AD0.8 The NE Starting Point

4-5 hours · Module 0 · Free
Operational Objective
Every security improvement starts from somewhere. Theory without context produces generic advice. This subsection introduces Northgate Engineering — the fictional company used throughout all Ridgeline courses — and maps its current M365 security posture as the baseline you'll improve across the remaining modules. NE represents a typical mid-size organisation: E3 licenses, security defaults enabled, no conditional access policies, basic email protection, Intune deployed for device management but no compliance policies enforced, and a single IT administrator (you) who has just been asked to "handle security." If this sounds familiar, it should — it's the starting point for most organisations where the IT team manages security.
Deliverable: Understanding of NE's current M365 security posture, the specific gaps that create risk, and the baseline you'll measure improvement against throughout this course.
Estimated completion: 20 minutes
NORTHGATE ENGINEERING — CURRENT SECURITY POSTUREIDENTITY⚠ Security defaults ON✗ No conditional access✗ No legacy auth blocking✗ SSPR not configured✗ 3 Global Admins (should be 2)✓ MFA registration at 87%Score: 3/10Module AD1 fixes thisEMAIL✓ EOP active (default)✗ No Safe Links policy✗ No Safe Attachments policy✗ No anti-phishing tuning✗ No SPF/DKIM/DMARC✗ No user-reported phishingScore: 1/10Module AD2 fixes thisDEVICES✓ Intune enrolled (85%)✗ No compliance policies✗ No CA + compliance integration✗ BitLocker not enforced⚠ Windows Update ring only✗ No endpoint protection policyScore: 2/10Module AD4 fixes thisDATA + MONITORING✗ No sensitivity labels✗ No DLP policies✓ Audit logging enabled (default)✗ Nobody reviews audit logs✗ No alert monitoring cadence✗ No incident response planScore: 1/10Modules AD5-AD7 fix this

Figure AD0.8 — Northgate Engineering's current M365 security posture. Secure Score: approximately 38%. MFA is partially deployed via security defaults. Email protection is default EOP only. Devices are enrolled in Intune but no compliance policies exist. Data protection and monitoring are essentially absent. This is a representative starting point for a mid-size organisation where IT manages security.

The company

Northgate Engineering is a mid-size engineering firm headquartered in the UK with 210 employees across three offices. They design and manufacture precision components for aerospace and defence clients. The company processes sensitive intellectual property (engineering designs, manufacturing specifications) and handles contractual data from clients with strict security requirements.

The M365 tenant has been running for four years. The IT team consists of three people: a senior IT administrator (that’s you in this scenario), a helpdesk technician, and an IT manager who splits time between IT and facilities management. There is no dedicated security role. The senior IT administrator handles everything from user provisioning to printer problems to Teams configuration — and now, security.

The licensing is M365 E3 for all 210 users, with an E5 trial that expired six months ago (Defender for Endpoint and the advanced Defender features are no longer available). The infrastructure is hybrid — Azure AD Connect syncs the on-premises Active Directory with Entra ID, and Exchange is fully online (migrated from on-premises two years ago).

The current state

NE’s M365 security posture reflects what happens when a tenant is administered competently but without security focus. Everything works. Users can sign in, email flows, Teams meetings happen, SharePoint sites are accessible, and devices are managed through Intune. But the security layer is almost entirely default.

Identity: security defaults are enabled, which means MFA registration is required and MFA is challenged probabilistically. 87% of users have registered for MFA — the remaining 13% are a mix of shared accounts, service accounts, and users who haven’t logged in since the registration window opened. There are three Global Administrator accounts — the IT administrator’s daily account, the IT manager’s account, and a legacy account from when the tenant was set up by a consultant. No conditional access policies exist. Legacy authentication is not explicitly blocked. Self-service password reset is not configured — every password reset goes through the helpdesk.

Email: Exchange Online Protection provides basic anti-spam and anti-malware filtering. No Safe Links or Safe Attachments policies are configured, meaning Defender for Office 365 Plan 1 features are available but unused. Anti-phishing policies are at default settings. SPF, DKIM, and DMARC are not configured on the company’s domain — email authentication is not enforced, which means anyone can spoof emails appearing to come from @northgateeng.com.

