WOLFSKYCLOUD
← Back to home

CASE STUDY

Microsoft 365 Baseline Security Implementation

Enterprise-grade security baseline for Contoso Ltd aligned to Zero Trust principles using Microsoft 365 E3 + Security P2 licensing.

Client Contoso Ltd / Contoso MSP
Status In Progress
Scope 6 Phases, 4–6 weeks
Repository manuelarceaburto/m365-baseline-security

OVERVIEW

Phased approach to enterprise security

This project implements an enterprise-grade Microsoft 365 security baseline across six phases, with each phase requiring written client approval before deployment. All pre-deployment configuration documents have been prepared and are pending approval.

Phase 1 Completed

Planning & Assessment

Discovery, licensing confirmation, SOW approval, admin workstation setup.

Phase 2 Ready to Deploy

Identity & Access Control

PIM, Conditional Access, MFA, break-glass accounts, role eligibility.

Phase 3 Queued

Email & Threat Protection

Defender for Office 365 P2, Safe Links, Safe Attachments, DKIM, DMARC, SPF.

Phase 4 Queued

Endpoint Security & EDR

Defender for Endpoint P2, Intune configuration, compliance policies, ASR rules.

Phase 5 Queued

Data Protection & Governance

Sensitivity labels, DLP policies, endpoint DLP, data classification schema.

Phase 6 Queued

Compliance, Audit & Secure Score

Unified audit log, alert policies, Secure Score assessment, remediation plan.

SECURITY ARCHITECTURE

Integrated M365 security framework

All components work together to create a comprehensive Zero Trust security posture. Each phase builds on previous foundations, ensuring layered protection across identity, email, endpoints, and data.

Identity & Access (Phase 2)

  • Entra ID P2 — User & device identity platform
  • PIM — Privileged Identity Management with time-bound elevation
  • Conditional Access — 6+ policies enforcing MFA, location, risk-based rules
  • Break-Glass Accounts — Emergency access excluded from all policies
  • Authentication Methods — Microsoft Authenticator, FIDO2, TAP (SMS/Voice disabled)
  • Identity Protection — Risk detection, sign-in anomalies, user compromises

Email & Threat Protection (Phase 3)

  • Defender for Office 365 P2 — Advanced threat protection
  • Safe Links — Real-time URL scanning + click tracking
  • Safe Attachments — Dynamic delivery or blocking by user risk
  • Anti-Phishing — Aggressive impersonation protection (level 3)
  • Anti-Spoofing — Spoof intelligence, DMARC enforcement
  • DKIM/SPF/DMARC — Email authentication staged rollout
  • Alert Policies — Real-time notifications for security events

Endpoint & EDR (Phase 4)

  • Defender for Endpoint P2 — Advanced EDR + vulnerability mgmt
  • Network Protection — Block mode for malicious URLs
  • AIR — Automated Investigation & Response (auto-remediate low/med, manual approval for high)
  • Threat Analytics — Weekly threat reports + recommendations
  • Intune — Unified endpoint management platform
  • Compliance Policies — BitLocker, Secure Boot, Firewall, Defender, password requirements
  • Config Profiles — Security Baseline, Defender, Firewall, ASR rules
  • App Protection (MAM) — PIN, copy/paste restrictions, offline wipe

Data Protection & Governance (Phase 5)

  • Sensitivity Labels — Public, General, Confidential, Highly Confidential, Personal
  • DLP Policies — Email, cloud (SharePoint/OneDrive), and endpoint DLP
  • Endpoint DLP — USB, Print, Cloud Upload restrictions
  • Information Barriers — Communication restrictions (optional)
  • Retention Policies — Data lifecycle management

Compliance & Audit (Phase 6)

  • Unified Audit Log — 180-day retention (E3) or 1-year (E5/add-on)
  • Alert Policies — 12+ policies for privilege changes, bulk deletion, impossible travel, DLP spikes
  • Secure Score — Security posture measurement + remediation tracking
  • Compliance Manager — Regulatory compliance tracking
  • eDiscovery — Legal hold + content search (if needed)

Foundation & Integration

  • Microsoft Graph API — All M365 platform automation
  • Azure CLI + PowerShell 7 — Infrastructure & policy-as-code
  • VS Code + Git — Configuration versioning & documentation
  • Intune-MDE Connector — Device health sync between platforms
  • Security group structure — Role-based policy targeting

DEPLOYMENT CAPABILITIES

What this implementation enables

🔐 Zero Trust Enforcement

No implicit trust. Every access request verified through MFA, device compliance, risk assessment, and Conditional Access policies. Break-glass accounts protected but monitored.

