Updating and patching software with Intune

Part 1: Vulnerability Remediation (Primarily via Microsoft Defender for Endpoint Integration)

Intune itself isn’t a vulnerability scanner. For this, you’ll leverage Microsoft Defender for Endpoint’s (MDE) Threat & Vulnerability Management (TVM) capabilities. The magic happens when MDE is integrated with Intune.

Onboard Devices to MDE:
- Ensure your devices are onboarded to Microsoft Defender for Endpoint. This can be done via an Intune policy (Endpoint security > Microsoft Defender for Endpoint > “Connect Windows devices…”).
Enable MDE-Intune Connection:
- In the Microsoft Defender portal (security.microsoft.com): Go to Settings > Endpoints > Advanced features.
- Turn ON “Microsoft Intune connection.”
- In the Microsoft Intune admin center (intune.microsoft.com): Go to Endpoint security > Microsoft Defender for Endpoint.
- Ensure “Allow Microsoft Defender for Endpoint to enforce Endpoint Security Configurations” is ON.
How Remediation Works:
- Vulnerability Identification: MDE’s TVM continuously scans your enrolled devices for software vulnerabilities and misconfigurations.
- Security Recommendations: MDE provides prioritized security recommendations. For many software vulnerabilities, the recommendation will be to “Update software.”
- Remediation Tasks in Intune:
  - For certain recommendations, MDE can create a “security task” in Intune.
  - You’ll see these tasks in Intune under Endpoint security > Vulnerability management > Recommendations (or Security tasks in older views).
  - You can then “Accept” the risk or “Request remediation.” If you request remediation, Intune might:
    - Guide you to update the application (if it’s a managed app).
    - Guide you to create/modify a configuration profile (e.g., for an OS setting).
- “Automatic” Remediation through Patching (see Part 2): The most common way to “automatically” remediate software vulnerabilities is by keeping the software patched. If you have robust patching (as described below), new versions of software that fix vulnerabilities will be deployed, effectively remediating them.
- Configuration Changes: For vulnerabilities related to misconfigurations (e.g., an insecure setting), MDE will recommend changing the setting. You can then create or modify an Intune configuration profile (e.g., Attack Surface Reduction rules, Security Baselines) to enforce the secure setting across devices.

Part 2: Regular Software Patching via Intune

Intune offers several ways to patch software:

Windows Updates (OS Patching):
- This is the most straightforward.
- Go to Devices > Windows > Update rings for Windows 10 and later.
- Create profiles to define:
  - Servicing channel: (e.g., General Availability Channel)
  - Quality update deferral period: How long to wait after Microsoft releases a monthly quality update.
  - Feature update deferral period: How long to wait for major Windows version upgrades.
  - Driver updates: Allow/block.
  - Microsoft product updates: (e.g., Office updates, if not managed separately).
  - User experience settings: Active hours, restart deadlines, notifications.
- Tip: Use multiple rings (e.g., Pilot, Broad) to test updates before wide deployment.
- Feature Updates: Use Devices > Windows > Feature updates for Windows 10 and later to control deployment of specific Windows versions (e.g., move everyone to 22H2).
- Expedited Updates: For critical zero-day patches, use Devices > Windows > Quality updates for Windows 10 and later (under Windows Update (preview)) to deploy specific KBs quickly, overriding deferrals.
Microsoft 365 Apps (formerly Office 365 ProPlus):
- Go to Apps > All apps > Add. Select Windows 10 and later > Microsoft 365 Apps.
- Configure the app suite. Key settings for patching:
  - Update Channel: (e.g., Current Channel, Monthly Enterprise Channel). This determines update frequency.
  - Automatically remove other versions: Yes.
  - Use shared computer activation: If applicable.
- Intune will then manage the deployment and ensure the apps stay on the selected update channel, receiving updates directly from the Office CDN.
- You can also use Configuration Profiles (Devices > Configuration Profiles > Create Profile > Windows 10 and later > Settings catalog and search for “Office” or “Update”) for more granular control over M365 App updates (e.g., update deadlines).
Third-Party Application Patching: This is often the most challenging area.
- Win32 App Management (Supersedence):
  - This is the most common Intune-native method.
  - When a new version of a third-party app is released (e.g., Adobe Reader, Chrome, 7-Zip):
    1. Package the new version as a Win32 app (using the Microsoft Win32 Content Prep Tool).
    2. Upload it to Intune.
    3. In the app’s properties, go to Supersedence.
    4. Add the older version(s) of the app that this new version should replace.
    5. Choose “Uninstall previous version.”
    6. Assign the new app to the same groups as the old app (or your target groups).
  - When devices check in, Intune will see the supersedence rule, uninstall the old version, and install the new one.
  - This requires manual effort to package each new version but automates the deployment.
- Microsoft Store Apps (New Experience with Winget integration):
  - Intune is increasingly integrating with winget (Windows Package Manager).
  - Go to Apps > Windows > Add. Select Microsoft Store app (new).
  - You can search the Store or Winget repository. If an app is available via Winget and you deploy it, Intune can help keep it updated if the app publisher supports winget upgrade properly and you deploy the “latest” version. This is still evolving.
- Enterprise App Catalog (Preview):
  - Apps > Windows > Windows catalog app (Win32) (Preview)
  - This provides a curated list of common enterprise apps that Microsoft packages and makes available. The idea is that Microsoft will also handle updating these apps in the catalog, simplifying your patching for these specific titles. This is a very promising feature.
- Third-Party Patch Management Solutions:
  - Many organizations use dedicated third-party patching tools that integrate with Intune (e.g., Patch My PC, ManageEngine Patch Manager Plus, Ivanti Security Controls).
  - These tools typically:
    - Monitor vendor feeds for new patches.
    - Automatically package them as Win32 apps (or their own format).
    - Publish them to Intune (or their own distribution system controlled by Intune).
    - Handle supersedence.
  - This significantly reduces the manual effort for third-party patching.
- PowerShell Scripts (Proactive Remediations or Win32 Apps):
  - For apps not easily packaged or without good supersedence options, you can use:
    - Proactive Remediations: (Requires appropriate licensing – typically E3 + MDE P1/P2 or E5)
      - A detection script checks if a vulnerable version is present or if a patch is needed.
      - A remediation script runs if the detection script indicates an issue (e.g., downloads and installs the update).
    - Win32 App with Scripts: Package a script as a Win32 app. The “install” command could be your patching script, and the detection method checks if the patch was successful.

Key Considerations & Best Practices:

Testing: Always test patches in a pilot group before broad deployment.
Phased Rollouts: Use Intune’s assignment filters and group staggering for gradual rollouts.
User Communication: Inform users about upcoming updates and potential reboots, especially if deadlines are enforced.
Monitoring: Regularly check Intune’s reporting for update compliance (e.g., Reports > Windows updates, app installation status).
Licensing: Some features (like Proactive Remediations or Defender for Endpoint) require specific Microsoft 365 licenses (e.g., E3, E5, or add-ons).

By combining MDE for vulnerability identification and Intune for deploying OS, Microsoft app, and third-party app updates, you can create a fairly robust system for managing vulnerabilities and patching. For extensive third-party app patching, a dedicated third-party tool integrated with Intune is often the most efficient solution.

How Windows VBS Helps Prevent Token Theft

VBS creates an isolated virtual environment to host critical security processes, making them inaccessible to malware running in the normal operating system. The key feature of VBS relevant to token theft is Credential Guard.

Credential Guard:
- It uses VBS to isolate and protect the Local Security Authority Subsystem Service (LSASS) process.
- LSASS stores sensitive credential information like NTLM password hashes and Kerberos Ticket Granting Tickets (TGTs).
- Attackers often try to dump LSASS memory (e.g., using Mimikatz) to extract these credentials, which can then be used in pass-the-hash or pass-the-ticket attacks to impersonate users and gain access to resources, including M365 services (especially in hybrid environments).
- With Credential Guard enabled, LSASS runs in the VBS isolated environment. The normal OS LSASS process only communicates with it via a secure Remote Procedure Call (RPC) interface. Even if an attacker gains kernel-level privileges in the normal OS, they cannot directly access the credential material stored within the VBS-protected LSASS.
- This makes it much harder to steal the credentials that would be used to obtain M365 tokens in the first place or to abuse on-premises credentials that might be synchronized to Azure AD.
Hypervisor-Protected Code Integrity (HVCI) / Memory Integrity:
- While not directly preventing token theft, HVCI is another VBS feature that enhances overall system security. It ensures that only signed and verified code can run in the Windows kernel.
- This makes it harder for malware to compromise the kernel, which could then be used to bypass other security measures, including potentially VBS itself or to inject code into processes holding tokens.

Important Considerations for M365 Tokens: M365 primarily uses OAuth 2.0 tokens (access tokens, refresh tokens) which are typically stored by applications (Outlook, Teams, browser) rather than directly in LSASS in the same way as NTLM hashes or Kerberos TGTs.

Credential Guard primarily protects against theft of Windows logon credentials (NTLM/Kerberos) that could be used to authenticate and then obtain M365 tokens.
It does not directly protect M365 access/refresh tokens stored in browser caches or application data if the user’s session is already compromised at the user-mode level (e.g., malware running as the user).

Appropriate Configuration for Windows Devices (using M365 Business Premium tools):

M365 Business Premium includes Microsoft Intune for device management, which is the recommended way to configure these settings.

