Shut these doors, in this order

Each door is one change, ordered by the exposure it removes and the certification requirements it completes per hour of work. Fixes interact, so the order is recalculated after every one.

Now · 5.5 hours

Next 30 days · 17 hours

−11.5 exposure4 hoursIDN-012
Stolen passwords, phished MFA and relayed sessions all end with the attacker signing in from their own computer. Requiring an Intune-compliant or company-joined device means a stolen credential or token is useless anywhere but on your own hardware.
1. Make sure every staff device is enrolled in Intune and compliant (see DEV-001) before enforcing.
2. Conditional Access > New policy from template > 'Require compliant or hybrid Azure AD joined device' for all users and all cloud apps.
3. Set the grant to require the device control - not 'MFA or compliant device'. Run report-only for a week, then On.
Needs Entra ID P1 and Intune (both in Microsoft 365 Business Premium).

Next 90 days · 7 hours

Shut these doors, in this order

Each door is one change, ordered by the exposure it removes and the certification requirements it completes per hour of work. Fixes interact, so the order is recalculated after every one.

Now · 5.5 hours

Next 30 days · 17 hours

−11.5 exposure4 hoursIDN-012
Stolen passwords, phished MFA and relayed sessions all end with the attacker signing in from their own computer. Requiring an Intune-compliant or company-joined device means a stolen credential or token is useless anywhere but on your own hardware.
1. Make sure every staff device is enrolled in Intune and compliant (see DEV-001) before enforcing.
2. Conditional Access > New policy from template > 'Require compliant or hybrid Azure AD joined device' for all users and all cloud apps.
3. Set the grant to require the device control - not 'MFA or compliant device'. Run report-only for a week, then On.
Needs Entra ID P1 and Intune (both in Microsoft 365 Business Premium).