Devices: 85% of endpoints are enrolled in Intune. The remaining 15% are personal devices (BYOD) that access M365 through web browsers. No device compliance policies exist — enrolled devices are managed for application deployment and Windows Update rings, but there’s no security baseline enforcement. BitLocker is deployed on most corporate devices but not enforced through policy.

Data and monitoring: no sensitivity labels, no DLP policies, no regular audit log review, no alert monitoring cadence, and no incident response procedure. The unified audit log is enabled by default but nobody has ever searched it. The Defender portal has been visited once (during the E5 trial) but is not part of any regular workflow.

How to run this assessment on your own tenant

NE’s assessment isn’t hypothetical — you can run the same checks on your environment right now using the admin portals. Here’s exactly what to check and where to find it.

MFA registration rate: Navigate to entra.microsoft.com → Protection → Authentication methods → Activity. The “Registration and reset” tab shows the percentage of users who have registered for MFA. If you see a registration rate below 90%, the gap represents accounts that can be compromised with just a password.

Global Administrator count: Navigate to entra.microsoft.com → Roles and administrators → Global Administrator. Count the members. Best practice is 2-4 Global Administrators (two break-glass accounts plus one or two operational admins). More than four creates unnecessary risk — every Global Administrator account is a tier-zero target. If you see accounts you don’t recognise or accounts that belong to former employees or consultants, that’s an immediate remediation item.

Legacy authentication usage: Navigate to entra.microsoft.com → Monitoring → Sign-in logs. Add a filter for “Client app” and select all the legacy options (IMAP4, POP3, SMTP, Exchange ActiveSync, Other clients). Any results in the last 30 days tell you which accounts are authenticating through protocols that don’t support MFA. These accounts can be compromised even when MFA is enabled because the legacy protocol bypasses the MFA challenge entirely.

Email protection status: Navigate to security.microsoft.com → Email & collaboration → Policies & rules → Threat policies. Check for Safe Links and Safe Attachments policies. If you only see “Built-in protection (preset)” and no custom policies, your email protection is running at the minimum level.

Intune compliance: Navigate to intune.microsoft.com → Devices → Compliance. If you see “No compliance policies” or only policies in a reporting state, devices are not being evaluated against any security baseline. Check Devices → All devices for the enrollment count — compare it to your total device count from the M365 Admin Center to calculate your enrollment percentage.

One more check that frequently reveals surprises: navigate to entra.microsoft.com → Roles and administrators → Global Administrator and click the role to see its members. In NE’s case, this reveals three Global Admins including a legacy consultant account that hasn’t been used in 18 months. That account is a dormant attack vector — if the consultant’s credentials were compromised through any breach database, the attacker would have Global Administrator access to your tenant. Removing or disabling unnecessary admin accounts is a zero-cost, five-minute security improvement that should happen before you build any conditional access policies. Each of these checks takes under two minutes. Together, they give you a concrete, evidence-based picture of where your tenant stands — not an assumption based on what you think you configured, but verified data from the admin portals.

For MFA registration specifically, there is a more detailed report at entra.microsoft.com → Protection → Authentication methods → Activity → Registration. This shows you not just the percentage but which specific users have not registered, which MFA methods they have registered (Authenticator app, phone, FIDO2 key), and when they last registered a method. Export this report before you deploy conditional access — the users who have not registered are the ones who will call the helpdesk on enforcement day, and you want to reach out to them proactively.

Compliance Myth: "Our environment isn't a target — we're not a bank or a hospital"
Northgate Engineering processes aerospace and defence intellectual property — but even if they didn't, every M365 tenant is a target. Commodity attacks (credential phishing, password spraying, BEC) are automated and target every domain, regardless of industry or size. The attacker doesn't know or care what your company does when they spray passwords against your login page. They care when they get in and discover financial data, customer records, or engineering designs they can sell or ransom. Every organisation has data worth stealing, and every M365 tenant has the same authentication infrastructure worth attacking.