Hardware & Firmware Requirements:
- 64-bit CPU with virtualization extensions (Intel VT-x or AMD-V) and SLAT.
- TPM 2.0 (Trusted Platform Module).
- UEFI firmware with Secure Boot enabled.
- BIOS/UEFI virtualization support enabled.
Enable VBS, Credential Guard, and HVCI via Intune:
- Using Endpoint Security Profiles (Recommended):
  1. Go to the Microsoft Intune admin center.
  2. Navigate to Endpoint security > Account protection.
  3. Click Create Policy.
  4. Platform: Windows 10 and later. Profile: Account protection. Click Create.
  5. Name the policy (e.g., “Enable Credential Guard”).
  6. Under Configuration settings:
    - Block Windows Hello for Business: Typically Not configured or Disabled unless you have specific reasons to block it.
    - Enable Credential Guard: Set to Enable with UEFI lock. This prevents it from being disabled remotely without physical presence for UEFI changes. (Choose “Enable without UEFI lock” if you need more flexibility during initial rollout/testing, but “with UEFI lock” is more secure).
    - Turn on Security Guard: (This likely refers to Microsoft Defender Security Guard, which is related to Secure Boot and VBS launch). Set to Enabled.
  7. Assign the policy to your target device groups.
  8. To enable HVCI (Memory Integrity):
    - Navigate to Endpoint security > Attack surface reduction.
    - Click Create Policy.
    - Platform: Windows 10 and later. Profile: Attack Surface Reduction Rules (or look for specific HVCI profiles if available, sometimes it’s under Device Configuration > Endpoint Protection).
    - Alternatively, and often more straightforward for HVCI:
      - Go to Devices > Configuration profiles.
      - Click Create profile.
      - Platform: Windows 10 and later. Profile type: Settings catalog.
      - Search for “Hypervisor Enforced Code Integrity” or “Memory Integrity”.
      - Add the setting (e.g., VirtualizationBasedSecurity > HypervisorEnforcedCodeIntegrity) and set it to Enabled.
- Secure Boot: This is typically enabled in the device UEFI/BIOS. Intune can report on Secure Boot status but doesn’t directly enable it from a cold start. Devices must be provisioned with it enabled.
Verify Deployment:
- On a client device, you can check msinfo32.exe. Look for “Virtualization-based security” status and “Credential Guard” / “Memory Integrity” listed as running.
- In Task Manager > Performance > CPU, you should see “Virtualization: Enabled”.

Complementary M365 Business Premium Security Measures:

VBS is one layer. For comprehensive token theft protection with M365:

Multi-Factor Authentication (MFA): Enforce MFA for all users via Conditional Access. This is the single most effective measure against credential/token compromise.
Conditional Access Policies:
- Require compliant devices (managed by Intune, with VBS enabled).
- Block legacy authentication.
- Restrict access from untrusted locations or risky sign-ins.
- Implement session controls (e.g., sign-in frequency).
Microsoft Defender for Business (included in M365 BP): Provides endpoint detection and response (EDR) capabilities to detect and block malicious activities, including attempts to steal tokens or abuse legitimate processes.
Identity Protection (Azure AD P1 features are included in M365 BP): Detects risky sign-ins and compromised user accounts, allowing for automated remediation.
Application Guard: Use Microsoft Defender Application Guard for Edge/Office to isolate untrusted websites and documents, preventing malware from accessing user session tokens in the browser or system.
Principle of Least Privilege: Ensure users do not have local admin rights unless absolutely necessary.
User Education: Train users to recognize phishing attempts and social engineering.

Conclusion:

Yes, VBS, particularly Credential Guard, is a valuable tool provided by Windows that, when configured (ideally via Intune with M365 Business Premium), significantly hardens devices against the theft of Windows credentials that could be used to obtain M365 tokens. However, it’s most effective as part of a broader defense-in-depth strategy that includes MFA, Conditional Access, Defender for Business, and other security best practices to protect M365 application-level tokens and user sessio

How Microsoft Defender for Cloud Apps fortifies Microsoft 365

What is Microsoft Defender for Cloud Apps?

At its core, MDCA is a Cloud Access Security Broker (CASB). It sits between your users and cloud applications (like Microsoft 365) to provide:

Visibility: Discover and identify cloud services and apps being used, including Shadow IT. For M365, it gives deep insights into activities within Exchange Online, SharePoint Online, OneDrive, Teams, etc.
Data Security: Identify and control sensitive information (DLP capabilities) within M365, preventing data leakage.
Threat Protection: Detect anomalous behavior, malware, and other threats targeting your M365 data and users.
Compliance: Assess if your cloud app usage, including M365 configurations, aligns with compliance requirements.

How MDCA Improves Microsoft 365 Security:

Enhanced Visibility & Activity Monitoring:
- MDCA logs detailed activities within M365 (file shares, downloads, logins, admin changes, mail rule creations, etc.). This is far more granular than standard M365 audit logs alone and is presented in a way that’s easier to query and investigate.
- You can see who is accessing what, from where, and what they’re doing with the data.
Advanced Threat Detection & Anomaly Detection:
- MDCA uses User and Entity Behavior Analytics (UEBA) to learn normal user patterns. It can then flag suspicious activities like:
  - Impossible travel: Logins from geographically distant locations in a short time.
  - Mass downloads/deletions: A user suddenly downloading or deleting an unusual number of files.
  - Suspicious inbox rules: Creation of forwarding rules that might exfiltrate email.
  - Ransomware activity: Rapid encryption of files.
  - Compromised account activity: Unusual administrative actions.
Data Loss Prevention (DLP) and Information Protection:
- Integration with Microsoft Purview Information Protection: MDCA can read sensitivity labels applied by Purview.
- Content Inspection: It can scan files in SharePoint Online and OneDrive for sensitive data (credit card numbers, PII, custom keywords, etc.) even if they aren’t labeled.
- Policies: You can create policies to automatically:
  - Apply sensitivity labels.
  - Restrict sharing (e.g., remove external sharing links for files containing PII).
  - Quarantine files.
  - Notify admins or users.
OAuth App Governance (Third-Party App Control):
- Many users grant third-party apps access to their M365 data (e.g., “Login with Microsoft,” calendar sync apps). Some of these apps can be risky.
- MDCA discovers these OAuth apps, assesses their permission levels and community trust, and allows you to:
  - Approve/Ban apps: Sanction safe apps and ban risky ones organization-wide.
  - Revoke app access: For specific users or for an entire app.
  - Get alerted on new, risky apps being authorized.
Conditional Access App Control (Session Control):
- This is a powerful feature used in conjunction with Microsoft Entra Conditional Access.
- When a user session to M365 apps (like SharePoint, Exchange Online) is routed through MDCA (as a reverse proxy), you can apply real-time controls:
  - Block downloads/uploads: Prevent users on unmanaged devices from downloading sensitive files.
  - Monitor sessions: Log all activities without blocking.
  - Block copy/paste: Prevent data exfiltration.
  - Apply labels on download: Ensure files downloaded to unmanaged devices are labeled and protected.
  - Block specific activities: e.g., prevent printing from an unmanaged device.
Security Configuration Assessment:
- While more directly handled by Microsoft Defender for Cloud (for Azure resources) or Microsoft Secure Score, MDCA contributes by identifying misconfigurations or risky behaviors within the M365 app context that could indicate broader security posture weaknesses.

Configuration Examples to Provide Protection:

Here’s how you might configure MDCA (steps are generalized as the UI can evolve, but concepts remain):

Prerequisite: Connect Microsoft 365 to Defender for Cloud Apps.

Go to the Microsoft Defender XDR portal (security.microsoft.com) -> Settings -> Cloud Apps -> Connected apps.
Click “+Connect an app” and select Microsoft 365. Follow the wizard to authorize the connection.

Example 1: Alert on Suspicious Inbox Forwarding Rules

Goal: Detect potential email exfiltration by compromised accounts.
Configuration:
1. In the Microsoft Defender XDR portal, go to Cloud Apps -> Policies -> Policy management.
2. Click Create policy and select Activity policy.
3. Name: “Suspicious Inbox Forwarding Rule Creation”
4. Severity: High
5. Category: Threat Detection
6. Triggers (Activities matching all of the following):
  - Activity type: Create inbox rule (or similar, depending on the exact activity name for Exchange Online).
  - App: Microsoft Exchange Online
  - Rule details/parameters: (You might need to use advanced filters here) Look for rule actions like Forward to, Redirect to where the recipient domain is Not in your organization’s approved domains.
7. Actions:
  - Send alert: Email security admins, create an incident in Microsoft Sentinel.
  - (Optional Governance Action): Suspend user in Microsoft Entra ID (use with extreme caution and after thorough testing).
8. Save the policy.

Example 2: Block Download of “Highly Confidential” Files to Unmanaged Devices

Goal: Prevent sensitive data from being downloaded to personal or untrusted devices.
Prerequisites:
- Microsoft Entra ID P1/P2 for Conditional Access.
- Sensitivity labels (“Highly Confidential”) configured in Microsoft Purview Information Protection.
- Unmanaged devices identified (e.g., via Intune compliance or Hybrid Azure AD Join status).
Configuration:
- Step A: Create a Conditional Access Policy in Entra ID:
  1. Go to portal.azure.com -> Microsoft Entra ID -> Security -> Conditional Access.
  2. Create a new policy.
  3. Name: “MDCA Session Control for SharePoint Unmanaged Devices”
  4. Users: All users (or a pilot group).
  5. Target resources (Cloud apps or actions): Select SharePoint Online.
  6. Conditions:
    - Device platforms: Any device.
    - Locations: Any location.
    - Client apps: Browser, Mobile apps and desktop clients.
    - Filter for devices: Exclude devices Marked as compliant (or Hybrid Azure AD Joined).
  7. Access controls -> Session: Select Use Conditional Access App Control and choose Block downloads (Preview) or Use custom policy... if you want more granular MDCA control.
  8. Enable policy.
- Step B: (If “Use custom policy…” was chosen above) Create a Session Policy in MDCA:
  1. In the Microsoft Defender XDR portal, go to Cloud Apps -> Policies -> Policy management.
  2. Click Create policy and select Session policy.
  3. Name: “Block Highly Confidential Downloads to Unmanaged”
  4. Session control type: Control file download (with DLP).
  5. Triggers (Activities matching all of the following):
    - App: Microsoft SharePoint Online
    - Device Tag: Does not equal Intune Compliant (or your identifier for managed devices).
    - Sensitivity label (from Microsoft Purview Information Protection): Equals Highly Confidential.
    - Activity type: File download.
  6. Actions:
    - Select Block.
    - Customize block message for the user.
    - Send alert.
  7. Save the policy.

