CIO Brief: Identity Is the New Perimeter — Now It Has a Brand
Retrospective: this article looks back at events from May 2022, written in 2026 with the benefit of hindsight.
The short version: In 2022, Microsoft reorganized its identity products under a new brand, Entra — reflecting a shift the whole industry made: who you are and what you can access now matter more than which network you're on.
Why identity is the new perimeter
Employees work from anywhere, apps live in the cloud, and partners and vendors connect directly. Firewalls around the office no longer define what's "inside." Attackers know it — most breaches now involve stolen credentials, tricked users or abused permissions.
What this means for investment
Security budgets have historically favored network and endpoint tools. An identity-first approach shifts priority to:
- Strong, phishing-resistant authentication.
- Least-privilege, time-limited admin access.
- Automated access lifecycle (joiners, movers, leavers).
- Monitoring of sign-ins and permission changes.
- Governance of non-human identities like apps and AI agents.
Questions to ask your team
- What share of our security budget goes to identity today?
- Do we have someone accountable for identity security?
- How long does it take to remove access when someone leaves?
- How many admin accounts have permanent rights?
What good looks like
A named identity program owner, a roadmap with measurable goals, and regular reporting to leadership.
The decision
If identity security doesn't have a clear owner and budget, assign both. It's where most attacks start.
- Microsoft Entra Launches (May 2022): Identity Becomes Its Own Product Family Platform Changes
- How to Map Entra Products to Your Identity Security Roadmap How-To & Hardening
- Identity Security Program Checklist for Mid-Market Companies How-To & Hardening