If you found this valuable, the I’d appreciate a ‘like’ or perhaps a donation at https://ko-fi.com/ciaops. This helps me know that people enjoy what I have created and provides resources to allow me to create more content. If you have any feedback or suggestions around this, I’m all ears. You can also find me via email director@ciaops.com and on X (Twitter) at https://www.twitter.com/directorcia.
If you want to be part of a dedicated Microsoft Cloud community with information and interactions daily, then consider becoming a CIAOPS Patron – www.ciaopspatron.com.
Recently, I detailed how I used a variety of Ai services with the same prompt to compare the generated results. You can read that initial article here:
The next step in this journey is now to start comparing them. For that I have used Microsoft 365 Copilot with GPT5 enabled. Here’s a concise summary of the key differences across the seven CIAOPS posts:
1. Audience & Tone
Aug 28 (ChatGPT DR): Short, practical overview for SMB IT/MSPs.
Aug 29 (Copilot Researcher): Formal, report‑style for CIO/CFO decision‑makers.
Aug 30 (Copilot Studio GPT‑5): Practitioner‑centric with actionable steps.
Aug 31 (Deepseek DR): Conceptual, explains “de‑perimeterization.”
Sep 1 (Gemini DR): Strategic, cost‑focused for board/C‑suite.
Sep 2 (ChatGPT): Feature‑inventory framing for non‑technical buyers.
Sep 3 (M365 Copilot GPT): Visionary/philosophical capstone on Zero Trust.
2. Unique Angle
Aug 28: Emphasizes App Proxy and host firewall as VPN/WAF alternatives.
Aug 29: Compares traditional firewall roles vs. modern limits; cost lens.
Aug 30: Provides a hardening checklist and “when you still need a firewall.”
Aug 31: Maps NGFW functions to M365 features; identity/data as perimeter.
Sep 1: Argues high‑end firewalls are financially inefficient for SMBs.
Sep 2: Highlights advanced security controls now built into M365 BP.
Sep 3: States perimeter is no longer the main control—identity/device/app is.
3. Depth & Practicality
Most actionable: Aug 30 (step‑by‑step baseline + decision criteria).
Most strategic: Sep 1 and Aug 29 (budget and governance framing).
Most conceptual: Aug 31 and Sep 3 (Zero Trust philosophy).
Most feature‑focused: Sep 2 (inventory of built‑in controls).
Here’s a comparison table summarizing the key differences across the seven CIAOPS posts
Post & Date
Audience & Tone
Unique Angle
Depth & Practicality
Aug 28 – ChatGPT (Deep Research)
SMB IT / MSPs; concise
App Proxy & host firewall as VPN/WAF alternatives
Moderate detail; quick read
Aug 29 – Copilot Researcher
CIO/CFO; formal report
Traditional firewall roles vs. modern limits; cost analysis
High-level strategy; structured
Aug 30 – Copilot Studio (GPT-5)
Admins/MSPs; hands-on
Hardening checklist + “when you still need a firewall”
Most actionable; step-by-step
Aug 31 – Deepseek (Deep Research)
SMB leaders; conceptual
Identity/data as the new perimeter; function mapping
Conceptual depth; less prescriptive
Sep 1 – Gemini (Deep Research)
Board/C-suite; strategic
Financial inefficiency of high-end firewalls for SMBs
Strategic recommendation
Sep 2 – ChatGPT
Non-technical buyers
Inventory of advanced security controls in M365 BP
Feature-focused; overview
Sep 3 – M365 Copilot (GPT)
Vision/strategy leaders
“Perimeter is no longer the main control” (Zero Trust)
If you are a regular reader of my blog, and I hope you are, you may have noticed a number of articles around a similar topic recently. A very common question these days is ‘What is the best AI service to use?’.
It turns out that the answer to that question is not straightforward. The reason is that AI models produce results ‘probabilistically’. This means, the answers are generated using probability based on the prompt that was made. Thus, even if you use exactly the same prompt, in exactly the same service, it is unlikely that you’ll get exactly the same answer, thanks to probability.
