← Home CMMC L1 M365 Hardening Playbook

MSP Technical Playbook

CMMC Level 1 — M365 Hardening & Rollout

Single-tech execution plan · Hourly estimates · Intune scoping · Phase timeline

⏱ Total estimated hours (1 tech): ~62–80 hours across all phases. Spread over 6–8 weeks for a small org (under 50 users). Larger orgs add ~15% per 25 additional users.

6-Week Rollout Timeline

Phase 1  Foundation — Week 1–2 ~18–22 hrs

Tenant assessment, MFA, Conditional Access, admin hardening, audit logging ON

Phase 2  Email & Data Controls — Week 2–3 ~12–16 hrs

Defender for Office, anti-phishing, DLP policies, SharePoint/OneDrive restrictions

Phase 3  Endpoints & Intune — Week 3–5 ~18–24 hrs

Device enrollment, compliance policies, Defender for Endpoint, BitLocker, patching baseline

Phase 4  Evidence & Attestation — Week 6 ~10–14 hrs

Screenshot evidence collection, SSP documentation, SPRS submission support

Phase 1  Foundation (Week 1–2) — ~18–22 hrs

Tenant baseline assessment

Run Microsoft Secure Score review, export current config state, document gaps vs. CMMC L1 17 practices

2–3 hrs

Entra ID / Azure AD user audit

Identify all accounts, remove stale/shared accounts, confirm no orphaned admin accounts, document user list

2–3 hrs

MFA enforcement rollout

Enable Security Defaults or Conditional Access MFA for ALL users. Communicate to staff, handle exceptions (break-glass accounts)

3–4 hrs

Conditional Access policies

Block legacy auth, require MFA for all apps, block risky sign-ins, set compliant device policy (link to Intune Phase 3)

3–4 hrs

Admin role hardening

Reduce Global Admin count to 2 max, enable PIM (Privileged Identity Management) if licensed, no admin on daily-use accounts

2 hrs

Audit logging enablement

Turn on Unified Audit Log, confirm mailbox auditing on, set retention to 90 days minimum (180 preferred), export config as evidence

1–2 hrs

Password policy hardening

Set 12-char minimum, enable Entra ID Password Protection (ban common passwords), disable password expiration if MFA is enforced (NIST best practice)

1 hr

Break-glass accounts

Create 2 emergency admin accounts, store creds in vault (IT Glue/KeePass), exclude from CA policies, monitor for use

1 hr

Phase 2  Email & Data Controls (Week 2–3) — ~12–16 hrs

Defender for Office 365 baseline

Enable Safe Links, Safe Attachments, anti-phishing policies (preset Standard or Strict). Configure via Security portal.

2–3 hrs

Anti-spam & anti-malware tuning

Review and harden default policies, enable auto-purge (ZAP), quarantine review process setup

1–2 hrs

Email authentication (SPF/DKIM/DMARC)

Verify SPF records, enable DKIM signing, set DMARC to p=quarantine minimum. Document DNS records as evidence.

2 hrs

DLP policy for FCI

Create DLP policy to detect/block FCI leaving org via email or SharePoint. Start in audit mode, flip to enforce after 1 week review.

2–3 hrs

SharePoint/OneDrive sharing lockdown

Set external sharing to Disabled or specific-people only. Restrict anonymous links. Configure org-wide defaults + site-level overrides.

2 hrs

Evidence repo setup

Create dedicated private SharePoint site for CMMC evidence. Configure permissions (MSP + Senior Official only). Set up folder structure.

1–2 hrs

Phase 3  Endpoints & Intune (Week 3–5) — ~18–24 hrs

💻 Intune Scoping for Level 1: You do NOT need to enroll every device in the building. Enroll only devices that touch FCI — laptops/desktops used for work email, file access, or contract-related communications. Personal phones, break-room kiosks, printers → out of scope unless they access FCI. When in doubt: if M365 is on it and FCI flows through it, enroll it.

Intune tenant setup & licensing check

Confirm MDM authority set to Intune, verify M365 Business Premium or Intune Plan 1 licenses assigned, set enrollment restrictions

1–2 hrs

Windows device enrollment

Enroll FCI-touching Windows devices via Autopilot, bulk enrollment, or manual Entra join. Build enrollment comms for users.

4–6 hrs

Device compliance policies

Require: OS min version, BitLocker on, Defender enabled, no jailbreak, max 3-day sign-in inactivity. Tie to Conditional Access.

2–3 hrs

BitLocker encryption enforcement

Deploy BitLocker config profile via Intune, enforce full disk encryption, escrow recovery keys to Entra ID. Verify on all enrolled devices.

2–3 hrs

Microsoft Defender for Endpoint

Onboard devices to MDE via Intune policy, confirm real-time protection ON, configure tamper protection, set up alert notifications

2–3 hrs

Windows Update / patch baseline

Create Update Ring policy: quality updates within 7 days, feature updates within 30 days. Document patching cadence as evidence.