🛡️ Threat Prevention & Response

Multi-layer threat detection: email phishing + malware (Safe Links/Attachments), endpoint threats (EDR + AIR), and user behavior anomalies (Identity Protection). Automated remediation for low/medium severity.

📊 Visibility & Audit Trail

Comprehensive logging of all identity, email, endpoint, and data access events. Unified Audit Log for compliance investigations. Alert policies notify security team of high-risk activities in real-time.

🚫 Data Loss Prevention

DLP policies prevent sensitive data (credit cards, SSN, PII) from being emailed, uploaded to personal cloud storage, or copied to USB drives. Graduated enforcement: audit → quarantine → block.

💾 Endpoint Hardening

All Windows devices required to have BitLocker encryption, Secure Boot, Windows Firewall, Defender real-time protection, and ASR rules blocking attack vectors. Non-compliance triggers remote lock after 7 days.

👤 Privileged Access Management

Admin roles made eligible-only (not standing). Tier 1 admins require approval + MFA + justification (4hr max). Quarterly Access Reviews ensure role necessity. PIM alerts if activation outside business hours.

📧 Email Security Posture

DMARC/SPF/DKIM prevent domain spoofing. Safe Links block malicious URLs at click-time. Safe Attachments use sandboxing for unknown files. Anti-phishing targets executive impersonation. ZAP removes phishing post-delivery.

📈 Secure Score Improvement

Baseline implementation adds 50–85 points to Microsoft Secure Score. Quantifiable security improvements demonstrable to board/executive leadership. Ongoing remediation plan for remaining gaps.

⚙️ Policy-as-Code Automation

All policies, rules, and configurations stored in Git. PowerShell/Graph scripts enable repeatable deployments across multiple tenants. Version control + peer review for all security changes.

🎯 Compliance Alignment

Baseline meets requirements for HIPAA, PCI-DSS, SOC2, and ISO 27001 foundational controls. Audit logs satisfy regulatory retention requirements. Sensitivity labels enable data classification compliance.

🔄 Graceful Degradation

Break-glass accounts provide emergency access if all Conditional Access policies fail. MFA exemption for emergency scenarios. Offline access to sensitive data during Azure AD outages (cached credentials).

📱 Mobile & Remote Security

App Protection Policies (MAM) control corporate data on personal devices without requiring full device enrollment. Offline wipe if device lost. Copy/paste restrictions prevent data exfiltration.

PHASE 2 — IDENTITY & ACCESS CONTROL

Zero Trust Foundation

Status: Ready to Deploy — Pending Client Approval

2.1 Privileged Identity Management (PIM)

  • Export baseline role assignments
  • Configure PIM role settings by tier:
    • Tier 1 (Global Admin, Security Admin) → MFA + Justification + Approval | 4hr max
    • Tier 2 (Exchange, SharePoint, Compliance Admin) → MFA + Justification | 8hr max
    • Tier 3 (Helpdesk, Teams, Intune Admin) → MFA only | 8hr max
  • Convert all roles to Eligible (T3 → T2 → T1)
  • Establish quarterly Access Reviews
  • Enable PIM alerts and monitoring

2.2 Conditional Access Policies

Deploy in Report-Only mode first — enforce after 72hr review with client

  • CA001 — Require MFA for All Users
  • CA002 — Block Legacy Authentication
  • CA003 — Sign-In Risk Policy (Medium+)
  • CA004 — User Risk Policy (High → force password change)
  • CA005 — Location-Based Restriction (outside trusted IPs)
  • CA006 — Privileged Role MFA (Tier 1 + Tier 2)

2.3 MFA & Identity Protection

  • Authentication Methods policy:
    • ✅ Microsoft Authenticator (push)
    • ✅ FIDO2 Security Keys
    • ✅ Temporary Access Pass (TAP)
    • ❌ SMS / Voice Call (disabled)
  • Enable Identity Protection risk detection
  • Configure alert notifications to security team

2.4 Prerequisites

  • ☐ Global Admin / delegated access confirmed
  • ☐ Entra ID P2 licenses on all admin accounts
  • ☐ 2 break-glass accounts identified & credentials stored offline
  • ☐ Trusted IP ranges provided by client

