The Technology Blueprint

Identity is the foundation of modern security. Before you secure anything else, you need to control who can access your systems and how. In a Zero Trust model, identity is the new perimeter - every access decision starts here.

Prerequisites

Before starting identity configuration, ensure you have:

1. Global Administrator access to your Microsoft 365 tenant
2. Access to your domain registrar's DNS management panel
3. A list of all users who need accounts
4. Organizational chart or department structure defined
5. Microsoft 365 Business Premium, E3, or E5 licenses purchased
6. A test user account that isn't your admin account

Step 1: Initial Tenant Configuration

Your Microsoft 365 tenant is the container for your entire cloud identity. Configure it correctly from day one.

1.1 Basic Tenant Setup:

1. Sign up for Microsoft 365 at admin.microsoft.com
2. Choose your tenant name carefully - this becomes yourorg.onmicrosoft.com and cannot be changed
3. Set your organization's physical address (required for licensing)
4. Configure tenant-level settings: timezone, language, release preferences
5. Enable targeted release for IT admins (get features early for testing)

1.2 Add Your Custom Domain:

1. Navigate to Settings → Domains → Add domain
2. Enter your domain (e.g., yourcompany.com)
3. Add the TXT record to your DNS: MS=ms12345678 (value provided)
4. Wait for DNS propagation (can take 15 minutes to 48 hours)
5. Verify the domain in Microsoft 365
6. Add MX, CNAME, and SPF records for email
7. Configure DKIM signing for email authentication
8. Add DMARC record for email security: v=DMARC1; p=quarantine; rua=mailto:dmarc@yourcompany.com

Critical: SPF, DKIM, and DMARC are essential for email deliverability and preventing spoofing. Skip these and your emails may go to spam - or attackers can send email pretending to be you.

1.3 DNS Records Required:

1. MX Record: yourcompany-com.mail.protection.outlook.com (Priority 0)
2. SPF (TXT): v=spf1 include:spf.protection.outlook.com -all
3. DKIM (CNAME): selector1._domainkey → selector1-yourcompany-com._domainkey.yourcompany.onmicrosoft.com
4. DKIM (CNAME): selector2._domainkey → selector2-yourcompany-com._domainkey.yourcompany.onmicrosoft.com
5. Autodiscover (CNAME): autodiscover → autodiscover.outlook.com
6. DMARC (TXT): _dmarc → v=DMARC1; p=quarantine; pct=100; rua=mailto:dmarc-reports@yourcompany.com

Estimated time: 2-4 hours + DNS propagation wait

Step 2: Entra ID Foundation Setup

Entra ID (formerly Azure Active Directory) is your cloud identity provider. Every user, app, and device ties back here.

2.1 Navigate to Entra Admin Center:

1. Go to entra.microsoft.com
2. Sign in with your Global Administrator account
3. Familiarize yourself with the navigation: Identity, Protection, Identity Governance

2.2 Configure Tenant Settings:

1. Identity → Overview → Properties
2. Set tenant name and technical contact
3. Configure privacy statement URL (required for compliance)
4. Enable LinkedIn account connections: OFF (security best practice)
5. Configure external collaboration settings (restrict by default)

2.3 Create Group Structure:

Groups control access to everything. Plan your structure before creating users.

1. Department Groups: HR, Finance, Operations, IT, etc.
2. Role Groups: Executives, Managers, Staff
3. Access Groups: App-Salesforce-Users, App-EHR-Users, etc.
4. License Groups: License-M365-E3, License-M365-E5
5. Security Groups: MFA-Excluded (emergency only), CA-Pilot-Users

Best Practice: Use dynamic groups where possible. They automatically add/remove users based on attributes like department or job title. This eliminates manual group management.

2.4 Configure User Settings:

1. Identity → Users → User settings
2. Users can register applications: No
3. Restrict non-admin users from creating tenants: Yes
4. Users can create security groups: No
5. Guest user access restrictions: Most restrictive
6. Administration center: Restrict access to Azure AD admin portal: Yes

Estimated time: 4-6 hours for complete setup

Step 3: Create Break-Glass Accounts

Before enforcing any security policies, create emergency access accounts. These save you when everything else fails.

3.1 Create Two Break-Glass Accounts:

1. Create BreakGlass1@yourcompany.onmicrosoft.com (use .onmicrosoft.com, not custom domain)
2. Create BreakGlass2@yourcompany.onmicrosoft.com
3. Assign Global Administrator role to both
4. Generate 128+ character random passwords for each
5. Do NOT enable MFA on these accounts (they're your backup when MFA fails)
6. Store credentials in a physical safe and/or secure offline location
7. Split the password: half with CEO, half with IT director (for accountability)

3.2 Configure Monitoring for Break-Glass:

1. Create an alert rule in Entra ID for any sign-in to these accounts
2. Go to Protection → Identity Protection → Alerts
3. Configure email and SMS notifications to multiple admins
4. Any use of these accounts should trigger immediate investigation
5. Test the accounts quarterly (document the test)

Critical: Never use break-glass accounts for daily work. They exist only for emergencies. If you see a sign-in you didn't authorize, assume compromise and rotate credentials immediately.

Estimated time: 1-2 hours

Step 4: Configure Password Policies

Modern password guidance has changed. Length matters more than complexity. Ban common passwords.

4.1 Password Policy Settings:

1. Go to Protection → Authentication methods → Password protection
2. Enable custom banned password list
3. Add company-specific terms: company name, product names, local sports teams
4. Enable password protection for Windows Server AD (if hybrid)
5. Set mode to Enforced (not Audit)

4.2 Recommended Password Requirements:

1. Minimum length: 14 characters (12 absolute minimum)
2. Complexity: Not required if length is 14+ (NIST guidance)
3. Expiration: Do not expire passwords (NIST guidance) - rely on MFA instead
4. History: Remember 24 previous passwords
5. Lockout: 10 failed attempts, 30-minute lockout

Why No Password Expiration?

NIST SP 800-63B recommends against periodic password changes. Users create predictable patterns (Password1!, Password2!, Password3!). With MFA enforced, password theft alone doesn't grant access. Focus on length and banning common passwords instead.

4.3 Self-Service Password Reset (SSPR):

1. Go to Protection → Password reset
2. Enable SSPR for All users (not Selected)
3. Require 2 authentication methods for reset
4. Methods: Mobile app notification, Mobile app code, Email, Mobile phone
5. Disable: Office phone, Security questions (too easily guessed)
6. Require users to re-confirm authentication info every 180 days
7. Enable writeback if hybrid (syncs reset passwords to on-prem AD)

Estimated time: 2-3 hours

Step 5: Enforce Multi-Factor Authentication (MFA)

MFA is non-negotiable. It blocks 99.9% of account compromise attacks. Every user, every time.

5.1 Configure Authentication Methods:

1. Go to Protection → Authentication methods → Policies
2. Enable Microsoft Authenticator for All users
3. Configure: Push notifications, Passwordless, Number matching (all enabled)
4. Enable FIDO2 Security Keys for admins (hardware keys like YubiKey)
5. Enable Temporary Access Pass for onboarding new users
6. Enable SMS as backup only (it's vulnerable to SIM swapping)
7. Disable Voice call (easily intercepted)
8. Disable Email OTP for primary use (use for guests only)

Security Note: SMS-based MFA is better than no MFA, but it's vulnerable to SIM swapping attacks. Use app-based authentication (Microsoft Authenticator) as the primary method. For privileged accounts, require hardware security keys (FIDO2).

