Skip to content

Fresh Tenant Setup

These are the steps I typically take to set up a fresh M365 E5 tenant. This is not complete. I'm documenting this (finally) as I rebuild a new test tenant.

Entra ID

Azure AD Connect

Assuming you already have a Lab Domain Controller and Server for AAD Connect.

Install AAD Connect, use Express Settings aad_connect_1

After it is finished, re-run and enable Hybrid Join

aad_connect_2 aad_connect_3

Enable Group Writeback

📘 Docs

On the AzureAD Connect server, run the following commands to enable Group Writeback in Windows PowerShell

Set-ADSyncScheduler -SyncCycleEnabled $false
Set-ADSyncAADCompanyFeature -GroupWritebackV2 $true
Set-ADSyncScheduler -SyncCycleEnabled $true
Start-ADSyncSyncCycle -PolicyType Initial

Hybrid Cloud Trust

📘 Docs

Create EntraID Kerberos Server

# Specify the on-premises Active Directory domain. A new Azure AD
# Kerberos Server object will be created in this Active Directory domain.
$domain = ""

# Enter a UPN of an Azure Active Directory global administrator
$userPrincipalName = ""

# Enter a domain administrator username and password.
$domainCred = Get-Credential

# Create the new Azure AD Kerberos Server object in Active Directory
# and then publish it to Azure Active Directory.
# Open an interactive sign-in prompt with given username to access the Azure AD.
Set-AzureADKerberosServer -Domain $domain -UserPrincipalName $userPrincipalName -DomainCredential $domainCred

# Verify server
Get-AzureADKerberosServer -Domain $domain -DomainCredential $domainCred -UserPrincipalName $userPrincipalName

Id                 : 17530
UserAccount        : CN=krbtgt_AzureAD,CN=Users,DC=contoso,DC=com
ComputerAccount    : CN=AzureADKerberos,OU=Domain Controllers,DC=contoso,DC=com
DisplayName        : krbtgt_17530
DomainDnsName      :
KeyVersion         : 27591
KeyUpdatedOn       : 10/13/2022 9:23:43 PM
KeyUpdatedFrom     :
CloudDisplayName   : krbtgt_17530
CloudDomainDnsName :
CloudId            : 17530
CloudKeyVersion    : 27591
CloudKeyUpdatedOn  : 10/13/2022 9:23:43 PM
CloudTrustDisplay  :


Identity Protection

Self Service Password Reset

[🔗 Portal]
📘 Docs

  • Enable Self service password reset
    • Target a group that excludes service accounts.

Authentication Methods

🔗 Portal
📘 Docs

User Settings

🔗 Portal

  • Toggle Off
    • Users can register Applications
    • Show keep user signed in
  • Toggle On
    • Restrict non-admin users from creating tenants
    • Restrict access to Entra ID administration portal entraid_user_settings

User Feature Settings

🔗 Portal

  • Select All for Users can use preview features for My Apps

Device Settings

Cloud LAPS

🔗 Portal
📘 Docs

  • Enable LAPS entra_device_laps

Enterprise State Roaming

🔗 Portal

  • Enable Enterprise State Roaming

Identity Protection

Multifactor authentication registration policy

  • Create a AAD group called Service Accounts, add the AzureAD Connect sync account
  • Enable the policy, targeting all users and excluding

Diagnostic Settings

🔗 Portal
📘 Docs

  • Enable all diagnostic settings to log to your Sentinel's log analytics workspace

Global Secure Access

🔗 Portal
📘 Docs

Internet Access

  1. Enable the M365 Profile
  2. Download the GSA Client and deploy to Windows devices.


Tenant Administration Settings

Defender for Endpoint Connector

🔗 Portal

  • Enable compliance policy evaluation for all platforms
  • Enable app sync
  • Enable App protection policy evaluation


Windows Automatic Enrollment

🔗 Portal

  • Set MDM and MAM user scopes to all intune_auto_enrollment

Windows Autopilot

🔗 Portal

  • Create a new Autopilot deployment profile intune_autopilot_profileintune_autopilot_profile_1

iOS Enrollment

🔗 Portal

User-driven iOS enrollment is a two step process - the push certificate and the enrollment profile.

