Practitioner Guide - 2026 Production Draft
A practitioner field guide for regulated EU operators running Microsoft 365. Maps DORA Article 9, NIS2 Article 21, ISO 27001 Annex A and CIS Microsoft 365 Foundations 6.0.1 to tenant controls, evidence and operating routines.
v1.0 production draft - last reviewed 2026-06-05
Microsoft 365 is usually the control plane for identity, email, documents, devices and collaboration. If that tenant is weak, the rest of the stack inherits the weakness.
This book turns DORA Article 9, NIS2 Article 21 and ISO 27001 Annex A into Microsoft 365 work: Conditional Access, PIM, Defender XDR, Sentinel, backup, licence evidence and audit packs.
The operator goal is simple: show the configuration, show the log, show the owner, show the rollback path. Anything else is slideware.
This guide is technical guidance, not legal advice. DORA, NIS2 and ISO 27001 mappings help you prepare evidence, but your regulator, auditor, DPO, legal counsel and sector authority decide what is sufficient.
Three governance languages point at the same operational question: can your tenant resist, detect, recover and prove control?
Score before you spend. A baseline without ownership becomes a screenshot collection.
Ship policy JSON, not screenshots. Screenshots do not roll back a lockout.
Standing global admin is not a privilege model. It is a compromise waiting for a password.
Wrong order creates blind spots. Deploy detection in a sequence the operations team can absorb.
A rule earns its place when someone knows what to do after it fires.
Recoverable is not the same thing as backed up. Retention answers policy. Backup answers recovery.
Hardening does not always mean E5. It means buying the controls you will configure and operate.
Audit readiness is the ability to answer the second question without panic.
Pick by control surface, not seat count. The right licence is the one your operators can run.
Regulation (EU) 2022/2554, Digital Operational Resilience Act
legal - accessed 2026-06-05
Directive (EU) 2022/2555, NIS2 Directive
legal - accessed 2026-06-05
CIS Microsoft 365 Foundations Benchmark 6.0.1
standard - accessed 2026-06-05
Microsoft Secure Score
vendor - accessed 2026-06-05
Microsoft Graph conditionalAccessPolicy API
vendor - accessed 2026-06-05
Microsoft Entra emergency access accounts
vendor - accessed 2026-06-05
Microsoft Entra ID Governance overview
vendor - accessed 2026-06-05
Pilot and deploy Microsoft Defender XDR
vendor - accessed 2026-06-05
One senior specialist. Zero hand-holding. Results in weeks.