Public sector · State police authority · 40,000 users

Identity governance and hardening for a state police authority with 40,000 users

A quiet corridor in a modern government office building with a card reader beside each wooden door and daylight from a window at the end.

Users: 40,000
Devices in Intune: 1,500
Duration: since June 2025
Role: Security and cloud architecture

Situation

A state police authority manages around 40,000 users in Active Directory and Microsoft Entra ID. Most clients and servers are still managed on-premises, and 1,500 devices are already in Intune. The authority needed a cloud security operating model that puts identities, endpoints, containers and monitoring under binding rules, aligned with the BSI IT-Grundschutz baseline, the German federal standard for information security.

Approach

WCS has been responsible for security and cloud architecture since June 2025. An assessment of Active Directory and Entra ID from an attacker’s perspective set the priorities for hardening.

Identity and access governance in Entra ID: access packages, access reviews to recertify groups, roles and access packages, joiner-mover-leaver processes through Lifecycle Workflows, and a PIM role model with just-in-time activation and approval for Entra roles and groups.
Sign-in: passwordless, phishing-resistant authentication with Windows Hello for Business and FIDO2.
On-premises hardening to Microsoft Security Baselines, CIS Benchmarks and BSI SiSyPHuS: Windows LAPS, Protected Users, restrictions on NTLM, SMBv1 and unsigned LDAP, Advanced Audit Policy and Defender for Identity, plus privileged access through tiering and privileged access workstations.
Endpoints: Intune baselines to BSI IT-Grundschutz for Windows 10/11 and Ubuntu, a WDAC pilot, a standard packaging and update process with a QA gate, and Defender for Endpoint on the 1,500 Intune devices. Servers are covered by Defender for Servers.
Containers and monitoring: a security model for ACR and AKS with image scanning and policies in Defender for Cloud, and Microsoft Sentinel as SIEM with a data source concept, KQL use cases and MITRE ATT&CK mapping.

Result

Access to groups, roles and applications follows defined steps for request, approval, expiry and recertification. Administrative roles are activated only when needed. The hardening standards are documented as operating requirements that the internal teams work to. The project is ongoing and commissioned until the end of 2026.