Remediation PlanningEnterprise

Block legacy authentication protocols

Configure sign-in risk Conditional Access policy

Block legacy auth endpoints at the authentication methods policy

Require MFA for Global Administrator sign-ins

Enforce Conditional Access for unmanaged devices

Enforce guest user access review cadence

Block legacy POP3 authentication to mailboxes

Disable voice call as a primary authentication method

Enforce authenticator app lockout policy

Enforce persistent browser sessions off for unmanaged devices

Enforce maximum eligible assignment duration for privileged roles

Require MFA for Exchange Administrator sign-ins

Block authentication from anonymous IP ranges

Restrict guest user invitation to specific admin roles

Block legacy IMAP authentication to mailboxes

Enforce firewall policy on Windows endpoints

Require biometric authentication for mobile devices

Enable spoofing prevention for hybrid deployments

Configure mailbox audit actions to log admin and delegate activity

Configure SPF hard-fail for all accepted domains

Disable EWS (Exchange Web Services) legacy auth

Configure Safe Attachments policy for all recipients

Disable PowerShell remote connections for non-admin mailboxes

Restrict external direct-send relay via receive connectors

Disable anonymous calendar sharing

Disable Basic Auth for POP3 at mailbox level

Enable communication compliance policy for Teams

Configure spam confidence level thresholds

Enable automated investigation for URL compromises

Enable standard preset security policy for all users

Enable external-sender tagging in Outlook

Require expiration dates on anonymous share links

Configure user-risk Conditional Access policy

Block external mail auto-forwarding org-wide

Enable Conditional Access for SharePoint access by unmanaged devices

Require MFA for Exchange Administrator sign-ins

Require MFA for SharePoint Administrator sign-ins

Block authentication from anonymous IP ranges

Require compliant device for privileged role activation

Restrict guest user invitation to specific admin roles

Block legacy IMAP authentication to mailboxes

Block legacy SMTP AUTH authentication

Enforce Authenticator app for passwordless sign-in

Enforce FIDO2 security keys for privileged users

Configure privileged access workstations for tier-0 admins

Require compliant device for admin access to Microsoft 365 admin center

Configure Identity Protection weekly digest to Security Operations

Investigate every flagged-for-review sign-in within 24 hours

Require approval workflow for privileged role activation

Notify role administrators on privileged role assignment changes

Require MFA for SharePoint Administrator sign-ins

Require MFA for Teams Administrator sign-ins

Require compliant device for privileged role activation

Enforce maximum sign-in frequency for privileged sessions

Prohibit user consent to unverified publisher apps

Require admin approval for app consent requests

Block legacy SMTP AUTH authentication

Disable self-service sign-up for guest users

Require device lock password policy on Android

Require BitLocker encryption on Windows endpoints

Require FileVault encryption on macOS endpoints

Block personal OneDrive sync on corporate Windows

Require Windows Update for Business ring assignment

Block external USB storage on corporate devices

Configure app configuration policy for Edge (managed)

Require device lock password policy on Android

Enforce Microsoft Defender for Endpoint on macOS devices

Deploy Microsoft Edge baseline security profile

Enable mailbox audit logging on all mailboxes

Configure mailbox audit actions to log admin and delegate activity

Configure SPF hard-fail for all accepted domains

Disable EWS (Exchange Web Services) legacy auth

Require quarantine on detected malware attachments

Configure Safe Attachments policy for all recipients

Configure mail flow rule to append external-sender banner

Restrict external direct-send relay via receive connectors

Require MFA for Exchange administrators

Configure DMARC with p=reject for all accepted domains

Disable Basic Auth for POP3 at mailbox level

Restrict mailbox delegation to approved roles

Enable Unified Audit Log tenant-wide

Disable Basic Auth for SMTP AUTH at mailbox level

Restrict anti-malware bypass list to approved senders

Require lobby admission for external meeting participants

Enable Safe Links scanning in Teams messages

Disable Teams guest access tenant-wide when not needed

Block screen sharing from anonymous meeting participants

Disable recording for anonymous meeting participants

Restrict recording transcription to organizers and presenters

Enable DLP policy for Teams chats and channels

Enable automatic investigation and remediation (AIR)

