Intelliseal — Microsoft 365 Tenant Security & Deployment Checklist

1. Sign in to the Microsoft 365 admin center.
2. Go to Settings > Domains > Add domain.
3. Enter the custom domain name and follow the wizard to add the required DNS verification (TXT) record at your domain registrar.
4. Confirm verification completes in the admin center before continuing.

MX record — use the exact value provided by the Microsoft 365 domain setup wizard to route mail to Exchange Online.

SPF (Sender Policy Framework)

• Add a DNS TXT record: v=spf1 include:spf.protection.outlook.com -all

DKIM (DomainKeys Identified Mail)

• Enable DKIM signing in the Exchange Admin Center.
• Publish two CNAME records:
  selector1._domainkey → selector1-yourdomain-com._domainkey.<initialdomain>.onmicrosoft.com
selector2._domainkey → selector2-yourdomain-com._domainkey.<initialdomain>.onmicrosoft.com
• Rotate DKIM keys annually.

DMARC (Domain-based Message Authentication, Reporting & Conformance)

• Add a DNS TXT record: v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@yourdomain.com; ruf=mailto:dmarc-forensics@yourdomain.com; pct=100; sp=quarantine; aspf=s
• Roll out gradually: start with p=none, then move to p=quarantine, and finally p=reject.
• Monitor DMARC aggregate/forensic reports regularly to catch spoofing attempts.

1. Assign role-based admin permissions instead of Global Admin for day-to-day work (e.g. User Administrator, Exchange Administrator, Intune Administrator as appropriate).
2. Limit the number of standing Global Admins to 2–4 break-glass/emergency accounts.
3. Review role assignments periodically as part of the quarterly review (Section 10).

Option A — Security Defaults (use if Conditional Access licensing is not available):

• Enforces MFA for all admins and users.
• Blocks legacy authentication (IMAP, POP3, older Office clients).

Option B — Conditional Access baseline (preferred if licensed, e.g. Business Premium):

1. Require MFA for all admins / privileged roles.
2. Require MFA for all users.
3. Block legacy authentication protocols.
4. Require MFA for risky sign-ins (requires Entra ID Identity Protection).
5. Block sign-in from high-risk or disallowed countries.

1. Set SSPR scope to "All" or a selected group.
2. Configure the number of authentication methods required (2 recommended).
3. Enable registration campaign so users register methods on next sign-in.

1. Review outstanding recommendations and prioritise by point value / risk.
2. Apply recommendations that don't conflict with documented exceptions.
3. Track trend month-over-month; target score above 70%.

1. Open the Microsoft 365 Defender portal.
2. Navigate to Email & Collaboration > Policies & Rules > Threat Policies.
3. Click Preset security policies.
4. Under Standard protection, click Manage Protection Settings.
5. Assign protection to All recipients, or to specific groups/users.
6. Click Save.

Impersonation settings — within the anti-phishing policy, explicitly add your key executives/domains (e.g. CEO, CFO, finance team, your own accepted domains) as protected users/domains so impersonation protection actually triggers for targeted phishing.

1. Set outbound anti-spam policy "Automatic forwarding rules" to Off / Automatic - System-controlled (blocks external auto-forward).
2. Optionally create a transport rule to reject external auto-forward messages with a clear NDR message.

1. Confirm mailbox audit logging is enabled tenant-wide (on by default for Microsoft 365, but verify).
2. Ensure Unified Audit Log (Section 6) is also turned on so mailbox actions are searchable.

1. Create one shared mailbox per generic address needed (e.g. info@, support@, accounts@).
2. Grant Full Access and Send As (or Send on Behalf) permissions to the relevant users.
3. Shared mailboxes don't need a license under the storage limit (50GB) — only assign a license if it needs to exceed that, be placed on litigation hold, or use Outlook's in-place archive.

1. Confirm the default mailbox plan's quota matches your licence (Business Premium includes 50GB per mailbox).
2. Set warning/prohibit-send/prohibit-send-receive thresholds if you want tighter limits than the plan default.

Result: when a user signs into a company Windows PC with their Microsoft 365 account, the device auto-enrols into Intune.

1. Add your pilot/test Windows devices to this group first.
2. Use this single group as the assignment target for every Intune policy in this section and in Section 5 (compliance, BitLocker, Defender AV, ASR, EDR, LAPS, update rings).
3. Recommended: stay on an Assigned group with manually added devices until you're comfortable, then switch to a dynamic device group.

Platform: Windows 10 and later · Profile: Windows 10/11 compliance policy · Name: Win-Compliance-Basic

Assign to: Intune-Windows-Devices

• Mobile: require Outlook Mobile with app protection (block native mail apps if needed); block jailbroken/rooted devices.
• Optional stretch goal: mark non-compliant if the Defender for Endpoint machine risk score exceeds your threshold (needs the Defender connector from item below).

Platform: Windows · Profile: BitLocker · Name: Win-BitLocker

Assign to: Intune-Windows-Devices

Platform: Windows 10 and later · Profile type: Settings catalog · Name: Win-Basic-Settings

Assign to: Intune-Windows-Devices

• Also add Wi-Fi and Email auto-configuration profiles for managed devices.
• Add browser and app control settings as needed (e.g. blocked app lists).

1. Choose the relevant baseline (e.g. "Security Baseline for Windows 10/11", "Microsoft Defender for Endpoint Security Baseline").
2. Review pre-configured settings against your organisation's needs and adjust exceptions.
3. Assign to a pilot group first, validate, then expand to all devices.

• Deploy Microsoft 365 Office apps (via Intune, or directly from the M365 portal for user-installed).
• Publish self-service apps through Company Portal.

