365 Tenants: templates from the library and from a reference tenant

A template describes how a tenant should be configured. It comes from the library or from a reference tenant.

Library “Conbool gehärtet”

In its tenth edition the library holds 77 entries in five topics. 25 of them are preselected; you add the others explicitly. With Choose and adopt you tick what you want, and it becomes a draft in your account. If the tenant has no template assigned yet, Release and assign to this tenant right away adopts, releases and assigns in one step.

Each entry shows the number of the CIS Microsoft 365 Foundations Benchmark 7.0.0 control it implements, 53 in total. Where an entry implements a control only partly, it says “partly” and gives the reason.

Secure sign-in

• Preselected: MFA for all users, MFA for administrators, MFA for Azure management, block legacy authentication, block device code flow and authentication transfer, sign-in frequency for administrators, secure authentication methods, prompt to set up the Authenticator app, strongest method first, lockout after failed attempts and banned weak passwords.
• Optional: phishing-resistant MFA for administrators, turn off SMS, voice call and email code as authentication methods, MFA for risky sign-ins, block risky sign-ins, password change for high user risk, sign-in on device registration, security info only from managed devices, access only from managed devices, mobile apps only with app protection, block unknown platforms, short sessions on unmanaged devices, password protection in on-premises Active Directory.

MFA for all and blocking legacy authentication are the foundation: choosing any further policy adds both. Security Defaults stay on until your own policies are enforced.

Guests and sharing

• Preselected: restrict guest permissions and stop users from creating apps and security groups, app consent as recommended by Microsoft, consent requests to administrators, guests not as group owners, sharing only with known guests without resharing, no blanket trust in other organizations.
• Optional: groups and teams created by administrators only, BitLocker keys only through administrators.

For app consent, 365 Tenants sets only which apps users may consent to themselves. Existing consents remain, and stricter settings are never loosened.

Exchange Online and Defender

• Preselected: mailbox auditing and external recipient hints, “External” tag, no automatic forwarding outside, block dangerous attachments, no Microsoft safe list, audit log on, no third-party storage in Outlook on the web, Safe Attachments for SharePoint, OneDrive and Teams.
• Optional: anti-phishing, phishing to quarantine, no unfiltered IP addresses and sender domains, sending limits, turn off SMTP with a password, reject Direct Send, no personal accounts in the new Outlook, Safe Documents.

“Phishing to quarantine” leaves spam handling unchanged so that it fits MailGuard. Before turning off SMTP with a password, printers and scanners need another route.

Microsoft Teams

All entries are optional because they apply to every meeting in the tenant: limited external access, no chat with other organizations, no third-party storage, no email into channels, meetings with a lobby for guests, no anonymous participants, no cloud recording, reporting of suspicious messages.

Devices with Intune

All entries are optional because they affect devices as soon as they are rolled out: compliance for Windows, macOS, iOS and Android, Microsoft Defender Antivirus, rules against attacks through macros and scripts, Windows Firewall, SmartScreen, local administrator password, lock after inactivity, Credential Guard, USB storage read-only, BitLocker, update ring for Windows, app protection for iOS and Android, at most ten devices per user in Entra and no local administrator on join.

• Compliance only marks a device. Access is blocked only by a Conditional Access policy that requires a compliant device.
• The rules against attacks through macros and scripts are set to audit. They report what they would block and block nothing.
• After rollout, Intune policies apply to all devices or all users. App protection is created without an assignment; the administrator chooses the group in Intune.

Optional entries with a safeguard

Entries that could lock users out have a safeguard:

• The run does not turn off SMS and voice call while anyone other than the emergency accounts has only a phone number as second factor. The dry run names them.
• Phishing-resistant MFA for administrators can be enforced only once every administrator other than the emergency accounts has registered a passkey, Windows Hello or a certificate.
• The risk entries need Entra ID P2. Without P2, 365 Tenants does not create them, and they do not hold up enforcement of the others.
• “Password change for high user risk” cannot be enforced while the tenant syncs from on-premises Active Directory.
• “Access only from managed devices” and “mobile apps only with app protection” lock out anyone working from their own device. The report-only evaluation shows before enforcement who would be affected.

With Change selection you rebuild an adopted template. If you adopted an earlier edition, you see the new one as the next version.

From a reference tenant

Under Templates → Template from this tenant today's state becomes a draft. Identifiers, addresses and domains of the source tenant become placeholders or must be explained, so that no foreign values travel into other tenants.

Versions

Release turns a draft into a version. Released versions are immutable. New version creates a new one; the comparison shows what is new, changed or removed. A version can be retired; existing assignments stay on it.

365 Tenants checks every version before release. Release is blocked, among other things, if a blocking policy does not exclude the emergency accounts.