Thus, to provide some answers hopefully, I used the same prompt in a number of different AI tools and results can be found here:
Also, where possible, I used the same AI tool to create the image for the post, although not all tools provide this capability. I also used the ‘deep research’ option of the tool if it was available.
So, you can go and look at each results and judge the results for yourself and I’d love you to share what you think or the differences you have seen between different tools out there.
My plan going forward with these ‘baseline’ results is to use AI once again to compare and contrast them against each other to find the similarities and differences and report back.
Something I have been waiting on for a while with Entra ID Global Secure Access (GSA) has been the availability of the Internet traffic profile on iOS.
When I check the latest version of Defender on my iDevices I found that this has now been enabled, provided better protection and advanced filtering like I have on other devices.
When I also updated my Windows devices I found that there is a nice new admin console available as well.
Microsoft Entra ID Global Secure Access helps small businesses protect their data and simplify IT by combining secure sign-in, app access, and network protection in one solution. It uses a modern “Zero Trust” approach, which means every user and device is verified before getting access, reducing the risk of cyberattacks. Instead of juggling multiple tools or complex VPNs, you get a single, easy-to-manage system that works for office, remote, and mobile workers. It improves employee experience with one login for all apps, supports flexible work without slowing things down, and scales as your business grows—all while saving costs by replacing multiple security products with one integrated service.
This guide will provide a comprehensive, production-safe approach using both the Microsoft 365 Defender portal and Exchange Online PowerShell. We will start with a baseline of security and then layer on advanced protections. The core strategy involves keeping the default EOP anti-malware policy as a foundational safety net while creating a higher-priority, custom policy for sensitive users, such as executives and finance teams. This ensures critical assets have the most aggressive, up-to-date protection without disrupting the entire organisation. We’ll also cover essential features like the Common Attachment Filter, Safe Attachments, Safe Links, and the Zero-hour Auto Purge (ZAP) engine to defend against a wide array of evolving threats, from zero-day malware to sophisticated phishing attacks.
1. Prerequisites & Licensing Checks
Before you begin, it’s crucial to understand your licensing model.
Exchange Online Protection (EOP): This is the baseline email security included with all Microsoft 365 subscriptions (e.g., Business Basic, Standard, E3). It provides fundamental anti-malware and anti-spam protection.
Microsoft Defender for Office 365 (MDO): This is an add-on or an included feature in higher-tier plans (e.g., Microsoft 365 Business Premium, E5). MDO Plan 1 adds Safe Attachments and Safe Links, while MDO Plan 2 adds advanced hunting, investigation, and automation features (e.g., Threat Explorer, Automated Investigation and Response). This guide assumes you may have an MDO licence and will detail the optional add-ons.
2. Policy Inventory & Strategic Approach
Best Practice: Do not modify the Default anti-malware policy. This ensures a consistent baseline of protection across all users who aren’t covered by a custom policy. Instead, create new, more restrictive policies for targeted, high-risk groups. Policies are processed by priority (0 being the highest), so a new custom policy with priority 0 will apply to its users, and the default policy will catch everyone else.
GUI Method: Inventory Existing Policies
Navigate to the Microsoft Defender portal at https://security.microsoft.com.
Go to Email & collaboration → Policies & rules → Threat policies.
Under the Policies section, click on Anti-malware. You will see the default policy and any custom ones you have created.
PowerShell Method: Inventory Existing Policies
First, connect to Exchange Online.
PowerShell
# Connect to Exchange Online PowerShell
Connect-ExchangeOnline -UserPrincipalName <your-admin-email> -ShowProgress:$true
Then, view the current policies.
PowerShell
# Get all malware filter policies and their associated rules
Get-MalwareFilterPolicy
Get-MalwareFilterRule
3. Recommended Anti-malware Settings
This section details the recommended settings for your new custom anti-malware policy.
GUI Method: Creating a New Policy
In the Microsoft Defender portal, go to the Anti-malware page from the previous step.
