Microsoft 365 Security Hardening — Secure Configuration & Risk Reduction
Securing and Hardening of your Microsoft 365 Environment is a focused Microsoft 365 security engagement: IT Partner reviews how well you are using the security controls already available in your subscription — Microsoft Secure Score recommendations, multi-factor authentication, Exchange Online Protection and Microsoft Defender for Office 365 policies, and identity and device settings — then delivers a prioritized, Microsoft-best-practice hardening plan and implements the approved built-in controls. The service is billed at $175 per hour, typically runs 1 week, and is managed by Roman Sotnik.
What this engagement is
IT Partner analyzes your Microsoft 365 organization's security based on your regular activities and current settings, then develops and implements a prioritized plan according to Microsoft recommendations to increase security and reduce risk. The review covers three areas: updated and managed Windows devices (Windows 10/11), a correctly configured Microsoft 365 environment — including Microsoft Secure Score recommendations, multi-factor authentication, and Exchange Online Protection / Microsoft Defender for Office 365 email protection policies — and the identity and device security capabilities licensed in your tenant, such as Microsoft Entra ID and Microsoft Intune (Enterprise Mobility + Security). Approved built-in controls are configured in the tenant; everything else lands in the prioritized plan with its licensing dependency named.
Success criteria
What you receive
How the work unfolds
Confirm engagement scope, stakeholders, schedule, and the administrative access needed for the security review.
Review your business needs, compliance drivers, and current licensing to understand which security controls matter most for your organization.
Analyze tenant configuration and security settings, including Microsoft Secure Score recommendations, identity and access settings, email protection policies, and device management state.
Present a prioritized plan of changes based on Microsoft best practices, with risk, user impact, and licensing dependencies named, and obtain your approval before anything is changed.
Configure the approved built-in Microsoft 365 security tools and features within the tenant's licensed capabilities.
Validate that approved changes were applied as intended and document exceptions, blockers, or outstanding items.
Deliver the comprehensive report and project closeout report, including final status, evidence of completed activities, and outstanding issues, if any.
Prerequisites
Who does what
IT Partner
- Service-level security review
- Microsoft Secure Score review and improvement
- Anti-malware, patching, and configuration management
- Threat protection review (Exchange Online Protection and Microsoft Defender for Office 365 policies)
- Customer controls for security
- Multi-factor authentication
- Customer controls for privacy
Your team
- Coordinate Client resources and staff schedules
- Provide a dedicated point of contact responsible for working with IT Partner
- Provide all the necessary information for the statement of work preparation
- Provide an account in the required services with the rights necessary to implement the service
- Coordinate any outside vendor resources and schedules
- Configure all network equipment, such as load balancers, routers, firewalls, and switches
- Review and approve engagement deliverables in a timely manner
- Request and approve all change management tickets (if available) in the Client environment
What's not included
Limitations & technical notes
Frequently asked questions
What is the Securing and Hardening of your Microsoft 365 Environment service?
Securing and Hardening of your Microsoft 365 Environment is a focused security engagement in which IT Partner analyzes your Microsoft 365 organization, reviews existing and optional security controls and settings, develops a prioritized plan based on Microsoft best practices, and implements the approved built-in security features. The goal is to make your Microsoft 365 environment measurably safer and more secure.
What is included in this Microsoft 365 security hardening engagement?
The engagement includes a service-level security review, analysis of your Microsoft 365 environment, Microsoft Secure Score review and improvement, implementation of approved built-in security tools and features, and a prioritized plan of changes. It covers areas such as anti-malware, patching and configuration management, Exchange Online Protection and Microsoft Defender for Office 365 policies, multi-factor authentication, and customer security and privacy controls.
How long does the Microsoft 365 hardening service take?
The engagement typically runs 1 week. The plan may vary depending on your needs, so scheduling, milestones, and effort are confirmed with IT Partner during scoping and kickoff.
How is this service priced?
The service is billed at $175 per hour, and no out-of-scope work is performed without your written approval. The final budget depends on the approved scope of changes and is reported in the project closeout report.
What prerequisites are required before starting the engagement?
A Microsoft 365 subscription is required. Windows 10 or 11 Pro or Enterprise licenses and Enterprise Mobility + Security capabilities — Microsoft Entra ID and Microsoft Intune — are recommended, because managed devices and identity controls are two of the three areas the hardening plan covers. If your licensing differs, IT Partner works within the capabilities your tenant actually has and flags any control that would require additional licensing.
Will IT Partner implement security changes or only provide recommendations?
Both. IT Partner develops the prioritized plan and implements the approved built-in security tools and features. Every change goes through the plan-of-changes approval before it is applied.
Does the service include Microsoft Secure Score improvement?
Yes. IT Partner reviews your Microsoft Secure Score recommendations as part of the environment analysis and implements the approved improvement actions that are available within your licensing.
Does the service include multi-factor authentication configuration?
Yes, multi-factor authentication is one of the areas addressed during the service. The exact approach — security defaults or Conditional Access policies, depending on your licensing — is agreed in the plan of changes.
Will this engagement cause downtime or disrupt users?
Security changes such as MFA enforcement or policy adjustments can affect how users sign in and work. Any potentially user-impacting change is identified in the plan of changes and scheduled with your approval; the service itself requires no Microsoft 365 downtime.
What access does IT Partner need to perform the engagement?
An account in the required services with the rights necessary to implement the service. The exact roles are confirmed during scoping based on which Microsoft 365 workloads and security controls are in the approved plan.
What responsibilities does the client have during the service?
Coordinate internal resources and schedules, assign a dedicated point of contact, provide the information and access needed for the statement of work, coordinate outside vendors, configure network equipment such as firewalls and switches, review deliverables promptly, and request or approve change management tickets where change management is used.
What deliverables and documentation will we receive?
A prioritized security improvement plan based on Microsoft best practices, a comprehensive report, and a project closeout report with final status, evidence against acceptance criteria, outstanding issues if any, and the final budget. More extensive documentation — such as a configuration workbook or administrator runbook — is available as a separately scoped, billable item.