Security Requirements for Microsoft Partners and Their Customers

1. Introduction: The Microsoft AI Cloud Partner Program serves as a framework to empower organizations through various benefits and incentives.1 Within this program, security stands as a fundamental pillar, critical for safeguarding the integrity of both the partner’s operational environment and the environments of their customers.1 This report aims to provide a comprehensive analysis of the specific security requirements that Microsoft partners must adhere to, drawing upon recent updates and guidelines. Furthermore, it will address the user’s inquiry regarding the necessity of achieving a Secure Score of 70 for both the partner and their customers.

The increasing sophistication of cyber threats necessitates a strong emphasis on security within the partner ecosystem. Microsoft’s partner network plays a vital role in delivering cloud services, making the security posture of each partner a crucial factor in maintaining the trust and security of the broader ecosystem. A vulnerability in a partner’s infrastructure could potentially expose numerous customers to risks. Therefore, Microsoft is proactively establishing security standards to mitigate these potential threats and ensure a secure environment for all stakeholders. The introduction of new benefits packages alongside these security requirements indicates a strategic alignment by Microsoft, where partners who demonstrate robust security practices are more likely to access enhanced resources and opportunities within the program. This interconnected approach incentivizes partners to prioritize security as a core aspect of their participation in the Microsoft AI Cloud Partner Program.

2. Mandatory Security Requirements for Microsoft Partners: Microsoft mandates several fundamental security obligations for partners participating in its programs. These requirements are designed to protect both the partners themselves and their customers from a range of cyber threats.

A primary mandatory security requirement is the enforcement of Multi-Factor Authentication (MFA) for all user accounts associated with a partner’s tenant.3 This obligation extends to partners involved in the Cloud Solution Provider (CSP) program, as well as Advisors and Control Panel Vendors.3 Partners must ensure that MFA is active whenever users sign in to Microsoft commercial cloud services, conduct transactions within the CSP program through Partner Center, or interact with relevant APIs.4 Microsoft provides its own MFA solution through Microsoft Entra security defaults, which is available at no additional cost.3 It is important to note that non-Microsoft MFA solutions are not taken into account when calculating the Partner Center security score.5 Failure to comply with these MFA requirements can result in the partner losing access to their customer tenants.4 The strong emphasis on MFA as a non-negotiable requirement underscores its critical role in preventing unauthorized access to sensitive environments. Passwords alone are often insufficient in today’s threat landscape, and MFA adds a crucial layer of defense by requiring users to provide multiple forms of verification, thereby significantly reducing the likelihood of account compromise. Microsoft’s firm stance on MFA reflects the widespread prevalence of credential theft in cyberattacks.

Another key mandatory requirement is the adoption of the Secure Application Model for partners who integrate with Partner Center APIs.3 This framework is essential for all app and user authentication models used in such integrations.3 By mandating this model, Microsoft aims to enhance the security of partner infrastructure and safeguard customer data from potential security risks.4 This shift towards the Secure Application Model for API integrations signifies a move towards more secure and less privileged access methods, ultimately reducing the potential attack surface. Traditional API access methods might involve storing credentials, which can introduce vulnerabilities. The Secure Application Model likely leverages modern authentication protocols like OAuth 2.0 and the principle of least privilege, ensuring that applications only possess the necessary permissions to perform their intended functions.

Beyond these core requirements, Microsoft also advises partners to embrace the principles of Zero Trust security.4 Furthermore, the removal of inactive Delegated Admin Privileges (DAP) is strongly recommended, as DAP is in the process of being deprecated and replaced by the more secure Granular Delegated Admin Privileges (GDAP).4 The recommendation to transition to GDAP and eliminate inactive DAP highlights Microsoft’s commitment to bolstering security through finer-grained access controls. DAP provides broad administrative rights to partner tenants over customer tenants, meaning that if a partner account with DAP is compromised, an attacker could potentially gain extensive control over the customer’s Microsoft 365 environment. GDAP, on the other hand, allows for the assignment of more specific roles with limited permissions, thereby mitigating this significant risk.

3. Understanding the Partner Center Security Score: To help partners assess and improve their security posture, Microsoft provides the Partner Center security score.5 This metric is designed to give partners a clear understanding of their tenant’s security level.5 It is accessible to direct-bill partners and indirect providers participating in the CSP, Value Added Reseller, or Advisor programs.5 The Partner Center security score ranges from 0 to 100 and reflects the tenant’s security based on adherence to specific security requirements established by Microsoft.5

The calculation of the Partner Center security score is based on the security scores assigned to individual security requirements.5 Each security requirement has a maximum possible score, ranging from 0 to 20 points, determined by its relative importance.5 Currently, a security requirement is considered either fully met, in which case it earns the maximum possible score, or not met, resulting in a score of 0 for that specific requirement.5 The overall Partner Center security score is calculated using the following formula: (Sum of individual security requirement scores) / (sum of individual security requirement max scores) * 100.5 This formula provides a weighted average of the partner’s compliance with the mandatory security measures.

There are several specific security requirements that contribute to the Partner Center security score, each with a defined maximum score 5:

Enable MFA: This requirement focuses on ensuring that multifactor authentication is enabled for all administrative roles within the partner’s tenant. Achieving this earns a maximum of 20 points. To be considered complete, every administrative user must be covered by MFA through security defaults, Conditional Access, or per-user MFA, and each admin user needs to have set up additional verification factors.5
Response to alerts is 24 hours or less on average: This requirement encourages partners to promptly address security alerts. Partners must triage and respond to alerts within 24 hours of their appearance in Partner Center, with an ideal goal of responding within one hour. Meeting this requirement contributes 10 points to the overall score. The average response time is calculated based on the activity of the last 30 days.5
Provide a security contact: This requirement emphasizes the importance of having a designated point of contact for security-related issues. Partners need to provide an email address, phone number, and the name of an individual or group responsible for responding to security incidents. Compliance with this requirement results in 20 points.5
All Azure subscriptions have a spending budget: This requirement applies specifically to partners operating under the new commerce experience. By setting up a spending budget for all their customers’ Azure subscriptions, partners can earn 10 points. Partners who are still on the traditional experience do not receive any points for this particular requirement.5
Users with administrative roles in the customer tenants must use MFA: This requirement extends the MFA mandate to the administrative roles within the partner’s customer tenants. Ensuring that MFA is enabled for these roles earns 20 points.5

It is important to reiterate that non-Microsoft MFA solutions are not supported for the “Enable MFA” requirement within the Partner Center security score framework and are therefore not factored into the score calculation.5 Partners can monitor and manage their security settings and view their current Partner Center security score through the Security requirements dashboard available in Partner Center.5 Furthermore, the partner security score API can be utilized to programmatically retrieve the score and gain insights into the security posture of their customers.6 The Partner Center security score is specifically tailored to the Microsoft ecosystem and the partner’s role within it. The requirements are designed to address common vulnerabilities and ensure partners are adhering to Microsoft’s security best practices for managing their own and their customers’ cloud environments. The weighting of different security requirements, such as the high scores assigned to MFA for both partner and customer administrators, clearly indicates Microsoft’s priorities in securing the partner channel by preventing unauthorized access with elevated privileges. The inclusion of the Azure spending budget requirement for new commerce partners suggests a connection between security and financial management, potentially aimed at preventing resource abuse or unauthorized consumption through proactive oversight.

To provide a clear overview of the Partner Center security score components, the following table summarizes the specific requirements and their corresponding maximum scores:

Security Requirement	Maximum Score	Description
Enable MFA	20 points	Requires multifactor authentication (MFA) to be enabled for administrative roles within the partner’s tenant.
Response to alerts is 24 hours or less on average	10 points	Requires partners to triage and respond to security alerts appearing in Partner Center within 24 hours, with a goal of responding within one hour.
Provide a security contact	20 points	Requires partners to provide an email address, phone number, and name of an individual or group responsible for responding to security incidents.
All Azure subscriptions have a spending budget	10 points	Applies to partners on the new commerce experience and requires them to set up a spending budget for all their customers’ Azure subscriptions. Partners on the traditional experience do not receive points for this requirement.
Users with administrative roles in the customer tenants must use MFA	20 points	Requires MFA to be enabled for all users holding administrative roles within the partner’s customer tenants.

