Page 70 of the DSE Microsoft 365 & Identity knowledge center, with source-backed guidance and practical next steps.
Clear guidance for Microsoft 365, Entra identity, account protection, collaboration, endpoint policy, and lifecycle changes.
Safe Links can scan and rewrite URLs and evaluate clicks in supported Microsoft 365 experiences; exclusions and do-not-rewrite entries narrow that inspection and need evidence-based ownership.
Read the guide
Many Teams meeting controls are evaluated from the organizer's assigned policy, so attendee experience can vary even when participants belong to the same organization.
Read the checklist
Purview sensitivity labels for Teams, Microsoft 365 groups, and SharePoint sites can enforce container settings, but a container label does not automatically label the documents stored inside.
Read the explainer
Conditional Access session controls influence reauthentication, browser persistence, app restrictions, resilience, and token protection; shorter sign-in frequency is not a universal session-revocation control.
Read the guide
Added LSA protection blocks plug-ins and drivers that do not meet protected-process requirements; Microsoft provides audit events that should be reviewed before broad enforcement.
Read the checklist
Protected Users applies nonconfigurable credential protections that can also break NTLM, delegation, offline sign-in, and other dependencies. Prove each account's authentication paths before membership expands.
Read the guide
Requiring LDAP signing rejects unsigned SASL binds and cleartext simple binds; Microsoft provides summary and detailed directory events to find dependent clients before enforcement.
Read the playbook
Disallowing Shared Key rejects account-key and dependent SAS authorization while allowing supported Microsoft Entra authorization, so caller discovery and migration must precede enforcement.
Read the playbook
Federation moves authentication information between separately administered parties. Document which provider, assertion, attributes, audience, assurance, and failure paths each relying service will accept.
Read the guide
Cloud-native zero trust shifts application policy toward user, application, and service identities. Inventory workload identities and enforce narrowly scoped service-to-service authorization across environments.
Read the guide