Microsoft 365 · Entra · Intune · Defender

Secure by Default

An automated discovery and enforcement script that reads and configures tenant-wide settings not covered by ALSO's Microsoft Security policy templates. It helps new tenants start securely from day one and validates existing tenants before running deeper scans and configurations with our other policies.

Read the report and review all recommended actions and guidance to help establish a secure-by-default environment.

Run discovery See what it checks

# read-only discovery - nothing is changed
PS> ./scripts/Invoke-SecureByDefault.ps1
  [Compliant] UnifiedAuditLogIngestionEnabled: True
  [Drift    ] Users can register applications: currently 'Yes', should be 'No'
  [Drift    ] Email OTP: currently 'Enabled', should be 'Disabled'
  [Manual   ] Incident email notifications: Cannot be read automatically
# happy with the report? enforce step by step
PS> ./scripts/Invoke-SecureByDefault.ps1 -Mode Enforce

12guided steps

0changes in Discover mode

2break-glass accounts

Three steps

Discover

Starts with a license check to show which recommendations apply to you today, then a read-only scan of your tenant against the secure reference. Nothing is changed.

Fix

Approve each change one by one, or skip it. Every prompt shows the old and new value.

Continue with templates

Move on to deeper configuration in the ALSO Policy Templates Navigator.

See Discover in action

About a minute of your time. You are just one minute away from your discovery report.

The script reads your tenant settings and shows what needs a change

The HTML report opens automatically, grouped by category

Why Secure by Default

ALSO's JSON configuration files cover policies and baselines. Some prerequisites live outside them: tenant switches, emergency access, authentication methods, enrollment and connector state. This tool closes that gap.

🔍

Discover before enforce

Default mode is strictly read-only and produces a drift report against the reference state.

🧭

Guided step by step

Each change is explained and confirmed.

🛡️

Safe by design

Run the script from your own controlled environment, such as an admin workstation or a secured jump host. It uses your interactive Global Administrator sign-in, runs locally, and keeps reports on your machine.

What it covers

Automated where an API exists; otherwise the report links straight to the right portal blade.

📜

Unified audit log

Check and activate ingestion.

automated

👤

Entra user & guest settings

App registration, tenant creation, security groups, guest access, admin center.

automatedpartly portal

✅

Consent & admin workflow

Low-impact user consent and admin consent requests.

automated

🚨

Break-glass accounts

Two onmicrosoft.com Global Admins, security group, restricted-management administrative unit.

automated

🔑

Passkeys / FIDO2

Enable FIDO2 and review all authentication methods.

automated

📁

SharePoint & OneDrive sharing

Tenant sharing level, default link type, link expiry.

automated

💻

Intune enrollment & local admin rights

MDM auto-enrollment scope and local admin rights.

automated

📧

Defender for Office 365

Standard and Strict preset policies and their recipients.

automated

🛰️

Defender for Endpoint, Identity and Cloud Apps

Provisioning, Intune connection, connector status, alerts, Defender for Identity, app governance.

automatedguided

🔐

Conditional Access baseline

Imports ALSO's policies switched off and keeps break-glass excluded from every policy.

automated

📱

Intune policy baseline

Compliance, app protection, BitLocker, LAPS, Defender and Edge policies, imported unassigned.

automated

🗂️

Microsoft Purview checks

Sensitivity labels, label policy and data loss prevention readiness.

automatedguided

How it works

Connect

Discover

Compare the tenant with config/reference-state.json. Nothing changes.

Review

Open the HTML report; adjust the reference to fit your organization.

Enforce

Confirm each change. Re-run any time to verify compliance.

Get started

A Global Administrator account is required for all steps. On first run, approve the permission request for the “Microsoft Graph Command Line Tools” enterprise application.

# if scripts are blocked: Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass
git clone https://github.com/CoC-MS/ALSO-Microsoft-Security-SecureByDefault
cd ALSO-Microsoft-Security-SecureByDefault

# 1. discovery (read-only)
./scripts/Invoke-SecureByDefault.ps1

# 2. guided enforcement
./scripts/Invoke-SecureByDefault.ps1 -Mode Enforce

Done with the basics? Continue with deeper configuration.

Secure by Default sets the tenant-wide prerequisites. Next, use the ALSO Microsoft Security Policy Templates Navigator to choose the policy templates and configuration that fit your licenses and platforms.

Open the Navigator →