Click Create a policy.
Give the policy a descriptive Name (e.g., High-Risk Users - Anti-malware Policy) and a Description. Click Next.
On the Users and domains page, choose the users, groups, or domains you want to protect. For our example, select Groups and search for ExecutiveTeam. Click Next.
On the Protection settings page, configure the following:
Protection settings
Enable zero-hour auto purge for malware: This is a service-side feature that, when enabled, automatically removes previously delivered malicious messages from user mailboxes. It’s a key part of EOP and is highly recommended.
Quarantine policy: Use the default AdminOnlyAccessPolicy. The rationale is simple: end-users should not be able to release malware. This prevents them from accidentally or maliciously releasing a dangerous file.
Common attachments filter
Check Enable common attachments filter. This is a powerful, extension-based block list that is a fantastic first line of defence. The list of file types has been expanded by Microsoft, but you should periodically review it.
Click Customize file types and ensure a robust list of high-risk file types is selected. The list should include: exe, dll, js, jse, vbs, vbe, ps1, com, cmd, bat, jar, scr, reg, lnk, msi, msix, iso, img, 7z, zipx. You can also add other file types that are not needed in your environment, such as wsf, wsh, url.
Notifications
Admin notifications: Check Notify an admin about undelivered messages from internal senders and Notify an admin about undelivered messages from external senders. Use your security mailbox for this (e.g., security@contoso.com).
Sender notifications:Do not enable Notify internal sender or Notify external sender. Notifying external senders can validate their address for future spam, and an internal sender’s mailbox might be compromised, which could alert the attacker.
PowerShell Method: Creating and Configuring the Policy
This script is idempotent (you can run it multiple times without errors) and will create or update the policies as needed.
PowerShell
# --- PowerShell Script to Configure Exchange Online Anti-malware Policies ---
# Define variables for your tenant
$tenantDomain = "contoso.com"
$highRiskGroupName = "ExecutiveTeam"
$adminNotificationMailbox = "security@contoso.com"
$policyName = "High-Risk Users - Anti-malware Policy"
$ruleName = "High-Risk Users - Anti-malware Rule"
# Define the common attachment filter file types
$fileTypes = @(
'ade','adp','ani','app','bas','bat','chm','cmd','com','cpl',
'crt','csh','dll','exe','fxp','hlp','hta','inf','ins','isp',
'jar','js','jse','ksh','lnk','mda','mdb','mde','mdt','mdw',
'mdz','msc','msi','msix','msp','mst','pcd','pif','prg','ps1',
'reg','scr','sct','shb','shs','url','vb','vbe','vbs','wsc',
'wsf','wsh','xnk','iso','img','7z','zipx','docm','xlsm'
)
# Connect to Exchange Online
Connect-ExchangeOnline -UserPrincipalName $adminNotificationMailbox -ShowProgress:$true
# Check if the policy exists
$policy = Get-MalwareFilterPolicy -Identity $policyName -ErrorAction SilentlyContinue
if ($null -ne $policy) {
Write-Host "Policy '$policyName' already exists. Updating settings..." -ForegroundColor Yellow
Set-MalwareFilterPolicy -Identity $policyName `
-Action DeleteMessage `
-EnableFileFilter:$true `
-FileTypes $fileTypes `
-EnableInternalSenderAdminNotifications:$true `
-EnableExternalSenderAdminNotifications:$true `
-AdminDisplayName "Custom policy for high-risk users."
} else {
Write-Host "Policy '$policyName' not found. Creating a new one..." -ForegroundColor Green
New-MalwareFilterPolicy -Name $policyName `
-Action DeleteMessage `
-EnableFileFilter:$true `
-FileTypes $fileTypes `
-EnableInternalSenderAdminNotifications:$true `
-EnableExternalSenderAdminNotifications:$true `
-AdminDisplayName "Custom policy for high-risk users."