Configure Apple MDM Push Certificate

📘 Docs

Enrollment Profile

🔗 Portal

  • Configure an enrollment profile
    • Create a profile that allows user choice of type of device (corporate vs user), target all users.
Supervised iOS Enrollment with Apple Configurator

🔗 Portal
📘 Docs There are two options for Apple Config profile - with user affinity and without. For testing, enrollment with User Affinity with the Company Portal app mimics how devices might be distributed to end users. 1. Create a new Enrollment Profile. On the settings step, select: User affinity: Enroll with User Affinity Select where users must authenticate: Company Portal 2. Export the profile you just created. Copy the URL. 3. Create a csv file with the serial numbers of iPads you wish to enroll. Serial number,device details 4. Upload the csv file in the portal under Devices. Assign the profile you just created. 5. In Apple Configurator, choose Settings -> Servers. Click + to add a server. Add the URL you copied from step 2. 6. Connect a device, and at the main screen, click Prepare. Leave the default options unchanged. 7. Choose the Intune MDM server defined in Step 5. 8. Skip Apple Business Manager sign-in if prompted. At the Organization screen select a previous org or create a new one. This is shown in the settings app in iOS. 9. Choose to generate a new supervision Identity or reuse an existing one. 10. Choose which steps to display in the Setup Assistant. Click Prepare to start the process.

Android Enrollment


User-driven Android enrollment is a two step process - the managed Google Play account linking and the enrollment profile.

Managed Google Play Account Linking


📘 Docs


Add app -> Microsoft 365 Apps for Windows 10 and Later. Assign to all devices.

intune_windows_m365_apps intune_windows_m365_apps_1

Endpoint security



Under Endpoint Detection and Response, create a new policy targeting Windows 10,11 and Server. Target all devices.




Deploying MDE on MacOS is a multi-step manual process, and changes occasionally. Refer to Intune-based deployment for Microsoft Defender for Endpoint on Mac - Microsoft Defender for Endpoint | Microsoft Learn for the most current steps.

The config files for MDE on Mac and Linux are in this GitHub repo.

  1. Approve system extensions
  2. Deploy the combined mobileconfig file from the repo to simplify policies.
  3. Deploy the Microsoft AutoUpdate config file from the repo
  4. Deploy the MDE Preferences config file from the repo to enable Endpoint DLP.
  5. Deploy the Defender App via Intune
  6. Deploy the MDE onboarding package

Security Baselines

Create a new Microsoft Defender for Endpoint Baseline policy and target all devices.


Account Protection

After enabling LAPS in Entra, create a Windows LAPS profile and apply to all devices. intune_laps_profile


M365 Defender

Email & collaboration

Policies & Rules -> Threat Policies -> Preset Security Configurations

Enable Standard Protection Preset Policies. mdo_protection_policies




In the Defender Portal, go to Settings -> Cloud Apps


Preview Features
  • Toggle Enable
IP address Ranges
  • If you have IP Ranges as Trusted Named Locations in EID, add them as Custom IP Address Ranges in MDCA with the category of Corporate mdca_ip_address_range

Cloud Discovery

Defender for Endpoint
  • Enforce App Access with Defender for Endpoint mdca_mde
User Enrichment
  • Enable User Enrichment mdca_user_enrichment

Information Protection

Microsoft Information Protection
  • Enable automatically scan new files
  • Enable scanning protected files. You'll need to go through the OAUTH grant process. mdca_mip
  • Enable file monitoring mdca_files

App governance

Service Status
  • Turn on app governance mdca_enable_app_gov

Connected Apps

App Connectors
  • Hit Connect an app, choose Microsoft 365 from the list. Select all options.


SIEM Agents

  • Add the Azure Sentinel integration


In the Defender Portal, go to Settings -> Endpoints

Advanced Features

Set the features configured below


Defender for Identity (MDI)


In the Defender Portal, go to Settings -> Identities


Click +Add Sensor, and download the installer and copy the Access key mdi_add_new_sensor

Install the sensor on all DCs in AD. Use the access key when prompted by the installer. mdi_sensor_install

After installing, configure the Active Directory requirements listed below.

