Cloud Security
Enterprise Microsoft 365 Security & Zero Trust
Designing and implementing Zero Trust controls across identity, device, and data layers in Microsoft 365.
Scope
- Entra ID tenant hardening and identity governance
- Conditional Access policy design (risk-based, device-based, location-based)
- Intune compliance and configuration baselines
- Microsoft Defender for Business policy rollout
- Purview DLP and sensitivity label taxonomy
Approach
- Mapped existing identity, device, and data flows before touching policy.
- Designed Conditional Access policies in report-only mode first, then staged enforcement by group.
- Built Intune compliance baselines aligned to the Conditional Access device requirements.
- Rolled out Defender and Purview policies incrementally, validating against real user workflows.
Context
A Zero Trust rollout across Microsoft 365 touches identity, endpoint, and data protection at the same time — change one layer without the others and you either break access for legitimate users or leave gaps an attacker can walk through. This project covered the design and staged implementation of that rollout for an organization’s Microsoft 365 tenant.
What this involved
The work centered on Entra ID as the identity control plane: tightening tenant-level settings, defining Conditional Access policies that balance security with usability, and layering MFA enforcement without locking out legitimate break-glass access. Device compliance was handled through Intune, with baselines designed to satisfy the device-state requirements referenced by the Conditional Access policies — so the two systems reinforce each other instead of working in isolation.
Microsoft Defender for Business and Purview DLP were introduced to extend protection to endpoints and data respectively, including sensitivity label design for the organization’s document types and DLP rules tuned to avoid excessive false positives.
Approach
Every policy change was staged: designed, tested in report-only or audit mode, reviewed against real sign-in and device logs, then enforced in controlled waves. This kept the rollout from breaking day-to-day operations while still moving the tenant toward a consistent Zero Trust posture.