Remediation plan Generated on 27/07/2026 14:32 — 17 prioritised actions.
Audited domain
Contoso Industries
contoso-industries.onmicrosoft.com
Active Directory, Exchange, Teams, SharePoint, OneDrive, Defender, Intune, Purview
P1 — Critical non-compliances (L1) Entra L1 Non-compliant
Remove disabled accounts from privileged roles
Remove role assignments from disabled accounts.
Get-MgDirectoryRoleMember | Where-Object { $_.AdditionalProperties.accountEnabled -eq $false } Entra L1 Non-compliant
Require MFA for all users
Conditional Access: a policy targeting all users (with break-glass exclusions) requiring MFA, ideally via a phishing-resistant authentication strength.
New-MgIdentityConditionalAccessPolicy -BodyParameter @{ DisplayName='MFA - Tous les utilisateurs'; State='enabledForReportingButNotEnforced'; Conditions=@{ Users=@{ IncludeUsers=@('All'); ExcludeUsers=@('<id-compte-urgence>') }; Applications=@{ IncludeApplications=@('All') } }; GrantControls=@{ Operator='OR'; BuiltInControls=@('mfa') } } Entra L1 Non-compliant
Require MFA for device join and registration
Conditional Access: create a policy on the "Register or join devices" user action requiring MFA.
Entra L1 Non-compliant
Block the device code authentication flow
Entra portal > Conditional Access: create a policy targeting device code authentication flows with the Block grant.
Get-MgIdentityConditionalAccessPolicy | Select-Object DisplayName,Conditions Exchange L1 Non-compliant
Control inbound and outbound mail connectors
Exchange admin center > Mail flow > Connectors: enforce TLS and restrict source domains or IP addresses.
Get-InboundConnector | Select-Object Name,Enabled,RequireTls,SenderDomains Intune L1 Non-compliant
Enumerate non-compliant devices
Configure this in the Microsoft Intune admin center.
# Via LDAP /deviceManagement P2 — Non-compliances (L2) Intune L2 Non-compliant
Analyze configuration profile assignments
Configure this in the Microsoft Intune admin center.
# Via LDAP /deviceManagement Entra L2 Non-compliant
Control federation relationships and ADFS configuration
Audit federated domains (authenticationType) and migrate to cloud authentication (PHS/PTA + seamless SSO) where possible.
Get-MgDomain -All | Select-Object Id, AuthenticationType Entra L2 Non-compliant
Limit the maximum PIM role activation duration
Entra > PIM > Role settings > Activation: lower 'Activation maximum duration' to 8 hours or less.
SharePoint L2 Non-compliant
Hide the site creation UI
SharePoint admin center > Settings > Site creation: hide the 'Create site' command from users.
# Centre d'administration SharePoint > Paramètres > Création de sites (Show/Hide the Create site command) P3 — Warnings Teams L2 Warning
Limit public teams
Review public teams and switch non-legitimate ones to 'Private' (team settings or Set-Team -Visibility Private).
Get-Team | ? Visibility -eq 'Public' # puis Set-Team -GroupId <id> -Visibility Private Entra L1 Warning
Prohibit guests in privileged roles
Remove guest accounts from privileged roles and create dedicated internal accounts.
Get-MgDirectoryRoleMember | Where-Object { $_.AdditionalProperties.userType -eq 'Guest' } Exchange L2 Warning
Enable MailTips for users
Set-OrganizationConfig -MailTipsAllTipsEnabled $true -MailTipsExternalRecipientsTipsEnabled $true.
Get-OrganizationConfig | Select-Object MailTipsAllTipsEnabled,MailTipsExternalRecipientsTipsEnabled Defender L1 Warning
Tolerate no active high-severity incident
Defender portal > Incidents: mobilize response on any high-severity incident (containment, eradication, post-mortem).
Get-MgSecurityIncident -Filter "status eq 'active' and severity eq 'high'" Exchange L1 Warning
Tag messages coming from outside
Exchange Online PowerShell: Set-ExternalInOutlook -Enabled $true.
Get-ExternalInOutlook | Select-Object Enabled,AllowList Teams L2 Warning
Define guest usage guidelines
Group.Unified directory setting: set GuestUsageGuidelinesUrl to your guest usage guidelines page.
# Group.Unified : GuestUsageGuidelinesUrl=<url> (Update-MgGroupSetting) Exchange L2 Warning
Enable litigation hold on sensitive mailboxes
Exchange admin center > Mailboxes > Features: enable litigation hold on sensitive accounts.
Get-Mailbox -ResultSize Unlimited | Select-Object PrimarySmtpAddress,LitigationHoldEnabled Report generated by AdGUARD — adguard.eu — read-only audit.