Microsoft 365 security hardening
A systematic improvement to the security of a live environment.
Raised Microsoft Secure Score from 54.5% to 83.6% across 30+ endpoints.
The problem
The tenant's Secure Score was 54.5%, below the DoD benchmark and a risk for CMMC assessment. I owned the remediation effort end to end, working through every recommendation category over several months.
What I built and owned
Audited all 30+ endpoints against Microsoft Secure Score recommendations, categorizing findings by severity and effort. Enabled and configured Conditional Access policies to block legacy authentication protocols and enforce MFA for all admin accounts. Deployed security baselines through Intune across all managed endpoints, hardening OS configurations to match NIST SP 800-171 controls. Remediated Defender for Endpoint alert configurations, enabling EDR, attack surface reduction rules, and automated investigation. Implemented Purview DLP policies for email and SharePoint to prevent CUI exfiltration. Tracked and documented every configuration change as SPRS control evidence for the SSP.
Evidence follows implementation
Every configuration change was documented as SPRS control evidence for the System Security Plan.
Project context
This work was carried out at Aalis Management Consulting. Production systems and organizational data are private.