}
# Check if the rule exists
$rule = Get-MalwareFilterRule -Identity $ruleName -ErrorAction SilentlyContinue
if ($null -ne $rule) {
Write-Host "Rule '$ruleName' already exists. Updating settings..." -ForegroundColor Yellow
Set-MalwareFilterRule -Identity $ruleName `
-MalwareFilterPolicy $policyName `
-Comments "Applies to high-risk group." `
-SentToMemberOf $highRiskGroupName `
-Priority 0
} else {
Write-Host "Rule '$ruleName' not found. Creating a new one..." -ForegroundColor Green
New-MalwareFilterRule -Name $ruleName `
-MalwareFilterPolicy $policyName `
-Comments "Applies to high-risk group." `
-SentToMemberOf $highRiskGroupName `
-Priority 0
}
Write-Host "Configuration complete. Run 'Get-MalwareFilterPolicy' and 'Get-MalwareFilterRule' to verify." -ForegroundColor Green
4. Defender for Office 365 Add-ons (If Licensed)
These advanced policies provide an additional layer of protection.
Safe Attachments: This sandboxing technology “detonates” email attachments in a virtual environment to detect zero-day malware.
Block: The most secure option. Messages with attachments are held while being scanned. If a threat is found, the message is blocked and quarantined. This can introduce a short delay (minutes) for emails with attachments.
Dynamic Delivery: A balance between security and user experience. The email body is delivered immediately with a placeholder for the attachment. The attachment is delivered once the scan is complete. Use this for users who can tolerate a minor delay on the attachment itself but need the email content right away. For a high-risk user group, Block is often the recommended setting.
Safe Links: This feature scans URLs at the time of the click, not just upon arrival. If a URL is later determined to be malicious, it will be blocked even if it was safe when the email was first received.
Zero-hour Auto Purge (ZAP): ZAP for malware is included in EOP and is enabled by default. MDO adds ZAP for high-confidence phishing and spam. This is a powerful, service-side feature that removes messages that have already been delivered to a user’s inbox if new threat intelligence indicates they are malicious. There is no per-policy PowerShell switch for this; its behaviour is managed by the service and the policy’s action on detection.
5. Quarantine Policies
Quarantine policies control what users can do with messages held in quarantine.
The default quarantine policy for malware (AdminOnlyAccessPolicy) prevents end-users from releasing messages. This is the recommended setting. You can create a new policy and enable notifications or release requests for other threat types (e.g., spam), but for malware, keep it locked down.
You can set up quarantine notifications (digests) for users, which provide a summary of messages in their quarantine.
6. Testing & Validation
Once your policies are configured, you must validate them.
The EICAR Test
Use a safe, legal test file to validate your policies. The EICAR (European Institute for Computer Antivirus Research) test file is a non-malicious file that all major anti-malware programs will detect.
To test the Common Attachment Filter, create a plain text file, rename it to eicar.zip, and place the EICAR string X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H* inside it.
To test Safe Attachments, send a test email with the EICAR file attached (as a .zip or other container) to a user in your test group.
Verifying with Message Trace
In the Microsoft Defender portal, go to Email & collaboration → Exchange message trace.
Search for the test message.
Click on the message to view details. The Event field should show a Fail status with the reason Malware.
Header Analysis: You can also check the message headers. Look for the X-Forefront-Antispam-Report header and the SCL (Spam Confidence Level) and PCL (Phishing Confidence Level) values. A message blocked by an anti-malware policy will have a CAT (Category) entry indicating malware.
7. Ongoing Monitoring & Tuning
Threat Explorer (MDO P2) / Reports (EOP): Regularly review the Threat Explorer (or Reports for EOP) in the Microsoft Defender portal to see what threats are being blocked. This helps you identify trends, attack vectors, and potential false positives.
Configuration Analyzer: Located under Email & collaboration → Policies & rules → Threat policies → Configuration analyzer, this tool compares your custom policies to Microsoft’s recommended Standard and Strict preset security policies. Use it to find and fix settings that are less secure than the recommended baselines.