5.2 Enable Number Matching and Additional Context:

1. Go to Authentication methods → Microsoft Authenticator
2. Enable number matching: Enabled for all users
3. Show application name: Enabled
4. Show geographic location: Enabled

Number matching prevents MFA fatigue attacks where attackers spam push notifications hoping users approve one by accident.

5.3 Plan Your MFA Rollout:

1. Week 1: IT team and early adopters register for MFA
2. Week 2: Announce to all users, provide documentation
3. Week 3: Mandatory registration deadline - enable registration campaign
4. Week 4: Enforce MFA via Conditional Access (report-only first)
5. Week 5: Switch Conditional Access to Enabled
6. Provide helpdesk support during rollout for locked-out users

5.4 Troubleshooting Common MFA Issues:

1. "I don't get push notifications" - Check phone has internet, app is updated, notifications enabled
2. "My code doesn't work" - Phone time must be accurate (enable automatic time)
3. "I got a new phone" - Use Temporary Access Pass or backup methods to re-register
4. "I'm traveling and can't use my phone" - Provide backup codes before travel
5. "The app keeps asking me to sign in" - May need to remove and re-add account

Estimated time: 4-8 hours for configuration + 2-4 weeks for full rollout

Step 6: Configure Conditional Access Policies

Conditional Access is the policy engine for Zero Trust. Every access request is evaluated against your policies.

6.1 Understand Policy Structure:

Every Conditional Access policy has three parts:

1. Assignments (WHO): Which users/groups does this apply to?
2. Conditions (WHEN): Under what circumstances? (device, location, risk, app)
3. Access Controls (WHAT): Grant access, block, or require additional verification

6.2 Essential Policies (Minimum Required):

1. CA001: Require MFA for All UsersUsers: All users (exclude break-glass accounts)
2. Cloud apps: All cloud apps
3. Grant: Require MFA
4. CA002: Block Legacy AuthenticationUsers: All users
5. Cloud apps: All cloud apps
6. Conditions: Client apps → Legacy authentication clients
7. Grant: Block access
8. CA003: Require MFA for AdminsUsers: Directory roles (all admin roles)
9. Cloud apps: All cloud apps
10. Grant: Require MFA + Require phishing-resistant MFA (if E5)
11. CA004: Block High-Risk Sign-insUsers: All users
12. Cloud apps: All cloud apps
13. Conditions: Sign-in risk → High
14. Grant: Block access
15. CA005: Require Password Change for High-Risk UsersUsers: All users
16. Cloud apps: All cloud apps
17. Conditions: User risk → High
18. Grant: Require password change + Require MFA

6.3 Advanced Policies (Recommended):

1. CA006: Require Compliant Device for Desktop AppsUsers: All users
2. Cloud apps: Office 365
3. Conditions: Device platforms → Windows, macOS
4. Grant: Require device to be marked as compliant
5. CA007: Require Approved App for MobileUsers: All users
6. Cloud apps: Office 365
7. Conditions: Device platforms → iOS, Android
8. Grant: Require approved client app OR Require app protection policy
9. CA008: Block Access from Untrusted LocationsUsers: All users (exclude travelers if needed)
10. Cloud apps: All cloud apps
11. Conditions: Locations → Exclude trusted (US, known offices)
12. Grant: Block access
13. CA009: Session Timeout for Sensitive AppsUsers: All users
14. Cloud apps: Sensitive apps (finance, HR systems)
15. Session: Sign-in frequency → 4 hours
16. Session: Persistent browser session → Never persistent
17. CA010: Require Terms of UseUsers: All users
18. Cloud apps: All cloud apps
19. Grant: Require Terms of Use acceptance
20. Re-accept: Every 365 days

Critical: Always start policies in Report-only mode. Run for 1-2 weeks and review the "What If" tool and sign-in logs before switching to Enabled. A misconfigured policy can lock out your entire organization.

6.4 Named Locations Configuration:

1. Go to Protection → Conditional Access → Named locations
2. Create "Trusted Office Locations" with your office IP ranges
3. Create "Blocked Countries" for high-risk regions you don't do business with
4. Mark your trusted locations as "Mark as trusted location"
5. Use these in Conditional Access policies for location-based controls

Estimated time: 12-24 hours to design, configure, test, and deploy all policies

Step 7: Configure Single Sign-On (SSO)

Connect all your applications to Entra ID. One identity, one login, centralized control.

7.1 Application Inventory:

1. List every application your organization uses
2. Categorize: SaaS apps, on-premises apps, custom apps
3. Identify authentication method each app supports: SAML, OIDC, password-based
4. Prioritize by user count and sensitivity

7.2 Add Gallery Applications:

1. Go to Identity → Applications → Enterprise applications
2. Click New application → Browse Azure AD Gallery
3. Search for your app (Salesforce, Zoom, Slack, etc.)
4. Click the app → Create
5. Configure SSO: Single sign-on → SAML
6. Download Federation Metadata XML or copy URLs
7. Configure the app vendor side with Entra ID details
8. Test SSO with a pilot user before rolling out

7.3 Configure SCIM Provisioning:

SCIM automatically creates, updates, and disables user accounts in connected apps.

1. In the Enterprise app, go to Provisioning
2. Set Provisioning Mode to Automatic
3. Enter the app's SCIM endpoint URL and authentication token
4. Configure attribute mappings (which Entra ID fields map to app fields)
5. Set provisioning scope (all users, or assigned users only)
6. Start provisioning and monitor the provisioning logs

Why SCIM Matters

Without SCIM, when an employee leaves, you must manually disable their account in every application. With SCIM, disable in Entra ID → automatically disabled everywhere. This is critical for security and compliance.

7.4 Common SSO Applications to Configure:

1. Productivity: Zoom, Slack, Asana, Monday.com, Notion
2. Finance: QuickBooks Online, Expensify, Bill.com
3. HR: BambooHR, Gusto, ADP, Workday
4. Healthcare: SimplePractice, TherapyNotes, Dentrix (if cloud)
5. CRM: Salesforce, HubSpot, Zoho
6. IT: GitHub, Jira, Confluence, AWS, Azure
7. Security: LastPass, 1Password, KnowBe4

Estimated time: 2-6 hours per application depending on complexity

Step 8: Guest Access and External Collaboration

Control how external users access your environment. Too loose = security risk. Too tight = business friction.

8.1 Configure External Collaboration Settings:

1. Go to Identity → External Identities → External collaboration settings
2. Guest user access: Limited access (can't enumerate users/groups)
3. Guest invite restrictions: Only admins and users in guest inviter role
4. Enable guest self-service sign-up: No
5. Collaboration restrictions: Allow invitations only to specified domains
6. Add trusted partner domains to the allow list

8.2 Guest Access Reviews:

1. Go to Identity Governance → Access reviews
2. Create a review for all guests in the tenant
3. Reviewers: Group owners or specific managers
4. Frequency: Quarterly
5. Auto-apply results: Remove access if not approved
6. Require justification for continued access

Estimated time: 2-4 hours

Step 9: Identity Monitoring and Alerting

You can't protect what you can't see. Configure comprehensive monitoring for identity events.

