Maester installed, testing your Entra ID baseline against the controls the earlier articles defended, running unattended and alerting you the day the tenant drifts. The piece that turns a baseline into something you can prove.
A new tenant is not a blank slate you harden at leisure. Microsoft starts writing on it the moment you create it, some of it in ink that never comes out. The sequence to follow, and the decisions you can never take back.
The critical tier is where there is nothing to debate. This is where judgment returns: what a careful architect sets by default, and the settings where reasonable people differ on culture and appetite.
The critical tier: the controls I will not hand a tenant to a client without. Walked in the order the estate actually depends on them, privileged access first, each with the reasoning, the setting, and the proof.
A best practice you cannot defend is just a setting you copied from someone else's tenant. Every item in this series carries the reasoning, the exact object to create, and the way you prove it stayed true.
Which estates stop at role PIM, which need groups, which extend to Azure, and the list of problems you should stop trying to solve with this product. Plus what the rest of the Governance pillar has to pick up.
A quarterly recurring review of who is eligible for Global Administrator, with named reviewers and results that apply themselves. Includes denying a test assignment and proving it actually disappeared.
A just-in-time estate decays back into a standing one within a year, through exceptions that each seemed reasonable. The seven alerts, the reviews that actually remove access, and the two places this costs more than P2.