ORCA Module: The Office 365 Recommended Configuration Analyzer (ORCA) is a community-developed PowerShell module that provides a comprehensive report of your M365 security posture. While not an official Microsoft tool, it’s an excellent resource for a deeper dive.
False Positive/Negative Submissions: If a legitimate message is blocked (false positive) or a malicious message gets through (false negative), you must submit it to Microsoft for analysis to improve their detection engines. The submission workflow is found under Actions & submissions → Submissions in the Microsoft Defender portal.
8. Change Control & Rollback
Documentation: Always document any changes made to a policy, including the date, reason, and the specific settings changed.
Phased Rollout: When creating a new policy, first apply it to a small test group before rolling it out to production users.
Rollback: If you encounter issues, you can disable the custom policy in the GUI by toggling its status to Off or with PowerShell using Set-MalwareFilterRule -Identity "Rule Name" -State Disabled. You can also decrease its priority to ensure it no longer applies.
9. Final Checklist
Use this checklist to ensure all best practices have been implemented.
[ ] Prerequisites: Confirm M365 Business Premium or Defender for Office 365 licensing for advanced features.
[ ] Policy Strategy: Leave the default anti-malware policy untouched as a safety net.
[ ] New Policy: Create a new custom anti-malware policy for high-risk users/groups (e.g., ExecutiveTeam).
[ ] Action: Set the action for malware detection to Quarantine the message.
[ ] Common Attachment Filter: Enable and verify a comprehensive list of high-risk file extensions.
[ ] Admin Notifications: Configure admin notifications for malware detections.
[ ] Sender Notifications: Disable notifications for both internal and external senders.
[ ] Safe Attachments (if licensed): Configure a new policy and set the action to Block for high-risk users.
[ ] Safe Links (if licensed): Configure a new policy to scan URLs in emails at the time of click.
[ ] Quarantine Policies: Confirm the quarantine policy for malware is set to AdminOnlyAccessPolicy to prevent user releases.
[ ] Testing: Send a test email with a containerised EICAR file to a user in the new policy’s scope.
[ ] Validation: Use Message Trace to confirm the message was blocked, and review the headers for malware detection results.
[ ] Monitoring: Schedule a regular review of threat reports and submissions.
[ ] Tuning: Address false positives/negatives by submitting them to Microsoft.
[ ] Change Control: Document all changes and have a rollback plan in place.
[ ] Configuration Analyser: Run the Configuration Analyser and compare your policies to Microsoft’s recommended settings.
For more information, refer to these authoritative resources:
Short answer (for a remote‑first SMB on Microsoft 365 Business Premium that’s configured well): For most scenarios, you do not need an expensive, next‑gen/UTM hardware firewall at every site. A basic, reliable edge router/firewall for NAT, stateful filtering, and ISP failover is usually sufficient—provided you shift protection to identity, device and app layers using Business Premium’s built‑in controls (Intune, Microsoft Defender for Business, and Conditional Access) and keep Windows Defender Firewall always on and centrally managed. [1][2][3][4]
Why the perimeter is no longer the control that matters most
Remote work + SaaS have moved users and data outside the office network. Microsoft’s Zero Trust approach puts the control points at identity, device health, and applications, not at a single network chokepoint. Business Premium packages these controls for SMBs: Endpoint EDR/ASR and network/web protection on the device (Defender for Business), Conditional Access to gate app access, and Defender for Office 365 to neutralise email‑borne attacks. In other words: you inspect and block at the endpoint and the cloud, which significantly reduces the value of a costly on‑prem firewall for a typical remote workforce. [5][1][6]
Defender for Business (MDB) adds web protection, network protection, web content filtering, attack surface reduction (ASR), and EDR—controls that used to be sold as “firewall features” in branch appliances. These run on the endpoint and follow the user everywhere. [2][5]
Windows Defender Firewall should remain enabled and centrally configured via Intune security baselines—giving you host‑based segmentation and policy without paying for advanced edge appliances. [7][4]
Conditional Access (Entra ID P1) lets you require MFA and compliant devices for Exchange/SharePoint/Teams and other SaaS apps, blocking risky sign‑ins even if a user is “on the office network.” [8][9]
Defender for Office 365 (Plan 1) (Safe Links/Attachments, anti‑phishing) removes the single biggest ingress vector—malicious email—before it ever hits a device. [10]
So… is anything beyond a basic firewall required?