PHASE 3 — EMAIL & THREAT PROTECTION

Defender for Office 365 P2

Status: Queued — Starts after Phase 2 sign-off

3.1 Safe Links & Safe Attachments

  • Safe Links: Real-time URL scanning, click tracking enabled for all users
  • Safe Attachments:
    • Standard users → Dynamic Delivery
    • High-risk users → Block
  • Anti-Phishing: Aggressive threshold (level 3), impersonation protection enabled
  • Anti-Spoofing: Spoof intelligence enabled, DMARC honor policy

3.2 DKIM Configuration

  1. Enable DKIM signing per domain in Defender portal
  2. Microsoft generates selector1 + selector2 CNAME records
  3. Client publishes CNAME records in DNS registrar ← CLIENT ACTION
  4. Validate propagation (48hr window)
  5. Test selector rotation

3.3 DMARC / SPF Rollout

  • Stage 1: p=none → Monitor aggregate reports (2 weeks)
  • Stage 2: p=quarantine → Review & remediate misaligned senders
  • Stage 3: p=reject → Full enforcement (client approval per stage)

3.4 Alert Policies

  • Malware detected in email → High → Security team
  • Phishing detected post-delivery (ZAP) → High → Security team
  • Email sending limit exceeded → High → Security + IT Manager
  • Suspicious inbox forwarding rule → High → Security team
  • User reported phishing → Medium → Security team

PHASE 4 — ENDPOINT SECURITY & EDR

Defender for Endpoint P2 & Intune

Status: Queued — Starts after Phase 3 sign-off

4.1 Defender for Endpoint P2

  • EDR: Active mode | Tamper protection: On | Cloud protection: High
  • Network Protection: Block mode
  • AIR (Automated Investigation & Response):
    • Full automation enabled
    • Low/Medium → auto-remediate
    • High → manual approval
  • Threat Analytics: Enabled, weekly review cadence

4.2 Intune Group Structure

  • SG-Intune-AllLicensed → Base policy target
  • SG-Intune-WindowsDevices → Windows compliance + config profiles
  • SG-Intune-CorporateDevices → Corporate device policies
  • SG-Intune-BYOD → App Protection (MAM) policies
  • SG-Intune-Pilots → 10–15 users for pilot ring
  • SG-Intune-Exclude-BreakGlass → Excluded from all policies

4.3 Compliance Policy (Windows)

  • ✅ BitLocker required
  • ✅ Secure Boot required
  • ✅ Firewall required
  • ✅ Defender real-time protection required
  • ✅ Minimum OS: Windows 10 22H2 (10.0.19044)
  • ✅ Password: 8 chars, alphanumeric + special
  • ✅ Screen lock: 5 minutes
  • ✅ Device risk score: Low or below (MDE integration)

Non-compliance actions: Day 0 → Mark | Day 1 → Email | Day 7 → Remote lock

4.4 Configuration Profiles

  • TGE-Win-SecurityBaseline → Microsoft Security Baseline (Windows 11)
  • TGE-Win-Defender-Config → AV settings, cloud protection, scheduled scan
  • TGE-Win-Firewall → Domain/Private/Public profiles enforced
  • TGE-Win-BitLocker → XTS-AES 256, recovery key → Entra ID escrow
  • TGE-Win-ASR-Rules → All 16 rules in Audit (2 weeks) → then Enforce

4.5 App Protection Policies (MAM)

Level 2 (All users):

  • PIN required (6 digits)
  • Block copy/paste to unmanaged apps
  • Block save to non-corporate storage
  • Offline wipe: 30 days

Level 3 (Finance, HR, Exec, IT Admins):

  • All Level 2 + advanced PIN, keyboard logger block

PHASE 5 — DATA PROTECTION & GOVERNANCE

Sensitivity Labels & DLP

Status: Queued — Starts after Phase 4 sign-off

5.1 Sensitivity Label Schema

  • Public → No restrictions
  • General → Internal use (default label)
  • Confidential → All Employees / Specific People
  • Highly Confidential → All Employees / Specific People (encryption + watermark)
  • Personal → Informational only

⚠️ Classification schema workshop required with client before deployment

5.2 DLP Policies

  • TGE-DLP-Financial-Email → Exchange — Credit Card, SSN, Bank Account
  • TGE-DLP-Financial-Cloud → SharePoint/OneDrive — same types
  • TGE-DLP-PII-Email → Exchange — SSN, Passport, Driver's License
  • TGE-DLP-PII-Cloud → SharePoint/OneDrive — same types
  • TGE-DLP-Endpoint-USB → Audit → Block (Confidential+)
  • TGE-DLP-Endpoint-Print → Audit (Highly Confidential)
  • TGE-DLP-Endpoint-Upload → Block non-corporate cloud storage