9.1 Configure Sign-in Log Retention:

1. Default retention is 30 days - not enough for compliance
2. Configure Log Analytics workspace integration (requires Azure subscription)
3. Stream logs to long-term storage (90 days minimum, 1 year recommended)
4. Set up automated exports if using third-party SIEM

9.2 Critical Alerts to Configure:

1. Any sign-in to break-glass accounts
2. Global Administrator role assigned
3. New Conditional Access policy created or modified
4. High-risk user detected
5. Bulk user creation or deletion
6. Consent granted to high-privilege applications
7. Sign-ins from impossible travel locations
8. Multiple failed sign-in attempts (brute force)

9.3 Review These Reports Weekly:

1. Risky sign-ins report
2. Risky users report
3. Sign-in logs filtered by failures
4. Audit logs for admin activities
5. Conditional Access insights and reporting

Estimated time: 4-8 hours for initial setup + ongoing weekly reviews

Identity Checklist

1. Tenant configured with custom domain
2. SPF, DKIM, and DMARC records configured
3. Break-glass accounts created and documented
4. Password policies configured (14+ characters, banned list)
5. Self-service password reset enabled
6. MFA enforced for all users via Conditional Access
7. Number matching enabled in Authenticator
8. All essential Conditional Access policies deployed
9. Legacy authentication blocked
10. High-risk sign-ins blocked automatically
11. SSO configured for all major applications
12. SCIM provisioning enabled where supported
13. Guest access restricted and reviewed quarterly
14. Sign-in logs retained for 1+ year
15. Critical alerts configured and tested

Defense in depth. Multiple security layers working together to detect and stop threats across endpoints, email, identity, and cloud. In Zero Trust, we assume breach and design controls to detect, contain, and remediate threats at every layer.

Prerequisites

Before configuring your security stack, ensure you have:

1. Microsoft 365 Business Premium, E3, or E5 licenses (E5 for full Defender suite)
2. Intune device enrollment completed (for endpoint onboarding)
3. Global Administrator or Security Administrator role
4. Test devices enrolled and compliant
5. Understanding of your organization's risk tolerance
6. Incident response contact list (who gets alerts)
7. Baseline understanding of normal network/user behavior

Step 1: Deploy Microsoft Defender for Endpoint

Defender for Endpoint is enterprise-grade EDR (Endpoint Detection and Response). It goes far beyond traditional antivirus - it detects behavioral anomalies, provides threat intelligence, and can automatically remediate attacks.

1.1 Initial Configuration:

1. Navigate to security.microsoft.com
2. Go to Settings → Endpoints → Onboarding
3. Configure tenant settings:Data retention: 180 days (maximum for investigation history)
4. Preview features: Enable (for IT pilot group only initially)
5. Geographic location: Select your primary region
6. Advanced features to enable:Automated investigation: On
7. Auto-resolve remediated alerts: On
8. Allow or block file: On
9. Custom network indicators: On
10. Tamper protection: On (prevents disabling Defender)
11. Show user details: On
12. Skype for Business integration: On
13. Microsoft Defender for Cloud Apps: On
14. Web content filtering: On
15. Device discovery: On

1.2 Onboard Devices via Intune:

1. In Microsoft Defender portal, go to Settings → Endpoints → Onboarding
2. Select deployment method: Microsoft Intune
3. Download the onboarding package (configuration file)
4. In Intune, go to Endpoint security → Endpoint detection and response
5. Create profile → Windows 10 and later → Endpoint detection and response
6. Settings:Microsoft Defender for Endpoint client configuration package type: Auto from connector
7. Sample sharing: All (or None if privacy concerns)
8. Telemetry Reporting Frequency: Expedited
9. Assign to All Devices group
10. Verify devices appear in Defender portal within 24 hours

Licensing Note: Defender for Endpoint P1 is included with M365 Business Premium. P2 (full EDR with automated investigation) requires M365 E5 or E5 Security add-on. Know which license you have before expecting features.

1.3 Configure Attack Surface Reduction (ASR) Rules:

ASR rules block common attack techniques before they execute.

1. In Intune, go to Endpoint security → Attack surface reduction
2. Create policy → Windows 10 and later → Attack surface reduction rules
3. Essential ASR rules to enable (Block mode):Block executable content from email and webmail
4. Block all Office applications from creating child processes
5. Block Office applications from creating executable content
6. Block Office applications from injecting code
7. Block JavaScript or VBScript from launching downloaded content
8. Block execution of potentially obfuscated scripts
9. Block Win32 API calls from Office macros
10. Block credential stealing from Windows LSASS
11. Block process creations from PsExec and WMI commands
12. Block untrusted and unsigned processes from USB
13. Use advanced protection against ransomware
14. Block Adobe Reader from creating child processes
15. Start in Audit mode for 2 weeks, then switch to Block
16. Add exclusions for legitimate business applications that trigger false positives

ASR Testing Process

1. Deploy rules in Audit mode to pilot group. 2. Monitor attack surface reduction events in Defender portal for 2 weeks. 3. Review false positives and add exclusions. 4. Switch to Block mode for pilot. 5. Monitor for 1 week. 6. Deploy to all users.

1.4 Configure Automated Investigation and Remediation:

1. Go to Settings → Endpoints → Advanced features
2. Ensure Automated investigation is enabled
3. Go to Settings → Endpoints → Device groups
4. For each device group, set automation level:
5. Automation levels:Full - remediate threats automatically: Recommended for most environments
6. Semi - require approval for core folders: For sensitive servers
7. Semi - require approval for any: High-oversight environments
8. No automated response: Only for testing, not recommended

1.5 Configure Web Content Filtering:

1. Go to Settings → Endpoints → Web content filtering
2. Create policy for your organization
3. Categories to block (minimum):Adult content
4. High bandwidth (streaming sites - optional)
5. Legal liability (torrents, hacking sites)
6. Gambling
7. Malware
8. Phishing
9. Newly registered domains (high risk)
10. Parked domains
11. Add exceptions for legitimate business sites if needed
12. Assign to device groups

1.6 Configure Alert Notifications:

1. Go to Settings → Endpoints → Email notifications
2. Create notification rule:
3. Name: Security Team Alerts
4. Include organization name: Yes
5. Include device information: Yes
6. Alert severity: High and Medium (Critical goes to all)
7. Recipients: security team distribution list
8. Create separate rule for Critical only → goes to IT leadership
9. Test by generating a test alert (EICAR test file)

1.7 Onboard macOS Devices:

1. In Defender portal, go to Settings → Endpoints → Onboarding
2. Select macOS and download onboarding package
3. For Jamf-managed Macs:Create configuration profiles for system extensions, network filter, full disk access
4. Deploy Microsoft Defender app via Jamf Self Service or policy
5. Deploy the onboarding package via script policy
6. Required macOS permissions (deploy via MDM):Full Disk Access for Microsoft Defender
7. System Extension approval
8. Network Filter (Content Filter) approval
9. Notifications
10. Background Services
11. Verify Macs appear in Defender portal device inventory

Estimated time: 12-20 hours for full endpoint deployment across platforms

Step 2: Configure Defender for Office 365 (Email Security)

Email is the #1 attack vector. Defender for Office 365 provides multi-layered protection against phishing, malware, business email compromise, and other email-borne threats.

2.1 Configure Safe Attachments:

1. Go to security.microsoft.com → Email & collaboration → Policies → Safe Attachments
2. Edit the default policy or create custom policy:
3. Settings:Safe Attachments unknown malware response: Dynamic Delivery (recommended) or Block
4. Redirect attachment on detection: Enable, send to security mailbox
5. Apply Safe Attachments detection response if scanning can't complete: On
6. Apply to all users

Dynamic Delivery vs. Block

Dynamic Delivery: Delivers email immediately, replaces attachment with placeholder while scanning. User can read email while waiting. Best for productivity.