Example 3: Detect and Alert on Mass Downloads from OneDrive

Goal: Identify potential data theft or compromised accounts.
Configuration:
1. In the Microsoft Defender XDR portal, go to Cloud Apps -> Policies -> Policy management.
2. Many anomaly detection policies are built-in. Look for “Mass Download” or similar. If it exists, review its settings and enable it.
3. If creating new, select Create policy -> Anomaly detection policy.
4. Name: “Mass Download from OneDrive”
5. Scope: You can scope it to specific users/groups, or all users.
6. Conditions: MDCA’s UEBA engine will handle most of this. You’ll primarily enable the detection type for “Mass Download” and ensure it’s active for Microsoft OneDrive for Business.
7. Risk factors/thresholds: Adjust sensitivity if needed (e.g., number of downloads, timeframe).
8. Actions:
  - Send alert: Email security admins.
  - Create an alert in Microsoft Defender XDR.
9. Save the policy.

Example 4: Govern Risky OAuth Apps

Goal: Prevent risky third-party apps from accessing M365 data.
Configuration:
1. In the Microsoft Defender XDR portal, go to Cloud Apps -> OAuth apps.
2. Review the list of apps. Filter by permissions (e.g., Mail.ReadWrite.All, Files.ReadWrite.All), community trust level, or last used.
3. For a suspicious or overly permissive app:
  - Click on the app.
  - You can choose to Ban app. This prevents new users from authorizing it and revokes existing authorizations.
4. Create a Policy for new OAuth apps:
  - Go to Cloud Apps -> Policies -> Policy management.
  - Click Create policy and select OAuth app policy.
  - Name: “Alert on New High-Permission OAuth Apps”
  - Severity: Medium/High
  - Triggers:
    - Permission level: High
    - Community use: Rare or Uncommon
    - (Optional) Specific permissions: e.g., Mail.Read.All
  - Actions:
    - Send alert.
    - (Optional Governance Action): Revoke app.
  - Save the policy.

Key Considerations:

Licensing: MDCA is typically part of Microsoft 365 E5, EMS E5, or available as a standalone license.
Alert Fatigue: Start with a few high-priority policies and tune them. Don’t enable everything at once.
User Impact: Be mindful of policies that might block legitimate user activity. Communicate changes and have a process for exceptions if needed.
Integration: MDCA works best when integrated with other Microsoft Defender XDR components and Microsoft Sentinel for a holistic security view and response capability.

By leveraging these capabilities and configurations, Defender for Cloud Apps significantly strengthens the security posture of your Microsoft 365 environment, providing deep visibility, data protection, and threat detection beyond the native capabilities of M365 itself.

Security Requirements for Microsoft Partners and Their Customers

1. Introduction: The Microsoft AI Cloud Partner Program serves as a framework to empower organizations through various benefits and incentives.1 Within this program, security stands as a fundamental pillar, critical for safeguarding the integrity of both the partner’s operational environment and the environments of their customers.1 This report aims to provide a comprehensive analysis of the specific security requirements that Microsoft partners must adhere to, drawing upon recent updates and guidelines. Furthermore, it will address the user’s inquiry regarding the necessity of achieving a Secure Score of 70 for both the partner and their customers.

The increasing sophistication of cyber threats necessitates a strong emphasis on security within the partner ecosystem. Microsoft’s partner network plays a vital role in delivering cloud services, making the security posture of each partner a crucial factor in maintaining the trust and security of the broader ecosystem. A vulnerability in a partner’s infrastructure could potentially expose numerous customers to risks. Therefore, Microsoft is proactively establishing security standards to mitigate these potential threats and ensure a secure environment for all stakeholders. The introduction of new benefits packages alongside these security requirements indicates a strategic alignment by Microsoft, where partners who demonstrate robust security practices are more likely to access enhanced resources and opportunities within the program. This interconnected approach incentivizes partners to prioritize security as a core aspect of their participation in the Microsoft AI Cloud Partner Program.

2. Mandatory Security Requirements for Microsoft Partners: Microsoft mandates several fundamental security obligations for partners participating in its programs. These requirements are designed to protect both the partners themselves and their customers from a range of cyber threats.

A primary mandatory security requirement is the enforcement of Multi-Factor Authentication (MFA) for all user accounts associated with a partner’s tenant.3 This obligation extends to partners involved in the Cloud Solution Provider (CSP) program, as well as Advisors and Control Panel Vendors.3 Partners must ensure that MFA is active whenever users sign in to Microsoft commercial cloud services, conduct transactions within the CSP program through Partner Center, or interact with relevant APIs.4 Microsoft provides its own MFA solution through Microsoft Entra security defaults, which is available at no additional cost.3 It is important to note that non-Microsoft MFA solutions are not taken into account when calculating the Partner Center security score.5 Failure to comply with these MFA requirements can result in the partner losing access to their customer tenants.4 The strong emphasis on MFA as a non-negotiable requirement underscores its critical role in preventing unauthorized access to sensitive environments. Passwords alone are often insufficient in today’s threat landscape, and MFA adds a crucial layer of defense by requiring users to provide multiple forms of verification, thereby significantly reducing the likelihood of account compromise. Microsoft’s firm stance on MFA reflects the widespread prevalence of credential theft in cyberattacks.

Another key mandatory requirement is the adoption of the Secure Application Model for partners who integrate with Partner Center APIs.3 This framework is essential for all app and user authentication models used in such integrations.3 By mandating this model, Microsoft aims to enhance the security of partner infrastructure and safeguard customer data from potential security risks.4 This shift towards the Secure Application Model for API integrations signifies a move towards more secure and less privileged access methods, ultimately reducing the potential attack surface. Traditional API access methods might involve storing credentials, which can introduce vulnerabilities. The Secure Application Model likely leverages modern authentication protocols like OAuth 2.0 and the principle of least privilege, ensuring that applications only possess the necessary permissions to perform their intended functions.

Beyond these core requirements, Microsoft also advises partners to embrace the principles of Zero Trust security.4 Furthermore, the removal of inactive Delegated Admin Privileges (DAP) is strongly recommended, as DAP is in the process of being deprecated and replaced by the more secure Granular Delegated Admin Privileges (GDAP).4 The recommendation to transition to GDAP and eliminate inactive DAP highlights Microsoft’s commitment to bolstering security through finer-grained access controls. DAP provides broad administrative rights to partner tenants over customer tenants, meaning that if a partner account with DAP is compromised, an attacker could potentially gain extensive control over the customer’s Microsoft 365 environment. GDAP, on the other hand, allows for the assignment of more specific roles with limited permissions, thereby mitigating this significant risk.

3. Understanding the Partner Center Security Score: To help partners assess and improve their security posture, Microsoft provides the Partner Center security score.5 This metric is designed to give partners a clear understanding of their tenant’s security level.5 It is accessible to direct-bill partners and indirect providers participating in the CSP, Value Added Reseller, or Advisor programs.5 The Partner Center security score ranges from 0 to 100 and reflects the tenant’s security based on adherence to specific security requirements established by Microsoft.5

The calculation of the Partner Center security score is based on the security scores assigned to individual security requirements.5 Each security requirement has a maximum possible score, ranging from 0 to 20 points, determined by its relative importance.5 Currently, a security requirement is considered either fully met, in which case it earns the maximum possible score, or not met, resulting in a score of 0 for that specific requirement.5 The overall Partner Center security score is calculated using the following formula: (Sum of individual security requirement scores) / (sum of individual security requirement max scores) * 100.5 This formula provides a weighted average of the partner’s compliance with the mandatory security measures.

There are several specific security requirements that contribute to the Partner Center security score, each with a defined maximum score 5:

Enable MFA: This requirement focuses on ensuring that multifactor authentication is enabled for all administrative roles within the partner’s tenant. Achieving this earns a maximum of 20 points. To be considered complete, every administrative user must be covered by MFA through security defaults, Conditional Access, or per-user MFA, and each admin user needs to have set up additional verification factors.5
Response to alerts is 24 hours or less on average: This requirement encourages partners to promptly address security alerts. Partners must triage and respond to alerts within 24 hours of their appearance in Partner Center, with an ideal goal of responding within one hour. Meeting this requirement contributes 10 points to the overall score. The average response time is calculated based on the activity of the last 30 days.5
Provide a security contact: This requirement emphasizes the importance of having a designated point of contact for security-related issues. Partners need to provide an email address, phone number, and the name of an individual or group responsible for responding to security incidents. Compliance with this requirement results in 20 points.5
All Azure subscriptions have a spending budget: This requirement applies specifically to partners operating under the new commerce experience. By setting up a spending budget for all their customers’ Azure subscriptions, partners can earn 10 points. Partners who are still on the traditional experience do not receive any points for this particular requirement.5
Users with administrative roles in the customer tenants must use MFA: This requirement extends the MFA mandate to the administrative roles within the partner’s customer tenants. Ensuring that MFA is enabled for these roles earns 20 points.5

It is important to reiterate that non-Microsoft MFA solutions are not supported for the “Enable MFA” requirement within the Partner Center security score framework and are therefore not factored into the score calculation.5 Partners can monitor and manage their security settings and view their current Partner Center security score through the Security requirements dashboard available in Partner Center.5 Furthermore, the partner security score API can be utilized to programmatically retrieve the score and gain insights into the security posture of their customers.6 The Partner Center security score is specifically tailored to the Microsoft ecosystem and the partner’s role within it. The requirements are designed to address common vulnerabilities and ensure partners are adhering to Microsoft’s security best practices for managing their own and their customers’ cloud environments. The weighting of different security requirements, such as the high scores assigned to MFA for both partner and customer administrators, clearly indicates Microsoft’s priorities in securing the partner channel by preventing unauthorized access with elevated privileges. The inclusion of the Azure spending budget requirement for new commerce partners suggests a connection between security and financial management, potentially aimed at preventing resource abuse or unauthorized consumption through proactive oversight.

