75 lines
4.0 KiB
Markdown
75 lines
4.0 KiB
Markdown
---
|
||
title: "Module 3 — M365 Security Hardening"
|
||
description: "Exchange Online Protection tuning, mailbox auditing, Unified Audit Log forwarding, Secure Score baseline, ASR rules, and ASTRAL configuration capture — no new licensing required for E3 clients."
|
||
eyebrow: "Consulting Module"
|
||
lead: "Most M365 E3 tenants are running at a fraction of the security their licence already includes. This module extracts that value systematically — tightening the controls that exist, enabling the logging that should be on, and capturing the baseline so drift is detectable from day one."
|
||
actions:
|
||
- label: "Get in Touch"
|
||
url: "/about/#contact"
|
||
primary: true
|
||
- label: "View All Modules"
|
||
url: "/consulting/skills/"
|
||
---
|
||
|
||
## What It Delivers
|
||
|
||
<div class="feature-list">
|
||
<div class="feature-item">
|
||
<div class="feature-item-icon">📧</div>
|
||
<div class="feature-item-body">
|
||
<h4>Exchange Online Protection Tuning</h4>
|
||
<p>Anti-phishing, anti-malware, and anti-spam policies reviewed and tightened. DKIM, DMARC, and SPF validated. External sender tagging enabled. Auto-forwarding to external addresses blocked — one of the most reliable business email compromise persistence mechanisms.</p>
|
||
</div>
|
||
</div>
|
||
<div class="feature-item">
|
||
<div class="feature-item-icon">📒</div>
|
||
<div class="feature-item-body">
|
||
<h4>Mailbox Auditing and UAL Forwarding</h4>
|
||
<p>Mailbox auditing enabled tenant-wide for all user and admin actions. Unified Audit Log configured for forwarding to SIEM or PULSAR. Every mailbox access, calendar sharing change, and permission modification becomes a searchable, retained event.</p>
|
||
</div>
|
||
</div>
|
||
<div class="feature-item">
|
||
<div class="feature-item-icon">📊</div>
|
||
<div class="feature-item-body">
|
||
<h4>Secure Score Baseline and Improvement Plan</h4>
|
||
<p>Current Secure Score documented with every open recommendation classified: accept, remediate, or mitigate. A realistic 90-day improvement plan targets the highest-impact items within the existing E3 licence — no new spend required to close most gaps.</p>
|
||
</div>
|
||
</div>
|
||
<div class="feature-item">
|
||
<div class="feature-item-icon">🛡️</div>
|
||
<div class="feature-item-body">
|
||
<h4>Attack Surface Reduction Rules</h4>
|
||
<p>ASR rules deployed via Intune in audit mode first, then staged to enforcement. Rules targeting Office macro abuse, credential theft from LSASS, and suspicious process creation — covering the most common malware execution paths without blocking legitimate business workflows.</p>
|
||
</div>
|
||
</div>
|
||
<div class="feature-item">
|
||
<div class="feature-item-icon">📸</div>
|
||
<div class="feature-item-body">
|
||
<h4>ASTRAL Baseline Capture</h4>
|
||
<p>ASTRAL deployed to take a Git-tracked snapshot of the post-hardening configuration. Every subsequent change opens a pull request with a diff and an AI-generated narrative. The hardened state becomes the recoverable baseline — if anything drifts, you know immediately and can restore deterministically.</p>
|
||
</div>
|
||
</div>
|
||
</div>
|
||
|
||
## No New Licensing Required
|
||
|
||
The full scope of this module is deliverable on Microsoft 365 E3. We do not recommend upgrading to E5 as a condition of delivery. If E5 features would materially improve a specific control, we say so and explain the trade-off — but we do not use the engagement as a licence upsell.
|
||
|
||
## Scope and Prerequisites
|
||
|
||
| | |
|
||
|---|---|
|
||
| **Duration** | 30–60 days |
|
||
| **Environment** | M365 E3+ |
|
||
| **Prerequisites** | Global Administrator access; Module 2 (Identity Security) completed or in parallel |
|
||
| **Natural follow-on** | Module 4 (Data Governance) for sensitivity labels and DLP |
|
||
|
||
<div class="cta-strip">
|
||
<h2>Extract the security your licence already includes</h2>
|
||
<p>Most E3 tenants leave the majority of their security value unconfigured. This module closes that gap systematically.</p>
|
||
<div class="actions">
|
||
<a href="/about/#contact" class="btn btn-primary">Get in Touch</a>
|
||
<a href="/consulting/skills/" class="btn btn-outline">View All Modules</a>
|
||
</div>
|
||
</div>
|