Table of Contents

1. 0) Pre‑reqs & Planning
2. 1) Create Tenant & Verify Domain
3. 2) Identity Foundations (Entra)
4. 3) Conditional Access — Secure Baseline
5. 4) Endpoint & Device Management (Intune)
6. 5) Threat Protection — Defender for Office 365
7. 6) Data Protection — Purview (Labels, DLP, Retention)
8. 7) Collaboration Controls — SharePoint/OneDrive/Teams
9. 8) Logging, Monitoring, and SIEM
10. 9) Admin Hardening & Operations
11. 10) Rollout & Testing Plan
12. 11) PowerShell Quick‑Starts
13. 12) Common Pitfalls
14. 13) Reusable Templates
15. 14) Ops Runbook
16. 15) Portal Shortcuts

0) Pre‑reqs & Planning

• Licensing:
  • Lean: Microsoft 365 Business Premium
  • Enterprise baseline: M365 E3 + Defender for Office 365 P2 + Intune
  • Advanced/XDR+Data: M365 E5
• Inputs: primary domain, registrar access, two break‑glass mailboxes, trusted IPs/regions, device platforms, retention/DLP requirements.

1) Create Tenant & Verify Domain

1. Sign up for Microsoft 365 (creates an Entra ID tenant).
2. Admin Center → Settings > Domains → Add domain → verify via TXT.
3. Complete MX/CNAME/Autodiscover as prompted.
4. Email auth trio:
   • SPF (root TXT): v=spf1 include:spf.protection.outlook.com -all
   • DKIM: Exchange Admin → Mail flow → DKIM → enable per domain
   • DMARC (TXT at _dmarc.domain): v=DMARC1; p=none; rua=mailto:dmarc@domain; adkim=s; aspf=s; pct=100 (tighten later)

2) Identity Foundations (Entra)

2.1 Break‑Glass Accounts

• Create two cloud‑only Global Admins (no MFA) with strong secrets and exclude from CA.
• Alert if these accounts sign in.

2.2 Least Privilege & PIM

• Use role‑based admin (Exchange/SharePoint/Intune Admin, etc.).
• (E5) Enable PIM for JIT elevation, approvals, and MFA on activation.

2.3 Prereqs & Auth Methods

• Disable Security Defaults if deploying custom CA.
• Add Named Locations (trusted IPs; optional geofencing).
• Enable Microsoft Authenticator, FIDO2/passkeys; define a Strong MFA authentication strength.

3) Conditional Access — Secure Baseline

Deploy in Report‑only mode, validate sign‑ins, then switch to On.

• Require MFA (All Users): exclude break‑glass/service accounts.
• Block Legacy Auth: block “Other clients” (POP/IMAP/SMTP basic).
• Protect Admins: require MFA + compliant device; add sign‑in risk ≥ Medium (E5).
• Require Compliant Device for M365 core apps (SharePoint/Exchange/Teams).
• Emergency Bypass policy for break‑glass accounts.

4) Endpoint & Device Management (Intune)

• Confirm MDM authority = Intune.
• Enrollment: Windows auto‑enroll; Apple Push cert for macOS/iOS; Android Enterprise.
• Compliance: BitLocker/FileVault, Secure Boot/TPM, passcode/biometric, minimum OS, Defender for Endpoint onboarding.
• Configuration: Windows Security Baselines; firewall; SmartScreen; ASR rules.
• MAM (BYOD): restrict copy/paste, block personal saves, require app PIN, selective wipe.

5) Threat Protection — Defender for Office 365

• Enable Preset security policies (Standard/Strict).
• Turn on Safe Links (time‑of‑click) and Safe Attachments (Dynamic Delivery).
• Tune anti‑spam and anti‑phishing; add VIP/user impersonation protection.
• Configure alert policies; route notifications to SecOps/Teams.

6) Data Protection — Purview

Sensitivity Labels

• Define taxonomy: Public / Internal / Confidential / Secret.
• Encrypt for higher tiers; set a default label; publish to groups.
• Enable mandatory labeling in Office apps.

