Monitor Entra extensions as control plane events: every change is suspicious

The article argues that for Microsoft Entra extensions, every change should be treated as suspicious by default, not just needing review. It outlines three change surfaces—runtime, configuration, and permissions—that require forced diagnostics and alerts. The author recommends inverting the default posture from trust to suspicion, with alerts triggering immediate SOC investigation and rollback unless approved.