4. The Solutions Partner for Security Designation and Partner Capability Score: The Microsoft AI Cloud Partner Program offers various designations to recognize partners with specific expertise. One such designation is the Solutions Partner for Security, which distinguishes partners who possess the necessary skills to protect customers from increasingly sophisticated cyberattacks across diverse environments, including remote, hybrid, and cloud infrastructures.2 To achieve this designation, partners are required to meet certain qualification criteria based on their partner capability score for security.8

The partner capability score is a composite score derived from a partner’s performance, skilling, and customer success, using data already recorded within Partner Center.8 To attain the Solutions Partner for Security designation, a partner must achieve a minimum score of 70 points, with at least one point in each of the following four key metrics 8:

Performance – Net customer adds
Skilling – Intermediate certifications
Customer success – Usage growth
Customer success – Deployments

Microsoft offers two distinct pathways for partners to pursue this designation: the Enterprise path and the Small and Medium Business (SMB) path, each with its own specific criteria.8 Microsoft evaluates partners on both paths and ultimately selects the highest score achieved from either path at the solution area level to determine qualification.8 This flexibility allows partners to leverage their strengths and focus on the path that best aligns with their business strategy and customer base.

The partner capability score for security is comprised of four metrics organized into three categories 8:

Performance (Maximum 20 points): This category assesses a partner’s ability to expand their customer base by leveraging Microsoft Security products and services. The primary metric is Net customer adds for both Microsoft 365 and Azure Security workloads. The calculation methods and eligibility criteria for net customer adds differ between the Enterprise and SMB tracks, taking into account factors like Azure Consumed Revenue (ACR) and the number of paid licenses for specific Microsoft 365 workloads.8
Skilling (Maximum points vary based on track): This category measures the security-related skills acquired by a partner organization through the number of certified individuals. The key metric is Intermediate certifications. Both the Enterprise and SMB tracks have mandatory prerequisites, requiring individuals to complete the Azure Security Engineer Associate and Microsoft Security Operations Analyst certifications. Additional points are awarded for completing advanced certifications such as Microsoft Cybersecurity Architect expert, Microsoft Identity and Access Administrator, or Microsoft Information Protection Administrator. The specific requirements and point allocations for these certifications vary between the Enterprise and SMB tracks.8
Customer Success: This category evaluates a partner’s effectiveness in driving the adoption and growth of Microsoft security solutions among their customers. It consists of two metrics:

Deployments (Maximum 20 points): This metric awards points based on the growth in the number of customer deployments of eligible Azure and Microsoft 365 security workloads. Similar to the Performance category, the calculation methods and eligible workloads differ between the Enterprise and SMB tracks.8
Usage growth (Maximum 20 points): This metric focuses on the growth in the usage of security workloads by a partner’s customers, measured by Security Azure consumed revenue (ACR) and the growth in the number of Microsoft 365 protected users. Again, the thresholds and calculation methods vary between the Enterprise and SMB tracks.8

The partner capability score for security is one of six solution areas within the broader Microsoft AI Cloud Partner Program.9 Achieving the Solutions Partner for Security designation comes with various benefits, including access to go-to-market services, technical advisory hours, technical support incidents, and exclusive product benefits tailored for security.2 The requirement of a minimum partner capability score of 70 points is specifically for attaining the Solutions Partner for Security designation and is not a general mandatory security requirement for all partners. The multi-faceted nature of the partner capability score, encompassing performance, skilling, and customer success, underscores Microsoft’s emphasis on a holistic approach to security expertise. To achieve this designation, partners must demonstrate not only that their staff possess the necessary security skills but also that they are actively acquiring new security customers and driving the adoption and usage of Microsoft security solutions among their existing customers. The existence of separate Enterprise and SMB tracks acknowledges the diverse business models within the partner ecosystem and provides achievable paths for different types of partners to demonstrate their security capabilities.

To further clarify the metrics for achieving the Solutions Partner for Security designation, the following table provides a summary of the requirements for both the Enterprise and SMB tracks:

Category	Metric	Enterprise Track Details	SMB Track Details
Performance	Net customer adds	Each net new customer contributes two points, up to a maximum of 20 points from ten customers.	Each net new customer contributes four points, up to a maximum of 20 points from five customers.
Skilling	Intermediate certifications	Step 1 (Required): At least two people must complete the Azure Security Engineer Associate certification (0 points). Step 2 (Required): At least two people must complete the Microsoft Security Operations Analyst certification (0 points). Step 3: Each certified individual completing one of the advanced certifications adds 6.67 points.	Step 1 (Required): At least one person must complete the Azure Security Engineer Associate certification (4 points). Step 2 (Required): At least one person must complete the Microsoft Security Operations Analyst certification (4 points). Step 3: Each certified individual completing one of the advanced certifications adds 8 points.
Customer Success	Deployments	Each net new customer contributes 3.3 points, up to a maximum of 20 points from six deployments.	Each net new customer contributes 3.3 points, up to a maximum of 20 points from six deployments.
Customer Success	Usage growth	Every Security Azure consumed revenue (ACR) growth of USD 1,250 earns one point (maximum 20 points). Every Microsoft 365 protected users growth of 125 earns one point (maximum 20 points).	Every Security Azure consumed revenue (ACR) growth of USD 750 earns one point (maximum 20 points). Every Microsoft 365 protected users growth of 50 earns one point (maximum 20 points).

5. Security Considerations for Customer Tenants: Ensuring the security of customer tenants is a critical aspect of the Microsoft partner program. While partners are primarily responsible for their own security, they also play a crucial role in safeguarding the environments of their customers.

One specific requirement that directly links partner security to customer security is the mandate for MFA for administrative roles within customer tenants.5 This requirement carries a significant weight of 20 points in the Partner Center security score calculation for the partner.5 This high weighting underscores the importance Microsoft places on securing privileged access within customer environments. Furthermore, the Partner Center provides partners with insights into customer MFA adoption statistics, allowing them to monitor and encourage the enablement of MFA across their customer base.5 This visibility empowers partners to identify potential security gaps and proactively engage with their customers to promote this essential security measure.

Microsoft emphasizes that partners have a vital role in protecting customer trust by implementing all necessary security measures.4 The partner security score API also enables partners to gain insights into their customers’ overall security posture.7 While the provided information highlights the importance of customer MFA and offers tools for partners to monitor it, there is no explicit mention of a specific security score requirement for customer tenants that partners must meet.6 However, the strong emphasis on MFA for customer administrators and the availability of customer security insights within the Partner Center framework indicate that Microsoft expects partners to have a clear understanding of their customers’ security practices and to take proactive steps to improve them. Although partners are not directly penalized based on a customer’s overall Microsoft Secure Score, their own Partner Center security score is directly affected by the enablement of MFA for administrative roles within their customer tenants. This creates a strong incentive for partners to actively promote and facilitate the adoption of MFA among their customers’ administrators, reflecting a shared responsibility for security within the Microsoft ecosystem.

6. Microsoft Secure Score vs. Partner Center Security Score: It is important to distinguish between the Microsoft Secure Score, which is a broad measure of an organization’s overall security posture, and the Partner Center security score, which is specifically designed for Microsoft partners.

