Microsoft 365 Business Powershell Runbook
Nick Ross · Updated
Uploading 52%
As we begin to move into the modern desktop environment from Microsoft, we will be relying heavily on Microsoft 365 Business for our customers baseline subscription. The process can get redundant if you are implementing many of the same practices across your customer base. We need our processes to be as automated as possible to save us time and reduce human error. For this reason I create a powershell run book that configures an entire M365 environment in a single command. This runbook was meant for the M365 Business sku but it can be customized to meet the requirements of what you want as a template
Click Here for Runbook Guide (opens in new tab)
What the runbook creates
All users and groups with assigned licenses added
MFA for all users
.
Encryption Rules Set up to auto-apply for DLP
Azure Information Protection label for encryption of documents and emails
.
Advanced Threat Protection policies set up for safe links and safe attachments
Microsoft Authenticator pushed out as a required App for iOS and Android devices
A device compliance policy for iOS, Android, and Windows
A device configuration policy for Windows Devices to have BitLocker
.
Terms and Conditions for when users enroll
Office 365 Business pushed out as a required App to window 10 devices and an uninstall of existing versions of Proplus
Customize Your Runbook and Settings
Configure Individual Settings
You will be able to customize each configuration setting if you do not want to match the default settings I have selected as best practices
Add/Remove Pieces of the Runbook
Find what works best across your customer base and cut out what doesn’t. Comment below on features you would use across your customer base
Spread the word
See how your Microsoft 365 tenant measures up in about a minute.
CloudCapsule scans 300+ security controls, shows what to fix first, and keeps watching for drift after you fix it. Whether you manage one tenant or fifty, it’s the complete Microsoft 365 security workflow.
No credit card required. Results in < 2 minutes.
Keep reading
Ditch the VPN: How Microsoft’s Global Secure Access is Changing Remote Connectivity
2025 has been a rough year for VPNs. We’ve seen breaches at major vendors, clunky user experiences, and a constant flood of helpdesk tickets from frustrated users. Yet, many businesses still rely on VPNs because their legacy line-of-business applications and on-prem file shares haven’t made the move to the cloud. But what if you could […]
Vendor Integrations will Break with GDAP
Checkout my latest article on this topic here!: Vendor Integrations Break with GDAP: The Fix! – (tminus365.com) Note This article assumes you have knowledge of GDAP (Granular Delegated Admin Privileges). If you do not, check out my article here: https://tminus365.com/granular-delegated-admin-privileges/ × Dismiss alert If you have a vendor that leverages an app registration or are […]
Leveraging PIM with GDAP
In my previous blog post, I talked about the major considerations when adding roles for GDAP relationships. In some instances, you may want to bump up security a step further and pair GDAP with PIM or privileged identity management. This would allow you to have just in time access to customer workloads for users in […]