Who can get in, from where, and what they can do.

• MFA for every user with no exceptions for directors
• Conditional Access that blocks legacy protocols and unknown countries
• Fewer than three Global Admins, each with a separate admin account
• A break glass account nobody uses
• Leavers disabled the same day with sessions revoked
• Guest access reviewed quarterly

The assessment finds the gaps with evidence. Hardening puts the policies in report only mode first, then enforces them group by group. Managed keeps them there and reviews admins monthly.