Library
Admin guides
Step-by-step how-tos for Microsoft 365, Azure, Google Cloud and AWS admins: what to prepare, the steps, how to check it worked and the mistakes to avoid.
9guides
4clouds
- Microsoft 365How to roll out Privileged Identity Management in Microsoft 365This guide moves your administrators from permanent admin roles to eligible roles that must be activated, with MFA, a justification and approval for the most powerful ones. It is written for Microsoft 365 and Entra administrators who want just-in-time admin access without locking themselves out.Read the guide →
- AWSHow to set up an organization CloudTrail in AWSThis guide shows how to create one multi-Region CloudTrail trail that records management activity for every account in your AWS Organization, stored in a single locked-down S3 bucket. It is written for AWS administrators who run more than one account and want a central audit log they can rely on.Read the guide →
- Google CloudHow to turn on organization-wide audit logs in Google CloudThis guide shows how to enable Data Access audit logs for every service across a whole Google Cloud organization and collect all log entries in one place. It is for cloud administrators and security engineers who need a complete record of who did what in their projects.Read the guide →
- Microsoft AzureHow to review who has access to Azure Key VaultThis guide shows how to find out which permission model each Azure Key Vault uses, who can reach its secrets, keys and certificates, and whether access is logged. It is for Azure administrators and security engineers who need to tighten vault access without breaking applications.Read the guide →
- AWSHow to enforce IMDSv2 on Amazon EC2 instancesThis guide shows how to find EC2 instances that still accept IMDSv1, confirm nothing depends on it, require IMDSv2 on running instances and make it the default for new ones. It is written for AWS administrators who manage EC2 in one account or many.Read the guide →
- Google CloudHow to remove user-managed service account keys in Google CloudThis guide shows how to find user-managed service account keys, check whether anything still uses them, disable and then delete them, and stop new ones being created. It is written for Google Cloud administrators who want workloads to rely on short-lived credentials instead of key files.Read the guide →
- Microsoft AzureHow to block public access to Azure storage accountsThis guide shows how to find Azure storage accounts that allow anonymous blob reads or accept traffic from any network, then close both gaps without breaking the apps that use them. It is written for Azure administrators who look after storage accounts across one or more subscriptions.Read the guide →
- Microsoft 365How to find and remove stale guest users in Microsoft 365This guide shows how to list guest accounts that have not signed in for a long time, review them with their owners and remove them safely. It is written for Microsoft 365 and Entra administrators who want to reduce external access without breaking active collaboration.Read the guide →
- Microsoft 365How to set up break-glass accounts in Microsoft 365This guide shows how to create two emergency access (break-glass) accounts that can still sign in to your Microsoft 365 tenant when normal admin sign-in is broken. It is written for tenant administrators who need a safe way back in after a Conditional Access mistake, an MFA outage or a lost admin device.Read the guide →
Check your settings without the manual work
ConfigCobra assesses Microsoft 365, Azure, Google Cloud and AWS against the CIS benchmarks, read-only.