Configure email authentication alert rule to SOC

Enable Attack Simulation Training user outcome tracking

Configure incident response playbook for mailbox takeover

Configure incident response playbook for BEC attempts

Enable anti-phishing impersonation protection for VIPs

Configure DKIM alignment enforcement

Enable Defender for Cloud Apps integration with Defender

Enable Defender for Identity integration with Entra ID

Disable SharePoint App Catalog self-service

Extend Unified Audit Log retention to 12 months

Block iCloud keychain sync on corporate iOS devices

Review access privileges via Access Reviews

Require MFA for Teams Administrator sign-ins

Require MFA for Compliance Administrator sign-ins

Enforce maximum sign-in frequency for privileged sessions

Require password change on high user risk

Require admin approval for app consent requests

Block unmanaged browser access to SharePoint and OneDrive

Block authentication attempts from countries not on allowlist

Require number matching for Microsoft Authenticator push

Require temporary access passes to expire within 24 hours

Configure password protection banned-password list

Configure named locations for trusted IP ranges

Require MFA for external partner tenant access (B2B)

Route Identity Protection alerts to the SIEM

Enforce just-in-time access for Exchange Administrator role

Require justification for privileged role activation

Configure activation notification recipients for all privileged roles

Require MFA for Compliance Administrator sign-ins

Require MFA for Security Administrator sign-ins

Disable self-service sign-up for guest users

Block unmanaged browser access to SharePoint and OneDrive

Restrict local administrator accounts on Windows

Block personal OneDrive sync on corporate Windows

Deploy Office 365 app baseline security profile

Restrict local administrator accounts on Windows

Configure DMARC with p=reject for all accepted domains

Disable Basic Auth for POP3 at mailbox level

Block mail forwarding to external domains by transport rule

Configure Safe Links policy with click-time protection

Enable anti-phishing policy with impersonation protection

Enforce litigation hold retention for 365 days minimum

Disable Basic Auth for SMTP AUTH at mailbox level

Block automatic mail forwarding at mailbox level

Enable anti-phishing mailbox intelligence

Enable DLP policy for Teams chats and channels

Restrict Teams federation to allow-listed domains

Block consumer OneDrive access in Teams channels

Restrict guest access to specific team channels

Block Teams live events creation to approved producers only

Configure Teams data residency for in-region tenants

Enable anti-phishing impersonation protection for VIPs

Configure Explorer search persistent queries for IR

Enable Defender for Office 365 Plan 2 AIR investigations

Configure spam confidence level thresholds

Enable bulk complaint level (BCL) filtering

Require MFA for Security Administrator sign-ins

Disable self-service sign-up for guest users

Enforce sign-in session lifetime for browser-based access

Disable SMS as a primary authentication method

Require on-premises password protection agent

Disable cross-tenant inbound B2B invitations by default

Enforce just-in-time access for Global Reader role

Require MFA for Global Administrator sign-ins

Enforce Conditional Access for unmanaged devices

Enforce guest user access review cadence

Block legacy POP3 authentication to mailboxes

Require MFA for SharePoint Administrator sign-ins

Restrict cut-copy-paste outside managed apps

Deploy Microsoft Edge baseline security profile

Block personal iCloud drive on corporate iOS

Block external USB storage on corporate devices

Restrict calendar sharing to internal users only

Enforce retention policy on Exchange mailboxes

Configure DKIM signing for all accepted domains

Disable Exchange ActiveSync legacy authentication

Block authentication from high-risk IP ranges

Disable OAB (Offline Address Book) legacy auth

Block Teams live events creation to approved producers only

Configure Teams data residency for in-region tenants

Disable Teams guest access tenant-wide when not needed

Configure DKIM alignment enforcement

Enable intra-organization spoof protection