Skip to content

Controls

Every control page has the same parts: why it matters, the steps, what it does to users, how to roll it back, a read-only check, how to verify and the Microsoft Learn pages it is based on.

30 controls are published here, the free Top 5 of each kit. The rest are listed on each kit's page.

Copilot readiness

ID Control Priority Effort
CR01 Find the overshared sites before Copilot does Highest 2 h
CR02 Hide the riskiest sites from Copilot while you fix them (Restricted Content Discovery) Highest 1 h
CR03 Make 'Specific people, view' the default sharing link and put an expiry on Anyone links High 1 h
CR04 Remove 'Everyone except external users' from sensitive sites and hide it in the people picker High 2 h + site owner time
CR05 Confirm Copilot interactions are audited and searchable High 30 min

AI agent hardening

ID Control Priority Effort
AG01 Inventory every agent in the tenant Highest 1 h
AG02 Require user authentication for Copilot Studio agents Highest 30 min
AG03 Block HTTP requests and channels you don't use High 1 h
AG04 Watch agent creation, publishing, sharing and authentication changes High 1 h
AG05 Block high-risk agent identities with Conditional Access High 30 min

Conditional Access

ID Control Priority Effort
CA01 Create two emergency access accounts, exclude them from every policy and alert on their use Highest 2 h
CA02 Name policies by persona and create every new policy in Report-only first Highest 1 h
CA03 Require MFA for all users on all resources with an authentication strength Highest 2 h + 7 days report-only
CA04 Block legacy authentication for all users Highest 1 h + 7 days report-only
CA05 Require phishing-resistant MFA for administrators Highest 2 h + 7 days report-only

Privileged access and PIM

ID Control Priority Effort
PA01 Inventory every privileged role assignment and bring Global Administrators below five Highest 3 h
PA02 Make admin roles eligible in PIM: no permanent active assignment except the two emergency accounts Highest 4 h
PA03 Set PIM role settings for Tier 0 roles: short activation, MFA or authentication context, justification, approval by two people Highest 2 h
PA04 Give every admin a separate cloud-only admin account, not synced from on-premises High 3 h
PA05 Run a quarterly access review of privileged roles and alert on roles assigned outside PIM High 2 h

Exchange Online protection

ID Control Priority Effort
EX01 Turn on the Standard preset security policy for all users (Strict for priority accounts) Highest 2 h
EX02 Block automatic forwarding to external addresses and review the forwards that already exist Highest 2 h
EX03 Publish SPF and turn on DKIM signing for every domain that sends mail Highest 3 h
EX04 Publish DMARC for every domain and move it from p=none to p=reject High 1 h set-up + 4 to 8 weeks monitoring
EX05 Anti-malware: common attachments filter on with Reject, zero-hour auto purge on, admin-only quarantine High 30 min

Defender for Endpoint and ASR

ID Control Priority Effort
DE01 Check every device is onboarded and its sensor is healthy Highest 1 h
DE02 Make sure Defender Antivirus is active with cloud protection and block at first sight Highest 1 h
DE03 Turn on tamper protection tenant-wide Highest 30 min
DE04 Put all ASR rules in Audit and block the three standard protection rules High 2 h + 2-4 weeks audit
DE05 Turn on network protection (audit, then block) High 1 h + 2 weeks audit