Page 72 of the DSE Microsoft 365 & Identity knowledge center, with source-backed guidance and practical next steps.
Clear guidance for Microsoft 365, Entra identity, account protection, collaboration, endpoint policy, and lifecycle changes.
Microsoft Entra cross-tenant access settings govern inbound and outbound B2B relationships and trust in external MFA or device claims. Inventory real partners, defaults, applications, and lifecycle before broad collaboration becomes the policy.
Read the playbook
Blocking sign-in and revoking refresh tokens are important, but existing access and application sessions can end on different timelines. Run a documented containment workflow and verify effective loss of access across supported services and independent applications.
Read the playbook
Shared mailboxes outlive projects and teams unless someone owns membership, direct sign-in, forwarding, retention, licensing, automation, and closure. Govern each mailbox as a business service, not a permanent bucket of delegated access.
Read the checklist
Retention policies, retention labels, records controls, and eDiscovery holds answer different questions. Route each requirement through legal, records, privacy, workload, license, scope, deployment, validation, exception, and release decisions.
Read the guide
Group Managed Service Accounts let supported domain services use domain-managed passwords and simplified SPN management. Migration still requires application support, dependency discovery, least privilege, host authorization, staged testing, and rollback.
Read the playbook
AD CS can issue credentials used for authentication, signing, and encryption. Treat certification authorities, templates, enrollment rights, web endpoints, keys, revocation, and recovery as high-value identity infrastructure.
Read the playbook
Windows Credential Guard isolates selected secrets with virtualization-based security, but legacy protocols, delegation, security packages, remote access, firmware, virtualization, and applications can change behavior. Discover and pilot before enforcement.
Read the playbook
Microsoft has fixed CVE-2026-70329, an Outlook integer-overflow vulnerability rated CVSS 8.8. Exploitation requires a user to open a malicious Office file. Review the exact affected editions, deploy the August 11 security release, and verify the installed build by servicing channel.
Read the briefing
Microsoft began rolling out passkeys as the default in public-cloud Microsoft Entra ID tenants on September 1, 2026. Microsoft-provided SMS and voice authentication is retired February 1, 2027 for most users and July 1, 2027 for Global Administrators and external users; organizations must migrate users to a phishing-resistant method or configure a telephony provider through Microsoft Security Store.
Read the briefing
A Universal Print connector is a live bridge between Microsoft 365 and existing printer queues. Give every connector a supported host, named owner, current software, controlled drivers, monitored capacity, and a tested replacement procedure.
Read the playbook