Page 74 of the DSE Microsoft 365 & Identity knowledge center, with source-backed guidance and practical next steps.
Clear guidance for Microsoft 365, Entra identity, account protection, collaboration, endpoint policy, and lifecycle changes.
Synthetic voice and video can make an impostor look familiar. Remove media familiarity from help-desk resets, executive requests, and payment approvals; verify through independent identity and workflow controls.
Read the checklist
Forest recovery is a controlled rebuild of the organization’s identity service. It requires trusted backups, an isolated recovery sequence, privileged credential resets, dependency validation, and rehearsed business acceptance—not simply a restored domain controller.
Read the playbook
Microsoft Entra Connect is replaceable only when its configuration, advanced exceptions, credentials, failover order, and validation evidence are ready. Staging mode lowers recovery time, but it is active-passive—not active-active.
Read the playbook
ScubaGear can compare Microsoft 365 configuration with CISA's SCuBA baselines. A defensible program also controls permissions, versions, configuration, exceptions, evidence, remediation, reruns, and drift interpretation.
Read the playbook
Managed identities, service principals, and user-based service accounts can retain access without human visibility. Choose the safest type, record ownership and purpose, control permissions and credentials, monitor use, and retire dependencies safely.
Read the guide
FFIEC's authentication and access guidance is risk-based, not an MFA-only checklist. Covered institutions can translate it into scoped risk decisions, layered preventive, detective, and corrective controls, testing, residual-risk approval, and examination-ready evidence.
Read the playbook
OAuth consent can give an application continuing access to Microsoft 365 data without stealing a password. Govern grants, permissions, ownership, review, and revocation as an identity lifecycle.
Read the playbook
Modern password policy emphasizes length, compromised-password screening, rate limiting, password-manager compatibility, and evidence-based changes while treating account recovery as a separate high-risk control.
Read the guide
Microsoft 365 resiliency, native deleted-item recovery, Purview retention, and Microsoft 365 Backup solve different problems. Map the available mechanism, protect its administration, and prove recovery with realistic tests.
Read the playbook
Business email compromise succeeds when a convincing message can change where money goes. Add independent verification, separation of duties, evidence, and rapid bank-and-IC3 response to the payment process.
Read the playbook