Office 365
CMMC Level 2 Guide to Entra PIM for Groups
Standing admin access is the habit I find most often in CMMC gap reviews. It feels convenient, but it creates a wide attack path and weak evidence for assessors. When…
How I Design CMMC Intune RBAC for Small Teams
Too many small defense contractors fail CMMC prep before an assessor ever looks at a control. They over-grant admin rights, blur ownership, and hope good people won’t make bad changes.…
Purview Insider Risk Setup for CMMC Level 2
A single employee can move Controlled Unclassified Information faster than most teams can detect it. That is why a solid Purview insider risk setup matters for any contractor or subcontractor…
CMMC Level 2 Safe Links and Safe Attachments Baseline
A single email click can undo months of compliance work. When I review Microsoft 365 tenants for CMMC Level 2, I often find email protection half-set, poorly scoped, or hard…
A Practical CMMC Secure Score Roadmap for Microsoft 365
Secure Score can pull a team into point chasing when what it needs is proof. I’ve seen Microsoft 365 admins raise the number, feel better for a week, and still…
Entra ID Cross-Tenant Access for CMMC Level 2
External collaboration is often the quietest hole in a CMMC boundary. A tenant-to-tenant trust that looks harmless can let weak identity assumptions cross into your environment. When I review Microsoft…
A Practical CMMC Tabletop Template for Microsoft 365 Incidents
A generic tabletop won’t help me in a CMMC assessment or during a real Microsoft 365 incident. It also won’t help when an Entra ID admin starts approving MFA prompts…
CMMC Access Packages in Entra ID for Level 2 Readiness
Access control usually breaks in ordinary moments, new hires, rushed admin requests, outside contractors, and projects that never get cleaned up. When I review CMMC Level 2 gaps, those are…
A Practical Power Apps Governance Checklist for CMMC Level 2 in Microsoft 365
A Power App can go from harmless helper to audit problem in a week. I see it happen when a team builds a quick form, connects it to live business…
CMMC Level 2 Teams External Access Policy Checklist
One open federation setting can weaken an otherwise solid CMMC boundary. I’ve seen Microsoft Teams become an untracked side door because nobody wrote down who could talk to whom, under…
Entra Connect Hardening Checklist for CMMC Level 2
One weak sync server can open a path through an otherwise solid CMMC Level 2 program. When I review hybrid identity in regulated environments, I treat Microsoft Entra Connect as…
Intune Device Cleanup Policy for Stale Endpoints in CMMC Level 2
When I review a Microsoft 365 tenant before a CMMC readiness effort, stale devices jump out fast. They fill reports with ghosts, blur asset counts, and make old access paths…