The Microsoft Secure Score is a measurement of an organization’s security health across Microsoft 365, Microsoft Entra ID, and other Microsoft services.11 A higher score indicates that more of the recommended security actions have been implemented.11 This score helps organizations to understand their current security state, identify areas for improvement, and compare their posture against industry benchmarks.11 Points are awarded for configuring recommended security features, performing security-related tasks, or mitigating risks through non-Microsoft solutions.11 Security defaults within Microsoft Entra ID contribute to the Microsoft Secure Score.11 While a target of 80% or higher is generally considered a good Microsoft Secure Score, this can vary depending on the organization’s size and industry.12 The Microsoft Secure Score can be accessed through the Microsoft Defender portal.11

Conversely, the Partner Center security score is specific to Microsoft partners participating in the CSP, Value Added Reseller, or Advisor programs.5 Its primary focus is on the security posture of the partner’s tenant and, to a certain extent, their customers’ tenants, particularly concerning MFA for administrative roles, within the context of the partner program.5 This score is calculated based on specific mandatory security requirements established by Microsoft for its partners.5 The Partner Center security score ranges from 0 to 100 5 and can be monitored and managed through the Security requirements dashboard in Partner Center.5 The partner security score API provides a quantifiable measure of a partner’s security performance and also offers insights into the security posture of their customers.6 The Microsoft Secure Score serves as a comprehensive security assessment tool for any organization using Microsoft products, whereas the Partner Center security score is a specific set of requirements and a scoring mechanism tailored by Microsoft for its partners within the partner program framework. While achieving a high Microsoft Secure Score is generally indicative of strong security practices, maintaining a high Partner Center security score is crucial for partners to ensure compliance with program requirements and potentially access certain benefits or maintain their partner status.

7. Addressing the Secure Score of 70 Requirement: The user specifically asked whether a Secure Score of 70 would be required for both the partner and their customers based on the provided blog post. The analysis of the research snippets reveals important distinctions regarding the use of the number 70 in relation to security within the Microsoft partner program.

The research indicates that a score of 70 is relevant in the context of the Solutions Partner for Security designation. To attain this specific designation, a partner needs to achieve a minimum partner capability score of 70 for the security solution area.8 It is crucial to understand that this partner capability score is based on a combination of performance metrics (net customer adds), skilling (intermediate certifications), and customer success metrics (usage growth and deployments), and it is distinct from the Partner Center security score.8

The provided snippets do not explicitly state a requirement for partners to maintain a Partner Center security score of exactly 70. The Partner Center security score is designed to measure a partner’s adherence to specific mandatory security requirements set by Microsoft. The general principle is to aim for the highest possible score by ensuring that all these mandatory requirements are fully met.5 There is no indication that a score of 70 is a specific threshold that partners must reach for this particular metric.

Similarly, the research snippets do not specify a mandatory Microsoft Secure Score of 70 for customer tenants that partners are obligated to ensure. While Microsoft encourages partners to promote security best practices among their customers, such as the implementation of MFA for administrative roles, there is no mention of a specific Microsoft Secure Score target for customers within the defined partner program requirements.6 The user’s query might stem from a general understanding that a security score around 70-80 is often considered a reasonable benchmark for overall security posture. However, it is essential to differentiate between the various scoring mechanisms within the Microsoft ecosystem and the specific context in which they are used. The Partner Center security score is about meeting specific mandated requirements for partners, while the partner capability score of 70 is related to achieving a particular Solutions Partner designation. Therefore, partners should primarily focus on meeting all the mandatory security requirements that contribute to the Partner Center security score to ensure compliance with the partner program, rather than focusing on an arbitrary score of 70 for this metric or for their customers’ overall Microsoft Secure Score.

8. Recommendations for Microsoft Partners: To effectively navigate the security requirements of the Microsoft AI Cloud Partner Program and enhance the security posture of both their own organizations and their customers, partners should consider the following recommendations:

Prioritize Enabling Multi-Factor Authentication (MFA): Ensure that MFA is enforced for all user accounts, both administrative and standard, within the partner tenant. This can be achieved using Microsoft Entra security defaults or other compatible MFA methods. Additionally, actively encourage and assist customers in enabling MFA for all their users, with a particular focus on administrative roles. Leverage the customer MFA statistics available in Partner Center to identify any gaps in adoption.3
Adopt the Secure Application Model: If your organization integrates with Partner Center APIs, it is crucial to ensure that all applications adhere to the Secure Application Model framework for authentication and authorization. This will help protect both your infrastructure and your customers’ data.3
Maintain Responsiveness to Security Alerts: Establish clear and efficient processes for monitoring and responding to security alerts that appear within Partner Center. Aim for a response time within 24 hours, with an ideal target of one hour, to maximize your Partner Center security score and mitigate potential risks.5
Provide and Maintain a Security Contact: Ensure that the designated security contact information (including name, email address, and phone number) within Partner Center is accurate and kept up-to-date. This ensures that Microsoft can effectively communicate with your organization in the event of any security-related issues.5
Set Azure Spending Budgets for Customers (New Commerce): For partners who are operating under the new commerce experience, it is important to configure spending budgets for all customer Azure subscriptions. This action contributes to your Partner Center security score and can also help in managing and monitoring resource consumption.5
Aim for the Solutions Partner for Security Designation: If your organization has security as a core area of expertise, consider working towards achieving the Solutions Partner for Security designation. This involves focusing on improving your performance metrics (net customer adds), skilling levels (relevant certifications), and customer success in deploying and driving the usage of security-related workloads.8
Regularly Review the Security Requirements Dashboard: Make it a practice to regularly utilize the Security requirements dashboard within Partner Center to monitor your current security score and identify any areas where improvements can be made to meet the mandatory requirements.5
Leverage the Partner Security Score API: Explore the potential of using the partner security score API to gain deeper insights into both your organization’s and your customers’ security posture. This proactive approach can help in identifying and addressing potential risks before they escalate.6
Transition to Granular Delegated Admin Privileges (GDAP): If your organization is still using Delegated Admin Privileges (DAP), plan and execute a migration to Granular Delegated Admin Privileges (GDAP). GDAP offers enhanced security by providing more granular and least-privileged access to customer tenants, reducing the potential impact of compromised partner accounts.4

These recommendations highlight the importance of a multi-layered approach to security, encompassing technical implementations like MFA and secure application models, operational procedures for alert management, and strategic goals such as achieving the Solutions Partner designation. Microsoft provides partners with both the requirements and the necessary tools, such as the Partner Center dashboard and API, to effectively manage and continuously improve their security posture, demonstrating a strong commitment to security within the partner program.

9. Conclusion: In summary, Microsoft partners are required to adhere to several mandatory security measures to ensure the safety and integrity of their own operations and the environments of their customers. These include the critical step of enforcing Multi-Factor Authentication (MFA) on their partner tenants and adopting the Secure Application Model when integrating with Partner Center APIs. The Partner Center security score serves as a key indicator of a partner’s compliance with these specific security requirements.

Achieving a partner capability score of at least 70 is a specific requirement for attaining the Solutions Partner for Security designation, which recognizes expertise in this critical area. This score is based on a holistic evaluation of a partner’s performance, skilling, and success in delivering security solutions. While promoting the adoption of MFA for administrative roles within customer tenants is a crucial responsibility for partners and directly impacts their Partner Center security score, the research does not indicate an explicit requirement for a specific Microsoft Secure Score target for customers.

Therefore, based on the analysis of the provided research snippets, a Partner Center security score of 70 is not explicitly mandated as a general requirement. Furthermore, a Microsoft Secure Score of 70 is not a defined requirement for customers within the context of the partner program requirements discussed. Instead, partners should prioritize meeting all the mandatory security requirements outlined by Microsoft to achieve the highest possible Partner Center security score. Simultaneously, they should actively work to improve the security posture of their customer tenants by promoting and facilitating the adoption of security best practices, particularly the implementation of Multi-Factor Authentication.