Block: Holds entire email until scan completes. More secure but delays delivery.

2.2 Configure Safe Links:

1. Go to Policies → Safe Links
2. Edit default policy or create custom:
3. Settings:On: Safe Links checks a list of known malicious links when users click links in email
4. Apply Safe Links to email messages sent within the organization: On
5. Apply real-time URL scanning for suspicious links: On
6. Wait for URL scanning to complete before delivering: On
7. Do not rewrite URLs, do checks via Safe Links API only: Off (keep URL rewriting on)
8. Do not rewrite the following URLs: Add trusted internal URLs if needed
9. Apply to: Teams, Office 365 apps
10. Track user clicks: On (for reporting)
11. Let users click through to original URL: Off (block malicious, no override)
12. Display organization branding on warning pages: On

2.3 Configure Anti-Phishing Policies:

1. Go to Policies → Anti-phishing
2. Edit default policy or create custom:
3. Impersonation protection (critical):Enable users to protect: Add executives, finance team, HR (up to 350 users)
4. Enable domains to protect: Your domain + key partner domains
5. Add trusted senders and domains: Legitimate partners that might trigger false positives
6. Enable mailbox intelligence: On
7. Enable intelligence for impersonation protection: On
8. Actions for impersonation:If email impersonates protected user: Quarantine the message
9. If email impersonates protected domain: Quarantine the message
10. If mailbox intelligence detects impersonated user: Move to Junk folder or Quarantine
11. Spoof protection:Enable spoof intelligence: On
12. If email is from spoofed sender: Quarantine
13. Show first contact safety tip: On
14. Show user impersonation safety tip: On
15. Show domain impersonation safety tip: On
16. Show unusual characters safety tip: On

Critical: Add your CEO, CFO, and anyone who can authorize payments or sensitive data to the protected users list. These are prime targets for BEC (Business Email Compromise).

2.4 Configure Anti-Spam Policies:

1. Go to Policies → Anti-spam
2. Edit inbound policy:
3. Bulk email threshold:Set to 5 or 6 (lower = more aggressive, higher = more permissive)
4. Most organizations work well at 6
5. Spam action:High confidence spam: Quarantine message
6. Spam: Move to Junk folder
7. Bulk: Move to Junk folder
8. Phishing: Quarantine message
9. High confidence phishing: Quarantine message
10. Retain spam in quarantine: 30 days
11. Enable safety tips: All on
12. Enable zero-hour auto purge (ZAP): On for spam, phishing, and malware

2.5 Configure Quarantine Policies:

1. Go to Email & collaboration → Review → Quarantine
2. Configure quarantine policies:
3. Default settings:Spam: Users can release + request release
4. Phishing: Admin release only
5. Malware: Admin release only
6. High confidence phishing: Admin release only
7. Configure quarantine notifications: Daily digest to users
8. Set up quarantine admin review process

2.6 Configure User Reporting:

1. Go to Settings → Email & collaboration → User reported settings
2. Enable Microsoft reporting experience
3. Configure:Monitor reported messages in Outlook: On
4. Send reported messages to: Microsoft and your security mailbox
5. Custom mailbox: security-phish@yourcompany.com
6. Customize before/after reporting messages
7. Deploy Report Message add-in to all users via Intune or centralized deployment
8. Train users on how and when to report suspicious emails

Why User Reporting Matters

Users are your first line of defense. When they report phishing, Microsoft uses that data to improve filters for everyone. You also get visibility into what's getting through your filters and can investigate potential compromises faster.

2.7 Configure Attack Simulation Training:

1. Go to Email & collaboration → Attack simulation training
2. Enable the service
3. Create simulation:
4. Select technique: Credential Harvest, Link in Attachment, etc.
5. Select payload (or create custom matching your brand)
6. Target all users or specific departments
7. Schedule: Monthly recommended
8. Configure landing page for users who click
9. Assign training for users who fail
10. Set up recurring simulations with varied techniques
11. Review reports and track improvement over time

Estimated time: 8-12 hours for complete email security configuration

Step 3: Apply CIS Level 1 Security Baseline

The Center for Internet Security (CIS) publishes industry-standard security benchmarks. Level 1 is the baseline that every organization should meet - it's designed to be practical without breaking functionality.

3.1 Understand CIS Levels:

1. Level 1: Basic security configurations that should be implemented everywhere. Minimal impact on functionality.
2. Level 2: Enhanced security for high-security environments. May impact usability or require additional configuration.

We implement Level 1 as the non-negotiable baseline for all organizations.

3.2 Windows 11 CIS Baseline via Intune:

1. In Intune, go to Endpoint security → Security baselines
2. Select "Security Baseline for Windows 10 and later" (also applies to 11)
3. Create profile
4. Key settings to verify are enabled:BitLocker: Require encryption, TPM required, save to Entra ID
5. Firewall: Enable for all profiles (Domain, Private, Public)
6. Windows Hello: Configure or disable based on your MFA strategy
7. Screen lock: Maximum inactivity 15 minutes, require password
8. Password: Minimum length 14, no expiration (with MFA)
9. Local admin: Rename built-in admin account, disable guest
10. UAC: Always prompt, secure desktop
11. SMB signing: Required for servers, enabled for clients
12. Audit policy: Enable success and failure for key events
13. Deploy to pilot group first
14. Monitor for conflicts with other profiles
15. Deploy to all Windows devices after pilot

Important: Security baselines can conflict with other Intune configuration profiles. Use Intune's conflict resolution tools to identify and resolve overlapping settings. The baseline should generally win for security settings.

3.3 Microsoft 365 CIS Baseline:

1. Go to security.microsoft.com → Secure Score
2. Review recommended actions - many align with CIS benchmarks
3. Key M365 security settings:Block legacy authentication (Conditional Access)
4. Require MFA for all users (Conditional Access)
5. Enable audit logging (Purview)
6. Disable anonymous calendar sharing
7. Block external forwarding (mail flow rules)
8. Enable mailbox auditing (on by default since 2019)
9. Configure data loss prevention policies
10. Restrict who can create groups and Teams
11. Disable OneDrive/SharePoint sharing with "Anyone"
12. Require managed devices for desktop apps
13. Document which Secure Score recommendations you've implemented and why not for others

3.4 macOS CIS Baseline:

1. In Jamf Pro, create or import CIS benchmark profiles
2. Key macOS CIS settings:FileVault: Require encryption
3. Firewall: Enable, enable stealth mode
4. Gatekeeper: App Store and identified developers only
5. SIP: Ensure System Integrity Protection is enabled
6. Automatic updates: Enable for macOS and apps
7. Screen lock: Require after 5 minutes of inactivity
8. Password: Require alphanumeric, 14+ characters
9. Remote access: Disable SSH, Screen Sharing unless needed
10. Bluetooth: Disable discoverability
11. AirDrop: Disable or contacts only
12. Guest account: Disable
13. Deploy to test group, verify no functionality issues
14. Deploy to all Macs

3.5 Browser Security (Edge/Chrome):

1. Create Intune configuration profile for Microsoft Edge
2. Key browser settings:Block password manager (use enterprise password manager)
3. SmartScreen: Enabled
4. Safe Browsing: Enhanced protection
5. Block dangerous downloads
6. Block malicious sites
7. Disable developer tools (optional, may break web apps)
8. Sync disabled for enterprise
9. Block third-party cookies (may break some sites)
10. Block pop-ups except for trusted sites
11. Extension allow/block list
12. For Chrome, use ADMX templates or Chrome Browser Cloud Management

3.6 Ongoing Compliance Monitoring:

1. Use Secure Score as ongoing benchmark (target: 80%+)
2. Run CIS-CAT assessments quarterly (if you have the tool)
3. Review Intune compliance reports weekly
4. Address non-compliant devices immediately
5. Document exceptions with business justification

Estimated time: 16-24 hours for baseline implementation across platforms

Step 4: Configure Defender for Identity and Cloud Apps

Defender for Identity detects identity-based attacks (credential theft, lateral movement). Defender for Cloud Apps provides visibility and control over SaaS applications.