Auto‑Labeling & DLP

• Auto‑label by sensitive info types (PCI, PII, healthcare, custom).
• DLP for Exchange/SharePoint/OneDrive/Teams: block or allow with justification; user tips; incident reports.

Retention

• Create retention policies per location; enable Litigation Hold when required.

7) Collaboration Controls — SharePoint/OneDrive/Teams

• External sharing: start with Existing guests only or New & existing guests per site.
• OneDrive default link type: Specific people.
• Apply CA “Require compliant device” for SPO/OD to block unmanaged downloads (or use session controls via Defender for Cloud Apps).

8) Logging, Monitoring, and SIEM

• Ensure Unified Audit is On (Audit Standard/Premium).
• Use Defender incidents and Advanced Hunting for investigations.
• Connect Entra/M365/Defender to Microsoft Sentinel; enable analytics rules (impossible travel, MFA fatigue, OAuth abuse).

9) Admin Hardening & Operations

• Use PIM for privileged roles; do monthly access reviews for guests/roles.
• Require compliant device for admins (PAW or CA).
• Grant least‑privilege Graph scopes to app registrations; store secrets in Key Vault.

10) Rollout & Testing Plan

1. Pilot: IT users → CA in report‑only → validate → turn on; Defender presets; labels/DLP in audit mode.
2. Wave 1: IT + power users → verify device compliance, mail flow, labeling prompts.
3. Wave 2: All staff → tighten DMARC (quarantine → reject) and DLP blocking.

Validation Checklist

• MFA prompts; legacy auth blocked in Sign‑in logs.
• Devices compliant; non‑compliant blocked.
• Safe Links rewriting; malicious attachments quarantined.
• Labels visible; DLP warns/blocks exfil.
• External sharing limited and audited.
• Audit flowing to Sentinel; test incidents fire.

11) PowerShell Quick‑Starts

# Graph
Install-Module Microsoft.Graph -Scope CurrentUser
Connect-MgGraph -Scopes "Directory.ReadWrite.All, Policy.Read.All, Policy.ReadWrite.ConditionalAccess, RoleManagement.ReadWrite.Directory"

# Exchange Online
Install-Module ExchangeOnlineManagement -Scope CurrentUser
Connect-ExchangeOnline

# Purview (Security & Compliance)
Install-Module ExchangeOnlineManagement
Connect-IPPSSession

# Examples
Get-MgIdentityConditionalAccessPolicy | Select-Object displayName,state
Set-Mailbox user@contoso.com -LitigationHoldEnabled $true
Start-DkimSigningConfig -Identity contoso.com

12) Common Pitfalls

• CA Lockout: Always exclude break‑glass until you validate.
• MFA fatigue: Use number matching / strong auth strengths.
• Unmanaged devices: Require compliant device or use session controls.
• Over‑sharing: Default to “Specific people” links; review guests quarterly.
• Excessive admin rights: PIM + recurring access reviews.

13) Reusable Templates

CA Baseline

• Require MFA (exclude break‑glass/service)
• Block legacy auth
• Require compliant device for admins
• Require compliant device for M365 core apps
• Emergency bypass for break‑glass

Intune Compliance (Windows)

• BitLocker required; TPM; Secure Boot; Defender AV on; OS ≥ Win10 22H2; Firewall on

DLP Starter

• Block outbound email with PCI/SSN (allow override with justification for managers)
• Block sharing items labeled Confidential to external

Purview Labels

• Public (no controls)
• Internal (watermark)
• Confidential (encrypt; org‑wide)
• Secret (encrypt; specific groups only)

14) Ops Runbook

• Daily: Review Defender incidents; quarantine releases.
• Weekly: Triage risky sign‑ins; device compliance drifts.
• Monthly: Access reviews (guests/roles); external sharing & DMARC reports.
• Quarterly: Test break‑glass; simulate phish; tabletop exercise.

15) Portal Shortcuts