Microsoft 365 + Entra: The SMB CISO's Default Stack — What to Turn On First
For most SMBs, M365 + Entra is already the identity fabric — they just haven't configured it as such. Here's the baseline that closes 80% of the identity risk in 10 days.
The average 50-seat SMB is on Microsoft 365 Business Premium and doesn’t realize they’ve already bought most of the security stack they need. Entra ID (Azure AD), Defender for Business, Purview, and Intune are all bundled. The problem is not the license — the problem is that nobody turned them on with any rigor. This is the 10-day baseline I stand up for a client running M365.
The six controls, in order
| # | Control | Where it lives | What it stops |
|---|---|---|---|
| 1 | Enforced MFA + phishing-resistant methods | Entra ID Conditional Access | Credential theft, MFA fatigue, adversary-in-the-middle |
| 2 | Break-glass account discipline | Entra ID | Locking yourself out of your own tenant |
| 3 | Least-privilege admin roles + PIM | Entra ID + Privileged Identity Management | Standing global-admin rights |
| 4 | Defender for Business + Defender for Office | M365 Defender | Ransomware pre-cursors, business email compromise |
| 5 | Purview DLP + sensitivity labels | Purview | Accidental exposure of PHI/PII in email or SharePoint |
| 6 | Intune baseline for managed devices | Intune | BYOD data leakage, unpatched endpoints |
Sprint 1 — Identity hygiene (days 1–4)
MFA that means something. Enforce phishing-resistant methods for all admin roles: Windows Hello for Business, FIDO2 security keys, or Microsoft Authenticator with number matching. Number matching alone cuts MFA fatigue attacks by ~90% based on Microsoft’s telemetry. Number-matching-only is the floor for standard users; hardware keys for anyone with admin rights.
Break-glass accounts. Two cloud-only global admin accounts, each with a 40-character password stored offline, MFA excluded but strictly monitored via Conditional Access sign-in logs alerting. If you ever have to use one, you know something is very wrong.
Conditional Access baseline. Six policies cover most of the risk:
- Block legacy authentication protocols
- Require MFA for all users
- Require compliant device or MFA for admins
- Block sign-ins from countries you never operate in
- Block or require MFA for high-risk sign-ins (requires P2)
- Session lifetime: 12 hours for regular users, 4 hours for admins
Sprint 2 — Admin roles (days 5–6)
Nobody should have permanent Global Administrator. Use Privileged Identity Management (PIM) to convert admin roles to just-in-time. The pattern:
- Every admin has PIM-eligible assignments
- Activation requires justification, MFA, and time-boxes to 4 hours
- Global Admin activation triggers an alert to a second admin
For a 50-seat SMB, five to seven people hold PIM-eligible roles. If more than seven need admin rights, the RBAC is wrong.
Sprint 3 — Detection (days 7–8)
Defender for Business is included in Business Premium. Turn on:
- Next-gen antivirus (Defender)
- Endpoint detection and response (EDR)
- Attack surface reduction rules — start with “audit” mode, promote to “block” after two weeks of noise review
- Automated investigation and response
Defender for Office 365 protects email:
- Safe Links (URL rewriting + time-of-click checks)
- Safe Attachments (sandbox detonation)
- Anti-phishing with impersonation protection for the top 20 named executives and domains
Sprint 4 — Data (days 9–10)
Purview sensitivity labels — four labels are enough:
Public(default)InternalConfidentialHighly Confidential — PHI/PII/PCI
Apply auto-classification for the last one using built-in sensitive info types (SSN, credit card, DOB near names). Enforce encryption on Confidential and above so a lost email stays readable only inside the tenant.
Purview DLP — two policies cover most compliance obligations:
- Block external sharing of files containing the “Highly Confidential” label
- Alert on outbound email containing more than 10 SSNs
Sprint 5 — Devices (day 10 and beyond)
Enrolling company-owned devices in Intune takes a week of coordination. The baseline compliance policy:
- Windows/macOS: encrypted, firewalled, up-to-date, with EDR reporting healthy
- Mobile: passcode required, encrypted, screen lock ≤5 min
- Conditional Access requires compliant device for accessing SharePoint, Exchange, Teams
BYOD gets Mobile Application Management without enrollment (MAM-WE): apps are containerized, corporate data can’t be copied to personal apps, remote wipe of the container without touching personal data.
What you have not done — on purpose
- Copilot for Security, Defender for Cloud, Sentinel SIEM — necessary at a certain scale, not on day one for 50 seats. Bring them in when detection load exceeds the SOC handoff you can absorb.
- Certificate-based authentication for machines — great pattern, but skip until Intune is stable.
- Cross-tenant B2B collaboration — configure when the first legitimate business need appears, not preemptively.