The controls I will not hand a tenant over without. The October cutoff and why the remediation is an inventory rather than a resharing exercise, the sharing argument the industry gets wrong, Teams as three separate doors with only one closed by default, and the protection policy no preset touches.
External sharing stopped being a SharePoint feature this year. Invitation, authentication and domain restriction for every shared file now happen in Entra, Microsoft did it to every tenant whether the setting was on or not, and removed the ability to turn it off. This is the frame, and the October deadline that comes with it.
Conditional Access is authored by whoever owns identity, but the signal it reads is manufactured by the endpoint estate. This is what the Intune side of that seam actually owns, and what a compliant device claim does and does not promise.
Every action from the Exchange Online baseline as a scannable list, with the way to check each one and a pointer to the article that argues for it. Tiered critical, recommended and optional, grouped by control-plane domain.
The part of the baseline organised by calendar rather than by control. Exchange Web Services stops working, basic authentication over mail submission follows, and three decisions in this product cannot be walked back once taken. The expensive half of each is the discovery, not the change.
Where judgment starts. Why I use Microsoft's preset threat policies and the quarantine argument nobody makes for them, where user-reported phishing actually lands when nobody configures it, what to stop Outlook doing on an unmanaged device, and the archiving decision that quietly costs you mailbox recovery.
Taking a domain from no email authentication at all to a rejecting DMARC policy, on a worked estate, then going one layer further and authenticating the transport as well as the message. Includes the negative test that most implementations skip and the only one that proves anything.
The controls I will not hand over a tenant without. Mail authentication end to end, including the DKIM record format that changed underneath every build guide, the protocols that predate your Conditional Access policy, and the audit log that is off by default on exactly the licences most estates run.
