M365 Remediation Guides

One control per page: what the frameworks actually require, the exact steps, and the evidence a reviewer accepts. Written from the same rule corpus Calibrant scans with.

• Limit Global Administrators — the 2–4 band, what PIM does to the count, and the export reviewers accept

  "How many Global Administrators do you have?" looks like the easiest question on the renewal form, and it's the one where the confident answer is most often wrong. The number in your head is usuall...

• Enforce MFA with Conditional Access — coverage is the threshold, not existence

  Every renewal questionnaire asks some version of "is MFA enforced for all users?" and most tenants that answer yes are running a policy that covers some users. The framework bar is stricter: CIS M3...

• SPF, DKIM, and DMARC in Microsoft 365 — the walk to p=reject

  Most tenants published a DMARC record years ago and have sat at p=none ever since. That's the norm, not negligence: p=none is the only policy you can publish without first knowing every service tha...