Skip to content

Security Hardening Recommendations

⚠ Note: These are recommendations for controls that live in your environment, not in SenseOn. SenseOn detects and responds to malicious activity, but it cannot enforce identity policy, Active Directory configuration or email filtering on your behalf. This section exists because the controls below are the ones our SOC most often finds missing or misconfigured when investigating real cases, and closing them removes whole classes of attack rather than individual alerts.

This section is deliberately narrow. It is not a general hardening baseline, and it does not try to replace CIS Benchmarks or NCSC guidance, both of which are more comprehensive and are maintained full time. What you get here instead is the subset of controls that materially changes the outcome of the incidents SenseOn actually sees, with the reasoning for each one.

Product versions, policy names and admin centre navigation change frequently, particularly in Microsoft Entra. Every recommendation links to the vendor's canonical documentation. Verify against the linked source before you deploy anything.

How to use this section

Each page is written for the person who will implement the change, and each stands alone so it can be sent as a single link. Pick the page that matches who owns the fix:

Page Owner in most organisations Covers
Identity and Access (Microsoft Entra ID) Identity or M365 administrator Conditional Access, phishing-resistant MFA, legacy authentication, privileged role management, application consent
Windows Endpoints Endpoint or desktop administrator PowerShell controls and logging, Attack Surface Reduction rules, macro and email-borne content, AutoPlay, local administrator rights, credential protection
Active Directory Infrastructure or AD administrator Administrative tiering, delegation, Kerberos and service accounts, protocol hardening, certificate services, recovery
Email and Collaboration M365 or messaging administrator Mail authentication, Defender for Office 365 policies, forwarding and exfiltration controls, legacy protocols, user reporting

The short version

If you only act on a handful of items, act on these. Each one has closed off a live attack path in cases our SOC has worked.

Priority Control Where Why it is first
1 Block legacy authentication Identity Legacy protocols cannot present an MFA challenge, so every other identity control is optional until this is closed.
2 Require MFA for all users, phishing-resistant for administrators Identity Password-only access remains the most common initial access route in the cases we escalate.
3 Remove standing local administrator rights Windows Endpoints Most endpoint malware that succeeds does so because the user could install it.
4 Enable the high-value Attack Surface Reduction rules Windows Endpoints Blocks the Office, script and email-borne execution chains that begin the majority of our malware cases.
5 Turn on PowerShell script block logging Windows Endpoints The single highest-value telemetry addition for investigation quality, and it costs nothing.
6 Disable external auto-forwarding Email and Collaboration The standard exfiltration and persistence step after a mailbox compromise.
7 Set the machine account quota to zero Active Directory A one-value change that removes a well-worn privilege escalation path.
8 Restrict user consent to applications Identity Consent phishing bypasses MFA entirely and survives a password reset.

Audit before you enforce

Every recommendation in this section can break something. The pattern used throughout, and the one we would ask you to follow, is the same ring model the firewall and browser guides use:

  1. Observe. Deploy the control in its non-enforcing state: report-only for Conditional Access, audit mode for Attack Surface Reduction and WDAC, p=none for DMARC.
  2. Measure. Leave it for at least one full business cycle, including month-end and any batch processing. A week is rarely long enough.
  3. Ring 0. Enforce for IT and security staff first. They can diagnose their own breakage.
  4. Ring 1. A representative cross-section of the business, deliberately including the awkward departments: finance, engineering, anyone with bespoke line-of-business software.
  5. Estate wide. Enforce, with a documented and tested rollback.

⚠ Always keep a way back in. Before you enforce any identity control, confirm your emergency access accounts are excluded and that you have tested signing in with one. See Emergency access accounts. More tenants are locked out by a well-intentioned Conditional Access policy than by an attacker.

How SenseOn helps you verify

Hardening is only real if you can prove it landed. SenseOn telemetry gives you a way to check the estate rather than trusting that policy applied:

  • Hunt Lab queries the raw endpoint telemetry directly, so you can confirm a control is in force across every device rather than sampling a few. The Hunt Lab Training series covers the query patterns.
  • Digital Estate shows what is actually deployed and reporting, which is usually where the gap between the intended and the real estate first appears.
  • Dashboards and Reporting track whether the case types a control was meant to address actually decline afterwards.

Individual pages include the specific checks worth running after each change.

Sources

All URLs verified on 19 August 2026.