To provide a clear overview of the Partner Center security score components, the following table summarizes the specific requirements and their corresponding maximum scores:

Security Requirement	Maximum Score	Description
Enable MFA	20 points	Requires multifactor authentication (MFA) to be enabled for administrative roles within the partner’s tenant.
Response to alerts is 24 hours or less on average	10 points	Requires partners to triage and respond to security alerts appearing in Partner Center within 24 hours, with a goal of responding within one hour.
Provide a security contact	20 points	Requires partners to provide an email address, phone number, and name of an individual or group responsible for responding to security incidents.
All Azure subscriptions have a spending budget	10 points	Applies to partners on the new commerce experience and requires them to set up a spending budget for all their customers’ Azure subscriptions. Partners on the traditional experience do not receive points for this requirement.
Users with administrative roles in the customer tenants must use MFA	20 points	Requires MFA to be enabled for all users holding administrative roles within the partner’s customer tenants.

4. The Solutions Partner for Security Designation and Partner Capability Score: The Microsoft AI Cloud Partner Program offers various designations to recognize partners with specific expertise. One such designation is the Solutions Partner for Security, which distinguishes partners who possess the necessary skills to protect customers from increasingly sophisticated cyberattacks across diverse environments, including remote, hybrid, and cloud infrastructures.2 To achieve this designation, partners are required to meet certain qualification criteria based on their partner capability score for security.8

The partner capability score is a composite score derived from a partner’s performance, skilling, and customer success, using data already recorded within Partner Center.8 To attain the Solutions Partner for Security designation, a partner must achieve a minimum score of 70 points, with at least one point in each of the following four key metrics 8:

Performance – Net customer adds
Skilling – Intermediate certifications
Customer success – Usage growth
Customer success – Deployments

Microsoft offers two distinct pathways for partners to pursue this designation: the Enterprise path and the Small and Medium Business (SMB) path, each with its own specific criteria.8 Microsoft evaluates partners on both paths and ultimately selects the highest score achieved from either path at the solution area level to determine qualification.8 This flexibility allows partners to leverage their strengths and focus on the path that best aligns with their business strategy and customer base.

The partner capability score for security is comprised of four metrics organized into three categories 8:

Performance (Maximum 20 points): This category assesses a partner’s ability to expand their customer base by leveraging Microsoft Security products and services. The primary metric is Net customer adds for both Microsoft 365 and Azure Security workloads. The calculation methods and eligibility criteria for net customer adds differ between the Enterprise and SMB tracks, taking into account factors like Azure Consumed Revenue (ACR) and the number of paid licenses for specific Microsoft 365 workloads.8
Skilling (Maximum points vary based on track): This category measures the security-related skills acquired by a partner organization through the number of certified individuals. The key metric is Intermediate certifications. Both the Enterprise and SMB tracks have mandatory prerequisites, requiring individuals to complete the Azure Security Engineer Associate and Microsoft Security Operations Analyst certifications. Additional points are awarded for completing advanced certifications such as Microsoft Cybersecurity Architect expert, Microsoft Identity and Access Administrator, or Microsoft Information Protection Administrator. The specific requirements and point allocations for these certifications vary between the Enterprise and SMB tracks.8
Customer Success: This category evaluates a partner’s effectiveness in driving the adoption and growth of Microsoft security solutions among their customers. It consists of two metrics:

Deployments (Maximum 20 points): This metric awards points based on the growth in the number of customer deployments of eligible Azure and Microsoft 365 security workloads. Similar to the Performance category, the calculation methods and eligible workloads differ between the Enterprise and SMB tracks.8
Usage growth (Maximum 20 points): This metric focuses on the growth in the usage of security workloads by a partner’s customers, measured by Security Azure consumed revenue (ACR) and the growth in the number of Microsoft 365 protected users. Again, the thresholds and calculation methods vary between the Enterprise and SMB tracks.8

The partner capability score for security is one of six solution areas within the broader Microsoft AI Cloud Partner Program.9 Achieving the Solutions Partner for Security designation comes with various benefits, including access to go-to-market services, technical advisory hours, technical support incidents, and exclusive product benefits tailored for security.2 The requirement of a minimum partner capability score of 70 points is specifically for attaining the Solutions Partner for Security designation and is not a general mandatory security requirement for all partners. The multi-faceted nature of the partner capability score, encompassing performance, skilling, and customer success, underscores Microsoft’s emphasis on a holistic approach to security expertise. To achieve this designation, partners must demonstrate not only that their staff possess the necessary security skills but also that they are actively acquiring new security customers and driving the adoption and usage of Microsoft security solutions among their existing customers. The existence of separate Enterprise and SMB tracks acknowledges the diverse business models within the partner ecosystem and provides achievable paths for different types of partners to demonstrate their security capabilities.

To further clarify the metrics for achieving the Solutions Partner for Security designation, the following table provides a summary of the requirements for both the Enterprise and SMB tracks:

Category	Metric	Enterprise Track Details	SMB Track Details
Performance	Net customer adds	Each net new customer contributes two points, up to a maximum of 20 points from ten customers.	Each net new customer contributes four points, up to a maximum of 20 points from five customers.
Skilling	Intermediate certifications	Step 1 (Required): At least two people must complete the Azure Security Engineer Associate certification (0 points). Step 2 (Required): At least two people must complete the Microsoft Security Operations Analyst certification (0 points). Step 3: Each certified individual completing one of the advanced certifications adds 6.67 points.	Step 1 (Required): At least one person must complete the Azure Security Engineer Associate certification (4 points). Step 2 (Required): At least one person must complete the Microsoft Security Operations Analyst certification (4 points). Step 3: Each certified individual completing one of the advanced certifications adds 8 points.
Customer Success	Deployments	Each net new customer contributes 3.3 points, up to a maximum of 20 points from six deployments.	Each net new customer contributes 3.3 points, up to a maximum of 20 points from six deployments.
Customer Success	Usage growth	Every Security Azure consumed revenue (ACR) growth of USD 1,250 earns one point (maximum 20 points). Every Microsoft 365 protected users growth of 125 earns one point (maximum 20 points).	Every Security Azure consumed revenue (ACR) growth of USD 750 earns one point (maximum 20 points). Every Microsoft 365 protected users growth of 50 earns one point (maximum 20 points).

5. Security Considerations for Customer Tenants: Ensuring the security of customer tenants is a critical aspect of the Microsoft partner program. While partners are primarily responsible for their own security, they also play a crucial role in safeguarding the environments of their customers.

One specific requirement that directly links partner security to customer security is the mandate for MFA for administrative roles within customer tenants.5 This requirement carries a significant weight of 20 points in the Partner Center security score calculation for the partner.5 This high weighting underscores the importance Microsoft places on securing privileged access within customer environments. Furthermore, the Partner Center provides partners with insights into customer MFA adoption statistics, allowing them to monitor and encourage the enablement of MFA across their customer base.5 This visibility empowers partners to identify potential security gaps and proactively engage with their customers to promote this essential security measure.

Microsoft emphasizes that partners have a vital role in protecting customer trust by implementing all necessary security measures.4 The partner security score API also enables partners to gain insights into their customers’ overall security posture.7 While the provided information highlights the importance of customer MFA and offers tools for partners to monitor it, there is no explicit mention of a specific security score requirement for customer tenants that partners must meet.6 However, the strong emphasis on MFA for customer administrators and the availability of customer security insights within the Partner Center framework indicate that Microsoft expects partners to have a clear understanding of their customers’ security practices and to take proactive steps to improve them. Although partners are not directly penalized based on a customer’s overall Microsoft Secure Score, their own Partner Center security score is directly affected by the enablement of MFA for administrative roles within their customer tenants. This creates a strong incentive for partners to actively promote and facilitate the adoption of MFA among their customers’ administrators, reflecting a shared responsibility for security within the Microsoft ecosystem.

6. Microsoft Secure Score vs. Partner Center Security Score: It is important to distinguish between the Microsoft Secure Score, which is a broad measure of an organization’s overall security posture, and the Partner Center security score, which is specifically designed for Microsoft partners.

The Microsoft Secure Score is a measurement of an organization’s security health across Microsoft 365, Microsoft Entra ID, and other Microsoft services.11 A higher score indicates that more of the recommended security actions have been implemented.11 This score helps organizations to understand their current security state, identify areas for improvement, and compare their posture against industry benchmarks.11 Points are awarded for configuring recommended security features, performing security-related tasks, or mitigating risks through non-Microsoft solutions.11 Security defaults within Microsoft Entra ID contribute to the Microsoft Secure Score.11 While a target of 80% or higher is generally considered a good Microsoft Secure Score, this can vary depending on the organization’s size and industry.12 The Microsoft Secure Score can be accessed through the Microsoft Defender portal.11

Conversely, the Partner Center security score is specific to Microsoft partners participating in the CSP, Value Added Reseller, or Advisor programs.5 Its primary focus is on the security posture of the partner’s tenant and, to a certain extent, their customers’ tenants, particularly concerning MFA for administrative roles, within the context of the partner program.5 This score is calculated based on specific mandatory security requirements established by Microsoft for its partners.5 The Partner Center security score ranges from 0 to 100 5 and can be monitored and managed through the Security requirements dashboard in Partner Center.5 The partner security score API provides a quantifiable measure of a partner’s security performance and also offers insights into the security posture of their customers.6 The Microsoft Secure Score serves as a comprehensive security assessment tool for any organization using Microsoft products, whereas the Partner Center security score is a specific set of requirements and a scoring mechanism tailored by Microsoft for its partners within the partner program framework. While achieving a high Microsoft Secure Score is generally indicative of strong security practices, maintaining a high Partner Center security score is crucial for partners to ensure compliance with program requirements and potentially access certain benefits or maintain their partner status.

