The whole category in one page.
IDENTITY CONNECTS EVERYTHING
Almost every product authenticates against the same directory, so identity explains more about the ecosystem's behaviour than anything else — and it is where security effort pays most.
Enable multi-factor authentication everywhere, block legacy authentication, and give administrators separate accounts.
ALWAYS EXCLUDE AN EMERGENCY ACCESS ACCOUNT FROM EVERY ACCESS POLICY
And run every policy in report-only mode before enabling it. Locking out every administrator is a real failure mode.
SYNCHRONISED STORAGE IS NOT A BACKUP, AND CLOUD RESOURCES ARE NOT BACKED UP BY DEFAULT
Configure protection deliberately, keep one copy unreachable from the network, and test restoring.
REMOVE CREDENTIALS FROM CONFIGURATION ENTIRELY
Managed identities and a secret store are the single most valuable security change available in this ecosystem.
RESTRICT WHO MAY CREATE THINGS
Teams, sites, environments and Power Platform solutions all sprawl within months without governance, and content becomes unfindable.
CHECK LICENCES AGAINST ACTUAL USERS, AND WATCH FOR RESOURCES LEFT RUNNING
Both are continuous, avoidable cost — and billing is in foreign currency, so it moves with the exchange rate.
TEST EVERY POLICY ON A PILOT GROUP FIRST
Applied incorrectly to everyone, it affects everyone immediately.
