1ebf n\u00e0o?<\/h1>\n

Microsoft 365 Security c\u00f3 nhi\u1ec1u l\u1edbp.<\/p>\n

Defender t\u1eadp trung nhi\u1ec1u h\u01a1n v\u00e0o threat protection.<\/p>\n

Purview t\u1eadp trung nhi\u1ec1u h\u01a1n v\u00e0o data security, compliance v\u00e0 governance.<\/p>\n

Entra ID t\u1eadp trung v\u00e0o identity v\u00e0 access.<\/p>\n

C\u00f3 th\u1ec3 hi\u1ec3u:<\/p>\n

Entra ID \u2192 Ai \u0111\u01b0\u1ee3c truy c\u1eadp<\/strong><\/p>\n

Defender \u2192 C\u00f3 m\u1ed1i \u0111e d\u1ecda n\u00e0o kh\u00f4ng<\/strong><\/p>\n

Purview \u2192 D\u1eef li\u1ec7u n\u00e0o c\u1ea7n b\u1ea3o v\u1ec7 v\u00e0 qu\u1ea3n tr\u1ecb<\/strong><\/p>\n

Ba l\u1edbp n\u00e0y b\u1ed5 sung cho nhau.<\/p>\n

N\u1ebfu identity b\u1ecb compromise, c\u00e1c l\u1edbp security ph\u00eda sau c\u00f3 th\u1ec3 g\u1eb7p r\u1ee7i ro.<\/p>\n

Do \u0111\u00f3, Entra ID th\u01b0\u1eddng \u0111\u01b0\u1ee3c xem l\u00e0 m\u1ed9t trong nh\u1eefng n\u1ec1n t\u1ea3ng \u0111\u1ea7u ti\u00ean doanh nghi\u1ec7p c\u1ea7n chu\u1ea9n h\u00f3a.<\/p>\n

M\u1ed9t t\u00ecnh hu\u1ed1ng th\u1ef1c t\u1ebf: nh\u00e2n vi\u00ean l\u00e0m vi\u1ec7c t\u1eeb xa<\/h1>\n

Nh\u00e2n vi\u00ean Sales \u0111ang c\u00f4ng t\u00e1c.<\/p>\n

H\u1ecd \u0111\u0103ng nh\u1eadp Microsoft 365 tr\u00ean laptop.<\/p>\n

Entra ID c\u00f3 th\u1ec3 tham gia v\u00e0o quy\u1ebft \u0111\u1ecbnh truy c\u1eadp d\u1ef1a tr\u00ean:<\/p>\n

User identity.<\/p>\n

MFA.<\/p>\n

Thi\u1ebft b\u1ecb.<\/p>\n

Location.<\/p>\n

Risk.<\/p>\n

Conditional Access policy.<\/p>\n

N\u1ebfu m\u1ecdi \u0111i\u1ec1u ki\u1ec7n \u0111\u1ea1t y\u00eau c\u1ea7u, user truy c\u1eadp Outlook, Teams v\u00e0 SharePoint.<\/p>\n

N\u1ebfu thi\u1ebft b\u1ecb kh\u00f4ng compliant ho\u1eb7c sign-in c\u00f3 risk cao, access c\u00f3 th\u1ec3 b\u1ecb h\u1ea1n ch\u1ebf.<\/p>\n

\u0110\u00e2y l\u00e0 v\u00ed d\u1ee5 cho th\u1ea5y Entra ID kh\u00f4ng ch\u1ec9 l\u00e0 m\u1ed9t danh s\u00e1ch user.<\/p>\n

M\u1ed9t t\u00ecnh hu\u1ed1ng kh\u00e1c: nh\u00e2n vi\u00ean ngh\u1ec9 vi\u1ec7c<\/h1>\n

N\u1ebfu employee offboarding ch\u1ec9 d\u1eebng \u1edf vi\u1ec7c thu laptop, r\u1ee7i ro v\u1eabn t\u1ed3n t\u1ea1i.<\/p>\n

IT c\u1ea7n x\u1eed l\u00fd identity.<\/p>\n

For example:<\/p>\n

Block sign-in.<\/p>\n

Thu h\u1ed3i active session khi ph\u00f9 h\u1ee3p.<\/p>\n

G\u1ee1 group membership.<\/p>\n

G\u1ee1 privileged role.<\/p>\n

X\u1eed l\u00fd license.<\/p>\n

Review application access.<\/p>\n

X\u1eed l\u00fd mailbox\/OneDrive theo quy tr\u00ecnh.<\/p>\n

Entra ID tr\u1edf th\u00e0nh m\u1ed9t th\u00e0nh ph\u1ea7n trung t\u00e2m trong qu\u00e1 tr\u00ecnh n\u00e0y.<\/p>\n

