Runbooks

M365 Configuration & Test Checklist — Intune · Encryption · PPPC · Defender · SSPM · Huntress

Owner Jerry Updated 2026-06-24 For Internal — engineering

M365 Configuration & Test Checklist

One scannable place to configure and test everything in Microsoft 365 for the CyberSuite stack on the internal tenant (and the template for a customer tenant via GDAP). Each section has Configure then Test with checkboxes. Deep-dive steps live in the linked runbooks; this is the do-and-verify index. Do sections in order — each gates the next.

Internal vs customer: internal tenant uses IUR licenses (Partner Success Core, internal-only). Customer tenants get the same config via GDAP + Pax8 CSP licensing. Never assign IUR to a customer.

0. Licensing & access (the gate)

Configure

Partner Success Core active → IUR: M365 Business Premium ×15, Defender Suite ×15, Entra ID P2 ×15.
Assign Business Premium + Defender Suite to your admin + a pilot user.
(Customer) GDAP grant: License Admin, User Admin, Intune Admin, Security Admin, Global Reader.

Test

Entra → Billing → Licenses shows SKUs available + assigned.
intune.microsoft.com and security.microsoft.com both load for the tenant.

1. Entra / Identity (C-04, C-05)

Configure

Break-glass FIRST: two cloud-only *.onmicrosoft.com emergency admins, long random passwords in 1Password, excluded from all Conditional Access.
MFA via Conditional Access (C-04): All users (exclude the 2 break-glass) → All cloud apps → Require MFA. Start Report-only → confirm sign-in logs → flip On.
Admins → require phishing-resistant MFA (authenticator/passkey/hardware, not SMS).
Admin separation (C-05): day-to-day on standard accounts; admin roles on separate accounts; no standing Global Admin.
Security Defaults OFF once CA covers MFA (don’t run both).

Test

Pilot user sign-in prompts for MFA; break-glass bypasses CA; sign-in logs show the policy applying.
Capture a screenshot of the CA policy + a pilot sign-in (C-04 evidence).

2. Intune / MDM (C-10 enabler + the Mac unblock)

Configure

Intune admin center → confirm MDM authority = Intune.
Windows auto-enroll: Entra → Mobility (MDM) → Microsoft Intune → MDM user scope = All (or pilot group).
Apple MDM push certificate (required for ANY Mac mgmt): Intune → Devices → Enrollment → Apple → download CSR → create at identity.apple.com with a shared company Apple ID → upload back. Calendar the annual renewal (lapse = every Mac drops off).
Enroll endpoints: Windows → Settings → Accounts → Access work or school → Entra join (auto-enrolls). Mac → install Company Portal → approve the management profile in System Settings → Device Management.

Test

Test PC appears under Devices → Windows; test Mac under Devices → macOS.
(dsregcmd /status shows AzureAdJoined=YES on the PC; profiles status -type enrollment shows MDM enrolled on the Mac.)

3. Endpoint encryption — BitLocker + FileVault (C-10)

Configure

Windows BitLocker: Intune → Endpoint security → Disk encryption → Create → Windows → BitLocker → XTS-AES 256, “store recovery key to Entra ID BEFORE enabling” = Yes → assign to pilot group.
Mac FileVault: Intune → Disk encryption → Create → macOS → FileVault → Escrow recovery key to Intune = Yes → assign to pilot group. (No-Intune Mac fallback: Mosyle free, or the Action1 RSA-escrow scripts in runbooks/action1-scripts/.)

Test (the PASS proof = key escrowed AND retrievable, not just “encryption on”)

Windows: Intune Encryption report = Encrypted; Entra → device → Recovery keys shows a BitLocker key; retrieve one to prove it. (manage-bde -status C: → Protection On, XTS-AES 256.)
Mac: fdesetup status → FileVault is On; recovery key retrievable in Intune (Devices → recovery keys); retrieve one.
Capture dated evidence: N/N encrypted by hostname + key-presence (key values redacted), keyed to CS-####.