All policies deploy in Test/Audit mode first — client reviews before enforcement

PHASE 6 — COMPLIANCE, AUDIT & SECURE SCORE

Governance & Measurement

Status: Queued — Starts after Phase 5 sign-off

6.1 Key Tasks

  • Unified Audit Log validation (180 days E3 / note: 1yr requires E5 or add-on)
  • 12 alert policies covering:
    • Privileged role changes
    • Bulk deletion
    • Impossible travel
    • DLP spikes
    • PIM activations outside hours
    • And more
  • Secure Score baseline assessment (before/after)
  • Remediation plan for remaining score gaps
  • Executive Security Posture Summary delivery

6.2 Expected Secure Score Impact

Phase 2 — Identity +15 to +25 pts
Phase 3 — Email +8 to +15 pts
Phase 4 — Endpoint +15 to +25 pts
Phase 5 — Data +8 to +12 pts
Phase 6 — Compliance +5 to +10 pts
Total Estimated Gain +50 to +85 pts

SUPPORTING INFRASTRUCTURE

Admin Workstation Setup

All tools installed via Install-AdminWorkstation.ps1 and Customize-MannyTerminal.ps1.

Core Tools

  • PowerShell 7
  • Windows Terminal
  • VS Code
  • Git
  • Python 3
  • Node.js

Azure Tools

  • Azure CLI
  • Azure Storage Explorer
  • Bicep CLI

Security Tools

  • Sysinternals
  • Wireshark
  • Nmap
  • PurpleKnight (manual)

PowerShell Modules (Graph & M365)

  • Microsoft.Graph
  • ExchangeOnlineManagement
  • MicrosoftTeams
  • PnP.PowerShell

PowerShell Modules (Azure)

  • Az
  • Az.PolicyInsights
  • Az.OperationalInsights
  • Az.Security

Utility Modules

  • PSFramework
  • PSScriptAnalyzer
  • MSAL.PS
  • ImportExcel
  • PSWriteHTML

Quick Connect Commands

Connect-M365          # Graph + Exchange Online
Connect-Intune        # Intune via Graph
Connect-AzureAdmin    # Azure (Az module)
Connect-All           # All services at once
Disconnect-All        # Clean disconnect
Set-ClientContext      # Switch Az + Graph tenant by client name
azctx                 # Show current Azure context
m365ctx               # Show current Graph/M365 context

PROJECT DOCUMENTS

Pre-Deployment Configuration

✅ Signed

SOW Rev2

Signed Statement of Work — full scope and deliverables

⏳ Pending

Phase 2–3 Pre-Approval

Identity & Access Control + Email Security configuration plan

⏳ Pending

Phase 4 Pre-Approval

Endpoint Security & Intune configuration plan

⏳ Pending

Phase 5–6 Pre-Approval

Data Protection, Governance, Compliance & Audit configuration plan

Out of Scope

Available upon request:

  • Windows Device Enrollment (guidance provided)
  • Third-party SIEM integrations
  • Custom app security architecture
  • Advanced SOC operations
  • Complex hybrid AD remediation
  • Red team / penetration testing
  • End-user phishing simulations

Key Assumptions

  • Client holds M365 E3 + Security P2 licenses
  • DNS access available for DKIM/SPF/DMARC
  • No major legacy authentication dependencies
  • Client available throughout project
  • Unassisted access required at each stage

DOCUMENTATION

Project Reference

Explore detailed deployment guides, prerequisites, and workstation setup. For the complete repository and all supporting documents, view the private GitHub repository.

Project Overview

This project implements an enterprise-grade Microsoft 365 security baseline for Contoso Ltd, aligned to Zero Trust principles using Microsoft 365 E3 + Security P2 licensing.