For a typical SMB with many remote workers and no critical on‑prem apps, the cost‑effective pattern is:
Keep a simple edge: ISP router/basic firewall with NAT, DHCP, basic filtering, and failover.
Do the heavy lifting in M365: Intune + Defender for Business + Conditional Access + Defender for Office 365.
Optionally add Microsoft’s cloud‑delivered network security (SSE) if you want SWG/Zero‑Trust Network Access without hardware (see below). [11]
This “thin‑edge, strong‑endpoint” model routinely outperforms legacy “big firewall, flat endpoints” setups in both risk reduction and TCO for remote‑first SMBs—because controls travel with the user and are enforced before data is accessed. [5][1]
When a high‑priced firewall might still be justified
Choose a premium firewall/UTM only if you truly need capabilities that are network‑only and site‑centric, for example:
High‑throughput site‑to‑site VPNs/SD‑WAN, or numerous branch tunnels to on‑prem resources you’ll keep long term.
Strict network segmentation/IPS for OT/IoT or lab environments that cannot run endpoint controls.
Regulatory demands for on‑prem IDS/IPS or mandated perimeter logging at a specific site.
Complex public services hosted in your office (reverse proxying/WAF for internet‑facing apps).
If none of these apply, put your budget into endpoint, identity, and app security rather than into an oversized edge box.
A practical blueprint: Configure Business Premium to replace “firewall features”
Below is a concrete, field‑tested setup that reduces or eliminates reliance on dedicated firewall appliances for most SMBs. I’ve mapped each step to the relevant Business Premium capability and included sources you already have.
1) Device hardening & local firewall (Intune + MDB)
Deploy Intune Security Baseline for Windows; enforce Windows Defender Firewall (all profiles), BitLocker, Windows Hello, credential guard, disable legacy protocols. [7]
In Defender for Business, enable:
Network protection (block mode) to stop outbound calls to malicious domains from any app.
Web content filtering to block risky categories (e.g., malware, proxies, adult, gambling) on the device.
ASR rules (e.g., block Office from creating child processes; block credential theft).
EDR with Automated Investigation & Remediation. [2][5]
These controls deliver the “URL filtering,” “DNS security,” and “IPS‑like prevention” marketing bullets you’d otherwise buy in a firewall—except they work everywhere the user goes. [6]
2) Identity gate (Entra ID Conditional Access)
Require MFA for all users (break‑glass excluded).
Require compliant device for Exchange, SharePoint, Teams; block legacy auth; add sign‑in risk and location conditions if needed.
Use App Protection Policies for BYOD to keep corporate data in protected app containers. [8][12]
3) Email & collaboration ingress (Defender for Office 365)
Turn on Safe Links and Safe Attachments with Dynamic Delivery; enable anti‑phishing and impersonation protection; route high confidence spam to quarantine. [10][13]
4) “Always‑on” local firewall
Ensure Windows Defender Firewall is on (even if another firewall exists). Manage via Intune; never disable it as a shortcut. [4]
5) Verification & posture
Track and remediate via Microsoft Secure Score and Defender for Business TVM dashboards; use the Business Premium setup checklists to close gaps. [3][14]
Want a cloud alternative to hardware perimeter security?
If you still want centralised egress policy and VPN‑less private app access—without buying boxes—Microsoft now offers Security Service Edge (SSE) under Global Secure Access:
Microsoft Entra Internet Access = identity‑aware Secure Web Gateway for internet/SaaS (generally available).