7. Addressing the Secure Score of 70 Requirement: The user specifically asked whether a Secure Score of 70 would be required for both the partner and their customers based on the provided blog post. The analysis of the research snippets reveals important distinctions regarding the use of the number 70 in relation to security within the Microsoft partner program.

The research indicates that a score of 70 is relevant in the context of the Solutions Partner for Security designation. To attain this specific designation, a partner needs to achieve a minimum partner capability score of 70 for the security solution area.8 It is crucial to understand that this partner capability score is based on a combination of performance metrics (net customer adds), skilling (intermediate certifications), and customer success metrics (usage growth and deployments), and it is distinct from the Partner Center security score.8

The provided snippets do not explicitly state a requirement for partners to maintain a Partner Center security score of exactly 70. The Partner Center security score is designed to measure a partner’s adherence to specific mandatory security requirements set by Microsoft. The general principle is to aim for the highest possible score by ensuring that all these mandatory requirements are fully met.5 There is no indication that a score of 70 is a specific threshold that partners must reach for this particular metric.

Similarly, the research snippets do not specify a mandatory Microsoft Secure Score of 70 for customer tenants that partners are obligated to ensure. While Microsoft encourages partners to promote security best practices among their customers, such as the implementation of MFA for administrative roles, there is no mention of a specific Microsoft Secure Score target for customers within the defined partner program requirements.6 The user’s query might stem from a general understanding that a security score around 70-80 is often considered a reasonable benchmark for overall security posture. However, it is essential to differentiate between the various scoring mechanisms within the Microsoft ecosystem and the specific context in which they are used. The Partner Center security score is about meeting specific mandated requirements for partners, while the partner capability score of 70 is related to achieving a particular Solutions Partner designation. Therefore, partners should primarily focus on meeting all the mandatory security requirements that contribute to the Partner Center security score to ensure compliance with the partner program, rather than focusing on an arbitrary score of 70 for this metric or for their customers’ overall Microsoft Secure Score.

8. Recommendations for Microsoft Partners: To effectively navigate the security requirements of the Microsoft AI Cloud Partner Program and enhance the security posture of both their own organizations and their customers, partners should consider the following recommendations:

Prioritize Enabling Multi-Factor Authentication (MFA): Ensure that MFA is enforced for all user accounts, both administrative and standard, within the partner tenant. This can be achieved using Microsoft Entra security defaults or other compatible MFA methods. Additionally, actively encourage and assist customers in enabling MFA for all their users, with a particular focus on administrative roles. Leverage the customer MFA statistics available in Partner Center to identify any gaps in adoption.3
Adopt the Secure Application Model: If your organization integrates with Partner Center APIs, it is crucial to ensure that all applications adhere to the Secure Application Model framework for authentication and authorization. This will help protect both your infrastructure and your customers’ data.3
Maintain Responsiveness to Security Alerts: Establish clear and efficient processes for monitoring and responding to security alerts that appear within Partner Center. Aim for a response time within 24 hours, with an ideal target of one hour, to maximize your Partner Center security score and mitigate potential risks.5
Provide and Maintain a Security Contact: Ensure that the designated security contact information (including name, email address, and phone number) within Partner Center is accurate and kept up-to-date. This ensures that Microsoft can effectively communicate with your organization in the event of any security-related issues.5
Set Azure Spending Budgets for Customers (New Commerce): For partners who are operating under the new commerce experience, it is important to configure spending budgets for all customer Azure subscriptions. This action contributes to your Partner Center security score and can also help in managing and monitoring resource consumption.5
Aim for the Solutions Partner for Security Designation: If your organization has security as a core area of expertise, consider working towards achieving the Solutions Partner for Security designation. This involves focusing on improving your performance metrics (net customer adds), skilling levels (relevant certifications), and customer success in deploying and driving the usage of security-related workloads.8
Regularly Review the Security Requirements Dashboard: Make it a practice to regularly utilize the Security requirements dashboard within Partner Center to monitor your current security score and identify any areas where improvements can be made to meet the mandatory requirements.5
Leverage the Partner Security Score API: Explore the potential of using the partner security score API to gain deeper insights into both your organization’s and your customers’ security posture. This proactive approach can help in identifying and addressing potential risks before they escalate.6
Transition to Granular Delegated Admin Privileges (GDAP): If your organization is still using Delegated Admin Privileges (DAP), plan and execute a migration to Granular Delegated Admin Privileges (GDAP). GDAP offers enhanced security by providing more granular and least-privileged access to customer tenants, reducing the potential impact of compromised partner accounts.4

These recommendations highlight the importance of a multi-layered approach to security, encompassing technical implementations like MFA and secure application models, operational procedures for alert management, and strategic goals such as achieving the Solutions Partner designation. Microsoft provides partners with both the requirements and the necessary tools, such as the Partner Center dashboard and API, to effectively manage and continuously improve their security posture, demonstrating a strong commitment to security within the partner program.

9. Conclusion: In summary, Microsoft partners are required to adhere to several mandatory security measures to ensure the safety and integrity of their own operations and the environments of their customers. These include the critical step of enforcing Multi-Factor Authentication (MFA) on their partner tenants and adopting the Secure Application Model when integrating with Partner Center APIs. The Partner Center security score serves as a key indicator of a partner’s compliance with these specific security requirements.

Achieving a partner capability score of at least 70 is a specific requirement for attaining the Solutions Partner for Security designation, which recognizes expertise in this critical area. This score is based on a holistic evaluation of a partner’s performance, skilling, and success in delivering security solutions. While promoting the adoption of MFA for administrative roles within customer tenants is a crucial responsibility for partners and directly impacts their Partner Center security score, the research does not indicate an explicit requirement for a specific Microsoft Secure Score target for customers.

Therefore, based on the analysis of the provided research snippets, a Partner Center security score of 70 is not explicitly mandated as a general requirement. Furthermore, a Microsoft Secure Score of 70 is not a defined requirement for customers within the context of the partner program requirements discussed. Instead, partners should prioritize meeting all the mandatory security requirements outlined by Microsoft to achieve the highest possible Partner Center security score. Simultaneously, they should actively work to improve the security posture of their customer tenants by promoting and facilitating the adoption of security best practices, particularly the implementation of Multi-Factor Authentication.

Works cited

New benefits packages for the Microsoft AI Cloud Partner Program, accessed on May 9, 2025, https://www.microsoft.com/en-us/americas-partner-one/News/new-benefits-packages-for-the-microsoft-ai-cloud-partner-program
Counter cyber threats as a Solutions Partner for Security, accessed on May 9, 2025, https://partner.microsoft.com/de-de/blog/article/counter-cyber-threats-as-a-solutions-partner-for-security
Partner security requirements FAQ – Partner Center | Microsoft Learn, accessed on May 9, 2025, https://learn.microsoft.com/en-us/partner-center/security/partner-security-requirements-faq
Partner security requirements – Partner Center | Microsoft Learn, accessed on May 9, 2025, https://learn.microsoft.com/en-us/partner-center/security/partner-security-requirements
Security requirements dashboard for Partner Center – Learn Microsoft, accessed on May 9, 2025, https://learn.microsoft.com/en-us/partner-center/security/security-requirements
What is the Security workspace? – Partner Center | Microsoft Learn, accessed on May 9, 2025, https://learn.microsoft.com/en-us/partner-center/security/overview
Use the partner security score API in Microsoft Graph (preview), accessed on May 9, 2025, https://learn.microsoft.com/en-us/graph/api/resources/partner-security-score-api-overview?view=graph-rest-beta
Solutions Partner for Security – Partner Center | Microsoft Learn, accessed on May 9, 2025, https://learn.microsoft.com/en-us/partner-center/membership/solutions-partner-security
Solutions Partner program Partner Capability Score – Partner Center | Microsoft Learn, accessed on May 9, 2025, https://learn.microsoft.com/en-us/partner-center/membership/partner-capability-score
Specialization – Microsoft Partner Network, accessed on May 9, 2025, https://partner.microsoft.com/en-us/partnership/specialization
Microsoft Secure Score – Microsoft Defender XDR, accessed on May 9, 2025, https://learn.microsoft.com/en-us/defender-xdr/microsoft-secure-score
Microsoft Secure Score – A Complete Overview – AdminDroid Blog, accessed on May 9, 2025, https://blog.admindroid.com/boost-up-your-security-posture-with-microsoft-secure-score/

Benefits of using KQL to improve the security

What is KQL?

KQL is a powerful, read-only query language designed to explore data and discover patterns. It’s used across various Microsoft services, most notably for our discussion:

Microsoft Sentinel: A cloud-native SIEM (Security Information and Event Management) and SOAR (Security Orchestration, Automation, and Response) solution.
Microsoft 365 Defender: An XDR (Extended Detection and Response) platform that provides integrated threat protection, detection, and response across endpoints, identities, email, and cloud apps. Its “Advanced Hunting” feature uses KQL.

Essentially, KQL allows you to “talk” to the vast amounts of security log data generated by your M365 services.