Works cited

New benefits packages for the Microsoft AI Cloud Partner Program, accessed on May 9, 2025, https://www.microsoft.com/en-us/americas-partner-one/News/new-benefits-packages-for-the-microsoft-ai-cloud-partner-program
Counter cyber threats as a Solutions Partner for Security, accessed on May 9, 2025, https://partner.microsoft.com/de-de/blog/article/counter-cyber-threats-as-a-solutions-partner-for-security
Partner security requirements FAQ – Partner Center | Microsoft Learn, accessed on May 9, 2025, https://learn.microsoft.com/en-us/partner-center/security/partner-security-requirements-faq
Partner security requirements – Partner Center | Microsoft Learn, accessed on May 9, 2025, https://learn.microsoft.com/en-us/partner-center/security/partner-security-requirements
Security requirements dashboard for Partner Center – Learn Microsoft, accessed on May 9, 2025, https://learn.microsoft.com/en-us/partner-center/security/security-requirements
What is the Security workspace? – Partner Center | Microsoft Learn, accessed on May 9, 2025, https://learn.microsoft.com/en-us/partner-center/security/overview
Use the partner security score API in Microsoft Graph (preview), accessed on May 9, 2025, https://learn.microsoft.com/en-us/graph/api/resources/partner-security-score-api-overview?view=graph-rest-beta
Solutions Partner for Security – Partner Center | Microsoft Learn, accessed on May 9, 2025, https://learn.microsoft.com/en-us/partner-center/membership/solutions-partner-security
Solutions Partner program Partner Capability Score – Partner Center | Microsoft Learn, accessed on May 9, 2025, https://learn.microsoft.com/en-us/partner-center/membership/partner-capability-score
Specialization – Microsoft Partner Network, accessed on May 9, 2025, https://partner.microsoft.com/en-us/partnership/specialization
Microsoft Secure Score – Microsoft Defender XDR, accessed on May 9, 2025, https://learn.microsoft.com/en-us/defender-xdr/microsoft-secure-score
Microsoft Secure Score – A Complete Overview – AdminDroid Blog, accessed on May 9, 2025, https://blog.admindroid.com/boost-up-your-security-posture-with-microsoft-secure-score/

How to enrol a device in Intune that has previously been joined to Entra id

When a device is Entra ID joined *before* the user has an Intune license or before automatic MDM enrollment is configured for that user/group, it won’t automatically enroll in Intune.

Here’s how to get it enrolled without needing to unjoin and rejoin Entra ID (which is the more disruptive option):

Method 1: Trigger Enrollment via Settings (Easiest & Preferred)

This is often the simplest way if automatic enrollment is now correctly configured for the user.

Ensure Prerequisites:
- Intune License: Confirm the user logging into the Windows device has an active Intune license assigned (e.g., part of Microsoft 365 E3/E5/F3, EMS E3/E5, or a standalone Intune license).
- MDM User Scope: In the Microsoft Entra admin center (entra.microsoft.com):
  - Navigate to Devices > Enrollment > Windows enrollment.
  - Click on Automatic Enrollment.
  - Ensure the MDM user scope is set to All or a group that the licensed user is a member of. (The MAM user scope is for a different purpose, usually BYOD).
- CNAME Records: While Entra ID join worked, it’s good to ensure your DNS CNAME records for EnterpriseRegistration and EnterpriseEnrollment are correctly pointing to Microsoft’s services. This is usually fine if Entra join worked, but it’s a foundational piece for MDM enrollment.
On the Windows Device:
- Log in as the user who has the Intune license.
- Go to Settings > Accounts > Access work or school.
- You should see “Connected to ‘s Microsoft Entra ID”.
- Click on this connection, then click the Info button.
- Look for a Sync button. Click it.
  - This action forces the device to re-evaluate its MDM enrollment status with Entra ID. If the user is now in scope and licensed, it should trigger the Intune enrollment process.
- Wait: Enrollment can take a few minutes. You might see a notification, or you can check the Intune portal (Microsoft Intune admin center) under Devices > Windows to see if the device appears and its compliance status.
- Reboot: Sometimes a reboot helps kickstart the process after clicking “Sync.”

Method 2: Enroll via Company Portal App

Ensure Prerequisites: Same as Method 1 (License and MDM User Scope).
On the Windows Device:
- Install the Company Portal app from the Microsoft Store.
- Open the Company Portal app.
- Sign in with the Entra ID credentials of the licensed user.
- The Company Portal app will typically detect that the device isn’t yet managed by Intune and will guide the user through the enrollment process. Follow the on-screen prompts.

Method 3: Enroll Only in Device Management (Less Common for this scenario but an option)

This method is typically for devices that are not Entra ID joined but you want to enroll them into Intune. However, it can sometimes nudge an already Entra ID joined device.

Ensure Prerequisites: Same as Method 1.
On the Windows Device:
- Go to Settings > Accounts > Access work or school.
- Click Connect.
- Crucially, on the “Set up a work or school account” screen, look for a link that says something like “Enroll only in device management” or similar phrasing. Do not just type the email address in the main box, as that will try to Entra ID join it (which it already is).
- Enter the user’s Entra ID email address and follow the prompts.

Troubleshooting & Verification:

Check Intune Portal: After attempting enrollment, go to the Microsoft Intune admin center (intune.microsoft.com) > Devices > Windows. Search for the device. It might take 5-30 minutes (sometimes longer) to appear or update its status.
Event Viewer on the Device:
- Open Event Viewer.
- Navigate to Applications and Services Logs > Microsoft > Windows > DeviceManagement-Enterprise-Diagnostics-Provider > Admin.
- Look for events related to MDM enrollment (Event ID 75 or 76 often indicate successful enrollment). Errors here can give clues.
Check MDM URLs in Registry (Advanced):
- Open Registry Editor (regedit).
- Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Enrollments.
- Look for a subkey with a GUID. Inside, you should find values like DiscoveryServiceFullUrl, EnrollmentServiceFullUrl, PolicyServiceFullUrl pointing to Intune services (e.g., https://enrollment.manage.microsoft.com/...). If these are present, enrollment likely succeeded or is in progress.
Patience: Sometimes it just takes a little while for all the syncs to happen.

Last Resort (If the above fails and you’re sure licensing/scoping is correct):

Disconnect from Entra ID and Rejoin:
- Backup important local data if any.
- Go to Settings > Accounts > Access work or school.
- Click the “Connected to ‘s Microsoft Entra ID” account and click Disconnect. Confirm the disconnection.
- Reboot the device.
- After rebooting, go back to Settings > Accounts > Access work or school.
- Click Connect.
- Choose to Join this device to Microsoft Entra ID and sign in with the licensed user’s credentials.
- This fresh join process should trigger the Intune enrollment immediately, assuming automatic enrollment is configured.

Start with Method 1 (Sync button) as it’s the least invasive. Method 2 (Company Portal) is also very reliable.

Benefits of using KQL to improve the security

What is KQL?

KQL is a powerful, read-only query language designed to explore data and discover patterns. It’s used across various Microsoft services, most notably for our discussion:

Microsoft Sentinel: A cloud-native SIEM (Security Information and Event Management) and SOAR (Security Orchestration, Automation, and Response) solution.
Microsoft 365 Defender: An XDR (Extended Detection and Response) platform that provides integrated threat protection, detection, and response across endpoints, identities, email, and cloud apps. Its “Advanced Hunting” feature uses KQL.

Essentially, KQL allows you to “talk” to the vast amounts of security log data generated by your M365 services.

