A new tenant is not a blank slate you harden at leisure. Microsoft starts writing on it the moment you create it, some of it in ink that never comes out. The sequence to follow, and the decisions you can never take back.
The critical tier is where there is nothing to debate. This is where judgment returns: what a careful architect sets by default, and the settings where reasonable people differ on culture and appetite.
The critical tier: the controls I will not hand a tenant to a client without. Walked in the order the estate actually depends on them, privileged access first, each with the reasoning, the setting, and the proof.
A best practice you cannot defend is just a setting you copied from someone else's tenant. Every item in this series carries the reasoning, the exact object to create, and the way you prove it stayed true.