4.1 Configure Defender for Identity:

1. Go to security.microsoft.com → Settings → Identities
2. For hybrid environments (on-prem AD):Download and install sensors on all domain controllers
3. Configure Directory Services account (read access to AD)
4. Configure VPN integration if using Always On VPN
5. Configure SIEM notifications if applicable
6. For cloud-only environments:Defender for Identity integrates automatically with Entra ID
7. Ensure Entra ID P2 is licensed for full Identity Protection
8. Configure entity tags:Mark sensitive accounts (executives, IT admins, service accounts)
9. Create honeytoken accounts (fake accounts to detect reconnaissance)
10. Tag sensitive groups (Domain Admins, Enterprise Admins)

4.2 Configure Identity Threat Detections:

1. Go to Settings → Identities → Detections
2. Review and tune these detections:Reconnaissance: LDAP reconnaissance, Account enumeration, Network mapping
3. Compromised credentials: Brute force, Password spray, Kerberoasting
4. Lateral movement: Pass-the-hash, Pass-the-ticket, Remote code execution
5. Domain dominance: DCSync, DCShadow, Golden ticket, Skeleton key
6. Exfiltration: Suspicious data collection, DNS tunneling
7. Configure exclusions for known legitimate activities (e.g., vulnerability scanners)
8. Set up alert notifications to security team

4.3 Configure Defender for Cloud Apps:

1. Go to security.microsoft.com → Cloud apps
2. Connect apps for visibility:Microsoft 365 (automatic)
3. Salesforce, Box, Dropbox, Google Workspace (if used)
4. AWS, Azure, GCP (for cloud posture)
5. Any SaaS apps with API connectors available
6. Configure discovery:Enable Cloud Discovery to find shadow IT
7. Upload firewall/proxy logs or use Defender for Endpoint integration
8. Review discovered apps weekly
9. Sanction approved apps, unsanction risky ones

4.4 Create Cloud App Security Policies:

1. Go to Cloud apps → Policies → Policy management
2. Create these essential policies:Mass download alert: Alert when user downloads excessive files
3. Risky sign-in: Alert on sign-ins from new locations or devices
4. Activity from infrequent country: Detect compromised accounts
5. Ransomware activity: Detect rapid file changes (encryption)
6. External sharing: Alert when sensitive files shared externally
7. Malware detection: Block or quarantine malicious files
8. Stale external sharing: Review old external shares

4.5 Configure Session Controls:

1. For high-risk scenarios, use Conditional Access App Control:In Conditional Access, select "Use Conditional Access App Control"
2. Session policy: Monitor, Block downloads, or Block cut/copy/paste
3. Example: Allow access from unmanaged device, but block file downloads
4. Example: Monitor all activity from high-risk sign-ins
5. Deploy for sensitive applications first (financial systems, HR systems)

Session Control Use Cases

Scenario 1: User signs in from personal device. Allow access to read email, but block downloading attachments.

Scenario 2: High-risk sign-in detected. Allow access but monitor all actions and alert on sensitive operations.

Scenario 3: Contractor accessing HR system. Block copy/paste to prevent data exfiltration.

4.6 Review and Respond to Alerts:

1. Establish alert review process (daily for high severity, weekly for medium)
2. Configure alert notification rules to on-call security
3. Create investigation playbooks for common alerts
4. For each alert, document:Was it a true positive or false positive?
5. What investigation steps were taken?
6. What remediation was performed?
7. Should detection tuning be adjusted?
8. Review Microsoft Secure Score weekly and address new recommendations

Estimated time: 8-16 hours for identity and cloud app security configuration

Security Stack Checklist

1. Defender for Endpoint deployed to all Windows devices
2. Defender for Endpoint deployed to all Macs
3. Attack Surface Reduction rules enabled (Block mode)
4. Automated investigation and remediation enabled
5. Web content filtering configured
6. Security alert notifications configured
7. Safe Attachments policy configured
8. Safe Links policy configured
9. Anti-phishing policy with impersonation protection
10. Anti-spam policies tuned
11. User reporting enabled and add-in deployed
12. Attack simulation training scheduled monthly
13. CIS Level 1 baseline applied to Windows
14. CIS baseline applied to macOS
15. Microsoft 365 Secure Score reviewed and optimized
16. Browser security policies deployed
17. Defender for Identity configured (sensors deployed if hybrid)
18. Defender for Cloud Apps connected to key SaaS apps
19. Cloud discovery enabled for shadow IT
20. Cloud app security policies created
21. Alert review process established
22. Weekly security review scheduled

For larger organizations or those with elevated risk requirements. Advanced controls for deeper visibility and tighter security. These features require Microsoft 365 E5 or equivalent add-on licenses.

Prerequisites

Before implementing enterprise controls, ensure you have:

1. Microsoft 365 E5 or E5 Security/Compliance add-ons
2. Entra ID P2 (required for PIM)
3. Base security controls already in place (Sections 1-4)
4. HR and Legal approval for monitoring features
5. Designated security/compliance team members
6. Executive sponsorship for governance initiatives

Step 1: Privileged Identity Management (PIM)

PIM provides just-in-time, just-enough access for administrative roles. Instead of permanent admin access, users request temporary elevation when they need it. This dramatically reduces the attack surface for privileged accounts.

1.1 Understand PIM Concepts:

1. Eligible assignment: User can activate the role when needed (requires action)
2. Active assignment: User has the role permanently (always on)
3. Activation: Process of temporarily enabling an eligible role
4. Just-in-time (JIT): Access granted only when needed, for limited time
5. Just-enough-access (JEA): Minimum permissions required for the task

1.2 Inventory Current Privileged Access:

1. Go to entra.microsoft.com → Identity governance → Privileged Identity Management
2. Click on Entra ID roles → Roles
3. Review each privileged role and its current assignments
4. High-priority roles to address first:Global Administrator
5. Privileged Role Administrator
6. Security Administrator
7. Exchange Administrator
8. SharePoint Administrator
9. User Administrator
10. Billing Administrator
11. Document current permanent assignments and who uses them

1.3 Configure Role Settings:

1. For each role, click Settings
2. Activation settings:Maximum activation duration: 8 hours (or less for highly sensitive roles)
3. Require MFA on activation: Yes (always)
4. Require justification: Yes
5. Require ticket information: Optional (for change management tracking)
6. Require approval: Yes for Global Admin, optional for others
7. Assignment settings:Allow permanent eligible assignment: Yes (for designated admins)
8. Allow permanent active assignment: No (except break-glass accounts)
9. Expire eligible assignment after: 1 year (forces annual review)
10. Expire active assignment after: 8 hours
11. Notification settings:Send notifications when eligible member activates: Yes
12. Notify all Privileged Role Administrators
13. Add security team to notifications

1.4 Convert Permanent Admins to Eligible:

1. Go to Entra ID roles → Select role (e.g., Global Administrator)
2. View current active (permanent) assignments
3. For each user:
4. Click on the assignment → Edit
5. Change from Active to Eligible
6. Set end date (1 year recommended)
7. Save changes
8. Notify affected admins before making changes
9. Provide documentation on how to activate roles

Critical: Keep at least 2 break-glass accounts with permanent Global Admin access (excluded from PIM). These are emergency-only accounts with complex passwords stored securely. Monitor all sign-ins to these accounts.