M\u1ed9t t\u00ecnh hu\u1ed1ng kh\u00e1c: IT Admin b\u1ecb compromise<\/h1>\n

N\u1ebfu administrator c\u00f3 Global Admin permanent v\u00e0 account b\u1ecb phishing, attacker c\u00f3 th\u1ec3 c\u00f3 ph\u1ea1m vi quy\u1ec1n r\u1ea5t l\u1edbn.<\/p>\n

Microsoft khuy\u1ebfn ngh\u1ecb nhi\u1ec1u l\u1edbp ki\u1ec3m so\u00e1t:<\/p>\n

Least privilege.<\/p>\n

MFA.<\/p>\n

PIM.<\/p>\n

Cloud-native privileged accounts.<\/p>\n

Access review.<\/p>\n

Conditional Access.<\/p>\n

\u0110\u00e2y l\u00e0 l\u00fd do administrator governance c\u1ea7n \u0111\u01b0\u1ee3c xem ri\u00eang v\u1edbi user th\u00f4ng th\u01b0\u1eddng.<\/p>\n

L\u1ed7i th\u01b0\u1eddng g\u1eb7p: ch\u1ec9 t\u1ea1o user r\u1ed3i b\u1ecf m\u1eb7c<\/h1>\n

M\u1ed9t s\u1ed1 tenant \u0111\u01b0\u1ee3c tri\u1ec3n khai theo c\u00e1ch:<\/p>\n

T\u1ea1o account.<\/p>\n

G\u00e1n license.<\/p>\n

Xong.<\/p>\n

Kh\u00f4ng c\u00f3 review access.<\/p>\n

Kh\u00f4ng review group.<\/p>\n

Kh\u00f4ng ki\u1ec3m tra inactive account.<\/p>\n

Kh\u00f4ng c\u00f3 offboarding r\u00f5.<\/p>\n

Sau v\u00e0i n\u0103m, tenant c\u00f3 th\u1ec3 ch\u1ee9a nhi\u1ec1u account kh\u00f4ng c\u00f2n ph\u00f9 h\u1ee3p.<\/p>\n

Identity governance c\u1ea7n \u0111\u01b0\u1ee3c xem nh\u01b0 m\u1ed9t ho\u1ea1t \u0111\u1ed9ng li\u00ean t\u1ee5c, kh\u00f4ng ph\u1ea3i vi\u1ec7c l\u00e0m m\u1ed9t l\u1ea7n.<\/p>\n

L\u1ed7i th\u01b0\u1eddng g\u1eb7p: qu\u00e1 nhi\u1ec1u Global Administrator<\/h1>\n

\u0110\u00e2y l\u00e0 m\u1ed9t trong nh\u1eefng l\u1ed7i nguy hi\u1ec3m nh\u1ea5t. Microsoft khuy\u1ebfn ngh\u1ecb d\u01b0\u1edbi 5 Global Administrator v\u00e0 d\u00f9ng role chuy\u00ean bi\u1ec7t thay v\u00ec quy\u1ec1n r\u1ed9ng n\u1ebfu c\u00f3 th\u1ec3. Admin role c\u1ea7n \u0111\u01b0\u1ee3c review \u0111\u1ecbnh k\u1ef3. \u0110\u1eb7c bi\u1ec7t:<\/p>\n

Partner c\u0169.<\/p>\n

Nh\u00e2n vi\u00ean chuy\u1ec3n ph\u00f2ng ban.<\/p>\n

Ng\u01b0\u1eddi ngh\u1ec9 vi\u1ec7c.<\/p>\n

Temporary admin.<\/p>\n

Project consultant.<\/p>\n

L\u1ed7i th\u01b0\u1eddng g\u1eb7p: d\u00f9ng account admin \u0111\u1ec3 \u0111\u1ecdc email h\u1eb1ng ng\u00e0y<\/h1>\n

