Studio JNY

Block legacy authentication

—

Move per-user MFA to Conditional Access

—

Retire SMS, voice and email OTP as authentication methods

—

Block device code flow and authentication transfer

—

Restrict app registration and third-party consent to admins

—

Non-admins cannot create tenants or self-service subscriptions

—

Entra Password Protection with a custom banned list

—

One real break-glass account

—

Unified audit log and mailbox auditing, retention set

—

Block external auto-forwarding

—

Shared and service mailboxes: sign-in blocked

—

Restrict directory read for members and guests

—

Email authentication — SPF, DKIM and DMARC all published

—

Security Defaults off, Conditional Access on

—

Block administrators from self-service password reset

—

Block device platforms the client doesn't use

—

Restrict Entra and Azure portal access to administrators

—

Defender for Office policy baselines

—

External sender warnings — external flag and MailTips

—

MFA for all users, all applications

—

MFA for all admin roles — no exclusions, no trusted-location bypass

—

Guest access restricted, guests require MFA

—

Admin sign-in frequency and no persistent browser session

—

Risk-based Conditional Access (risky sign-in, risky user)

—

Teams meeting and external access hygiene

—

SharePoint and OneDrive session hygiene

—

Require a managed, compliant device

—

Phishing-resistant authentication (passkeys / FIDO2)

—

Separate admin accounts with no mailbox

—

External sharing limited to authenticated recipients

—

Geographic restriction on sign-in

Huntress ITDR watches sign-in location behaviourally. Cut because it is covered, not because location doesn't matter.