1.5 Configure Approval Workflows:

1. For highly sensitive roles, require approval before activation
2. Go to Role settings → Require approval
3. Select approvers:Primary: IT Security Manager or Director
4. Fallback: IT Director or CIO
5. Never have single approver (vacation, unavailability)
6. Configure notification to approvers
7. Set approval timeout (4 hours recommended)

When to Require Approval

Always require: Global Administrator, Privileged Role Administrator

Consider requiring: Exchange Admin, Security Admin, Billing Admin

Usually don't require: Helpdesk Admin, User Admin (for daily operations)

1.6 Set Up Access Reviews:

1. Go to Identity governance → Access reviews → New access review
2. Configure review:Review name: "Quarterly Admin Role Review"
3. Review scope: Directory roles (select privileged roles)
4. Reviewers: Manager, self-review, or specific reviewers
5. Recurrence: Quarterly
6. Duration: 14 days
7. Auto-apply results: Yes (remove access if not approved)
8. If reviewer doesn't respond: Remove access
9. Enable for all privileged roles
10. Send reminders to reviewers

1.7 Configure PIM Alerts:

1. Go to PIM → Entra ID roles → Alerts
2. Enable and configure these alerts:Roles don't require MFA: Should trigger (misconfiguration)
3. Roles are being activated too frequently: Review threshold
4. Potential stale accounts: Haven't activated in 90+ days
5. Roles assigned outside of PIM: Detect shadow assignments
6. Too many Global Administrators: Limit to 2-4
7. Roles being assigned without MFA: Critical alert
8. Configure alert recipients (security team)
9. Review alerts weekly

1.8 Train Administrators on PIM:

1. Activation process:Go to Privileged Identity Management → My roles
2. Find the role you need → Activate
3. Provide justification (required)
4. Complete MFA (required)
5. Wait for approval (if required)
6. Role is active for configured duration
7. Role automatically deactivates when time expires
8. Document common scenarios and which roles to activate
9. Provide emergency escalation process

Estimated time: 12-20 hours for full PIM implementation

Step 2: Insider Risk Management

Insider Risk Management detects potentially risky user behavior - data theft, security violations, or policy breaches - before they become incidents. It correlates signals across Microsoft 365 to identify concerning patterns.

2.1 Prerequisites and Privacy Considerations:

1. Required licenses:Microsoft 365 E5
2. Or M365 E3 + E5 Insider Risk Management add-on
3. Or M365 E3 + E5 Compliance add-on
4. Before implementation, involve:Legal: Review privacy laws, employee monitoring regulations
5. HR: Align with employee policies, union considerations
6. Works council: If applicable in your jurisdiction
7. Privacy officer: Data protection impact assessment
8. Document business justification for monitoring
9. Update employee handbook/policies to disclose monitoring

Privacy Alert: Insider Risk Management monitors user behavior. Many jurisdictions require employee notification and consent. Some prohibit certain types of monitoring entirely. Always get legal approval first.

2.2 Configure Prerequisites:

1. Go to compliance.microsoft.com → Insider risk management
2. Enable audit logging:Required for activity correlation
3. Should already be enabled from Section 4
4. Configure HR connector (optional but powerful):Go to Settings → Data connectors → HR
5. Connect to your HR system (Workday, SAP, custom CSV)
6. Import: Resignation date, termination date, performance status
7. This enables "departing employee" triggering events
8. Define priority users (optional):Go to Settings → Priority user groups
9. Add users with access to sensitive data
10. Add users in high-risk roles (finance, IT, executives)
11. These users get enhanced monitoring

2.3 Create Insider Risk Policies:

1. Go to Policies → Create policy
2. Policy templates available:Data theft by departing users: Detects data exfiltration before/after resignation
3. General data leaks: Detects accidental or intentional data exposure
4. Data leaks by priority users: Enhanced monitoring for high-risk users
5. Data leaks by disgruntled users: Correlates with HR performance data
6. Security policy violations: Detects circumventing security controls
7. Patient data misuse: Healthcare-specific (requires healthcare data)
8. Start with "Data theft by departing users" - highest ROI

2.4 Configure Policy Settings:

1. Triggering events (what starts monitoring):User submits resignation (from HR connector)
2. User is terminated (from HR connector)
3. User removed from group (e.g., removed from project team)
4. User on performance improvement plan (from HR)
5. Manual: Add user to policy scope
6. Indicators to detect (what behavior to monitor):Downloading large amounts of files from SharePoint/OneDrive
7. Copying files to USB devices (Endpoint DLP signals)
8. Uploading to personal cloud storage
9. Sending emails with attachments to personal accounts
10. Printing unusual volumes
11. Accessing files outside normal working hours
12. Accessing files not normally accessed by this role
13. Thresholds:Set what's "unusual" - e.g., downloading 100+ files when normal is 10
14. Start with default thresholds, tune based on alerts

2.5 Configure Privacy Settings:

1. Go to Settings → Privacy
2. Anonymization:Enable pseudonymization: User names shown as "User-1234"
3. Investigators can't see real names until escalation
4. Requires approval to de-anonymize
5. Data handling:Set data retention period for alerts (default 120 days)
6. Configure who can view case data
7. Enable audit logging of investigator actions

2.6 Set Up Alert and Case Management:

1. Alert workflow:Alert generated → Triage (is this real?) → Case (investigate)
2. Cases can have multiple alerts
3. Configure alert severity thresholds:Low: Informational, review weekly
4. Medium: Review within 48 hours
5. High: Review within 24 hours
6. Case actions:Dismiss: False positive, document why
7. Escalate: Send to HR, Legal, or management
8. Send notice: Automated warning to user
9. Create eDiscovery case: Preserve evidence for investigation

2.7 Train Investigation Team:

1. Role assignments:Insider Risk Management Analysts: Triage alerts
2. Insider Risk Management Investigators: Full case access
3. Insider Risk Management Admins: Configure policies
4. Training should cover:How to review and triage alerts
5. What constitutes actionable vs. false positive
6. Proper documentation of investigation steps
7. When to escalate to HR/Legal
8. Evidence preservation requirements
9. Privacy and confidentiality obligations
10. Document escalation procedures

Estimated time: 20-32 hours for implementation + legal/HR coordination

Step 3: Viva Insights (Organizational Analytics)

Viva Insights provides data-driven insights into how your organization works - meeting culture, focus time, work-life balance, and collaboration patterns. Not a security control, but valuable for organizational health.