Benefits of Using KQL to Improve M365 Tenant Security:

Proactive Threat Hunting:
- Beyond Built-in Detections: While Microsoft provides many out-of-the-box detections, KQL allows you to hunt for specific, emerging threats, anomalous behaviors, or indicators of compromise (IOCs) that might not trigger a standard alert.
- Hypothesis-Driven Investigation: You can form a hypothesis (e.g., “Are there any unusual external email forwarding rules set up?”) and use KQL to validate it against your logs.
Deep Incident Investigation & Root Cause Analysis:
- Contextual Understanding: When an alert fires, KQL lets you dive deep into the raw logs (Azure AD sign-ins, Exchange mail flow, SharePoint activity, Defender alerts, etc.) to understand the full scope, timeline, and impact of an incident.
- Connecting the Dots: You can join data from different sources (e.g., correlate a suspicious sign-in with subsequent file access or email activity) to build a complete picture.
Custom Detection Rule Creation:
- Tailored Alerts: If you identify a pattern of malicious activity specific to your environment or a new threat vector, you can write KQL queries and turn them into custom analytic rules in Microsoft Sentinel or custom detection rules in M365 Defender. This automates the detection of future occurrences.
- Reduced False Positives: By crafting precise KQL queries, you can fine-tune detection logic to minimize false positives and focus on genuine threats.
Enhanced Visibility & Reporting:
- Custom Dashboards & Workbooks: KQL queries can power custom dashboards and workbooks in Sentinel, providing tailored views of your security posture, trends, and key metrics (e.g., risky sign-ins by location, malware detections over time).
- Compliance & Auditing: Extract specific data needed for compliance reporting or internal audits, such as administrator activity logs or access to sensitive data.
Understanding Your Environment:
- Baseline Activity: Use KQL to understand normal patterns of behavior in your tenant. This makes it easier to spot deviations that could indicate a security issue.
- Configuration Audits: Query configurations (e.g., MFA status, conditional access policies, sharing settings) to ensure they align with security best practices.
Speed and Scalability:
- KQL is optimized for querying massive datasets very quickly, which is essential when dealing with the volume of telemetry generated by M365 services.

How to Get Started Using KQL for M365 Security:

Access the Right Portals:
- Microsoft 365 Defender Portal (security.microsoft.com):
  - Navigate to Hunting > Advanced Hunting. This is where you’ll query data from Defender for Endpoint, Defender for Office 365, Defender for Identity, Defender for Cloud Apps, and Azure AD Identity Protection.
- Microsoft Sentinel (via Azure Portal portal.azure.com):
  - Navigate to your Log Analytics Workspace connected to Sentinel, then select Logs. This is where you’ll query data ingested into Sentinel, which can include M365 logs, Azure activity, third-party logs, etc.
Ensure Data Ingestion (Prerequisite):
- For Microsoft 365 Defender Advanced Hunting: Most data from the Defender suite is automatically available.
- For Microsoft Sentinel: You need to set up Data Connectors for the M365 services you want to query (e.g., Azure Active Directory, Office 365, Microsoft Defender for Cloud Apps).
Learn Basic KQL Syntax:
- KQL queries are a sequence of data transformation steps piped (|) together.
- TableName: Start by specifying the table you want to query (e.g., SigninLogs, EmailEvents, DeviceEvents).
  - In Advanced Hunting, the schema is usually pre-loaded on the left.
  - In Sentinel (Logs), you can see available tables in the schema pane.
- | where Condition: Filters rows based on a condition (e.g., | where ResultType == "50126" for failed logins due to MFA).
- | project Column1, Column2: Selects specific columns.
- | summarize Aggregation by GroupingColumn: Aggregates data (e.g., | summarize count() by UserPrincipalName).
- | top N by Column [desc/asc]: Shows the top N results.
- | extend NewColumn = Calculation: Creates a new column.
- | join kind=inner (OtherTable) on CommonColumn: Combines rows from two tables.
- Time Range: Use the time picker in the UI or specify in the query (e.g., | where TimeGenerated > ago(1d)).
Explore Schemas and Tables:
- In both Advanced Hunting and Sentinel Logs, there’s a schema explorer. Familiarize yourself with the available tables and their columns. Common tables include:
  - M365 Defender: IdentityLogonEvents, EmailEvents, UrlClickEvents, DeviceProcessEvents, CloudAppEvents.
  - Sentinel (often from Azure AD): SigninLogs, AuditLogs, OfficeActivity, SecurityAlert.

Start with Simple Queries and Build Up:

Example: See the last 10 sign-ins.

SigninLogs // Or IdentityLogonEvents in M365 Defender
| top 10 by TimeGenerated desc

Example: Count failed sign-ins by user in the last day.

SigninLogs
| where TimeGenerated > ago(1d)
| where ResultType != 0 and ResultType != 50140 // Filter for various failure codes, 0 and 50140 are common success/interrupts
| summarize FailureCount = count() by UserPrincipalName
| top 10 by FailureCount desc

Use IntelliSense and Built-in Help:
- The query editors in both portals have IntelliSense to help you with table names, column names, and operators.
- Look for example queries or templates provided by Microsoft.
Leverage Microsoft’s Learning Resources:
- Microsoft Learn KQL Path: Search for “KQL” on Microsoft Learn. There are excellent modules.
- Microsoft Sentinel Documentation: Full of KQL examples for security scenarios.
- Microsoft 365 Defender Advanced Hunting Documentation: Similar to Sentinel docs but focused on Defender data.
- GitHub Repositories: Microsoft and the community share many KQL queries for Sentinel and M365 Defender on GitHub.
Practice, Practice, Practice:
- Take an existing alert and try to find the related raw logs.
- Think of a security question (e.g., “Has anyone downloaded an unusual number of files from SharePoint recently?”) and try to answer it with KQL.

Example KQL Queries for M365 Security:

Suspicious Sign-in Locations (Sentinel – SigninLogs):

SigninLogs
| where TimeGenerated > ago(7d)
| where Location != "YourExpectedCountry" // Be more specific with IPs or city if possible
| summarize count() by UserPrincipalName, Location, IPAddress
| sort by count_ desc

New Email Inbox Forwarding Rule (M365 Defender – CloudAppEvents):

CloudAppEvents
| where TimeGenerated > ago(1d)
| where Application == "Microsoft Exchange Online"
| where ActionType == "New-InboxRule"
| where RawEventData has "ForwardTo" or RawEventData has "RedirectTo"
| project Timestamp, AccountObjectId, UserAgent, RawEventData

Potentially Malicious File Downloads by a User (M365 Defender – CloudAppEvents for SharePoint/OneDrive):

CloudAppEvents
| where TimeGenerated > ago(1d)
| where ActionType == "FileDownloaded"
| where Application in ("Microsoft SharePoint Online", "Microsoft OneDrive for Business")
// Optional: add filters for specific file types if known (e.g., | where FileName endswith ".exe" or FileName endswith ".ps1")
| summarize FilesDownloaded = dcount(FileName), TotalSize = sum(tolong(RawEventData.FileSize)) by Actor = UserPrincipalName, bin(TimeGenerated, 1h)
| where FilesDownloaded > 10 // Example threshold

Key Takeaway:

KQL is an indispensable skill for modern security operations in the Microsoft ecosystem. It empowers you to move from reactive alert chasing to proactive threat hunting and deep investigation, significantly improving your M365 tenant’s security posture. Start simple, leverage the available resources, and gradually build your expertise.

How effective is enabling Windows Attack Surface Reduction in preventing a Windows device from Malware?

Enabling Windows Attack Surface Reduction (ASR) rules is **highly effective** in preventing a Windows device from many common types of malware and attack techniques. It’s a crucial component of a defense-in-depth strategy.

However, it’s not a silver bullet and its effectiveness depends on several factors.

Here’s a breakdown of its effectiveness:

How ASR Works and Why It’s Effective:

Targets Common Attack Vectors: ASR rules are specifically designed to block behaviors commonly used by malware to infect machines and execute malicious code. This includes:
- Office Application Abuse: Blocking Office apps from creating executable content, injecting into other processes, creating child processes, or running macros deemed malicious.
- Script-Based Attacks: Blocking obfuscated scripts (JavaScript, VBScript, PowerShell), or scripts that download/run payloads.
- Email-Based Threats: Blocking executable content from email clients and webmail.
- Exploitation Techniques: Preventing credential stealing (e.g., from LSASS), process hollowing, or unsigned/untrusted executables from running from USB drives.
- Ransomware Behaviors: Some rules can help mitigate common ransomware tactics.
Pre-Execution and Early-Execution Prevention: Many ASR rules intervene before malware fully executes or early in its execution chain, stopping the attack before significant damage occurs. This is more proactive than relying solely on detection of already-running malware.
Reduces Reliance on Signatures: While traditional AV relies heavily on signatures for known malware, ASR focuses on behaviors. This makes it more effective against new or polymorphic malware that might not have a signature yet.
Complements Antivirus: ASR works alongside Microsoft Defender Antivirus (or other AV solutions) and Endpoint Detection and Response (EDR) solutions like Microsoft Defender for Endpoint. It adds an extra layer of proactive defense.