AD Configuration

  • Configure Event Collection via GPO
  • Configure Group Managed Service Account account
    • On the first DC
      • Create root KDS key powershell Add-KdsRootKey -EffectiveTime ((get-date).addhours(-10))
      • Purge kerberos tickets powershell klist purge -li 0x3e7
      • Create the gMSA ``` powershell New-ADServiceAccount accountname -PrincipalsAllowedToRetrieveManagedPassword "Domain Controllers" -DNSHostName
                - Install the gMSA on the DC
                  ``` powershell
                  Install-ADServiceAccount -Identity 'accountname'
    • On the other DCs, purge kerberos tickets and install the service account
    • Add the gMSA in the portal Adding a gMSA account

Microsoft Purview

Device Onboarding


  1. Enable Windows and Mac device onboarding. This requires MDE.

Sensitivity Labels

Enable labeling for Protected content & PDFs

With the SharePoint Module in PowerShell 5

connect-sposervice -url 'https://<tenant>'
Set-SPOTenant -EnableAIPIntegration $true
Set-SPOTenant -EnableSensitivityLabelforPDF $true

Enable Labeling for Containers

In a fresh tenant, there will not be any EntraID group settings configured, so those need to be created. After that, you can enable the label sync.

With the AzureADPreview module in Windows PowerShell (PS5)

$TemplateId = (Get-AzureADDirectorySettingTemplate | where { $_.DisplayName -eq "Group.Unified" }).Id
$Template = Get-AzureADDirectorySettingTemplate | where -Property Id -Value $TemplateId -EQ
$setting = $Template.CreateDirectorySetting()
$setting["EnableMIPLabels"] = "True"
New-AzureADDirectorySetting -DirectorySetting $Setting

Then, with the ExchangeOnlineManagement module in PS5/PS7+


Enable co-authoring for Encrypted Files

This can be done in the portal, or via PowerShell.

With the ExchangeOnlineManagement module in PS5/PS7+

Set-PolicyConfig -EnableLabelCoauth:$true


Endpoint DLP


🔗 Portal 📘 Docs

In Settings, change the following: - Advanced classification scanning and protection: On

MIP Scanner

🔗 Portal 📘 Docs

Prerequisites - Service account in AD, exclude from MFA registration and CAs - SQL server for the scanner, as well as a windows server.

Deployment 1. Create a Scanner Cluster 2. Create a Content Scan Job. Be sure to disable any of the auto options - this will just be for scanning.

Exact Data Match

🔗 Portal
📘 Docs

  1. Create a new EDM SIT. Since I work in healthcare, I typically use Synthea to generate patient records. We do have sample industry files you can use.
  2. Make note of the datastrore name when you finish the EDM wizard. You'll need it for the EDM uploader.
EDM Uploader Tool
  1. Create a service account for the EDM upload agents to run as.
  2. Create a EntraID security group named EDM_DataUploaders and add the service account to it.
  3. Install the EDM upload tool to c:\EDM
  4. Place sample data in c:\EDM\Data
  5. Save the schema .\EdmUploadAgent.exe /SaveSchema /DataStoreName your_data_store_name /OutputDir c:\edm\data
  6. Create c:\EDM\hash
  7. Upload the data .\EdmUploadAgent.exe /uploaddata /datastorename your_data_store_name /datafile C:\edm\data\your_data.csv /hashlocation c:\edm\hash /schema C:\edm\data\your_data_store_name.xml /allowedbadlinespercentage 5

Insider Risk Management


🔗 Portal
📘 Docs

Add your account to the Insider Risk Management role.

Browser Activity Plugins

  1. Deploy the Edge profile via Intune as described here
  2. Deploy the Chrome profile via Intune as described here


🔗 Portal
📘 Docs

Policy Indicators
  • Select all indicators under the following categories
    • Office
    • Device
    • Microsoft Defender for Endpoint
    • Risky Browsing
    • Microsoft Defender for Cloud Apps
  • Toggle analytics on


🔗 Portal
📘 Docs

  1. Create a Data Leaks policy from the template
  2. Target all users
  3. Choose not to prioritize content.
  4. For triggering events, choose User performs an exfiltration activity
  5. For thresholds, choose Apply built-in thresholds.
  6. For indicators, leave the default ones checked.