Microsoft Entra Private Access = Zero‑Trust Network Access that can replace traditional VPNs for private apps. [11][15][16][17]
These are add‑ons (not bundled with Business Premium), but they’re often cheaper and simpler than rolling out/maintaining premium branch firewalls, especially for multi‑site SMBs. [11]
Decision framework (quick)
Remote‑first, SaaS‑first, no critical on‑prem: Go basic edge + Business Premium blueprint above. No high‑priced firewall required. [1][2]
Some on‑prem, but limited: Consider basic edge + Entra Private Access for VPN‑less private access. Add Entra Internet Access if you need centralised web policy/logging across sites. [11][16]
Heavy on‑prem/OT, compliance‑driven, or high‑throughput site mesh: A premium firewall/UTM may be justified—ideally fewer, centralised ones—combined with the Business Premium controls above.
Put it into action in 2–3 weeks (what I’d run for your clients)
Baseline: Deploy Intune security baseline and onboard all devices to Defender for Business; verify Network protection and Web filtering are in block mode. [7][2]
For most remote‑heavy SMBs standardising on Microsoft 365 Business Premium, spend on configuring Business Premium properly and keeping Windows Defender Firewall enforced, not on premium hardware firewalls. Use Global Secure Access if/when you need cloud‑delivered SWG/Zero‑Trust access. Keep hardware at the edge simple unless you have clear, site‑specific needs that only a high‑end firewall can meet. [1][2][11]
If you like, I can turn this into a client‑ready one‑pager with a policy checklist you can drop into proposals, plus an Intune/MDB baseline JSON to deploy across tenants. Want me to draft that?
References
[1] Module 02 – Security
[2] Microsoft Defender for Business A Comprehensive Guide to Endpoint Protection, Capabilities, and Comparison with Defender for Endpoint Plans
[3] Microsoft 365 Business Premium Setup Checklist A Comprehensive Guide for IT Professionals
If you’ve ever asked an AI for help and received a vague or off-target response, the issue probably wasn’t the AI—it was the prompt. The good news? There’s a simple fix. The best prompts follow a 4-part structure that helps you get crystal-clear, actionable results every time.
Whether you’re automating client onboarding, writing documentation, or prepping for a Microsoft 365 migration, this framework will help you get the most out of your AI tools.
The 4 Parts of a Great Prompt
1. Role – Tell the AI who to be
This sets the tone and perspective. You’re not just asking a question—you’re assigning a role.
Examples:
“Act as a Microsoft 365 onboarding specialist.”
“Act as a cybersecurity consultant for a mid-sized MSP.”
“Act as a technical writer creating documentation for IT admins.”
“Act as a trainer preparing a workshop for small business owners.”
Why it works: It aligns the AI’s responses with the mindset, priorities, and language of that role.
2. Context – Provide background
Give the AI a sense of the situation. What’s happening? Who’s involved? What’s the goal?
Examples:
“We’re creating a welcome kit for new clients using Microsoft 365 Business Premium.”
“The client is migrating from Google Workspace and needs guidance on Exchange Online.”
“We’re preparing a presentation for an IT conference focused on SMBs.”
“The audience is non-technical business owners who need to understand cloud security basics.”
Why it works: It helps the AI tailor its response to your specific scenario, avoiding generic advice.
3. Command – Be clear about what you want
This is your actual request. Don’t be vague—spell it out.
Examples:
“Write a checklist of the top 10 setup tasks for Microsoft 365.”
“Create a comparison table between Microsoft Defender and third-party antivirus tools.”
“Draft an email explaining the benefits of SharePoint to a small business client.”
“Generate a PowerShell script to bulk-create user accounts in Azure AD.”
Why it works: Specific instructions lead to specific results.
4. Format – Define the output style
Tell the AI how you want the answer delivered. This saves you time and makes the output immediately usable.
Examples:
“Output as a numbered list in markdown.”
“Include bullet points with brief explanations.”
“Format as a blog post with headings and subheadings.”
“Provide the script in a code block with inline comments.”
