Security Setup Checklist

• List your adminsIn the Microsoft Entra admin center (entra.microsoft.com), go to Entra ID > Roles & admins to see everyone holding privileged roles.
• Turn on FIDO2 keysGo to Entra ID > Protection > Authentication methods and enable FIDO2 security key and/or Passkey (Microsoft Authenticator) as allowed methods.
• Register a security keyGive each admin a hardware key (like a YubiKey) and have them enroll it at aka.ms/mysecurityinfo (the Security info page).
• Create break-glass accountsMake two emergency 'break-glass' Global Admin accounts and exclude them from the policy so you never lock yourself out.
• Build a report-only policyIn Entra ID > Conditional Access, create a policy: All users (exclude break-glass) > All resources > Grant > Require authentication strength > Phishing-resistant MFA. Set it to Report-only first.
• Turn the policy onAfter the sign-in logs show no surprises, edit the policy and switch Enable policy from Report-only to On.
• Block legacy authenticationCreate a second Conditional Access policy that blocks legacy (older) authentication clients, which can bypass MFA entirely.

Evidence to keep: Conditional Access policy export (JSON) · Authentication methods registration report · Sign-in logs showing phishing-resistant sign-ins

• Count your Global AdminsIn the Microsoft Entra admin center, go to Entra ID > Roles & admins and review who holds Global Administrator; aim for fewer than five.
• Assign narrower rolesReplace Global Admin with least-privilege roles (like Helpdesk Admin or Exchange Admin) from the same Roles & admins page.
• Turn on PIMGo to ID Governance > Privileged Identity Management to make admin roles 'eligible' instead of always-on.
• Make roles eligibleIn PIM > Microsoft Entra roles > Roles, move admins to Eligible assignments so they activate access only when needed.
• Set activation rulesFor each role select Role settings > Edit and require MFA on activation, a justification, approval, and a short duration (for example one hour).
• Require approval for Global AdminIn the Global Administrator role settings, turn on Require approval and name at least two approvers.
• Schedule access reviewsIn ID Governance > Access reviews, create a recurring review so unused admin rights get removed automatically.

Evidence to keep: PIM role settings export · List of eligible vs. permanent role assignments · Completed access review report

• List all devicesIn the Microsoft Intune admin center (intune.microsoft.com), go to Devices > All devices to see every managed and co-managed device.
• Check device identitiesIn the Microsoft Entra admin center, go to Entra ID > Devices > Overview to spot stale, non-compliant, and unmanaged devices.
• Review all user accountsGo to Entra ID > Users to confirm each account is a real person and disable ones you don't recognize.
• Inventory installed appsIn Intune, open a device and select Discovered apps (or the App inventory tab) to see software running on it.
• List connected appsIn Entra ID > Enterprise applications, review every third-party app that has been granted access to your tenant.
• Find guest accountsIn Entra ID > Users, filter by User type = Guest to track outside collaborators who have access.
• Export and date the listUse the Download/Export button on the All devices and Users pages to save a dated copy as your inventory record.

Evidence to keep: Intune All devices export (CSV) · Entra Users and Devices export · Enterprise applications list

• Confirm auditing is onIn the Microsoft Purview portal (purview.microsoft.com), open Audit; audit search is on by default, but verify it's active for your tenant.
• Verify with PowerShellIn Exchange Online PowerShell run Get-AdminAuditLogConfig | FL UnifiedAuditLogIngestionEnabled and confirm the value is True.
• Grant audit permissionsIn Purview go to Settings > Roles and scopes > Role groups and assign trusted staff the Audit Logs or View-Only Audit Logs role.
• Run a test searchOn the Purview Audit page, run a search (for example, by user or activity) to confirm records are being captured.
• Review sign-in logsIn the Microsoft Entra admin center, go to Entra ID > Monitoring > Sign-in logs to watch for risky or failed logins.
• Extend log retentionConsider an Audit (Premium) license or an audit retention policy so logs are kept up to a year instead of the default 180 days.
• Centralize with a SIEMOptionally stream logs to Microsoft Sentinel for alerts; add it from the Microsoft Defender or Azure portal.

Evidence to keep: Screenshot of UnifiedAuditLogIngestionEnabled = True · Sample audit log search export · Audit retention policy configuration

• Define trusted locationsIn the Microsoft Entra admin center, go to Entra ID > Conditional Access > Named locations and add your office IP ranges, marking them as trusted.
• Block risky countriesCreate a Countries named location for regions you never expect traffic from, then a policy that blocks sign-ins from them.
• Require compliant devicesIn Conditional Access, create a policy granting access only when the device is marked compliant (managed by Intune).
• Separate admin accessAdd a policy that requires phishing-resistant MFA and a compliant device specifically for admin portals.
• Turn on Global Secure AccessGo to Global Secure Access > Settings to enable the service and its Conditional Access signaling (the compliant network check).
• Publish private appsUse Global Secure Access > Applications to publish internal apps through Private Access so they're never exposed to the public internet.
• Test then enforceRun each new policy in Report-only mode, check the sign-in logs, then switch Enable policy to On.