Privileged account kh\u00f4ng n\u00ean \u0111\u01b0\u1ee3c s\u1eed d\u1ee5ng nh\u01b0 account l\u00e0m vi\u1ec7c th\u00f4ng th\u01b0\u1eddng n\u1ebfu doanh nghi\u1ec7p mu\u1ed1n gi\u1ea3m r\u1ee7i ro. Microsoft c\u0169ng khuy\u1ebfn ngh\u1ecb cloud-native account cho Microsoft Entra v\u00e0 Microsoft 365 privileged roles trong c\u00e1c m\u00f4i tr\u01b0\u1eddng c\u1ea7n b\u1ea3o m\u1eadt cao.<\/p>\n

M\u1ed9t m\u00f4 h\u00ecnh ph\u00f9 h\u1ee3p h\u01a1n l\u00e0 t\u00e1ch:<\/p>\n

Account c\u00f4ng vi\u1ec7c.<\/p>\n

Account qu\u1ea3n tr\u1ecb.<\/p>\n

\u0110i\u1ec1u n\u00e0y gi\u00fap gi\u1ea3m exposure.<\/p>\n

L\u1ed7i th\u01b0\u1eddng g\u1eb7p: Conditional Access tri\u1ec3n khai qu\u00e1 nhanh<\/h1>\n

Conditional Access r\u1ea5t m\u1ea1nh nh\u01b0ng c\u0169ng c\u00f3 th\u1ec3 kh\u00f3a nh\u1ea7m user ho\u1eb7c admin n\u1ebfu c\u1ea5u h\u00ecnh sai.<\/p>\n

Do \u0111\u00f3, policy n\u00ean \u0111\u01b0\u1ee3c:<\/p>\n

Thi\u1ebft k\u1ebf r\u00f5.<\/p>\n

Pilot.<\/p>\n

Test.<\/p>\n

Theo d\u00f5i sign-in logs.<\/p>\n

Sau \u0111\u00f3 m\u1edbi rollout r\u1ed9ng.<\/p>\n

Microsoft m\u00f4 t\u1ea3 Conditional Access l\u00e0 c\u01a1 ch\u1ebf policy d\u1ef1a tr\u00ean t\u00edn hi\u1ec7u, n\u00ean m\u1ed7i policy c\u1ea7n \u0111\u01b0\u1ee3c ki\u1ec3m tra trong b\u1ed1i c\u1ea3nh th\u1ef1c t\u1ebf tr\u01b0\u1edbc khi enforce to\u00e0n t\u1ed5 ch\u1ee9c.<\/p>\n

L\u1ed7i th\u01b0\u1eddng g\u1eb7p: kh\u00f4ng review external access<\/h1>\n

Guest user v\u00e0 application access c\u0169ng c\u1ea7n governance. M\u1ed9t partner \u0111\u01b0\u1ee3c m\u1eddi v\u00e0o project 12 th\u00e1ng tr\u01b0\u1edbc c\u00f3 th\u1ec3 kh\u00f4ng c\u00f2n c\u1ea7n access.<\/p>\n

M\u1ed9t enterprise application c\u0169 c\u00f3 th\u1ec3 v\u1eabn c\u00f2n quy\u1ec1n. Access review \u0111\u1ecbnh k\u1ef3 gi\u00fap gi\u1ea3m quy\u1ec1n d\u01b0 th\u1eeba. Microsoft khuy\u1ebfn ngh\u1ecb s\u1eed d\u1ee5ng recurring access reviews \u0111\u1ec3 x\u00e1c \u0111\u1ecbnh v\u00e0 thu h\u1ed3i role ho\u1eb7c quy\u1ec1n kh\u00f4ng c\u00f2n c\u1ea7n thi\u1ebft, n\u1ebfu t\u1ed5 ch\u1ee9c c\u00f3 license h\u1ed7 tr\u1ee3.<\/p>\n

Doanh nghi\u1ec7p n\u00ean review Microsoft Entra ID h\u00e0ng qu\u00fd nh\u01b0 th\u1ebf n\u00e0o?<\/h1>\n

V\u00ec identity thay \u0111\u1ed5i li\u00ean t\u1ee5c theo nh\u00e2n s\u1ef1 v\u00e0 h\u1ec7 th\u1ed1ng, review theo qu\u00fd l\u00e0 m\u1ed9t nh\u1ecbp kh\u00e1 th\u1ef1c t\u1ebf.<\/p>\n

M\u1ed9t quarterly review c\u00f3 th\u1ec3 t\u1eadp trung v\u00e0o 6 nh\u00f3m.<\/p>\n