Why it works: It ensures the result fits your workflow—whether you’re pasting it into a document, email, or presentation.
Real-World Prompt Example for MSPs
Let’s say you’re preparing a client-facing guide for Microsoft 365 setup. Here’s how you’d apply the framework:
Role: Act as a Microsoft 365 onboarding specialist.
Context: We’re creating a guide for small business clients who’ve just signed up for Microsoft 365 Business Premium.
Command: Write a checklist of the top 10 setup tasks they should complete in their first week.
Format: Output as a numbered list in markdown, with brief explanations for each item.
Result: A clear, actionable checklist ready to drop into your documentation or client portal.
Final Tip
The more precise your prompt, the better your outcome. This framework works across use cases—from writing blog posts to generating PowerShell scripts. Try it out next time you’re working with AI, and watch your productivity soar.
In the traditional office-centric model, these were critical because most corporate data lived inside the LAN, and the firewall was the security choke point.
2. The SMB + Remote Work Reality
Today’s SMBs:
Store most of their data in cloud services (SharePoint, OneDrive, Exchange Online).
Have distributed workforces — employees working from home, coffee shops, or on the road.
Rely less on a central office network, so the expensive firewall no longer sees or controls most traffic.
Need cost-effective, identity-centric security, not just network perimeter defense.
This shift makes it harder to justify high-priced, feature-rich firewall appliances for many SMBs.
3. What Microsoft 365 Business Premium Already Delivers
When configured to the maximum security posture, Business Premium provides many capabilities that overlap or outright replace firewall functionality:
Identity & Access
Azure AD Conditional Access: Enforces location/device/role-based access.
Multi-Factor Authentication (MFA): Protects user logins.
Privileged Identity Management (PIM): Limits exposure of admin accounts.
Defender for Endpoint web protection: URL filtering, blocking malicious domains (no need for hardware-based URL filtering).
Conditional Access with Named Locations: Blocks risky geographies or anonymous IPs.
4. Do You Still Need a Firewall?
Basic firewall/router is still required: For NAT, stateful inspection, and safe connectivity at the office.
Expensive NGFWs (with deep inspection, SSL inspection, sandboxing) are usually overkill for SMBs already invested in Business Premium.
The real attack surface today is user identity + endpoints + cloud apps, which Business Premium protects more effectively than any edge firewall.
5. Cost-Effective SMB Model
For a typical SMB with a cloud-first, remote-heavy workforce:
Use a basic business-grade firewall/router (Ubiquiti, Fortinet entry-level, Cisco Meraki Go, etc.) at each office for connectivity and minimal protection.
Push all security to Microsoft 365 Business Premium:
Enforce Conditional Access + MFA.
Require compliant devices via Intune.
Use Defender for Endpoint for threat protection + web filtering.
Enable Defender for Office 365 (Safe Links, Safe Attachments).
Apply DLP policies and sensitivity labels.
This setup gives comprehensive, identity- and cloud-centric protection without needing a $10k+ hardware firewall sitting in an office few people use.
6. When a Hardware Firewall Still Makes Sense
A high-end firewall may still be justified if:
The business runs on-premises servers/apps that must be protected.
There are compliance requirements (e.g., PCI DSS, HIPAA) requiring full network logging or specific controls.
You need site-to-site VPNs across multiple offices.
You want network segmentation that can’t be handled by cloud policies.
Otherwise, for remote-heavy, cloud-first SMBs, Microsoft 365 Business Premium reduces or eliminates the need for expensive dedicated firewall appliances.
✅ Answer in short: For most SMBs using Microsoft 365 Business Premium at full security posture, a basic firewall/router is sufficient. Expensive NGFW appliances add little value compared to the security already built into Microsoft 365. The smarter investment is in identity, endpoint, and cloud security controls via Business Premium rather than perimeter hardware.
Would you like me to also create a visual reference architecture diagram that shows how an SMB can replace traditional firewall functions with M365 Business Premium security features? That way you could present it clearly to clients.
CIAOPS 