Guide
Best Practices
A prioritized, opinionated baseline for common Microsoft workloads, one wave per workload, starting with Entra ID and tenant setup. Every item carries the reasoning, the exact thing to set, and the way you prove it stayed true, grouped by the eight control-plane domains and tiered by obligation rather than difficulty. Written to be read in order.
Entra ID
6 articlesIdentity comes first, because every other control in this pillar assumes the accounts allowed to change it are already governed. This series also carries the pillar’s conventions: what the tiers mean, which references I trust and why, and how a baseline gets proven rather than asserted.
Best Practices, Owned: What a Baseline Is For
A best practice you cannot defend is just a setting you copied from someone else's tenant. Every item in this series carries the reasoning, the exact object to create, and the way you prove it stayed true.
The Entra ID Baseline: The Critical Tier
The critical tier: the controls I will not hand a tenant to a client without. Walked in the order the estate actually depends on them, privileged access first, each with the reasoning, the setting, and the proof.
The Entra ID Baseline: Recommended and Optional Tiers
The critical tier is where there is nothing to debate. This is where judgment returns: what a careful architect sets by default, and the settings where reasonable people differ on culture and appetite.
The New Tenant: Sequencing and One-Way Doors
A new tenant is not a blank slate you harden at leisure. Microsoft starts writing on it the moment you create it, some of it in ink that never comes out. The sequence to follow, and the decisions you can never take back.
Proving the Baseline: The Verification Loop
Maester installed, testing your Entra ID baseline against the controls the earlier articles defended, running unattended and alerting you the day the tenant drifts. The piece that turns a baseline into something you can prove.
The Entra ID Quick Checklist
The whole Entra baseline compressed into a list you can run down in an afternoon. Every action the reasoned articles defended, grouped by the eight control-plane domains and tiered by obligation.
Exchange Online
7 articlesThe outward-facing half. Mail is the one surface a stranger can address directly and unauthenticated, so this series covers authenticating what you send, the protocols that predate every policy you wrote, and the capability Microsoft is removing on published dates.
Exchange Online: The Surface Strangers Can Reach
Every control in the identity baseline defends accounts you own. Mail is the one surface any stranger can address directly, unauthenticated, thousands of times an hour. This is the frame for the Exchange baseline, and the four platform changes that turned familiar recommendations into no-ops.
The Exchange Online Baseline: The Critical Tier
The controls I will not hand over a tenant without. Mail authentication end to end, including the DKIM record format that changed underneath every build guide, the protocols that predate your Conditional Access policy, and the audit log that is off by default on exactly the licences most estates run.
Build Sheet: Mail Authentication to Enforcement
Taking a domain from no email authentication at all to a rejecting DMARC policy, on a worked estate, then going one layer further and authenticating the transport as well as the message. Includes the negative test that most implementations skip and the only one that proves anything.
The Exchange Online Baseline: Recommended and Optional Tiers
Where judgment starts. Why I use Microsoft's preset threat policies and the quarantine argument nobody makes for them, where user-reported phishing actually lands when nobody configures it, what to stop Outlook doing on an unmanaged device, and the archiving decision that quietly costs you mailbox recovery.
Exchange Online on a Clock: Retirements and One-Way Doors
The part of the baseline organised by calendar rather than by control. Exchange Web Services stops working, basic authentication over mail submission follows, and three decisions in this product cannot be walked back once taken. The expensive half of each is the discovery, not the change.
Build Sheet: Protocol Retirement Discovery
The retirements calendar tells you the clock is running. This build sheet produces the artefact that answers it: a dated inventory of everything still speaking Exchange Web Services, SMTP AUTH, POP3 or IMAP4, and an allow list built from evidence rather than inherited.
The Exchange Online Quick Checklist
Every action from the Exchange Online baseline as a scannable list, with the way to check each one and a pointer to the article that argues for it. Tiered critical, recommended and optional, grouped by control-plane domain.
Collaboration Apps
7 articlesWhere the estate meets everyone else. SharePoint, OneDrive and Teams are the surfaces your organisation shares from, and external sharing now runs entirely through Entra, which makes the identity series above prerequisite reading rather than adjacent. This series covers who can reach your files, what to fix before Copilot makes it legible, and the one deadline in the pillar that arrives whether or not anybody did the work.
Collaboration: The Surface You Already Shared
External sharing stopped being a SharePoint feature this year. Invitation, authentication and domain restriction for every shared file now happen in Entra, Microsoft did it to every tenant whether the setting was on or not, and removed the ability to turn it off. This is the frame, and the October deadline that comes with it.
The Collaboration Baseline: The Critical Tier
The controls I will not hand a tenant over without. The October cutoff and why the remediation is an inventory rather than a resharing exercise, the sharing argument the industry gets wrong, Teams as three separate doors with only one closed by default, and the protection policy no preset touches.
Build Sheet: The Guest Account Inventory Before October
Finding every external person holding a link without a guest account, creating the accounts, and proving the gap is closed. On a worked estate, with a real deadline. The interesting part is reconciling addresses, not running cmdlets.
The Collaboration Baseline: Recommended and Optional Tiers
Where judgment starts. Why the default link type is the highest-leverage setting in the product, whether a guest should be able to pass your trust on to a stranger, which container a piece of work belongs in, and how long a departed employee's files should outlive them.
Before Copilot: Fixing What Everyone Can Already See
Copilot does not create an oversharing problem, it makes an existing one legible. The four mechanisms that cause it, Microsoft's own remediation sequence and why the order is right, what restricted content discovery does not do, and the packaging problem in the middle of the blueprint.
Collaboration on a Clock: Retirements and What Already Broke
Six things in this estate stopped working during the first seven months of the year. If something broke and nobody could explain it, the explanation is probably here. One thing breaks in October, and one door closed behind every tenant without asking.
The Collaboration Quick Checklist
Every action from the collaboration baseline as a scannable list, with the way to check each one and a pointer to the article that argues for it. The October deadline is section one, because it is the only part where inaction produces an outage.
