The summary.
THE CLOUD DIRECTORY IS NOT ACTIVE DIRECTORY
Different concepts, different protocols, no group policy, despite the similar name.
ALWAYS EXCLUDE AN EMERGENCY ACCESS ACCOUNT FROM EVERY POLICY
Locking every administrator out with a policy nobody can satisfy is a real and recoverable-only-with-difficulty failure.
And run every policy in report-only mode first, examining what it would have affected.
PREFER PHISHING-RESISTANT METHODS, AND ENABLE NUMBER MATCHING
Codes by message can be intercepted, delivery is unreliable, and they cost money.
Number matching prevents approval fatigue, where a user approves a prompt they did not initiate.
REQUIRE TWO REGISTERED METHODS PER USER
Otherwise a lost phone means administrator intervention every time.
ASSIGN THE NARROWEST ROLE THAT PERMITS THE WORK
Few holders of the highest role, and more than one — a single administrator who becomes unavailable locks out the organisation.
A PASSWORD RESET DOES NOT END EXISTING SESSIONS
Revoke sessions and tokens, check authentication methods, and look for mailbox rules — the attacker otherwise remains signed in.
PREFER PASSWORD HASH SYNCHRONISATION FOR HYBRID IDENTITY
Federation infrastructure failing prevents all cloud sign-in.
