Page 2 of the DSE Microsoft 365 & Identity knowledge center, with source-backed guidance and practical next steps.
Clear guidance for Microsoft 365, Entra identity, account protection, collaboration, endpoint policy, and lifecycle changes.
A reliable passkey and passwordless rollout starts with user personas, device and application compatibility, recoverable registration, pilot waves, and measured enforcement.
Read the playbookMicrosoft Entra ID Protection can support automatic and manual risk remediation, but each action must follow investigation and preserve the distinction between password change, account recovery, and risk dismissal.
Read the playbookRecurring Microsoft Entra access reviews can help owners recertify group, application, role, guest, and access-package assignments before stale access becomes permanent.
Read the guideWindows LAPS can rotate and escrow a unique local administrator password, but conflicting policies, the wrong backup directory, missing accounts, or excessive retrieval rights can leave the control ineffective.
Read the guideIntune device cleanup rules hide stale records from the admin center and reports. They do not wipe, retire, or remove the corresponding Microsoft Entra device object.
Read the guideBuilt-in, Standard, and Strict preset security policies provide Microsoft-maintained email-protection settings. Correct licensing, precedence, targeting, quarantine support, and mail-flow testing still matter.
Read the guideAdministrator-side phishing defense combines phishing-resistant authentication, secure defaults, message and web controls, endpoint protection, rapid reporting, evidence, and tested response.
Read the checklistConditional Access can combine identity, device, application, and location signals to enforce access controls. Report-only evaluation, emergency access, test users, licensing checks, and phased activation are essential to avoid unintended lockout.
Read the playbookSharePoint and OneDrive sharing is governed by tenant, site, link, group, and Microsoft Entra settings. A safer model uses intentional collaboration sites, authenticated guests where practical, restrictive defaults, ownership, and recurring access review.
Read the guideOffboarding is an identity, device, records, and continuity workflow. Blocking sign-in is urgent, while mailbox, OneDrive, ownership, legal hold, forwarding, licensing, and account deletion decisions must follow an approved sequence.
Read the checklist