4. ⭐ PPPC profile — makes Action1 + Huntress work on Mac (load-bearing)

macOS gates RMM/EDR agents behind TCC (Privacy); only an MDM-pushed PPPC profile pre-approves them. Configure

On an enrolled Mac, read each agent’s identity: codesign -dr - /path/to/Action1Agent and the Huntress agent → note bundle ID + designated requirement (don’t guess them).
Intune → Devices → macOS → Configuration profiles → PPPC: grant Full Disk Access = Allow to Action1 and Huntress (by bundle ID + requirement).
If either ships a system/endpoint-security extension: also push a System Extensions allow profile + (Huntress) the network/web-content-filter PPPC per its docs.
Assign to the macOS pilot group before/with the agent push.

Test

Mac → System Settings → Privacy & Security → Full Disk Access shows the agents enabled via profile (greyed/managed).
Action1 OS-patching + Huntress detection work with no manual prompt on the Mac.

5. Microsoft Defender for Endpoint (internal hardening; optional MS-native EDR)

(Huntress is the EDR at every tier; Defender for Endpoint here is internal hardening + the Huntress↔Defender telemetry integration. See sspm-defender-poc-internal-tenant.md Parts B/C.) Configure

Onboard Windows: Defender portal → Settings → Endpoints → Onboarding → deploy via Intune (or the onboarding package).
Onboard Mac: deploy the Defender for Endpoint mac agent via Intune + its PPPC/system-extension profile.

Test

Both endpoints show in security.microsoft.com → Assets → Devices as onboarded/healthy.
Run the Defender EICAR/test detection on each → alert appears.

6. SSPM — Microsoft Defender for Cloud Apps (the Sentinel deliverable)

(Sentinel tier, M365 only. See sspm-defender-poc-internal-tenant.md Part A.) Configure

security.microsoft.com → confirm Defender for Cloud Apps is provisioned (from Defender Suite / E5).
Connect the Microsoft 365 app connector (SaaS Security Posture Management).
Enable the SSPM posture recommendations for M365; review/enable the baseline policies.

Test

SSPM dashboard shows the M365 connector connected and posture recommendations populated.
Capture a screenshot of the posture score + one recommendation (Sentinel evidence).

7. Huntress (the EDR — all tiers)

(Deployed via Action1; see runbooks/action1-setup-and-deployment.md + action1-scripts/.) Configure

Get ACCT_KEY / ORG_KEY from the Huntress deploy page.
Windows: deploy the Huntress installer via Action1 (silent, keys baked) — Huntress manages built-in Defender Antivirus on Windows.
Mac: deploy the Huntress .pkg via Action1 (the validated Deploy Huntress — macOS (Bash) script, curl -fsSL). Huntress mac uses XProtect; grant the network content filter (auto-approved via the PPPC on managed Macs — §4).
(Optional) Wire the Huntress ↔ Microsoft Defender for Endpoint telemetry integration (Win + Mac).

Test

Every endpoint reports healthy in the Huntress portal (Action1 deploying it is not proof — Huntress seeing the agent is).
Mac: confirm the network content filter is approved (no lingering prompt on managed Macs).
Confirm the deploy logs are clean (the -fsSL curl fix — no false “Error” status).

8. Action1 (RMM — the endpoint-management leg, adjacent)

Configure

Agent enrolled on PC + Mac into the CS-#### group; OS-correct policy set assigned (patch SLA 7/30/60; FileVault-OFF / BitLocker-OFF alert). Test
Endpoints check in; inventory populates; a test patch installs in-window; remote connect works. (Mac limit: app + minor-OS patching only — not major OS upgrades / OS-vuln discovery → Intune/manual.)

Cross-cutting sign-off

All recovery keys (BitLocker/FileVault) escrowed and retrievable (§3) — the C-10 PASS bar.
PPPC verified so Action1 + Huntress are silent-functional on Mac (§4).
Huntress healthy in portal on every endpoint (§7).
Annual renewals calendared: Apple MDM push cert (+ ABM/ADE if used).
Evidence captured per control, keyed to CS-####, dated.

Honest limits to not overclaim: Action1 security config is via scripts, not enforced MDM profiles (enforced profiles = Intune); Action1 Mac patching excludes major-OS upgrades; Sentinel SSPM is M365-only. State these; don’t claim native coverage that isn’t there.