1. User v\u00e0 account<\/h2>\n

Ki\u1ec3m tra:<\/p>\n

Account inactive.<\/p>\n

Account \u0111\u00e3 ngh\u1ec9 vi\u1ec7c.<\/p>\n

Guest user c\u0169.<\/p>\n

Account kh\u00f4ng c\u00f3 owner.<\/p>\n

Account \u0111\u1eb7c bi\u1ec7t.<\/p>\n

M\u1ee5c ti\u00eau l\u00e0 gi\u1ea3m identity kh\u00f4ng c\u00f2n c\u1ea7n thi\u1ebft.<\/p>\n

2. Admin roles<\/h2>\n

Review:<\/p>\n

Global Administrator.<\/p>\n

Privileged Role Administrator.<\/p>\n

Exchange Administrator.<\/p>\n

SharePoint Administrator.<\/p>\n

Security Administrator.<\/p>\n

User Administrator.<\/p>\n

Microsoft khuy\u1ebfn ngh\u1ecb ki\u1ec3m so\u00e1t privileged role theo least privilege v\u00e0 review th\u01b0\u1eddng xuy\u00ean.<\/p>\n

3. MFA v\u00e0 authentication<\/h2>\n

Ki\u1ec3m tra:<\/p>\n

Admin \u0111\u00e3 c\u00f3 MFA ch\u01b0a?<\/p>\n

C\u00f3 user quan tr\u1ecdng n\u00e0o ch\u01b0a \u0111\u01b0\u1ee3c b\u1ea3o v\u1ec7?<\/p>\n

Authentication methods c\u00f3 c\u00f2n ph\u00f9 h\u1ee3p?<\/p>\n

C\u00f3 ph\u01b0\u01a1ng th\u1ee9c y\u1ebfu kh\u00f4ng c\u1ea7n thi\u1ebft?<\/p>\n

MFA l\u00e0 m\u1ed9t trong nh\u1eefng security baseline quan tr\u1ecdng nh\u1ea5t.<\/p>\n

4. Conditional Access<\/h2>\n

Review:<\/p>\n

Policy n\u00e0o \u0111ang active?<\/p>\n

C\u00f3 exclusion n\u00e0o kh\u00f4ng c\u00f2n h\u1ee3p l\u00fd?<\/p>\n

C\u00f3 legacy exception kh\u00f4ng?<\/p>\n

C\u00f3 policy tr\u00f9ng nhau kh\u00f4ng?<\/p>\n

C\u00f3 user b\u1ecb block ngo\u00e0i \u00fd mu\u1ed1n kh\u00f4ng?<\/p>\n

Sign-in logs r\u1ea5t h\u1eefu \u00edch \u0111\u1ec3 \u0111\u00e1nh gi\u00e1 t\u00e1c \u0111\u1ed9ng th\u1ef1c t\u1ebf.<\/p>\n

5. Sign-in v\u00e0 risk<\/h2>\n

Review c\u00e1c pattern b\u1ea5t th\u01b0\u1eddng.<\/p>\n

For example:<\/p>\n

Failed sign-in t\u0103ng m\u1ea1nh.<\/p>\n

Sign-in t\u1eeb location l\u1ea1.<\/p>\n

Admin login b\u1ea5t th\u01b0\u1eddng.<\/p>\n

Risky user n\u1ebfu license h\u1ed7 tr\u1ee3.<\/p>\n

Microsoft Entra activity logs v\u00e0 Identity Protection c\u00f3 th\u1ec3 h\u1ed7 tr\u1ee3 qu\u00e1 tr\u00ecnh \u0111i\u1ec1u tra n\u00e0y.<\/p>\n

6. App v\u00e0 partner access<\/h2>\n

Review:<\/p>\n

Enterprise application.<\/p>\n

Guest user.<\/p>\n

Partner account.<\/p>\n

Admin delegation.<\/p>\n

Application permission.<\/p>\n

Kh\u00f4ng n\u00ean \u0111\u1ec3 quy\u1ec1n t\u1ed3n t\u1ea1i v\u00f4 th\u1eddi h\u1ea1n ch\u1ec9 v\u00ec tr\u01b0\u1edbc \u0111\u00e2y t\u1eebng c\u1ea7n.<\/p>\n

Checklist Microsoft Entra ID n\u00ean ki\u1ec3m tra \u0111\u1ecbnh k\u1ef3<\/h1>\n

Doanh nghi\u1ec7p c\u00f3 th\u1ec3 d\u00f9ng checklist sau m\u1ed7i qu\u00fd:<\/p>\n