KritikosgnsStudio · Security
Ten controls to do first, as epics and stories with steps, a read-only PowerShell check and a clear "done" test. Free. When you are through Sprint 1, the full kit adds 48 more across Entra ID, Exchange Online, Teams, SharePoint/OneDrive and Purview.
Download the free Top 10 View on GitHubMC1479514: tenants that have not set the policy get attachments in federated chats, with automatic permission grants. Decide now.
Get-CsTeamsFilesPolicy -Identity Global | Select FileSharingInChatsWithExternalUsers
Printers, scanners and apps that send with a username and password stop working. Find them first.
Get-TransportConfig | Select SmtpClientAuthenticationDisabled
| ID | Control | Licence |
|---|---|---|
E01 | Create two break-glass (emergency access) accounts | Any |
E02 | Require MFA for all users | Free (Security defaults) or Entra ID P1 (Conditional Access) |
E03 | Block legacy authentication | Entra ID P1 (or Security defaults) |
E04 | Reduce and separate admin accounts | Any (PIM needs Entra ID P2) |
E05 | Restrict user consent to applications | Any |
E06 | Confirm audit logging is on | Any (retention depends on license) |
E07 | Block automatic external email forwarding | Exchange Online |
E08 | Apply the Standard preset security policy | EOP (Defender for Office 365 for Safe Links/Attachments) |
E09 | Set up SPF, DKIM and DMARC | Any |
E10 | Self-service password reset with banned passwords | Entra ID P1 for SSPR with on-prem writeback and custom banned list |
Files in the zip: m365-hardening-kit-emergency-top-10-guide.md · …-jira-import.csv (epics + stories, parent links, priority, sprint) · …-tracker.csv (Planner / Azure DevOps / Excel) · …-readonly-checks.ps1 · README.md · LICENSE. MIT licence.
| Sprint | Controls |
|---|---|
| Sprint 1 - Emergency | 10 |
| Sprint 2 - Identity | 14 |
| Sprint 3 - Email | 11 |
| Sprint 4 - Collaboration | 16 |
| Sprint 5 - Data & monitoring | 7 |
Plus 48 read-only checks in one script and the m365-hardening-coach Claude skill: give it the results CSV and your licences, get readiness %, this week's five fixes, licence gaps and a three-sentence summary for management.
Microsoft message MC1479514 says attachments in external (federated) chats become available by default for tenants that have not configured the setting, and advises setting your choice by the first week of November 2026. Control T02 in the kit has both PowerShell options.
Per Microsoft's January 2026 timeline update, Basic auth for SMTP AUTH client submission is disabled by default for existing tenants in late December 2026. Control M01 uses the SMTP AUTH clients report to find printers and apps that will break.
No. The scripts only call Get-* cmdlets and write a results CSV. The kit builder refuses any check containing Set-, New-, Remove-, Update-, Enable- or Disable- cmdlets.
Stories carry a Sprint value and a sprint-N label. If your Jira project does not map the Sprint column on import, filter by label and bulk-move.