Factors Influencing Effectiveness:

Which Rules Are Enabled: There are many ASR rules. Not all may be suitable for every environment. Enabling more relevant rules increases protection. Some key high-impact rules include:
- Block Office applications from creating child processes.
- Block Adobe Reader from creating child processes.
- Block execution of potentially obfuscated scripts.
- Block credential stealing from the Windows local security authority subsystem (lsass.exe).
- Block executable content from email client and webmail.
Mode of Operation (Audit vs. Block):
- Audit Mode: Logs what would have been blocked. Essential for testing and identifying potential legitimate application conflicts (false positives) before enabling block mode. Provides visibility but no active prevention.
- Block Mode: Actively prevents the flagged behaviors. This is where the true preventative power lies.
Exclusions: Properly configured exclusions are necessary for legitimate applications that might otherwise trigger ASR rules. Overly broad exclusions can reduce effectiveness.
Configuration and Management: Consistent deployment and management (e.g., via Group Policy, Intune, MEMCM) ensure all devices are protected.
Attacker Sophistication: While ASR stops many common TTPs (Tactics, Techniques, and Procedures), highly sophisticated attackers might find novel ways to bypass specific rules or use techniques not covered by ASR.
Keeping Systems Updated: Microsoft continually updates ASR rules and the underlying Defender platform to address new threats and improve detection logic.

Limitations:

False Positives: The primary challenge. Some legitimate applications, especially older or custom-developed ones, might exhibit behaviors that trigger ASR rules. Thorough testing in audit mode is crucial.
Not a Complete Solution: ASR doesn’t cover every conceivable attack vector. It won’t stop zero-day exploits against unpatched vulnerabilities if the exploit doesn’t trigger a specific ASR rule behavior.
User Experience: If not carefully tuned, blocking legitimate actions can frustrate users.

Conclusion:

Enabling Windows Attack Surface Reduction rules is a very effective proactive measure to significantly reduce the likelihood of malware infection from common attack vectors. It raises the bar for attackers, forcing them to use less common or more sophisticated techniques.

For maximum effectiveness:

Start in Audit Mode: Understand the impact on your environment.
Gradually Enable Rules in Block Mode: Prioritize rules that block high-risk behaviors with low potential for false positives first.
Monitor and Tune: Continuously review ASR logs and adjust exclusions as needed.
Use in Conjunction with Other Security Layers: ASR should be part of a comprehensive security strategy that includes antivirus, EDR, firewalls, patching, and user education.

When implemented thoughtfully, ASR is a powerful, built-in tool that provides a substantial boost to Windows endpoint security.

Getting started with the Microsoft Power Platform

The goal is to empower you (and your colleagues) to build solutions *without* necessarily needing deep coding expertise, focusing on productivity boosts and automating those repetitive tasks.

What is the Power Platform?

Think of it as a suite of low-code/no-code tools that work seamlessly with Microsoft 365 (and many other services) to:

Power Apps: Build custom applications (mobile or web) for specific tasks or processes.
Power Automate: Automate workflows and repetitive tasks between different apps and services.
Power BI: Analyze data and create interactive dashboards and reports (often used alongside the others, but slightly different focus).
Power Virtual Agents: Build intelligent chatbots without code.
(Underlying) Dataverse: A secure, scalable data platform to store and manage data used by your Power Platform solutions (think of it as a sophisticated database optimized for business apps).

For quick and easy productivity gains and automation, we’ll primarily focus on Power Apps and Power Automate.

Prerequisites & Access

Microsoft 365 License: Most standard Microsoft 365 Business or Enterprise licenses (like E3, E5, Business Standard, Business Premium) include foundational Power Platform capabilities. This typically covers:
- Running apps.
- Creating flows with Standard connectors (like SharePoint, Outlook, Teams, OneDrive, Forms, Excel Online).
- Limited Dataverse usage.
- Important Note: Using Premium connectors (like SQL Server, Salesforce, custom APIs), AI Builder features, RPA (Robotic Process Automation), or extensive Dataverse capacity often requires additional standalone Power Apps or Power Automate licenses. Start with what’s included first!
Accessing the Tools:
- Go to Office.com and sign in with your work account.
- Click the App Launcher (the “waffle” icon, 9 dots) in the top-left corner.
- You should see icons for Power Apps and Power Automate. If not, click “All apps”.
- Alternatively, go directly to:
  - make.powerapps.com for Power Apps
  - make.powerautomate.com (or flow.microsoft.com) for Power Automate

Getting Started: The Strategy

The key is to start small and focus on a specific pain point. Don’t try to boil the ocean.

Identify a Bottleneck or Repetitive Task: What’s something you or your team does regularly that is manual, time-consuming, or prone to errors?
- Examples: Manually copying data from an email into a spreadsheet, chasing people for approvals, collecting information via long email chains, tracking simple requests on paper or a shared doc.
Choose the Right Tool (Initially):
- Need to automate a process that runs in the background? (e.g., save email attachments, notify a team when a file is updated, request approval) -> Power Automate is likely your best bet.
- Need a user interface to interact with data or kick off a process? (e.g., a simple form to submit requests, a way to view and update items in a list, a checklist app) -> Power Apps is probably the way to go. Often, Power Apps and Power Automate work together.
Leverage Templates: This is the ABSOLUTE EASIEST way to start. Both Power Apps and Power Automate have extensive template galleries based on common scenarios.
Connect Your M365 Services: The real power comes from connecting the tools you already use (Outlook, Teams, SharePoint, OneDrive, Forms, Planner, etc.).
Build, Test, Iterate: Your first attempt won’t be perfect. Build something simple, test it, get feedback, and refine it.

Detailed Steps with Examples:

Scenario 1: Automating Email Attachments to OneDrive (Using Power Automate)

Pain Point: You receive regular reports via email from a specific sender and have to manually save the attachments to a designated OneDrive folder.
Tool: Power Automate
Steps:
1. Go to make.powerautomate.com.
2. On the left menu, click Templates.
3. Search for “Save email attachments to OneDrive”. You’ll find several variations. Select one like “Save Office 365 email attachments to a specified OneDrive for Business folder”.
4. Review the flow description and the connections it needs (Office 365 Outlook, OneDrive for Business).
5. Click Continue. Power Automate will check if you’re already signed into these services or prompt you to sign in.
6. Configure the Trigger: The template likely starts with the “When a new email arrives (V3)” trigger. You need to customize it:
  - Folder: Usually Inbox.
  - From: Enter the specific email address of the sender.
  - Include Attachments: Set to Yes.
  - Subject Filter: (Optional but recommended) Enter keywords from the subject line to be more specific (e.g., “Weekly Report”).
7. Configure the Action(s): The template will have actions like “Apply to each” (to handle multiple attachments) and “Create file” (for OneDrive).
  - In the “Create file” action:
    - Folder Path: Click the folder icon and navigate to the exact OneDrive folder where you want to save the files.
    - File Name: The template usually pre-fills this with Attachments Name (dynamic content from the trigger). This is good.
    - File Content: The template usually pre-fills this with Attachments Content. This is also good.
8. Save the flow.
9. Test the flow. You can use the “Test” button in the top-right. Choose “Manually” and then trigger the flow by having an email sent that matches your criteria (or use a recent email if available via automatic testing).
10. Turn it On: Once saved, the flow is active and will run automatically whenever a new email matching your criteria arrives.
Productivity Gain: Saves you minutes every time that email arrives, reduces the chance of forgetting, and keeps files organized automatically.

