Lock Down Your Microsoft 365: Your Essential Security Policies

How do you secure your Microsoft 365? Here are 13 essential security policies for Microsoft 365 security, including conditional access policies.

🆓 FREE Facebook Group
From security to productivity apps to getting the best value from your Microsoft 365 investment, join our Microsoft 365 Mastery Group

🆓 FREE Microsoft 365 Guide
Our FREE Guide - Discover 5 things in Microsoft 365 that will save your business time and money….. and one feature that increases your Cyber Security by 99.9%

💻 Want to Work Together?

😁 Follow on Socials
TikTok @bearded365guy
Instagram @bearded365guy

Chapters
00:00 Introduction
01:08 Turn Off Security Defaults
03:07 Conditional Access MFA
04:54 Conditional Access Approved Countries
09:25 Block Unapproved Device Types
10:57 Disable Persistant Browser Sessions
12:05 App Protection Policies
13:54 Block Legacy Authentication
15:16 Require MFA for Entra Join
16:16 Disable SMS MFA
18:27 Enable App Consent Workflow
20:29 Default SharePoint Sharing Settings

[smittayy]

I'd also recommend creating a Continuous Access Policy to require MFA if the network changes. This helps protecting against session token theft

[patrick__]

As always very informative!
Though I've some questions about 2FA.

1. What will be the impact for users when disabling SMS from Entra when they've already enabled/using SMS using the Per user MFA?

2. Do you need to disable Per user MFA when 2FA forced using a CA?

3. You've excluded the Admin from any CA. How would you enforce 2FA for this one?

Greetings from overseas, the Netherlands.

[GregThomson]

@Jonathan Edwards. A nice bunch conditional access policies. My understanding is that the device platform filter only looks at the device string as reported by the device. This can be spoofed. A better control for managed devices are device filters. e.g. Where the device platform is not a managed Windows device, require an app protection policy.

[bowersza]

Thanks, Jonathan - what a great overview! I cannot stress enough the importance of implementing these important controls in your tenant. well done!

[justinpascarella]

Thanks again Jonathan! The video I've been waiting for. Question, for those already enrolled in SMS/Phone call MFA, once you enable/enforce these policies, what happens? Will they be prompted/forced to enroll or change their MFA method to using the MS Authenticator?

[easy-tech]

Thanks Jonathan, this insight was really helpful. May I know what license type is required to create new policies?

[gregfyn]

Thanks Jonahan, I like your straight forward communication style.

[alexandrecarreirapt]

I work supporting 365 and i love your videos. Thanks!

[djrx]

This is fantastic. thanks so much for putting this together.

[orlandom-cr]

I just wanted to join the group and let you know that your videos are amazing. Straight to the point and very informative. Due to this video, I created a little script in PowerShell using Microsoft Graph that will configure all these conditional access policies and one more that block access to all Azure Admin Portals. I just want to share the script as a little contribution to all the effort and good things that you put on your videos. What is the best way to share it? Thanks again for all your good work

[GFloGG]

Thank you for this video! Really great insight to the CA policies and really set a great foundation for me! Love what you're doing!

[paulmckenna]

At the start of the video you created a conditional access policy requiring MFA for all users. Why is a second policy required MFA for Entra join. Isn't that redundant? Great video, Thanks!

[ggoben]

Great Vid. Was wondering if you could do a video on Intune device licenses. There is practically no info out there on this. Specifically enrolling Win10/11 devices using Intune device licenses for shared workstations? What are the best ways to do this? What are the limitations? Lots of businesses use shared workstations for healthcare or factory workers that use the same workstations when on shift as others. We want them in Intune without paying per user license. Thanks!

[whoamigodknows]

Brilliant. No BS. straight to the point.

[ScottMillar]

you would'nt believe how many dont do any of this! very helpful

[JRashid]

Another great video! Too many organisations rely on Microsoft Baseline or defaults

[vibhubhatnagar]

loved this video thanks looking forward for more such videos

[andrewenglish]

In the Entra ID Conditional Access -> Policies -> new Policy settings there is now "Newtwork" do we need to change anything there for any of these policies you are creating?
And when you do the exclusion for CA02 if the we are on P1 license with Business Standard will this work or do we need to add a different set of options?

[GabrielJIsaza]

Amesing explanation. Question, do I need to assign an Entra P1 license for each user in my organization if I want to implement those essential security policies?

[jimmyroels]

Thank you Jonathan, this will help me secure the tenants of my customers.