A tenant created last month has one permissions model in the Defender portal. A tenant created three years ago has two, and nothing will break until somebody asks what a named analyst can actually do.
Every pillar in this series is a product you can license separately. The thing that makes them a suite is a platform layer nobody sells you, that arrives free with the first qualifying licence, and that most tenants never deliberately configure.
The retirements calendar tells you the clock is running. This build sheet produces the artefact that answers it: a dated inventory of everything still speaking Exchange Web Services, SMTP AUTH, POP3 or IMAP4, and an allow list built from evidence rather than inherited.
Every action from the collaboration baseline as a scannable list, with the way to check each one and a pointer to the article that argues for it. The October deadline is section one, because it is the only part where inaction produces an outage.
Six things in this estate stopped working during the first seven months of the year. If something broke and nobody could explain it, the explanation is probably here. One thing breaks in October, and one door closed behind every tenant without asking.
Copilot does not create an oversharing problem, it makes an existing one legible. The four mechanisms that cause it, Microsoft's own remediation sequence and why the order is right, what restricted content discovery does not do, and the packaging problem in the middle of the blueprint.
Where judgment starts. Why the default link type is the highest-leverage setting in the product, whether a guest should be able to pass your trust on to a stranger, which container a piece of work belongs in, and how long a departed employee's files should outlive them.
Finding every external person holding a link without a guest account, creating the accounts, and proving the gap is closed. On a worked estate, with a real deadline. The interesting part is reconciling addresses, not running cmdlets.