Scenario 2: Creating a Simple Request Form/Tracker (Using Power Apps & SharePoint)

Pain Point: Your team uses email or chat to request small IT support items, making them hard to track and manage.
Tools: SharePoint (for data storage), Power Apps (for the user interface)
Steps:
1. Create a SharePoint List:
  - Go to your team’s SharePoint site (or create a new one).
  - Click + New > List.
  - Choose Blank list. Name it something like “IT Support Requests”.
  - Add columns relevant to the request:
    - Title (Rename to “Short Description” – required by default)
    - Requester (Person or Group column, default to current user)
    - RequestDetails (Multiple lines of text)
    - Urgency (Choice column: High, Medium, Low)
    - Status (Choice column: New, In Progress, Completed, Cancelled – default to ‘New’)
    - AssignedTo (Person or Group column – optional initially)
    - CompletionDate (Date and Time column – optional)
2. Create the Power App:
  - Go to make.powerapps.com.
  - Click Create > SharePoint.
  - It will ask you to select or enter a SharePoint site URL. Find your site.
  - Select the “IT Support Requests” list you just created.
  - Click Create.
3. Automatic App Generation: Power Apps will automatically generate a basic 3-screen app (Browse, View Details, Edit/Create New) based on your SharePoint list columns!
4. Customize (Optional but Recommended):
  - Browse Screen: Select the gallery (the list of items). In the right-hand pane (or top formula bar), you can change which fields are displayed. Maybe show Title, Requester, and Status.
  - Edit/New Screen: Select the form. In the right-hand pane, click “Edit fields”. You can reorder fields, change control types (e.g., make RequestDetails bigger), or remove fields you don’t want users filling in (like AssignedTo if only IT assigns). Set the default value for Status to “New”.
  - Theme/Colors: Use the “Theme” option on the Home tab to quickly change the look and feel.
5. Save the app (give it a meaningful name like “IT Request App”).
6. Publish the app.
7. Share the app:
  - Click Share (top right or from the app list).
  - Enter the names or email addresses of the colleagues who need to submit requests.
  - Crucially: Make sure they also have permission to access the underlying SharePoint list! Grant them “Contribute” access to the list itself in SharePoint.
  - Decide if you want to send an email invitation.
8. Accessing the App: Users can access the app via the Power Apps mobile client, directly from the web link you share, or you can even embed it within a SharePoint page or Microsoft Teams tab for easier access.
Productivity Gain: Centralized request tracking, standardized information collection, clear status visibility, replaces messy email/chat trails.

Further Steps & Learning:

Explore More Templates: Both Power Apps and Power Automate have hundreds. Browse them for inspiration.
Learn about Connectors: Understand the difference between Standard (included with M365) and Premium (require extra licenses). Explore the vast list of available connectors.
Combine Power Apps and Power Automate:
- Trigger a Power Automate flow from a Power App button (e.g., when a new IT request is submitted in the app, trigger a flow to post a notification in a Teams channel).
- Use Power Automate to update data that your Power App displays.
Microsoft Learn: This is your BEST resource for structured learning. Search for Power Apps and Power Automate paths and modules – many are beginner-focused. (learn.microsoft.com)
Power Platform Community: Ask questions, see what others are building. (powerusers.microsoft.com)
Experiment: The best way to learn is by doing. Pick another small task and try to build a solution! Don’t be afraid to try things out in the editor.

Key Mindset:

Low-Code, Not No-Effort: While you don’t need traditional coding, you do need to think logically about process steps (for Automate) and user interface design (for Apps).
Iterative Improvement: Your first version is just the start. Use it, get feedback, and make it better over time.
Focus on Value: Prioritize automating tasks or building apps that provide the most significant time savings or process improvements first.

By starting small, using templates, and focusing on your existing M365 tools, you can quickly begin leveraging the Power Platform to make a real difference in your daily productivity and reduce manual work. Good luck!

Need to Know podcast–Episode 345

Join me for the latest news an updates from the Microsoft Cloud just on eve of Microsoft Build. Microsoft 365 Copilot Wave 2 is upon u and I provide some thoughts and information on what to expect as well as some thoughts around why data is the important thing to consider with AI rather than which model might currently be better. Listen along and let me know your thoughts.

Brought to you by www.ciaopspatron.com

you can listen directly to this episode at:

https://ciaops.podbean.com/e/episode-345-its-all-about-the-data/

Subscribe via iTunes at:

https://itunes.apple.com/au/podcast/ciaops-need-to-know-podcasts/id406891445?mt=2

or Spotify:

https://open.spotify.com/show/7ejj00cOuw8977GnnE2lPb

Don’t forget to give the show a rating as well as send me any feedback or suggestions you may have for the show.

Resources

@directorcia

Join my shared channel

CIAOPS merch store

Become a CIAOPS Patron

Microsoft 365 Copilot Wave 2 Spring updates

Microsoft 365 Copilot: Built for the era of human–agent collaboration

2025 release wave 1 brings hundreds of updates to Microsoft Dynamics 365 and Power Platform

What’s new in Copilot Studio: April 2025

Researcher agent in Microsoft 365 Copilot

Analyst agent in Microsoft 365 Copilot

What’s new in the Microsoft 365 Copilot app – April 2025

Announcing Public Preview of DLP for M365 Copilot in Word, Excel, and PowerPoint

Explore practical best practices to secure your data with Microsoft Purview

Project Manager in Planner Demo

What’s new in Microsoft Intune: April 2025

Introducing ActorInfoString: A New Era of Audit Log Accuracy in Exchange Online

Advanced deployment guide for Conditional Access Policy templates

Enforce device compliance and app protection policies on BYOD with M365 Business premium

M365 Business Premium is well-suited for this because it includes key components like:

Microsoft Intune (Part of Microsoft Endpoint Manager): For Mobile Device Management (MDM) and Mobile Application Management (MAM).
Azure Active Directory (Azure AD) Premium P1: Provides Conditional Access policies, which are crucial for enforcement.
Information Protection Features: For data security.

Here’s a step-by-step approach, focusing on the least intrusive but effective methods for BYOD:

Core Strategy: Prioritize App Protection Policies (MAM) without Full Device Enrollment (MDM)

This is often the preferred approach for BYOD because it protects corporate data within specific apps without taking full control over the user’s personal device. It respects user privacy while securing business information.

Steps:

Configure App Protection Policies (APP / MAM Policies):
- Go to the Microsoft Endpoint Manager admin center: (endpoint.microsoft.com)
- Navigate: Apps > App protection policies.
- Create Policy: Click “+ Create policy” and select the platform (iOS/iPadOS or Android).
- Basics: Give the policy a descriptive name (e.g., “BYOD App Protection – Android”).
- Apps:
  - Target policy to: Select “All Public Apps” or “Selected Apps”. For BYOD, often start with core Microsoft apps (Outlook, Teams, OneDrive, Edge, Office apps). You can add other MAM-enabled apps later.
  - Important: This policy only applies to apps that support Intune App Protection.
- Data Protection: This is the core. Configure settings like:
  - Prevent backup: Block backing up work data to personal cloud storage (iCloud/Google Cloud).
  - Restrict cut, copy, paste: Control data movement between managed (work) apps and unmanaged (personal) apps. Often set to “Policy managed apps”.
  - Encryption: Ensure app data is encrypted. (Usually enabled by default).
  - Screen capture: Block screen capture for Android (iOS requires device management).
  - Save copies of org data: Prevent saving work files to local/personal storage. Allow saving only to managed locations like OneDrive for Business or SharePoint.
  - Receive data from other apps: Control if managed apps can receive data from unmanaged apps.
  - Open data in Org documents: Control which apps can open work documents.
- Access Requirements: Define how users access the protected apps:
  - PIN for access: Require a separate PIN (or biometrics) to open the work apps. Configure PIN complexity and timeout.
  - Work or school account credentials for access: Force re-authentication after a period of inactivity.
- Conditional Launch: Set conditions that must be met for the app to launch (e.g., block rooted/jailbroken devices, minimum OS version, app version).
- Assignments:
  - Target: Assign the policy to specific Azure AD user groups containing your BYOD users. Do not assign to device groups for MAM-without-enrollment.
- Review + Create: Finalize and create the policy.
Configure Conditional Access Policies in Azure AD:
- This is how you enforce the use of protected apps and check device state (even without full enrollment).
- Go to the Microsoft Endpoint Manager admin center or Azure AD portal: (portal.azure.com)
- Navigate: Endpoint Security > Conditional Access (in MEM) or Azure Active Directory > Security > Conditional Access (in Azure Portal).
- Create New Policy:
  - Name: Give it a clear name (e.g., “CA – Require App Protection for Mobile Access”).
  - Assignments > Users and groups: Target the same user groups as your App Protection Policy.
  - Assignments > Cloud apps or actions: Select the specific M365 services you want to protect (e.g., Exchange Online, SharePoint Online, Teams). Start with “Office 365” (which covers multiple services).
  - Assignments > Conditions > Device platforms: Configure this policy to apply only to iOS and Android.
  - Assignments > Conditions > Client apps: Configure this to apply to “Mobile apps and desktop clients” > “Modern authentication clients” > Select “Mobile apps”.
  - Access Controls > Grant:
    - Select “Grant access”.
    - Choose “Require app protection policy”.
    - Optional but Recommended: Also choose “Require approved client app”. This ensures users are using MAM-capable apps (like Outlook Mobile instead of native mail clients).
    - For “Multiple controls”: Select “Require all the selected controls”.
  - Enable policy: Set to “On”.
  - Create: Save the policy.