3.1 Understand Viva Insights Tiers:

1. Personal insights: Individual productivity data (free with M365)
2. Manager insights: Team-level aggregated data (requires Viva license)
3. Leader insights: Organization-wide trends (requires Viva license)
4. Advanced insights: Custom queries, research-grade data (requires premium)

3.2 Configure Privacy Settings:

1. Go to Microsoft 365 admin center → Settings → Org settings → Viva Insights
2. Privacy controls:Minimum aggregation threshold: 10 people (can't see groups smaller than this)
3. Opt-out: Allow users to opt out of personal insights
4. Manager access: Control what managers can see about their teams
5. Excluded groups: Exclude sensitive groups (executives, HR)

Privacy by Design

Viva Insights is designed with privacy in mind. Individual data is never shown to managers or leaders. All insights are aggregated and anonymized. The minimum threshold prevents identification of individuals in small teams.

3.3 Enable and Configure:

1. Assign Viva Insights licenses to users
2. Personal insights (automatic):Digest email: Weekly summary of work patterns
3. Focus time: Schedule blocks for deep work
4. Meeting effectiveness: Track meeting habits
5. Collaboration hours: Monitor work-life balance
6. Manager insights:Managers see aggregated team data
7. After-hours work trends
8. Meeting load analysis
9. 1:1 meeting frequency
10. Organizational data upload (optional):Upload HR data: Department, location, level, function
11. Enables insights by org segment
12. E.g., "Engineering spends 30% more time in meetings than Sales"

3.4 Use Insights for Organizational Health:

1. Key metrics to track:After-hours collaboration: Burnout indicator
2. Meeting-free time: Availability for focus work
3. Manager 1:1 frequency: Employee engagement indicator
4. Network size: Collaboration breadth
5. Double-booked meetings: Calendar hygiene
6. Set up quarterly reviews with leadership
7. Use data to inform policy changes (e.g., "meeting-free Fridays")

Estimated time: 4-8 hours for setup and configuration

Step 4: eDiscovery (Premium)

eDiscovery finds, preserves, and exports content for legal and compliance investigations. Premium adds advanced analytics, review workflows, and custodian management.

4.1 eDiscovery Tiers:

1. Content search: Basic search across M365 (included with E3)
2. eDiscovery Standard: Case management, holds, export (E3)
3. eDiscovery Premium: Custodians, review sets, analytics, predictive coding (E5)

4.2 Assign eDiscovery Permissions:

1. Go to compliance.microsoft.com → Permissions
2. Role groups:eDiscovery Manager: Create cases, run searches, manage holds
3. eDiscovery Administrator: Full access to all cases
4. Reviewer: View and tag content (no search/export)
5. Assign minimal necessary permissions
6. Log who has eDiscovery access

Security Note: eDiscovery provides access to potentially all organizational content. Limit access strictly. Audit all eDiscovery activity. Consider requiring manager approval for case creation.

4.3 Create and Manage Cases:

1. Go to eDiscovery → Cases → Create case
2. Case structure:Case name: Use consistent naming (e.g., "Legal-2024-001-SmithVCompany")
3. Description: Matter number, legal counsel, purpose
4. Members: Who can access this case
5. Premium cases include:Custodians: People whose data is being collected
6. Data sources: Specific mailboxes, sites, Teams
7. Holds: Preserve data from deletion
8. Review sets: Collected content for analysis
9. Jobs: Processing and export tasks

4.4 Implement Legal Holds:

1. When to place holds:Litigation is filed or reasonably anticipated
2. Regulatory investigation
3. Internal investigation
4. Audit requirement
5. Hold types:In-place hold: Preserves all content for custodian
6. Query-based hold: Preserves content matching criteria
7. Retention hold: Uses retention policy (Section 4)
8. Hold process:Document hold requirement from Legal
9. Identify custodians and data sources
10. Create hold in eDiscovery case
11. Verify hold is applied
12. Track hold status
13. Release hold only with Legal approval

4.5 Search and Collect Content:

1. Build search queries:Date range: sent:2023-01-01..2023-12-31
2. Keywords: "project alpha" OR "project beta"
3. Sender/recipient: from:john@company.com
4. File types: filetype:xlsx OR filetype:pdf
5. Locations: Specific mailboxes, SharePoint sites
6. Preview results before collection
7. Add results to review set for analysis

4.6 Review and Analyze (Premium):

1. Review set features:Near-duplicate detection: Group similar documents
2. Email threading: View conversations together
3. Themes: AI-identified topics in content
4. Relevance tagging: Train model to prioritize relevant content
5. Tagging:Create tag structure (Responsive, Non-Responsive, Privileged)
6. Assign reviewers to tag content
7. Track review progress
8. Use analytics to reduce review volume

4.7 Export for Production:

1. Export options:Native format: Original file types
2. PDF: All content converted to PDF
3. PST: Email exported as Outlook archive
4. Include metadata in load file
5. Download export package
6. Transfer to external counsel or review platform
7. Document chain of custody

Estimated time: Varies by case (hours to hundreds of hours)

Enterprise Controls Checklist

1. PIM enabled for Entra ID roles
2. All privileged roles converted to eligible assignments
3. Break-glass accounts documented and monitored
4. Approval workflows configured for high-sensitivity roles
5. Access reviews scheduled for all admin roles
6. PIM alerts configured and monitored
7. Administrators trained on activation process
8. Insider Risk Management approved by Legal/HR
9. HR connector configured (if applicable)
10. Initial insider risk policies created
11. Investigation team trained
12. Privacy settings configured appropriately
13. Viva Insights enabled with privacy controls
14. eDiscovery permissions assigned appropriately
15. Legal hold process documented
16. eDiscovery audit logging enabled

The foundation everything else runs on. Business-class equipment, proper segmentation, and enterprise-grade monitoring. A poorly designed network undermines every other security control you implement.

Prerequisites for Network & Infrastructure

1. Budget for business-class equipment (Ubiquiti, Meraki, or equivalent)
2. Internet service with static IP or DDNS for remote management
3. Physical access to network closet/equipment room
4. Current inventory of all network-connected devices
5. Understanding of bandwidth requirements

Network Architecture

Segment, monitor, and control traffic flow. A flat network where everything can talk to everything is a ransomware attacker's dream. Proper segmentation contains breaches and limits lateral movement.

Network Segmentation Strategy

Create separate VLANs for different security zones:

1. Corporate VLAN (10) - Managed workstations, company-owned devices. Full access to internal resources, subject to firewall inspection.
2. Server VLAN (20) - On-premises servers, NAS devices, critical infrastructure. Restricted access, only necessary ports open.
3. IoT/OT VLAN (30) - Printers, cameras, HVAC systems, medical devices. No internet access unless required, isolated from corporate network.
4. Guest VLAN (40) - Visitors, personal devices if allowed. Internet only, no access to internal resources, bandwidth throttled.
5. BYOD VLAN (50) - Personal devices that need limited internal access. Captive portal authentication, restricted to specific resources.
6. Management VLAN (99) - Network equipment management interfaces. Highly restricted, only IT admin access.

Business-Class Equipment Requirements

1. Firewall/Router - Next-gen firewall with IDS/IPS, content filtering, VPN capability. Sophos XGS, Fortinet, or Ubiquiti Dream Machine Pro for smaller environments.
2. Managed Switches - VLAN support, PoE for access points and cameras, port security, SNMP monitoring. Ubiquiti Pro or Enterprise series.
3. Wireless Access Points - Enterprise-grade with multiple SSID support, WPA3, RADIUS authentication capability, centralized management.
4. UPS (Uninterruptible Power Supply) - Protect network equipment from power fluctuations. Minimum 15-minute runtime for graceful shutdown.

No Consumer Equipment: Consumer routers (Netgear, Linksys, TP-Link consumer lines) lack security features, receive infrequent updates, and don't support proper segmentation. They're never appropriate for business use.