Evidence to keep: Named locations configuration export · Conditional Access policy set export · Global Secure Access / Private Access app list

• Onboard devices to DefenderIn the Microsoft Defender portal (security.microsoft.com), go to Settings > Endpoints > Onboarding to connect your Windows devices.
• Review the weakness listIn the Defender portal open Vulnerability management (now under Exposure management) > Recommendations to see prioritized fixes.
• Send fixes to IntuneOn a recommendation, select Request remediation to create a task that flows into the Microsoft Intune admin center.
• Create update ringsIn the Intune admin center, go to Devices > Windows updates and create Update rings for Windows 10 and later to schedule patch deferrals and deadlines.
• Add a pilot ringMake a small 'test' ring that gets updates first, so you catch bad patches before they reach everyone.
• Use Windows AutopatchTurn on Windows Autopatch in Intune to automatically roll updates across rings and report on patch compliance.
• Track patch complianceReview the Windows update and Autopatch reports in Intune to confirm you reach roughly 95% patched by each deadline.

Evidence to keep: Defender Vulnerability Management recommendations export · Intune Update rings configuration · Windows Autopatch / update compliance report

• Plan your labelsDecide a simple set like Public, General, Confidential, and Highly Confidential before building anything.
• Create sensitivity labelsIn the Microsoft Purview portal, go to Solutions > Information Protection > Sensitivity labels and select + Create to build each label.
• Turn on encryption for a labelWhile configuring a higher label (like Confidential), enable encryption and choose which users can open the content.
• Publish the labelsIn Information Protection > Publishing policies, create a label policy so labels appear in Office apps for your users.
• Encrypt device disksIn the Microsoft Intune admin center, go to Endpoint security > Disk encryption > Create Policy > Windows > BitLocker and assign it to devices.
• Escrow recovery keysIn the BitLocker profile, require recovery keys to be saved to Entra ID so you can recover a locked device.
• Confirm transit encryptionVerify Exchange Online and SharePoint enforce TLS by default; encryption in transit is on automatically for Microsoft 365 services.

Evidence to keep: Sensitivity label and policy export · Intune BitLocker (Disk encryption) policy · Entra-escrowed BitLocker recovery keys report

• Open Microsoft 365 BackupIn the Microsoft 365 admin center (admin.microsoft.com), go to Settings > Microsoft 365 Backup to enable the tool.
• Assign the backup admin roleIn Entra ID, grant a trusted person the Microsoft 365 Backup Administrator role instead of using Global Admin.
• Create a SharePoint policyIn the Backup dashboard select Back up sites and create a policy covering your critical SharePoint sites.
• Create a OneDrive policyCreate a OneDrive backup policy so users' individual files are protected against deletion and ransomware.
• Create an Exchange policyCreate an Exchange policy to back up mailboxes; consider Full Workload Backup to auto-protect new items.
• Confirm restore pointsWait for initial backups to finish, then verify restore points appear in the Backup dashboard.
• Test a restoreDo a small test restore of one site or mailbox to a new location to confirm recovery actually works.

Evidence to keep: Microsoft 365 Backup policy configuration · Screenshot of available restore points · Successful test-restore record

• Check your Secure ScoreIn the Microsoft Defender portal, go to security.microsoft.com/securescore to see your current score and ranked recommendations.
• Work the top actionsOpen the Recommended actions tab and tackle the highest-ranked, low-effort items first for the biggest gains.
• Choose your identity baselineSmall tenants can keep Security Defaults on; tenants with Entra ID P1/P2 should turn it off and deploy Conditional Access templates instead (not both).
• Deploy device baselinesIn the Microsoft Intune admin center, go to Endpoint security > Security baselines and deploy the Windows and Defender for Endpoint baselines.
• Assign baselines to groupsAssign each baseline to your device groups and review the compliance results Intune reports back.
• Fix baseline conflictsCheck for policies that fight each other in Intune, since conflicting settings can leave a device unprotected.
• Track your score over timeRevisit Secure Score monthly and compare against similar organizations to confirm you're improving, not sliding back.

Evidence to keep: Secure Score history export · Intune security baseline assignment and compliance report · Conditional Access or Security Defaults configuration

• Label sensitive data firstMake sure sensitivity labels (from the encryption step) are applied, because Copilot honors label permissions when deciding what a user can see.
• Open DLP policiesIn the Microsoft Purview portal, go to Data Loss Prevention > Policies and select + Create policy using the Custom template.
• Scope to CopilotOn the Locations page, turn on the Microsoft 365 Copilot and Copilot Chat location.
• Block sensitive promptsAdd a rule: Content contains > Sensitive information types, with action Restrict Copilot from processing content > Processing prompts.
• Block sensitive files in answersAdd a second rule using Content contains > Sensitivity labels to stop Copilot from grounding responses on your most sensitive labeled files.
• Guard against public AIOnboard Windows devices to Purview and create an Endpoint DLP rule that blocks pasting sensitive data into sites like ChatGPT.
• Test in simulation modeRun the policy in simulation mode, review the matches, tune it, then turn it on.

Evidence to keep: Purview DLP policy export (Copilot location) · Endpoint DLP rule for generative AI sites · DLP simulation / alert report