What this baseline means

NE’s current state is not unusual. Industry surveys consistently show that 40-60% of M365 tenants have no conditional access policies, 30-40% haven’t configured Defender for Office 365 features beyond defaults, and fewer than 20% have operational device compliance policies. NE is average — which is exactly the problem. Average M365 security configuration leaves the door open for the most common attacks.

The good news is that every gap in NE’s posture is fixable with E3 licensing, zero additional budget, and the time investment this course teaches. MFA enforcement through conditional access takes an afternoon to deploy. Email protection with Safe Links and Safe Attachments takes an hour to configure. Device compliance policies take a few hours to build and test. The blocking factor has never been cost or complexity — it’s been knowledge. This course provides the knowledge. The rest of the modules walk you through closing each gap, one at a time, in the order that maximises security impact.

Decision point

You’ve assessed NE’s current posture and identified the gaps. Your IT manager asks: “What’s the single most important thing we should do first?” You have the full gap list — identity, email, devices, data, monitoring. Which one do you recommend as the first priority?

Option A: Email protection — configure Safe Links and Safe Attachments because users are reporting phishing emails weekly.

Option B: Identity — move from security defaults to conditional access with MFA enforcement and legacy auth blocking.

Option C: Devices — create compliance policies and enforce device requirements through conditional access.

Option D: Monitoring — set up a daily alert review cadence in the Defender portal.

The correct answer is Option B. Identity is always first. Conditional access with deterministic MFA and legacy authentication blocking prevents the vast majority of credential-based attacks. Even if phishing emails still land (and they will until you configure email protection), the attacker can’t use stolen credentials if conditional access blocks the sign-in. Email protection is second. Devices are third. Monitoring starts alongside everything else but isn’t a standalone priority — monitoring without controls to monitor is just watching incidents happen.

Try it: Map your own starting point

Using NE’s assessment as a template, score your own environment across the four categories: Identity (0-10), Email (0-10), Devices (0-10), Data & Monitoring (0-10).

For Identity: do you have conditional access policies? Is legacy auth blocked? How many Global Administrators exist? What’s your MFA registration rate?

For Email: are Safe Links and Safe Attachments configured? Do you have SPF, DKIM, and DMARC on your domain? Is anti-phishing tuned beyond defaults?

For Devices: are devices enrolled in Intune? Do compliance policies exist? Are compliance results feeding into conditional access?

For Data & Monitoring: do you have sensitivity labels? DLP policies? Does anyone review the Defender portal alerts regularly?

Write down your scores. These are your baseline. The rest of this course improves each category, starting with Identity in the next module.

NE has 210 users on E3 licenses with security defaults enabled and 87% MFA registration. An attacker performs a password spray against NE's tenant using a list of common passwords. Which users are most vulnerable?
All 210 users because security defaults don't enforce MFA on every sign-in — Not quite. Security defaults do challenge for MFA on many sign-ins, significantly reducing the risk for registered users. The risk is not uniform across all users.
The 3 Global Administrator accounts because they have the most privileges — Partially correct. Admin accounts are the highest-value targets, but security defaults specifically require MFA for all admin sign-ins. The admins are actually better protected than some standard users under security defaults.
The 13% of users who haven't registered for MFA and any accounts accessible via legacy authentication protocols — Correct. Users who haven't registered for MFA can't be challenged for a second factor. Accounts accessible via IMAP, POP3, or other legacy protocols bypass MFA entirely even for registered users. These are the gaps that conditional access closes.
None of them because security defaults block password spray attacks — No. Security defaults don't block password spray attacks at the authentication layer. They may challenge individual sign-ins for MFA, but they don't detect or block the distributed pattern of a spray attack across many accounts.

You're reading the free modules of M365 Security: From Admin to Defender

The full course continues with advanced topics, production detection rules, worked investigation scenarios, and deployable artifacts. Premium subscribers get access to all courses.

View Pricing See Full Syllabus