Firewall Configuration

1. Default Deny - Block all traffic by default, explicitly allow required traffic. Document every rule.
2. IDS/IPS Enabled - Intrusion detection and prevention for all traffic. Keep signatures updated.
3. SSL/TLS Inspection - Decrypt and inspect HTTPS traffic (with appropriate privacy considerations and certificate deployment).
4. Geo-blocking - Block traffic from countries you don't do business with. Common blocks: Russia, China, North Korea, Iran.
5. Application Control - Block known malicious applications, control cloud app usage (shadow IT).
6. DNS Filtering - Block malicious domains at the DNS level before connections are established.

Wireless Network Security

1. WPA3-Enterprise - Preferred. Uses RADIUS for authentication, individual credentials per user, certificate-based authentication option.
2. WPA3-Personal - Acceptable for guest networks with strong passphrase (20+ characters), rotated regularly.
3. Separate SSIDs - Different networks for corporate (RADIUS), guest (captive portal), IoT (isolated), BYOD (certificate or credentials).
4. 802.1X Authentication - Machine certificates from Intune for managed devices, RADIUS authentication for all.
5. Client Isolation - Enable on guest and BYOD networks to prevent device-to-device communication.

Network Monitoring & Alerting

1. SNMP Monitoring - Monitor bandwidth, CPU, memory on all network devices. Alert on thresholds.
2. NetFlow/sFlow - Traffic analysis for anomaly detection, capacity planning, security investigation.
3. Syslog Collection - Centralize logs from all network devices for SIEM integration.
4. Uptime Monitoring - Monitor critical devices, alert on outages. External monitoring for internet connectivity.
5. Automated Alerts - New device connected, rogue DHCP server, port flapping, high bandwidth consumption.

Network Documentation Requirements

1. Network diagram (logical and physical) - updated with every change
2. IP addressing scheme with VLAN assignments
3. Firewall rule documentation with business justification
4. Equipment inventory (model, serial, location, warranty)
5. ISP contact information and circuit details
6. Change log for all network modifications

Estimated time: 16-40 hours for design and implementation

Backup & Recovery

When (not if) something fails, how fast can you recover? Ransomware attacks, hardware failures, and human error will happen. Your backup strategy determines whether it's an inconvenience or a catastrophe.

Critical Misconception: Microsoft 365 retention is NOT backup. Retention policies protect against accidental deletion for a limited time. After retention expires, data is permanently gone. Malicious deletion by a compromised account can bypass retention. You need true backup.

The 3-2-1 Backup Rule

1. 3 Copies - Original data plus two backup copies
2. 2 Different Media - Cloud and local, or different cloud providers
3. 1 Offsite - At least one copy in a different physical location

Modern enhancement: 3-2-1-1-0: Add one immutable copy (can't be modified or deleted) and zero errors (verified backup integrity).

Microsoft 365 Backup

Third-party backup solutions for Microsoft 365 (Veeam, Datto, Acronis, etc.):

1. Exchange Online - Mailboxes, calendars, contacts. Point-in-time recovery for individual items or full mailbox restore.
2. SharePoint Online - Sites, document libraries, lists. Version history beyond native 500 versions, site-level restore.
3. OneDrive for Business - User file storage. Individual file recovery, full account restore for departed users.
4. Teams - Channels, conversations, files. Team-level and channel-level recovery.
5. Entra ID - User objects, group memberships, configurations. Often overlooked but critical for disaster recovery.

New: Microsoft 365 Backup

Microsoft now offers native M365 Backup (pay-per-use, via Azure). Covers Exchange, SharePoint, OneDrive. Consider for organizations standardizing on Microsoft, but evaluate against established third-party solutions.

On-Premises/Hybrid Backup

1. Servers - Full image backup for bare-metal recovery. Application-aware backup for databases (SQL, Exchange on-prem).
2. File Shares - Incremental backup with versioning. Fast recovery for individual files.
3. Databases - Transaction log backup for point-in-time recovery. Test restoration regularly.
4. Virtual Machines - Snapshot-based backup with application quiescing. Instant recovery capability.
5. Configuration Backup - Network device configs, firewall rules, system settings. Often forgotten until needed.

RPO and RTO Definitions

1. RPO (Recovery Point Objective) - Maximum acceptable data loss measured in time. "We can lose up to 4 hours of work." Determines backup frequency.
2. RTO (Recovery Time Objective) - Maximum acceptable downtime. "We need to be operational within 2 hours." Determines recovery method.

Example targets by system criticality:

1. Critical (Email, ERP) - RPO: 1 hour, RTO: 4 hours
2. Important (File shares) - RPO: 4 hours, RTO: 8 hours
3. Standard (Archive) - RPO: 24 hours, RTO: 24 hours

Immutable Backup (Ransomware Protection)

Ransomware specifically targets backup systems. Immutable backups cannot be modified or deleted, even by administrators, for a set retention period.

1. Cloud Immutability - AWS S3 Object Lock, Azure Immutable Blob Storage, Wasabi Object Lock. Backup vendor must support.
2. Air-Gapped Backup - Physically disconnected backup that ransomware cannot reach. Tape, offline disk, or isolated cloud.
3. Retention Lock - Backup software feature preventing deletion before retention expires.
4. Separate Credentials - Backup system uses different credentials than production. Compromise of domain admin doesn't give backup access.

Backup Testing Requirements

1. Daily - Verify backup job completion, check for errors and warnings, confirm data protected.
2. Weekly - Restore random file/email to verify recoverability. Document results.
3. Monthly - Full system restore to isolated environment. Verify application functionality.
4. Quarterly - Disaster recovery drill. Simulate major outage, execute recovery procedures, measure against RTO.
5. Annually - Complete DR test with business stakeholder participation. Update procedures based on lessons learned.

Untested backups are not backups. "We think it's working" is not acceptable. Regular, documented testing is the only way to know you can recover.

Disaster Recovery Planning

1. Business Impact Analysis - Identify critical systems, maximum tolerable downtime, recovery priorities.
2. Recovery Procedures - Step-by-step instructions for each scenario (hardware failure, ransomware, site loss).
3. Communication Plan - Who to notify, how to communicate during outage, status update cadence.
4. Vendor Contacts - Support numbers, account details, escalation paths for critical vendors.
5. Recovery Site - Where will you operate if primary site is unavailable? Cloud, alternate office, remote work?

Backup Encryption Requirements

1. Encryption in transit (TLS 1.2+) for all backup traffic
2. Encryption at rest (AES-256) for stored backup data
3. Key management separate from backup data (avoid key stored with backup)
4. Document encryption keys securely (offline copy, break-glass procedure)

Estimated time: 8-16 hours for setup + 2-4 hours/month for testing

Network & Infrastructure Checklist

1. Network segmented with VLANs for different security zones
2. Business-class firewall with IDS/IPS enabled
3. All consumer-grade networking equipment replaced
4. Wireless networks secured with WPA3 and proper authentication
5. Guest network isolated from internal resources
6. Network diagram current and accessible
7. Firewall rules documented with business justification
8. Network monitoring and alerting active
9. Microsoft 365 backed up with third-party solution
10. On-premises data backed up following 3-2-1 rule
11. Immutable/air-gapped backup copy exists
12. RPO and RTO defined for all critical systems
13. Backup testing performed and documented regularly
14. Disaster recovery plan documented and tested
15. Backup encryption configured (transit and rest)
16. Backup credentials separate from production domain