Benefits of Using KQL to Improve M365 Tenant Security:

Proactive Threat Hunting:
- Beyond Built-in Detections: While Microsoft provides many out-of-the-box detections, KQL allows you to hunt for specific, emerging threats, anomalous behaviors, or indicators of compromise (IOCs) that might not trigger a standard alert.
- Hypothesis-Driven Investigation: You can form a hypothesis (e.g., “Are there any unusual external email forwarding rules set up?”) and use KQL to validate it against your logs.
Deep Incident Investigation & Root Cause Analysis:
- Contextual Understanding: When an alert fires, KQL lets you dive deep into the raw logs (Azure AD sign-ins, Exchange mail flow, SharePoint activity, Defender alerts, etc.) to understand the full scope, timeline, and impact of an incident.
- Connecting the Dots: You can join data from different sources (e.g., correlate a suspicious sign-in with subsequent file access or email activity) to build a complete picture.
Custom Detection Rule Creation:
- Tailored Alerts: If you identify a pattern of malicious activity specific to your environment or a new threat vector, you can write KQL queries and turn them into custom analytic rules in Microsoft Sentinel or custom detection rules in M365 Defender. This automates the detection of future occurrences.
- Reduced False Positives: By crafting precise KQL queries, you can fine-tune detection logic to minimize false positives and focus on genuine threats.
Enhanced Visibility & Reporting:
- Custom Dashboards & Workbooks: KQL queries can power custom dashboards and workbooks in Sentinel, providing tailored views of your security posture, trends, and key metrics (e.g., risky sign-ins by location, malware detections over time).
- Compliance & Auditing: Extract specific data needed for compliance reporting or internal audits, such as administrator activity logs or access to sensitive data.
Understanding Your Environment:
- Baseline Activity: Use KQL to understand normal patterns of behavior in your tenant. This makes it easier to spot deviations that could indicate a security issue.
- Configuration Audits: Query configurations (e.g., MFA status, conditional access policies, sharing settings) to ensure they align with security best practices.
Speed and Scalability:
- KQL is optimized for querying massive datasets very quickly, which is essential when dealing with the volume of telemetry generated by M365 services.

How to Get Started Using KQL for M365 Security:

Access the Right Portals:
- Microsoft 365 Defender Portal (security.microsoft.com):
  - Navigate to Hunting > Advanced Hunting. This is where you’ll query data from Defender for Endpoint, Defender for Office 365, Defender for Identity, Defender for Cloud Apps, and Azure AD Identity Protection.
- Microsoft Sentinel (via Azure Portal portal.azure.com):
  - Navigate to your Log Analytics Workspace connected to Sentinel, then select Logs. This is where you’ll query data ingested into Sentinel, which can include M365 logs, Azure activity, third-party logs, etc.
Ensure Data Ingestion (Prerequisite):
- For Microsoft 365 Defender Advanced Hunting: Most data from the Defender suite is automatically available.
- For Microsoft Sentinel: You need to set up Data Connectors for the M365 services you want to query (e.g., Azure Active Directory, Office 365, Microsoft Defender for Cloud Apps).
Learn Basic KQL Syntax:
- KQL queries are a sequence of data transformation steps piped (|) together.
- TableName: Start by specifying the table you want to query (e.g., SigninLogs, EmailEvents, DeviceEvents).
  - In Advanced Hunting, the schema is usually pre-loaded on the left.
  - In Sentinel (Logs), you can see available tables in the schema pane.
- | where Condition: Filters rows based on a condition (e.g., | where ResultType == "50126" for failed logins due to MFA).
- | project Column1, Column2: Selects specific columns.
- | summarize Aggregation by GroupingColumn: Aggregates data (e.g., | summarize count() by UserPrincipalName).
- | top N by Column [desc/asc]: Shows the top N results.
- | extend NewColumn = Calculation: Creates a new column.
- | join kind=inner (OtherTable) on CommonColumn: Combines rows from two tables.
- Time Range: Use the time picker in the UI or specify in the query (e.g., | where TimeGenerated > ago(1d)).
Explore Schemas and Tables:
- In both Advanced Hunting and Sentinel Logs, there’s a schema explorer. Familiarize yourself with the available tables and their columns. Common tables include:
  - M365 Defender: IdentityLogonEvents, EmailEvents, UrlClickEvents, DeviceProcessEvents, CloudAppEvents.
  - Sentinel (often from Azure AD): SigninLogs, AuditLogs, OfficeActivity, SecurityAlert.

Start with Simple Queries and Build Up:

Example: See the last 10 sign-ins.

SigninLogs // Or IdentityLogonEvents in M365 Defender
| top 10 by TimeGenerated desc

Example: Count failed sign-ins by user in the last day.

SigninLogs
| where TimeGenerated > ago(1d)
| where ResultType != 0 and ResultType != 50140 // Filter for various failure codes, 0 and 50140 are common success/interrupts
| summarize FailureCount = count() by UserPrincipalName
| top 10 by FailureCount desc

Use IntelliSense and Built-in Help:
- The query editors in both portals have IntelliSense to help you with table names, column names, and operators.
- Look for example queries or templates provided by Microsoft.
Leverage Microsoft’s Learning Resources:
- Microsoft Learn KQL Path: Search for “KQL” on Microsoft Learn. There are excellent modules.
- Microsoft Sentinel Documentation: Full of KQL examples for security scenarios.
- Microsoft 365 Defender Advanced Hunting Documentation: Similar to Sentinel docs but focused on Defender data.
- GitHub Repositories: Microsoft and the community share many KQL queries for Sentinel and M365 Defender on GitHub.
Practice, Practice, Practice:
- Take an existing alert and try to find the related raw logs.
- Think of a security question (e.g., “Has anyone downloaded an unusual number of files from SharePoint recently?”) and try to answer it with KQL.

Example KQL Queries for M365 Security:

Suspicious Sign-in Locations (Sentinel – SigninLogs):

SigninLogs
| where TimeGenerated > ago(7d)
| where Location != "YourExpectedCountry" // Be more specific with IPs or city if possible
| summarize count() by UserPrincipalName, Location, IPAddress
| sort by count_ desc

New Email Inbox Forwarding Rule (M365 Defender – CloudAppEvents):

CloudAppEvents
| where TimeGenerated > ago(1d)
| where Application == "Microsoft Exchange Online"
| where ActionType == "New-InboxRule"
| where RawEventData has "ForwardTo" or RawEventData has "RedirectTo"
| project Timestamp, AccountObjectId, UserAgent, RawEventData

Potentially Malicious File Downloads by a User (M365 Defender – CloudAppEvents for SharePoint/OneDrive):

CloudAppEvents
| where TimeGenerated > ago(1d)
| where ActionType == "FileDownloaded"
| where Application in ("Microsoft SharePoint Online", "Microsoft OneDrive for Business")
// Optional: add filters for specific file types if known (e.g., | where FileName endswith ".exe" or FileName endswith ".ps1")
| summarize FilesDownloaded = dcount(FileName), TotalSize = sum(tolong(RawEventData.FileSize)) by Actor = UserPrincipalName, bin(TimeGenerated, 1h)
| where FilesDownloaded > 10 // Example threshold

Key Takeaway:

KQL is an indispensable skill for modern security operations in the Microsoft ecosystem. It empowers you to move from reactive alert chasing to proactive threat hunting and deep investigation, significantly improving your M365 tenant’s security posture. Start simple, leverage the available resources, and gradually build your expertise.

How effective is enabling Windows Attack Surface Reduction in preventing a Windows device from Malware?

Enabling Windows Attack Surface Reduction (ASR) rules is **highly effective** in preventing a Windows device from many common types of malware and attack techniques. It’s a crucial component of a defense-in-depth strategy.

However, it’s not a silver bullet and its effectiveness depends on several factors.

Here’s a breakdown of its effectiveness:

How ASR Works and Why It’s Effective:

Targets Common Attack Vectors: ASR rules are specifically designed to block behaviors commonly used by malware to infect machines and execute malicious code. This includes:
- Office Application Abuse: Blocking Office apps from creating executable content, injecting into other processes, creating child processes, or running macros deemed malicious.
- Script-Based Attacks: Blocking obfuscated scripts (JavaScript, VBScript, PowerShell), or scripts that download/run payloads.
- Email-Based Threats: Blocking executable content from email clients and webmail.
- Exploitation Techniques: Preventing credential stealing (e.g., from LSASS), process hollowing, or unsigned/untrusted executables from running from USB drives.
- Ransomware Behaviors: Some rules can help mitigate common ransomware tactics.
Pre-Execution and Early-Execution Prevention: Many ASR rules intervene before malware fully executes or early in its execution chain, stopping the attack before significant damage occurs. This is more proactive than relying solely on detection of already-running malware.
Reduces Reliance on Signatures: While traditional AV relies heavily on signatures for known malware, ASR focuses on behaviors. This makes it more effective against new or polymorphic malware that might not have a signature yet.
Complements Antivirus: ASR works alongside Microsoft Defender Antivirus (or other AV solutions) and Endpoint Detection and Response (EDR) solutions like Microsoft Defender for Endpoint. It adds an extra layer of proactive defense.

Factors Influencing Effectiveness:

Which Rules Are Enabled: There are many ASR rules. Not all may be suitable for every environment. Enabling more relevant rules increases protection. Some key high-impact rules include:
- Block Office applications from creating child processes.
- Block Adobe Reader from creating child processes.
- Block execution of potentially obfuscated scripts.
- Block credential stealing from the Windows local security authority subsystem (lsass.exe).
- Block executable content from email client and webmail.
Mode of Operation (Audit vs. Block):
- Audit Mode: Logs what would have been blocked. Essential for testing and identifying potential legitimate application conflicts (false positives) before enabling block mode. Provides visibility but no active prevention.
- Block Mode: Actively prevents the flagged behaviors. This is where the true preventative power lies.
Exclusions: Properly configured exclusions are necessary for legitimate applications that might otherwise trigger ASR rules. Overly broad exclusions can reduce effectiveness.
Configuration and Management: Consistent deployment and management (e.g., via Group Policy, Intune, MEMCM) ensure all devices are protected.
Attacker Sophistication: While ASR stops many common TTPs (Tactics, Techniques, and Procedures), highly sophisticated attackers might find novel ways to bypass specific rules or use techniques not covered by ASR.
Keeping Systems Updated: Microsoft continually updates ASR rules and the underlying Defender platform to address new threats and improve detection logic.

Limitations:

False Positives: The primary challenge. Some legitimate applications, especially older or custom-developed ones, might exhibit behaviors that trigger ASR rules. Thorough testing in audit mode is crucial.
Not a Complete Solution: ASR doesn’t cover every conceivable attack vector. It won’t stop zero-day exploits against unpatched vulnerabilities if the exploit doesn’t trigger a specific ASR rule behavior.
User Experience: If not carefully tuned, blocking legitimate actions can frustrate users.