1–2 hrs

Application control / approved apps

Deploy required apps (M365 Apps, Defender, VPN if used) via Intune. Block unauthorized software installs if possible via policy.

2 hrs

USB/removable media policy

Deploy policy to block or audit USB storage devices on FCI endpoints. Ties directly to MP.1.118 media protection practice.

1 hr

Screen lock & idle timeout

Enforce 15-min screen lock via Intune config profile. Require password/PIN to unlock. Document as AC.1.002 evidence.

1 hr

Phase 4  Evidence & Attestation (Week 6) — ~10–14 hrs

Evidence screenshot collection

Screenshot every control: Conditional Access policies, MFA report, Defender status, BitLocker compliance, DLP policies, audit log settings, patch compliance dashboard

3–4 hrs

SSP (System Security Plan) writeup

Document the in-scope environment, all 17 practices and how they're met, evidence location references. Use DoD SSP template.

3–4 hrs

POA&M for any gaps

Document any remaining NOT MET items with remediation owner, timeline, and interim compensating controls

1–2 hrs

Senior Official review session

Walk customer's affirming officer through evidence package. Answer questions. Get sign-off on accuracy before SPRS submission.

1–2 hrs

SPRS score entry

Customer's Senior Official logs into SPRS, enters score (target: 110), affirms submission. You support but do NOT submit on their behalf.

1 hr

Identity & MFA Hardening — Full Checklist

✅ Enable MFA for ALL users — no exceptions

Use Conditional Access (preferred) or Security Defaults. Every account, including service accounts where possible.

✅ Block legacy authentication protocols

IMAP, POP3, SMTP AUTH, basic auth — these bypass MFA. Block via Conditional Access. Confirm no printers/apps depend on these first.

✅ No shared accounts

Every user gets their own login. "reception@" or "shared@" mailboxes must use shared mailbox (no license, no login) not shared credentials.

✅ Privileged Identity Management (PIM)

Admins request elevation when needed, not permanently Global Admin. Requires Entra ID P2 (included in M365 Business Premium).

✅ Stale account removal

Disable accounts within 24 hrs of termination. Quarterly review of all active accounts against HR roster.

✅ Password complexity + spray protection

12-char min, Entra Smart Lockout enabled, Entra ID Password Protection deployed (blocks "Password1", "Welcome1" etc.)

✅ Sign-in risk policies

Entra ID Protection: block high-risk sign-ins, require MFA for medium-risk. Requires Entra ID P2.

Email & DLP Hardening — Full Checklist

✅ Defender for Office 365 — Safe Attachments

Scan all attachments in a detonation sandbox before delivery. Apply to all domains. Set unknown action to "Block".

✅ Defender for Office 365 — Safe Links

Rewrite all URLs, scan at click-time. Enable for email + Teams. Block "do not rewrite" list abuse.

✅ Anti-phishing — impersonation protection

Add key executives and domains to impersonation protection list. Set spoof intelligence to enabled. Use Strict preset if possible.

✅ SPF record verified

Confirm v=spf1 record in DNS includes all sending IPs/services. Hard fail (-all) preferred.

✅ DKIM signing enabled

Enable DKIM for all accepted domains in M365 Security portal. Verify CNAME records in DNS propagated.

✅ DMARC policy published

Start at p=none for visibility, move to p=quarantine within 30 days. Add rua= reporting address.

✅ DLP policy — FCI keyword detection

Create policy detecting contract numbers, FCI labels, or sensitive terms. Block external email with FCI, alert on internal oversharing.

✅ Auto-forward to external blocked

Create outbound spam policy or transport rule blocking auto-forwarding to external addresses. Common attack vector.

SharePoint, OneDrive & Data Controls

✅ Disable anonymous sharing links

Org-wide setting: Sharing → Anyone links = OFF. "Anyone with the link" must be disabled at tenant level.

✅ External sharing = Specific people only (or Off)

SharePoint admin center → Policies → Sharing. Set to "Specific people" or "Only people in your org" for max security.

✅ FCI library — restricted site

Create a dedicated SharePoint site for FCI files. Limit membership to only those who need access. No broad "Everyone" permissions.

✅ Sensitivity labels (optional but recommended)

Apply "FCI - Confidential" label to FCI documents. Label can auto-apply encryption and restrict printing/forwarding.

✅ OneDrive sync restrictions

Block sync on unmanaged/personal devices. Allow sync only from Intune-compliant or Entra-joined devices.

✅ Versioning enabled on FCI libraries

Ensure version history is on (50+ versions). This is also your ransomware recovery safety net.

✅ Evidence repo site created + locked down

Private site: CMMC evidence only. Permissions: MSP admin + customer Senior Official. No broad internal access.