1. Confirm remote lock, wipe and locate actions are available for enrolled devices (Devices > All devices > select device).
2. Create Update rings: define deferral periods for feature/quality updates, active hours, and whether users can pause updates.
3. Assign rings in phases: pilot ring first, then broad rings.

1. Target iOS/Android platforms.
2. Require PIN, restrict copy/paste and save-as to unmanaged apps, require encryption of app data.

Step 1 — turn on LAPS for the tenant

Step 2 — create the Intune LAPS policy

Platform: Windows · Profile: Local admin password solution (Windows LAPS) · Name: Win-LAPS

Assign to: Intune-Windows-Devices

Platform: Windows 10 and later · Profile: Endpoint detection and response · Name: Win-EDR

Assign to: Intune-Windows-Devices

• Defender for Business licenses assigned to all users/devices in scope.
• Windows 10/11 devices enrolled in Intune.
• Devices are Azure AD-joined or Hybrid-joined.
• Admin access confirmed to Intune, Microsoft 365 Defender, and Entra ID.

1. First confirm "Connect Intune with Microsoft Defender for Endpoint" (Section 4) is turned on — onboarding depends on that connector.
2. Create an onboarding policy.
3. Set Onboarding = Onboard.
4. Assign to the Pilot device group (or Intune-Windows-Devices once out of pilot — see the naming-consistency note in Section 4).
5. Validate devices show as "Onboarded" in the Defender portal.

Phase 1 — Audit (run for 7–14 days):

• Block credential stealing from LSASS
• Block Office apps from creating child processes
• Block Office apps from injecting code
• Block process creations from PSExec and WMI
• Use advanced protection against ransomware

Phase 2 — Block: after validating audit results show no false positives, switch all rules above to Block mode.

• EDR in block mode: Enabled
• Automatic investigation: Enabled
• Automatic remediation: Enabled

Web Protection

• Network protection: Block
• SmartScreen: Block malicious and unwanted content

Ransomware Protection

• Controlled Folder Access: start in Audit, then move to Block
• Protect common user folders only

Defender portal checks

• Device status = Active
• Sensor health = Healthy

Vulnerability management

• No unresolved High exposure recommendations
• Secure Score trending upward

1. Pilot group (IT & test users)
2. Staged rollout (20–30% of devices)
3. Full deployment

• Skipping the ASR audit phase
• Overusing exclusions
• Disabling Tamper Protection
• MFA not enforced
• Treating antivirus alone as sufficient protection

• All devices onboarded
• Tamper Protection enforced
• ASR rules in Block mode
• EDR in block mode enabled
• MFA enforced tenant-wide

1. Use built-in templates covering financial information and personal information (PII).
2. Scope to Exchange, SharePoint, OneDrive, Teams.
3. Start in test mode with policy tips before enforcing blocks.

1. Create label taxonomy (e.g. Public, Internal, Confidential, Highly Confidential).
2. Publish a label policy to the relevant users/groups.
3. Requires appropriate licensing (Business Premium/E5 compliance add-on).

1. Set retention duration in line with company/regulatory requirements.
2. Apply defaults for the Recycle Bin as well as long-term retention where required.

1. Enable audit logging tenant-wide if not already on.
2. Confirm search returns results for a recent test action.

1. Set up an eDiscovery (Standard or Premium, per licence) case for the tenant.
2. Assign case admins/investigators.

1. Identify key mailboxes requiring hold (executives, finance, legal).
2. Enable litigation hold and set duration (or indefinite).

1. Enable Known Folder Move for Desktop, Documents, and Pictures.
2. Notify users to complete the redirect prompt on first sign-in.

1. Review risky sign-ins and risky users reports periodically.
2. Configure email notifications to admins for risk detections (requires Identity Protection).

1. Create a Team site per department/project that needs its own document library and Team.
2. Create a Communication site for company-wide announcements/intranet content.
3. Set site owners and default permission groups.

1. Set the organisation-wide default (e.g. "New and existing guests" rather than "Anyone" links, unless the business genuinely needs anonymous links).
2. Review per-site sharing settings for anything more sensitive than the default (finance, HR, exec sites).

1. Set the default OneDrive storage quota per user (up to the Business Premium 1TB entitlement).
2. Restrict sync to domain-joined/managed devices only (block sync on unmanaged/personal PCs) if required by policy.

1. Set up initial Teams structure by department/project.
2. Apply a naming convention for new Teams (e.g. prefix by department/project code) via Teams naming policy.
3. Configure meeting policies: who can record meetings, transcription, and default meeting settings.
4. Configure external access (federation with other domains) and guest access separately — decide whether guests can be added to Teams at all, and if so, what they can see.
5. Apply messaging and app-permission policies as required.

1. Create a transport rule to append a standard signature/disclaimer.
2. Set organisation-wide mail policies as required.

Deliver temporary credentials securely and require password + MFA registration at first sign-in.

Provide a short onboarding session or quick-reference guide covering daily use of Teams, OneDrive, and Outlook, plus how to register MFA methods.

1. Select a third-party backup provider (e.g. Acronis, Datto).
2. Configure backup scope: Exchange mailboxes, SharePoint sites, OneDrive, Teams data.
3. Set backup frequency and retention, and periodically test a restore.

• Any request to disable MFA, legacy authentication, or mailbox protections must be documented and approved by the Security Lead.
• Exceptions expire after 90 days unless reapproved.

• Initial setup checklist completed and signed off by the IT Engineer.
• Quarterly review of tenant Secure Score, audit logs, and compliance alerts.
• Annual policy review to align with current Microsoft recommendations.