How Xbox Secures 70+ Entra Tenants Every Night with Maester
Show notes
Xbox Security runs a gaming-specific Microsoft Entra baseline across more than 70 tenants every night.
The scale is striking: about 50 controls, dozens of independently operated game-studio tenants, and one parallel pipeline that checks whether each environment still matches Xbox’s security intent. When a Conditional Access policy moves to report-only or a required service principal loses a permission, the next run finds it.
In this episode of Entra.Chat, Merill speaks with Audrey Long, Principal Cloud Security Architect in Xbox Security at Microsoft, and Sam Erde, SecureShield Architect at Patriot Consulting and a Maester maintainer. Audrey explains how Xbox Security extended Maester with custom PowerShell, GitHub Actions, a multi-tenant service principal, federated identity credentials, dashboards, ticketing, and time-bound exceptions.
The result is more than a posture report. Findings flow into an operational lifecycle with owners and deadlines. Studios get readable reports, deep links to the affected object, and remediation guidance. Security teams can answer audit questions without interrupting all the tenant admins, while the Maester pipeline keeps read-only observability separate from remediation authority.
The conversation also covers why a Microsoft-wide baseline needs adapting for gaming acquisitions, how custom tests encode an organization’s intent, why security configuration deserves regression tests, the Investigate status Audrey’s team helped introduce, and how administrators can use AI as a first-draft assistant for PowerShell and CI/CD without outsourcing validation.
Subscribe with your favorite podcast player or watch on YouTube
Sponsor
Maester Cloud turns every Maester and Microsoft Zero Trust Assessment run into a durable evidence trail. See new failures, fixes, accepted risks, and posture changes across every tenant—without digging through old HTML reports.
* Keep 5+ years of tenant history in your chosen Azure region
* Compare runs, spot drift, and get change alerts
Maester Cloud is in active development. Join the waitlist for hosted, self-hosted, or enterprise onboarding updates.
About Audrey Long
Audrey Long is a Principal Cloud Security Architect in Xbox Security at Microsoft. She focuses on Microsoft Entra and identity security, as well as securing Azure, AWS, and Google Cloud environments across Xbox and its game studios. In this episode, she shares how her team built a gaming-specific Entra baseline and operationalized it across more than 70 tenants.
* LinkedIn - https://www.linkedin.com/in/aulong/
About Sam Erde
Sam Erde is part of the Maester core maintainer team, a Microsoft MVP, and a SecureShield Architect at Patriot Consulting. He focuses on Active Directory, Microsoft Entra ID, Microsoft 365 security, and practical PowerShell tooling for defenders.
LinkedIn - https://www.linkedin.com/in/samerde/
Related Links
* Maester, installation guide, and source code (mentioned at 02:19) - Maester · installation guide · GitHub source
* Continuous monitoring with Maester and GitHub Actions (mentioned at 14:38) - https://maester.dev/docs/monitoring/github/
* Writing custom Maester tests (mentioned at 22:39) - https://maester.dev/docs/writing-tests/
* Connect-Maester permissions and read-only access (mentioned at 24:38) - https://maester.dev/docs/connect-maester/
* Zero Trust Assessment: Secure your tenant (mentioned at 25:46) - https://entra.news/p/find-your-tenants-hidden-flaws-in
* Maester’s Investigate test-result status (mentioned at 34:02) - https://maester.dev/docs/writing-tests/formatting-test-results/
* Making Security Invisible for Game Developers (mentioned at 45:52) - https://opsmatters.com/videos/making-security-invisible-game-developers
Related Entra.Chat Episodes
* How to Secure Copilot Agents, Azure DevOps & Defender (+ more) with Maester 2.1 (Full Breakdown)
* Zero Trust Assessment: Secure your tenant
* How to Design Bullet-Proof Conditional Access Policies in Microsoft Entra ID
Chapters
00:00 Intro00:42 Meet Audrey Long02:19 From 50 Controls to 70+ Tenants05:11 Making an Entra Baseline Gaming-Specific08:32 Why Custom Maester Tests Matter11:07 Governance and Nightly Automation15:27 From Findings to Remediation18:07 Reports Studios Can Actually Use22:39 Building Custom Multi-Tenant Tests28:07 Security Intent as Regression Tests30:48 Catching Drift and Producing Audit Evidence41:39 CI/CD and AI for Security Admins
Podcast Apps
Entra.Chat - https://entra.chat
Apple Podcast - https://entra.chat/apple
YouTube - https://entra.chat/youtube
Spotify - https://entra.chat/spotify
Overcast - https://entra.chat/overcast
Pocketcast - https://entra.chat/pocketcast
Others - https://entra.chat/rss
Merill’s socials
YouTube - youtube.com/@merillx
LinkedIn - linkedin.com/in/merill
Twitter - twitter.com/merill
TikTok - tiktok.com/@merillf
Bluesky - bsky.app/profile/merill.net
Mastodon - infosec.exchange/@merill
Threads - threads.net/@merillf
GitHub - github.com/merill
Get full access to Entra.News - Your weekly dose of Microsoft Entra at entra.news/subscribe