Page 167 of the DSE Cybersecurity knowledge center, with source-backed guidance and practical next steps.
Source-backed guidance for identity, vulnerability reduction, ransomware readiness, detection, response, and recovery.
Entra entitlement management access packages bundle resource roles with request and lifecycle policies, creating a governable project-access product when catalog and package ownership are explicit.
Read the guide
Microsoft Entra application provisioning records source and target operations and can quarantine a failing job; operations still need ownership before delayed access or removal becomes an incident.
Read the playbook
Microsoft Purview DLP simulation mode can show policy matches and likely impact without enforcing configured actions, creating an evidence stage for tuning scope and exceptions.
Read the checklist
Defender for Office 365 Safe Attachments uses preset and custom policies with recipient filtering and priority; an apparently valid custom policy may not control users already covered by a higher-precedence preset policy.
Read the checklist
Safe Links can scan and rewrite URLs and evaluate clicks in supported Microsoft 365 experiences; exclusions and do-not-rewrite entries narrow that inspection and need evidence-based ownership.
Read the guide
Many Teams meeting controls are evaluated from the organizer's assigned policy, so attendee experience can vary even when participants belong to the same organization.
Read the checklist
Purview sensitivity labels for Teams, Microsoft 365 groups, and SharePoint sites can enforce container settings, but a container label does not automatically label the documents stored inside.
Read the explainer
Conditional Access session controls influence reauthentication, browser persistence, app restrictions, resilience, and token protection; shorter sign-in frequency is not a universal session-revocation control.
Read the guide
Added LSA protection blocks plug-ins and drivers that do not meet protected-process requirements; Microsoft provides audit events that should be reviewed before broad enforcement.
Read the checklist
SMB signing helps detect message tampering and resist relay, but requiring it changes connection acceptance and can expose legacy client, server, alias, and performance dependencies.
Read the guide