Intune Scope Rule for CMMC Level 1:
Enroll only devices that access FCI — work laptops, desktops used for DoD contract work, and any mobile device with work email + access to contract files. Personal phones, shared kiosks, printers, and non-work devices are out of scope unless they touch FCI data. Document your scope decision in the SSP.

Required Intune Config Profiles & Policies

✅ Device Compliance Policy

Require: OS min version (Win 11 22H2+), BitLocker = required, Defender = required, Firewall = required, no jailbreak, secure boot on

✅ BitLocker encryption profile

Full disk encryption on OS drive, AES 256-bit, recovery key escrowed to Entra ID. Startup PIN optional but adds security.

✅ Windows Defender Antivirus profile

Real-time protection ON, tamper protection ON, cloud-delivered protection ON, automatic sample submission ON, PUA protection ON

✅ Defender for Endpoint onboarding

Deploy MDE onboarding package via Intune. Verify in MDE portal that all devices show as "Active". Set EDR in block mode.

✅ Windows Update rings

Quality/security updates: 0–7 day deferral. Feature updates: 30-day deferral. Deadline enforcement: 3 days after deferral ends.

✅ Firewall config profile

Windows Firewall ON for all profiles (Domain, Private, Public). Inbound connections blocked by default. Log dropped packets.

✅ Screen lock / idle timeout

Screen lock after 15 min inactivity, require password to unlock, enforce via Device Restrictions config profile

✅ USB/removable storage restriction

Block or audit USB mass storage. Use Device Control policy in MDE or Intune Device Restrictions profile. Maps to MP.1.118.

✅ Local admin restrictions

Remove standard users from local admin group. Use Windows LAPS (Local Admin Password Solution) for managed local admin accounts.

✅ Conditional Access — compliant device required

Require device marked "Compliant" in Intune before allowing M365 access. Blocks non-enrolled devices from accessing FCI.

License Requirements for Intune

✅ M365 Business Premium

Includes Intune, Defender for Business, Entra ID P1, Defender for Office 365 P1. Best value for SMB. ~$22/user/mo.

⚠️ M365 Business Standard or Basic

Does NOT include Intune or Defender for Endpoint. You'll need to add Intune Plan 1 (~$8/user/mo) and Defender separately.

Logging & Monitoring Checklist

✅ Unified Audit Log — ON

Purview compliance portal → Audit → confirm enabled. Captures sign-ins, file access, admin changes, mailbox events.

✅ Mailbox auditing — ON for all users

Run: Set-OrganizationConfig -AuditDisabled $false in Exchange Online PowerShell. Verify per-mailbox audit actions.

✅ Sign-in logs retained 90+ days

Default Entra sign-in logs: 30 days (P1) or 7 days (free). Export to Log Analytics or Storage Account for longer retention.

✅ Microsoft Secure Score — baseline documented

Screenshot Secure Score dashboard as evidence. Target 70%+ before attestation. Export improvement actions as your gap list.

✅ Defender for Endpoint alerts configured

Set up email notifications for high-severity alerts to MSP security mailbox. Review MDE incidents weekly at minimum.

✅ Failed login monitoring

Entra ID Protection or Smart Lockout handles automated response. Review risky users report weekly. Document review cadence in SSP.

✅ Admin activity alerts

Set alert policies for: new Global Admin added, bulk file deletion, mail forwarding rule created, suspicious sign-in. Built into Purview.

What is ITAR?

International Traffic in Arms Regulations — a U.S. government set of regulations that controls the export and import of defense-related articles, services, and technical data listed on the U.S. Munitions List (USML).

What is EAR?

Export Administration Regulations — controls export of dual-use items (commercial goods and tech that also have military applications), listed on the Commerce Control List (CCL).

ITAR / EAR vs. CMMC — How They Interact

CMMC Level 1 (FCI only)

ITAR/EAR are generally NOT triggered at this level. Basic contract delivery data (schedules, invoices, logistics) is FCI, not ITAR-controlled technical data.

CMMC Level 2 (CUI)

ITAR/EAR becomes very relevant here. CUI often includes ITAR-controlled technical data. This is where you need GCC High, strict access controls, and potentially a DDTC registration.

MSP Action Item: Ask your customer — "Does your contract involve technical drawings, specs, or data related to weapons, military platforms, or export-controlled technology?"

If YES → escalate to a legal/compliance attorney familiar with ITAR before touching that data. Do NOT store ITAR data in commercial M365 without proper controls. That is a Level 2+ conversation with GCC High.

Quick Reference

ITAR

State Dept · USML · Defense articles

→ GCC High required for storage

EAR

Commerce Dept · CCL · Dual-use tech

→ GCC or GCC High depending on sensitivity

FCI (L1)

DoD contract data · Non-classified

→ Commercial M365 ✅ (hardened)