User Experience with this Approach:

The user installs a managed app (e.g., Outlook) from the public app store.
They sign in with their work (Azure AD) account.
Conditional Access checks if access is allowed. The policy requires an app protection policy.
The user is prompted that their organization protects data in the app. They may be prompted to install the Microsoft Authenticator (on Android) or the Company Portal app (on iOS/Android). Crucially, they do NOT need to fully enroll their device via the Company Portal. The Company Portal app simply needs to be present to receive and report the APP status.
The App Protection Policy settings are applied to the app (e.g., PIN required, copy/paste restrictions).
The user can now securely access work data within that managed app. Their personal apps and data remain untouched and unmanaged.

Alternative/Additional Strategy: Device Compliance (Requires Enrollment – MDM)

If you need stronger device-level controls (e.g., enforcing screen lock complexity on the device itself, checking for device encryption, ensuring minimum OS), you need users to enroll their devices into Intune (MDM). This is more intrusive for BYOD and users might resist.

Steps (If Choosing Enrollment):

Configure Enrollment Restrictions: (MEM Admin Center > Devices > Enroll devices > Enrollment device platform restrictions) Ensure personal iOS/Android devices are allowed to enroll if you intend to support this.
Create Device Compliance Policies: (MEM Admin Center > Devices > Compliance policies)
- Create separate policies for iOS and Android.
- Configure settings like: Minimum/Maximum OS Version, Require PIN/Password, Require Encryption, Device Threat Level (if using Defender for Endpoint), Block rooted/jailbroken devices.
- Assign these policies to user groups.
Modify/Create Conditional Access Policies:
- Instead of (or in addition to) “Require app protection policy,” add the grant control “Require device to be marked as compliant”.
- You can combine these: Require a compliant device AND require app protection policy for maximum security on enrolled BYOD devices.

User Experience with Enrollment:

User installs the Company Portal app.
User signs in and follows the prompts to enroll their device. This grants Intune management capabilities over the device.
Intune checks the device against the assigned Compliance Policy.
If compliant, the device is marked as such in Azure AD.
Conditional Access policies check for this compliance status before granting access to corporate resources.
App Protection Policies can still be applied for layered data security within apps, even on enrolled devices.

Summary & Recommendation:

For BYOD, start with App Protection Policies (MAM) without enrollment, enforced by Conditional Access requiring App Protection and Approved Client Apps. This provides strong data security within work apps with minimal impact on the user’s personal device.
Use Device Compliance Policies (MDM) requiring enrollment only if you have specific, strong requirements for device-level settings and your users consent to this level of management on their personal devices.
Always communicate clearly with users about what is being managed and why, especially with BYOD.
Test thoroughly with pilot groups before rolling out broadly.

By leveraging App Protection Policies and Conditional Access, Microsoft 365 Business Premium offers a powerful and flexible way to secure corporate data on BYOD smartphones while respecting user privacy.

Storage limits for Microsoft 365 Business Premium and Microsoft 365 Enterprise E5

The main differences lie in OneDrive per-user storage potential and Exchange Online mailbox/archive sizes and capabilities. SharePoint storage calculation is generally the same, but E5 often caters to larger organizations, potentially leading to more overall pooled storage.

Here’s a comparison table:

Feature/Service	Microsoft 365 Business Premium	Microsoft 365 Enterprise E5	Key Difference
OneDrive for Business (Per-User File Storage)	1 TB per user (default) Can often be increased by admin to 5 TB, sometimes 25 TB under specific conditions.	Starts at 1 TB per user Admin can increase to 5 TB, then 25 TB. For plans with 5+ users, can request unlimited (initially provisioned as 25 TB, then 25 TB SharePoint site collections per user).	Business Premium maxes out (typically 5TB/25TB), E5 can go beyond with admin steps.
SharePoint Online (Tenant Pooled Storage)	1 TB base tenant storage + 10 GB per licensed user Storage is pooled across all sites.	1 TB base tenant storage + 10 GB per licensed user Storage is pooled across all sites.	No difference in calculation. Total pooled storage depends on user count. E5 tenants might have more total storage due to higher user counts typically.
Exchange Online (Primary Mailbox)	50 GB Primary Mailbox (Comes with Exchange Online Plan 1)	100 GB Primary Mailbox (Comes with Exchange Online Plan 2)	E5 has double the primary mailbox size (due to Exchange Online Plan 2 vs Plan 1).
Exchange Online (Archive Mailbox)	50 GB Archive Mailbox (Standard, separate archive)	1.5 TB Archive Mailbox (Initially 100GB) Auto-Expanding Archiving enabled by default.	Business Premium has a fixed 50 GB archive. E5’s archive can grow massively.
Microsoft Teams (File Storage)	Files stored in SharePoint/OneDrive. Subject to those respective limits.	Files stored in SharePoint/OneDrive. Subject to those respective limits.	No direct difference. Storage limits are dictated by SharePoint/OneDrive.
Stream (on SharePoint) (Video Storage)	Videos stored in SharePoint/OneDrive. Subject to those respective limits.	Videos stored in SharePoint/OneDrive. Subject to those respective limits.	No direct difference. Storage counts against SharePoint/OneDrive pooled storage.

Key Takeaways & Nuances:

OneDrive: The biggest potential difference. While both start at 1 TB, E5 offers a path to effectively unlimited storage per user (requires admin configuration and meeting criteria like having 5+ E5 licenses). Business Premium has clearer upper limits (usually 5 TB or potentially 25 TB with admin intervention).
Exchange Mailbox: E5 provides significantly larger primary mailboxes (100 GB vs 50 GB).
Exchange Archive: This is a major E5 advantage. Business Premium has a standard 50 GB archive. E5 includes Auto-Expanding Archiving, which starts larger (100 GB) and can automatically grow up to 1.5 TB, removing significant storage headaches for long-term email retention.
SharePoint: The calculation for pooled tenant storage is identical (1 TB base + 10 GB per user). An organization with E5 licenses might have more total SharePoint storage simply because they have more users, but the formula per user is the same.
Admin Action: Increasing OneDrive storage beyond the initial 1 TB (in either plan) usually requires administrator configuration. The “unlimited” OneDrive in E5 requires specific admin steps and meeting license count prerequisites.
Add-on Storage: Both plans allow for purchasing additional SharePoint storage if the pooled limit is reached.

In summary, Microsoft 365 E5 offers substantially more generous storage limits and capabilities, particularly for individual user file storage (OneDrive potential) and email archiving (Exchange Online Auto-Expanding Archive). Business Premium provides ample storage for many small-to-medium businesses but has stricter upper bounds compared to E5’s potential.