I secure administrator access first, then email and endpoints. I roll controls out in a pilot and capture evidence; a higher Secure Score alone does not prove the tenant is safe.
Before I start
- A named tenant owner, administrative access, a pilot group, and an approved change window.
- A licence inventory: Conditional Access, endpoint management, and advanced email controls depend on entitlement.
- A list of legacy applications, mail senders, critical services, and recovery requirements.
Step by step
Record ownership and licensing
I fill the tenant baseline sheet with domain, owner, admin roles, licences, renewal contacts, and the ten most critical services. Use separate named admin accounts for administration and ordinary accounts for email.
Prepare emergency access
Create and protect at least two cloud-only emergency admin accounts following Microsoft’s current guidance. Use strong independent authentication, monitor every use, store recovery details securely, and test access. Excluding an account from a particular policy does not exempt it from platform-enforced MFA.
Choose the identity-control path
For a simple tenant without premium identity licensing, verify Security Defaults is enabled. With the required licences, design Conditional Access: protect admin sign-in, require MFA, block legacy authentication, and plan device requirements. I test policy scope before enforcement and do not disable the existing baseline before its replacement is ready.
Microsoft: Security Defaults · Microsoft: Conditional Access deployment
Test authentication as a user
I register strong authentication for pilot users, test ordinary sign-in, and check admin access from a second session. For Conditional Access, inspect report-only results and the What If tool before staged enforcement. Record exceptions with an owner and expiry.
Harden mail without breaking senders
In Defender, evaluate the Standard preset security policy for the intended audience and available licences. Inventory senders, publish a single valid SPF record, configure DKIM, and introduce DMARC monitoring before stronger enforcement once all legitimate senders are validated.
Microsoft: preset email security policies · Microsoft: email authentication
Enroll and protect pilot devices
I establish Intune ownership, update rings, encryption recovery-key access, endpoint protection, and compliance checks for a small group. Then I test the link between device compliance and access policy without blocking enrollment or recovery.
Set collaboration and offboarding rules
I define who may create teams, share externally, approve guests, and retain content. Test an offboarding case: disable sign-in, revoke sessions, transfer ownership, preserve required data, and remove licences at the right time.
Prove recovery and hand over
I record alert routing and backup/retention responsibilities, then restore a representative file using the intended recovery method. The final handover includes owners, exceptions, evidence links, a rollback path, and the next review date.
How I check the result
0 of 4 checks completed
Checklist progress stays in this browser. I use it to track checks, not to certify a deployment or compliance.
If something does not work
Users locked out
Use the tested emergency route and revert the specific recent policy; inspect sign-in logs before retrying.
Mail rejected after DMARC enforcement
Identify the failing legitimate sender and align SPF/DKIM before restoring enforcement.
Device remains noncompliant
Inspect the failed compliance setting and sync status rather than bypassing the entire access baseline.
My working templates
I assign ownership and record the evidence behind each baseline setting.
Download CSV ↓I compare an actual recovery with the recovery-time and recovery-point objectives.
Download CSV ↓Official sources I checked
I checked these sources on 13 October 2026. Product screens and legal requirements change; I verify the relevant source before a production rollout or legal decision.