Conclusion:

Enabling Windows Attack Surface Reduction rules is a very effective proactive measure to significantly reduce the likelihood of malware infection from common attack vectors. It raises the bar for attackers, forcing them to use less common or more sophisticated techniques.

For maximum effectiveness:

Start in Audit Mode: Understand the impact on your environment.
Gradually Enable Rules in Block Mode: Prioritize rules that block high-risk behaviors with low potential for false positives first.
Monitor and Tune: Continuously review ASR logs and adjust exclusions as needed.
Use in Conjunction with Other Security Layers: ASR should be part of a comprehensive security strategy that includes antivirus, EDR, firewalls, patching, and user education.

When implemented thoughtfully, ASR is a powerful, built-in tool that provides a substantial boost to Windows endpoint security.

Enforce device compliance and app protection policies on BYOD with M365 Business premium

M365 Business Premium is well-suited for this because it includes key components like:

Microsoft Intune (Part of Microsoft Endpoint Manager): For Mobile Device Management (MDM) and Mobile Application Management (MAM).
Azure Active Directory (Azure AD) Premium P1: Provides Conditional Access policies, which are crucial for enforcement.
Information Protection Features: For data security.

Here’s a step-by-step approach, focusing on the least intrusive but effective methods for BYOD:

Core Strategy: Prioritize App Protection Policies (MAM) without Full Device Enrollment (MDM)

This is often the preferred approach for BYOD because it protects corporate data within specific apps without taking full control over the user’s personal device. It respects user privacy while securing business information.

Steps:

Configure App Protection Policies (APP / MAM Policies):
- Go to the Microsoft Endpoint Manager admin center: (endpoint.microsoft.com)
- Navigate: Apps > App protection policies.
- Create Policy: Click “+ Create policy” and select the platform (iOS/iPadOS or Android).
- Basics: Give the policy a descriptive name (e.g., “BYOD App Protection – Android”).
- Apps:
  - Target policy to: Select “All Public Apps” or “Selected Apps”. For BYOD, often start with core Microsoft apps (Outlook, Teams, OneDrive, Edge, Office apps). You can add other MAM-enabled apps later.
  - Important: This policy only applies to apps that support Intune App Protection.
- Data Protection: This is the core. Configure settings like:
  - Prevent backup: Block backing up work data to personal cloud storage (iCloud/Google Cloud).
  - Restrict cut, copy, paste: Control data movement between managed (work) apps and unmanaged (personal) apps. Often set to “Policy managed apps”.
  - Encryption: Ensure app data is encrypted. (Usually enabled by default).
  - Screen capture: Block screen capture for Android (iOS requires device management).
  - Save copies of org data: Prevent saving work files to local/personal storage. Allow saving only to managed locations like OneDrive for Business or SharePoint.
  - Receive data from other apps: Control if managed apps can receive data from unmanaged apps.
  - Open data in Org documents: Control which apps can open work documents.
- Access Requirements: Define how users access the protected apps:
  - PIN for access: Require a separate PIN (or biometrics) to open the work apps. Configure PIN complexity and timeout.
  - Work or school account credentials for access: Force re-authentication after a period of inactivity.
- Conditional Launch: Set conditions that must be met for the app to launch (e.g., block rooted/jailbroken devices, minimum OS version, app version).
- Assignments:
  - Target: Assign the policy to specific Azure AD user groups containing your BYOD users. Do not assign to device groups for MAM-without-enrollment.
- Review + Create: Finalize and create the policy.
Configure Conditional Access Policies in Azure AD:
- This is how you enforce the use of protected apps and check device state (even without full enrollment).
- Go to the Microsoft Endpoint Manager admin center or Azure AD portal: (portal.azure.com)
- Navigate: Endpoint Security > Conditional Access (in MEM) or Azure Active Directory > Security > Conditional Access (in Azure Portal).
- Create New Policy:
  - Name: Give it a clear name (e.g., “CA – Require App Protection for Mobile Access”).
  - Assignments > Users and groups: Target the same user groups as your App Protection Policy.
  - Assignments > Cloud apps or actions: Select the specific M365 services you want to protect (e.g., Exchange Online, SharePoint Online, Teams). Start with “Office 365” (which covers multiple services).
  - Assignments > Conditions > Device platforms: Configure this policy to apply only to iOS and Android.
  - Assignments > Conditions > Client apps: Configure this to apply to “Mobile apps and desktop clients” > “Modern authentication clients” > Select “Mobile apps”.
  - Access Controls > Grant:
    - Select “Grant access”.
    - Choose “Require app protection policy”.
    - Optional but Recommended: Also choose “Require approved client app”. This ensures users are using MAM-capable apps (like Outlook Mobile instead of native mail clients).
    - For “Multiple controls”: Select “Require all the selected controls”.
  - Enable policy: Set to “On”.
  - Create: Save the policy.

User Experience with this Approach:

The user installs a managed app (e.g., Outlook) from the public app store.
They sign in with their work (Azure AD) account.
Conditional Access checks if access is allowed. The policy requires an app protection policy.
The user is prompted that their organization protects data in the app. They may be prompted to install the Microsoft Authenticator (on Android) or the Company Portal app (on iOS/Android). Crucially, they do NOT need to fully enroll their device via the Company Portal. The Company Portal app simply needs to be present to receive and report the APP status.
The App Protection Policy settings are applied to the app (e.g., PIN required, copy/paste restrictions).
The user can now securely access work data within that managed app. Their personal apps and data remain untouched and unmanaged.

Alternative/Additional Strategy: Device Compliance (Requires Enrollment – MDM)

If you need stronger device-level controls (e.g., enforcing screen lock complexity on the device itself, checking for device encryption, ensuring minimum OS), you need users to enroll their devices into Intune (MDM). This is more intrusive for BYOD and users might resist.

Steps (If Choosing Enrollment):

Configure Enrollment Restrictions: (MEM Admin Center > Devices > Enroll devices > Enrollment device platform restrictions) Ensure personal iOS/Android devices are allowed to enroll if you intend to support this.
Create Device Compliance Policies: (MEM Admin Center > Devices > Compliance policies)
- Create separate policies for iOS and Android.
- Configure settings like: Minimum/Maximum OS Version, Require PIN/Password, Require Encryption, Device Threat Level (if using Defender for Endpoint), Block rooted/jailbroken devices.
- Assign these policies to user groups.
Modify/Create Conditional Access Policies:
- Instead of (or in addition to) “Require app protection policy,” add the grant control “Require device to be marked as compliant”.
- You can combine these: Require a compliant device AND require app protection policy for maximum security on enrolled BYOD devices.

User Experience with Enrollment:

User installs the Company Portal app.
User signs in and follows the prompts to enroll their device. This grants Intune management capabilities over the device.
Intune checks the device against the assigned Compliance Policy.
If compliant, the device is marked as such in Azure AD.
Conditional Access policies check for this compliance status before granting access to corporate resources.
App Protection Policies can still be applied for layered data security within apps, even on enrolled devices.

Summary & Recommendation:

For BYOD, start with App Protection Policies (MAM) without enrollment, enforced by Conditional Access requiring App Protection and Approved Client Apps. This provides strong data security within work apps with minimal impact on the user’s personal device.
Use Device Compliance Policies (MDM) requiring enrollment only if you have specific, strong requirements for device-level settings and your users consent to this level of management on their personal devices.
Always communicate clearly with users about what is being managed and why, especially with BYOD.
Test thoroughly with pilot groups before rolling out broadly.

By leveraging App Protection Policies and Conditional Access, Microsoft 365 Business Premium offers a powerful and flexible way to secure corporate data on BYOD smartphones while respecting user privacy.

Starting point for implementing Intune security policies

This plan focuses on establishing foundational security controls across your diverse devices, leveraging the integrated features of M365 BP.

Core Concepts:

Microsoft Intune: Your cloud-based Mobile Device Management (MDM) and Mobile Application Management (MAM) solution.
Azure Active Directory (Azure AD): Your identity provider. User accounts and groups live here. It’s tightly integrated with Intune.
Configuration Profiles: These define settings and restrictions pushed to managed devices (MDM).
Application Protection Policies (APP / MAM): These protect organizational data within specific apps, useful for both corporate and personally owned (BYOD) devices, without requiring full device enrollment.
Compliance Policies: Define rules devices must meet to be considered “compliant” (e.g., have encryption enabled, be updated).
Conditional Access (CA): The powerhouse feature (included in M365 BP via Azure AD Premium P1 features) that uses signals (like user, location, device compliance) to enforce organizational policies (like requiring MFA or blocking access from non-compliant devices).

Assumptions:

You have Microsoft 365 Business Premium licenses assigned to all 20 users.
You have Global Administrator access to your Microsoft 365 tenant.
Your users are licensed and exist in Azure AD.

