Skip to content
Back to the Handbook
Practitioner guide, 2026 edition

Tenant Hardening for Microsoft 365

DORA and NIS2 operations, mapped to NIST CSF 2.0

A field guide for EU teams on Microsoft 365: DORA Article 9, NIS2 Article 21 and NIST CSF 2.0 mapped to tenant controls, evidence and routines.

See a sample page

Stripe checkout. The PDF arrives by email after payment, licensed to your email address. Digital content terms.

Want it done in your own tenant? See the service: Tenant hardening for Microsoft 365.

69
pages
10
chapters
11
named sources

€99, including VAT, so the total stated here is what you pay: for a consumer the VAT sits inside it, and a verified EU business buyer under the reverse charge pays the same total with no VAT charged. The PDF arrives by email within seconds, licensed to your email address on every page. Buying for a business: no refund after delivery unless the guide differs materially from this page. Buying as a consumer: we do not ask you to give up your right of withdrawal, so you can withdraw within 14 days even after the download and get a full refund. Refund Policy, section 02.

Cover of Tenant Hardening for Microsoft 365. It lists 10 chapters, from The Microsoft 365 Hardening Mandate to Decision Matrix: Business Premium, E3, E5 and Add-ons.

PDF field guide

Reviewed 18 July 2026 · PDF edition

About this guide

Who it is for and what it covers

Microsoft 365 is usually the control plane for identity, email, documents, devices and collaboration. If that tenant is weak, the rest of the stack inherits the weakness.

This book turns the ITSailor Microsoft 365 Security Baseline, NIST CSF 2.0, DORA Article 9 and NIS2 Article 21 into Microsoft 365 work: Conditional Access, PIM, Defender XDR, Sentinel, backup, licence evidence and audit packs.

The operator goal is simple: show the configuration, show the log, show the owner, show the rollback path.

Inside the PDF

What comes with the PDF

  • 10-chapter practitioner guide with a control-by-control hardening path.

  • ITS-M365 / NIST CSF 2.0 / DORA / NIS2 / GDPR mapping table for Microsoft 365 operators.

  • Conditional Access policy-as-code starter JSON.

  • Secure Score and licence-waste PowerShell audit snippets.

  • Sentinel KQL starter rule for failed sign-in bursts.

  • Audit-day evidence checklist for identity, endpoint, email, backup and logging controls.

Sample page

One chapter as it appears in the PDF

Previewed chapter: Conditional Access Policy-as-Code

Ship policy JSON, not screenshots. Screenshots do not roll back a lockout.

ITS-M365-ID-001 to ITS-M365-ID-004NIST CSF 2.0 PR.AADORA Article 9

Tenant Hardening for Microsoft 365itsailor.io

Chapter 3

Conditional Access Policy-as-Code

Ship policy JSON, not screenshots. Screenshots do not roll back a lockout.

  • ITS-M365-ID-001 to ITS-M365-ID-004
  • NIST CSF 2.0 PR.AA
  • DORA Article 9

Conditional Access is where the tenant turns risk appetite into runtime enforcement. The anti-pattern is clicking policies directly into production and documenting them afterward. The operator pattern is different: write the policy, test in report-only, simulate impact, document exclusions, deploy in waves, keep rollback instructions next to the policy.

Every Conditional Access policy should have a purpose, a scope, a signal, a control and a rollback path. "Block risky access" is not specific enough. "Require phishing-resistant MFA for privileged roles except monitored break-glass group, report-only for seven days, then enable for admins" is operable.

Table of contents

Contents

  1. ITS-M365 control setNIST CSF 2.0 GV.RM, PR.AA, DE.CM, RC.RP

    The Microsoft 365 Hardening Mandate

    Three governance languages point at the same operational question: can your tenant resist, detect, recover and prove control?

    What the chapter asks you to keep

    • Control map from ITS-M365 / NIST CSF 2.0 / DORA Article 9 / NIS2 Article 21 to Microsoft 365 workloads.
    • Named control owner for identity, endpoint, email, backup and logging.
    • Quarterly evidence refresh schedule.
  2. ITS-M365 control setMicrosoft Secure Score

    Tenant Baseline and Posture Assessment

    Score before you spend. A baseline without ownership becomes a screenshot collection.

    What the chapter asks you to keep

    • Secure Score export or API output.
    • ITS-M365 control worksheet with stable ID, profile, source, status, owner and exception reason.
    • Posture review date and next review date.
  3. ITS-M365-ID-001 to ITS-M365-ID-004NIST CSF 2.0 PR.AA

    Conditional Access Policy-as-Code

    Ship policy JSON, not screenshots. Screenshots do not roll back a lockout.

    What the chapter asks you to keep

    • Conditional Access JSON export.
    • Report-only impact review.
    • Change record with activation date and rollback owner.
  4. ITS-M365-PA-001 to ITS-M365-PA-005NIST CSF 2.0 PR.AA

    JIT Admin and Privileged Identity Management

    Permanent Global Administrator assignments give an attacker one password to find. Make them eligible in PIM and keep two break-glass accounts.

