setup examples
the same control, on the platform you already run
The rules say what must be true. These pages show what that looks like in a real tenant: the steps, the portal path, how to tell it worked and what goes wrong.
last checked 2 November 2026English only for now
Microsoft 365 and Microsoft Entra ID
- microsoft 365: switch on the sign-in baselineSecurity defaults turn on a second factor, block old mail protocols and protect the admin consoles, with no extra licence. The steps below keep the order that avoids a lockout.
- microsoft 365: two emergency access accountsEmergency, or break-glass, accounts keep you from locking yourself out of your own tenant. Microsoft's guidance in nine steps, with the alert and the 90-day drill that make them trustworthy.
- microsoft 365: block legacy authenticationOld mail protocols cannot ask for a second factor, so an attacker can use them to get around yours. Find who still uses them, then block them with a Conditional Access policy that starts in report-only mode.
The pages name a platform because the settings are specific to it. They recommend no product and compare none. Each page says which documentation it follows and when it was read.
your next step
Pick the control your next audit or customer will ask about, and open the page for the platform you run.