Step-by-Step Implementation Plan:

Phase 1: Preparation & Foundational Setup

Access the Endpoint Manager Admin Center:
- Go to: https://endpoint.microsoft.com/
- Log in with your Global Administrator account. This is your central hub for Intune configuration.
Set MDM Authority to Intune:
- Navigate to Tenant administration > Tenant status.
- Verify that the Mobile device management authority is set to Microsoft Intune. If it’s something else (like Office 365 MDM or Configuration Manager), you’ll need to change it. This is usually a one-time setting for new tenants. Be careful if you have existing MDM.
Configure Enrollment Settings (Enable Platforms):
- You need to explicitly allow each device platform to enroll.
- Windows: Go to Devices > Enroll devices > Windows enrollment > Automatic Enrollment.
  - Set MDM user scope to All (or a specific Pilot Group first).
  - Set MAM user scope to All (or Pilot Group). This enables MAM without full enrollment for BYOD Windows.
  - Recommendation: Also configure DNS CNAME records (enterpriseenrollment and enterpriseregistration) pointing to Microsoft’s services to simplify Windows enrollment. Search Microsoft Docs for “Configure DNS for Intune Windows enrollment”.
- Apple (iOS/iPadOS & macOS): Go to Devices > Enroll devices > Apple enrollment.
  - You must create an Apple Push Notification service (APNs) certificate. Follow the Apple MDM Push certificate link and instructions carefully. This certificate needs renewal annually. Set reminders!
  - For macOS enrollment methods, initially, users can enroll via the Company Portal app.
  - For iOS/iPadOS enrollment methods, users can enroll via the Company Portal app.
  - (Advanced/Recommended for corporate devices later: Consider Apple Business Manager integration for supervised enrollment).
- Android: Go to Devices > Enroll devices > Android enrollment.
  - Click Managed Google Play and connect your Intune tenant to your organization’s Managed Google Play account. Follow the instructions. This is required for most Android management scenarios.
  - Decide on enrollment profiles. For a mix of BYOD and potentially corporate devices, enabling Android Enterprise: Personally-owned devices with work profile is the most common starting point for BYOD. This creates a secure container for work apps/data separate from personal data.
Create User Groups:
- Go to the Azure AD portal (https://aad.portal.azure.com/) or via M365 Admin Center (Groups > Active groups).
- Create at least one group, e.g., “All Company Employees”. Assign all 20 users to this group. This makes targeting policies much easier. You might create pilot groups later for testing.

Phase 2: Basic Security Policies (Configuration Profiles)

Start with essential security settings for each platform. Target these profiles to your “All Company Employees” group (or a pilot group first).

How to Create: In Endpoint Manager (https://endpoint.microsoft.com/), go to Devices > Configuration profiles > Create profile. Select the Platform, then choose a Profile type (use Settings catalog where possible for granularity, or Templates for common scenarios).

Windows Security Policies:
- Platform: Windows 10 and later
- Profile Type: Settings catalog
- Key Settings to Configure (Search within Settings catalog):
  - BitLocker: Require device encryption, configure recovery key storage. (Crucial!)
  - Password: Set minimum length, complexity, history.
  - Windows Defender (Microsoft Defender Antivirus): Ensure real-time monitoring, cloud protection, daily scans are enabled. (M365 BP includes Defender for Business features here).
  - Windows Update for Business: Create Update Rings to manage patch deployment (e.g., install deadlines, deferral periods).
  - Firewall: Ensure Microsoft Defender Firewall is enabled for relevant profiles (Domain, Private, Public).
macOS Security Policies:
- Platform: macOS
- Profile Type: Settings catalog (preferred) or Templates (e.g., Device Restrictions)
- Key Settings:
  - Passcode: Set minimum length, complexity, auto-lock time.
  - Encryption (FileVault): Require FileVault disk encryption, configure recovery key escrow. (Crucial!)
  - Software Update Policy: Configure how updates are handled.
  - Security & Privacy: Enforce Gatekeeper (allow apps from App Store and identified developers), ensure Firewall is enabled.
iOS/iPadOS Security Policies:
- Platform: iOS/iPadOS
- Profile Type: Settings catalog (preferred) or Templates (e.g., Device Restrictions)
- Key Settings:
  - Passcode: Require passcode, set minimum length, complexity (e.g., alphanumeric), maximum grace period for device lock, max failed attempts before wipe (optional but strong).
  - Device Restrictions: Consider disabling simple passcodes, maybe block untrusted TLS certificates, configure AirDrop settings. Start minimally.
Android Enterprise (Work Profile) Security Policies:
- Platform: Android Enterprise
- Profile Type: Personally-owned work profile > Device restrictions
- Key Settings:
  - Work profile settings: Require a separate Work Profile Password (complexity, length).
  - Device password: Require a device screen lock (can be less strict than work profile if desired, but still recommended).
  - Security: Ensure work profile data is encrypted (usually default), block screen capture within the work profile, potentially restrict data sharing between personal/work profiles.

Phase 3: Protect App Data (Application Protection Policies – MAM)

This is vital for BYOD scenarios and adds a layer of security even on enrolled devices.

How to Create: In Endpoint Manager, go to Apps > App protection policies > Create policy. Select the platform (iOS/iPadOS, Android, Windows).

Create Policies for iOS/iPadOS and Android:
- Target these policies to your “All Company Employees” group.
- Apps: Select All Microsoft apps or target specific core apps initially (Outlook, OneDrive, Teams, Edge, Word, Excel, PowerPoint).
- Data Protection Settings:
  - Prevent Save As to local/personal storage.
  - Restrict Cut, copy, and paste between policy-managed apps and unmanaged/personal apps (Allow within policy apps).
  - Block opening work data in unmanaged apps.
  - Encrypt work app data.
- Access Requirements:
  - Require PIN for access (separate from device passcode). Set complexity, length, timeout. Allow Biometrics (Face ID/Touch ID/Fingerprint) as an alternative to PIN.
- Conditional Launch:
  - Set conditions like minimum OS version, block jailbroken/rooted devices.
(Optional but Recommended) Create Policy for Windows:
- This protects data on Windows devices without full MDM enrollment (useful if some Windows PCs are personal).
- Target the policy to the user group.
- Select target apps (e.g., Edge).
- Configure similar data protection settings (prevent save-as, restrict copy/paste).
- Note: Windows MAM has fewer features than mobile MAM.

Phase 4: Enforce Health and Access (Compliance & Conditional Access)

This ties everything together.

Create Device Compliance Policies:
- How to Create: In Endpoint Manager, go to Devices > Compliance policies > Create policy. Select Platform.
- Key Settings (Align with Configuration Profiles):
  - Windows: Require BitLocker, Require Secure Boot, Require Antivirus, Require Firewall, Set Min/Max OS Version, Require Password.
  - macOS: Require System Integrity Protection, Require Firewall, Require Password, Require FileVault, Set Min/Max OS Version.
  - iOS/iPadOS: Require Passcode, Require device encryption (implicit with passcode), Min/Max OS Version, Block Jailbroken devices.
  - Android Enterprise (Work Profile): Require Device Lock, Require Encryption, Min/Max OS Version, Block Rooted devices, Require Google Play Protect checks.
- Actions for Non-Compliance: Start with Mark device noncompliant (immediately). You can add Send email to end user after a few days.
- Assignment: Assign these policies to your “All Company Employees” group.
Configure Foundational Conditional Access Policies:
- How to Configure: In Endpoint Manager, go to Devices > Conditional Access > Create new policy. (This actually takes you to the Azure AD CA portal).
- Policy 1: Require MFA for All Users:
  - Name: CA001: Require MFA for All Users
  - Assignments: Users and groups > Include All users. Exclude 1-2 emergency access/”break-glass” accounts (highly recommended).
  - Cloud apps or actions: Include All cloud apps.
  - Conditions: Define any trusted locations (like your office IP) where MFA might be skipped if necessary (use with caution).
  - Access controls: Grant > Grant access > Check Require multi-factor authentication. Require all the selected controls.
  - Enable policy: On (or Report-only initially to test impact).
- Policy 2: Require Compliant Devices for Cloud App Access:
  - Name: CA002: Require Compliant Device for Access
  - Assignments: Users and groups > Include All users. Exclude break-glass accounts.
  - Cloud apps or actions: Include All cloud apps.
  - Conditions: Device platforms > Configure > Include All platforms. Client apps > Configure > Include Browser, Mobile apps and desktop clients.
  - Access controls: Grant > Grant access > Check Require device to be marked as compliant. Require all the selected controls.
  - Enable policy: Report-only first, then On.
- Policy 3: Require Approved App / App Protection Policy for Mobile Access:
  - Name: CA003: Require Protected Apps on Mobile
  - Assignments: Users and groups > Include All users. Exclude break-glass accounts.
  - Cloud apps or actions: Include Office 365 (or specific apps like Exchange Online, SharePoint Online).
  - Conditions: Device platforms > Configure > Include Android, iOS. Client apps > Configure > Include Mobile apps and desktop clients.
  - Access controls: Grant > Check Require approved client app AND Require app protection policy. Select Require one of the selected controls (allows flexibility if one isn’t applicable).
  - Enable policy: Report-only first, then On.

Phase 5: User Enrollment, Communication & Monitoring

Communicate with Users:
- Explain why these changes are being made (security, data protection).
- Provide simple instructions on how to enroll their devices (e.g., install Company Portal app from the app store and sign in).
- Explain what they should expect (e.g., prompts for PINs, work profile creation on Android).
- Offer support for the transition.
Guide Users Through Enrollment:
- Have users install the “Intune Company Portal” app on their iOS, Android, and macOS devices and sign in with their M365 credentials. Follow the prompts.
- For Windows devices that are not already Azure AD Joined: Guide users through Settings > Accounts > Access work or school > Connect, entering their M365 email and following prompts to join Azure AD and enroll in Intune (if Automatic Enrollment is configured).
Monitor Enrollment and Compliance:
- In Endpoint Manager, check Devices > Overview for enrollment status and compliance overview.
- Check specific device compliance under Devices > Compliance policies.
- Review Conditional Access sign-in logs in Azure AD (Monitoring > Sign-in logs) to see policy impacts.

Important Considerations:

Start Simple & Iterate: Don’t try to implement everything at once. Start with foundational policies and build complexity as needed.
Test Thoroughly: Use pilot groups before rolling out to everyone. Use “Report-only” mode for Conditional Access policies initially.
BYOD vs. Corporate: Be clear about expectations for personal devices (Work Profile on Android, MAM policies) vs. company-owned devices (potentially fully managed).
User Experience: Balance security with usability. Overly restrictive policies can hinder productivity.
Documentation: Keep track of the policies you create and why.
Annual APNs Renewal: Don’t forget this! If it expires, you can’t manage Apple devices.

This step-by-step guide provides a solid starting point leveraging the security features within Microsoft 365 Business Premium. Remember to consult Microsoft’s official documentation for detailed configuration options as you proceed.