    What the chapter asks you to keep

    • PIM role assignment export.
    • Activation history sample.
    • Monthly privileged access review record.
  5. ITS-M365-EP-001 to ITS-M365-EP-005NIST CSF 2.0 PR.PS, DE.CM

    Defender XDR Onboarding Order

    Wrong order creates blind spots. Deploy detection in a sequence the operations team can absorb.

    What the chapter asks you to keep

    • Defender XDR onboarding status.
    • Incident queue screenshots or export.
    • Response runbook and test record.
  6. ITS-M365-LD-001 to ITS-M365-LD-004NIST CSF 2.0 DE.CM, DE.AE, RS.MA

    Sentinel Analytics Rules That Are Not Noise

    A rule earns its place when someone knows what to do after it fires.

    What the chapter asks you to keep

    • Analytics rule export.
    • Incident tuning log.
    • Response playbook with owner and escalation path.
  7. ITS-M365-RS-001 to ITS-M365-RS-003NIST CSF 2.0 PR.IR, RC.RP

    Microsoft 365 Backups: Native Retention Is Not Enough

    Recoverable is not the same thing as backed up. Retention answers policy. Backup answers recovery.

    What the chapter asks you to keep

    • Backup policy export.
    • Restore test record.
    • RTO / RPO decision and owner sign-off.
  8. ITS-M365-GV-001NIST CSF 2.0 GV.RM

    Licence Right-Sizing in Production

    Hardening does not always mean E5. It means buying the controls you will configure and operate.

    What the chapter asks you to keep

    • Licence assignment export.
    • Inactive-user and disabled-user waste report.
    • Control-to-licence matrix with accepted gaps.
  9. ITS-M365 control setNIST CSF 2.0 GV.OV, DE.CM, RC.RP

    The Audit Day Survival Pack

    Audit readiness is the ability to answer the second question without panic.

    What the chapter asks you to keep

    • Evidence index with owner and review date.
    • Control exception register.
    • Sample auditor Q&A pack.
  10. ITS-M365-GV-001NIST CSF 2.0 GV.RM

    Decision Matrix: Business Premium, E3, E5 and Add-ons

    Pick by control surface, not seat count. The right licence is the one your operators can run.

    What the chapter asks you to keep

    • Control-to-licence matrix.
    • Licence change approval.
    • Quarterly licence and control review date.
Source basis

Sources

Each source links to the original. The access date is when this edition last read it.

Primary law

Regulation (EU) 2022/2554, Digital Operational Resilience Act

Primary legal text for DORA. Used for ICT risk, continuity and incident references.

Accessed 5 June 2026

Primary law

Directive (EU) 2022/2555, NIS2 Directive

Primary legal text for NIS2. Article 21 anchors cybersecurity risk-management measures.

Accessed 5 June 2026

Standard

NIST Cybersecurity Framework 2.0

Public risk-management vocabulary used for the ITS-M365 control crosswalk.

Accessed 5 June 2026

Vendor documentation

Microsoft Secure Score

Microsoft guidance for Secure Score posture measurement and recommended actions.

Accessed 5 June 2026

Vendor documentation

Microsoft Graph conditionalAccessPolicy API

Used for Conditional Access policy-as-code examples.

Accessed 5 June 2026

Vendor documentation

Microsoft Entra emergency access accounts

Used for break-glass account guidance.

Accessed 5 June 2026

Vendor documentation

Microsoft Entra ID Governance overview

Used for privileged access and identity governance framing.

Accessed 5 June 2026

Vendor documentation

Pilot and deploy Microsoft Defender XDR

Used for Defender XDR pilot and deployment sequencing.

Accessed 5 June 2026

Vendor documentation

Threat detection in Microsoft Sentinel

Used for analytics rule design, incident framing and the Defender portal transition timeline.

Accessed 5 June 2026

Vendor documentation

Microsoft Sentinel automation rules

Used for Sentinel incident ownership, assignment and automation guidance.

Accessed 5 June 2026

Vendor documentation

Microsoft 365 Backup overview

Used for native backup and restore framing.

Accessed 5 June 2026

What this guide is not

This guide is technical guidance, not legal advice. ITS-M365, NIST CSF 2.0, DORA, NIS2 and GDPR mappings help you prepare evidence, but your regulator, auditor, DPO, legal counsel and sector authority decide what is sufficient.

Written and maintained by

Michal Jatczak

ITSailor is the trading name. The legal publisher is Michal Jatczak, Malta VAT registered.

About the publisher
In your own tenant

The same review, in your own tenant

Use the guide to self-assess. The Architecture & Security Design Workshop covers the same ground in two hours in your own Microsoft 365 tenant and ends in a written gap analysis, a Copilot gate record and an evidence register.

See the workshop
The companion field guide

DORA and NIS2: The Strategic IT Roadmap

A field guide that maps ICT risk, third-party concentration, incident reporting and resilience testing to a 90/180/365-day operating plan.

See the companion guide