Key Details:
  • Status: In Progress (Rev 2 — May 2026)
  • Licensing: M365 E3 + Security P2
  • Methodology: Zero Trust alignment across 6 phases
  • Approval Model: Written client sign-off before each deployment

Project Documents

SOW Rev2
Full scope Statement of Work
✅ Signed
Phase 2-3 PreApproval
Identity & Email configuration plan
⏳ Pending
Phase 4 PreApproval
Endpoint Security & Intune configuration plan
⏳ Pending
Phase 5-6 PreApproval
Data Protection & Compliance configuration plan
⏳ Pending

6-Phase Deployment Guide

Phase 1: Planning ✅
→
Phase 2: Identity 🟡
→
Phases 3-6 🔵
Phase 2

Identity & Access Control

Status: Ready to Deploy (Pending Approval)

  • Privileged Identity Management (PIM)
  • Conditional Access Policies (6 policies)
  • MFA & Authentication Methods
  • Identity Protection

📊 Secure Score Impact: +15–25 pts

Phase 3

Email & Threat Protection

Status: Queued (Starts after Phase 2)

  • Defender for Office 365 P2
  • Safe Links & Safe Attachments
  • DKIM/DMARC/SPF Configuration
  • Anti-Phishing Policies

📊 Secure Score Impact: +8–15 pts

Phase 4

Endpoint Security & EDR

Status: Queued (Starts after Phase 3)

  • Defender for Endpoint P2 (EDR)
  • Intune Compliance & Configuration
  • BitLocker & Firewall Enforcement
  • App Protection Policies (MAM)

📊 Secure Score Impact: +15–25 pts

Phase 5

Data Protection & Governance

Status: Queued (Starts after Phase 4)

  • Sensitivity Labels (4-tier schema)
  • DLP Policies (Financial, PII)
  • Endpoint DLP (USB, Print, Upload)
  • Data Governance Framework

📊 Secure Score Impact: +8–12 pts

Phase 6

Compliance & Audit

Status: Queued (Starts after Phase 5)

  • Unified Audit Log (180 days E3)
  • Alert Policies (12 policies)
  • Secure Score Baseline Assessment
  • Executive Reporting & Remediation Plan

📊 Secure Score Impact: +5–10 pts

Total Estimated Secure Score Gain: +50–85 pts

All phases deploy in validation/audit/report-only mode first before final enforcement.

Admin Workstation Setup

Complete toolchain installed via Install-AdminWorkstation.ps1 and Customize-MannyTerminal.ps1.

Core Tools

Core
  • PowerShell 7
  • Windows Terminal
  • VS Code
  • Git
Azure
  • Azure CLI
  • Azure Storage Explorer
  • Bicep CLI
Security
  • Sysinternals
  • Wireshark
  • Nmap
  • PurpleKnight
Runtime
  • Python 3
  • Node.js
  • WSL2 + Ubuntu

PowerShell Modules

Graph & M365

Microsoft.Graph • ExchangeOnlineManagement • MicrosoftTeams • PnP.PowerShell

Azure

Az • Az.PolicyInsights • Az.OperationalInsights • Az.Security

Utility

PSFramework • PSScriptAnalyzer • MSAL.PS • ImportExcel • PSWriteHTML

Quick Connect Commands

Connect-M365          # Graph + Exchange Online
Connect-Intune        # Intune via Graph
Connect-AzureAdmin    # Azure (Az module)
Connect-All           # All services at once
Disconnect-All        # Clean disconnect

Set-ClientContext      # Switch Az + Graph tenant by client name
azctx                 # Show current Azure context
m365ctx               # Show current Graph/M365 context

Timeline & Project Scope

Engagement Timeline

Resource Scheduling

Up to 2 weeks before kickoff

Estimated Duration

4–6 weeks from kickoff

Billing Model

50% at initiation / 50% at completion

Post-Implementation Support

2 weeks after Phase 6 completion

Out of Scope

Available upon request:

  • Windows Device Enrollment (guidance provided)
  • Third-party SIEM integrations
  • Custom app security architecture
  • Advanced SOC operations
  • Complex hybrid AD remediation
  • Red team / penetration testing
  • End-user phishing simulation campaigns

Key Assumptions

  • ✅ Client holds M365 E3 + Security P2 licenses
  • ✅ DNS access available for DKIM/SPF/DMARC configuration
  • ✅ No major legacy authentication dependencies
  • ✅ Client available throughout the project
  • ✅ Unassisted access required at each stage

For the complete documentation, deployment scripts, and pre-approval documents, Access Private GitHub Repository

INTERESTED IN SIMILAR WORK?

Let's scope your engagement.

A 30-minute alignment call to walk through your environment, discuss fit, and identify a starting point — whether that's a project, staff augmentation, or a managed service.

Schedule a meeting View on GitHub