DEV Community

Cover image for Before Ignite: 5 settings to check in your Microsoft 365 tenant
CD Security Lab
CD Security Lab

Posted on Originally published at gitlab.com

Before Ignite: 5 settings to check in your Microsoft 365 tenant

#microsoft #security #ignite #azure

Microsoft Ignite runs 17 to 20 November. In that one week Microsoft announces most of the year's security changes for Sentinel, Defender, Entra, Purview and Security Copilot, and the Book of News lists all of them. The teams that get value from it on day one are not the ones who read fastest. They are the ones whose tenant was already in the right starting position.

In the lab tenant (contoso.com, 200 users, Microsoft 365 E5) I found that four of the five "new" things I was excited about last year were blocked by a setting that had nothing to do with the announcement: a portal nobody had opened, an audit log that was off, a browser extension that was never deployed. This post is the five checks I now do before every Ignite, in order of how much they unblock.

TL;DR

  • Problem: Ignite announcements land in the Defender portal, the Purview portal and Entra. If your tenant still runs Sentinel from the Azure portal, has auditing off, or has no baseline Conditional Access, you cannot even try the new features, let alone use them.
  • Who it hurts: the CISO who asks "can we have this?" on 18 November and hears "in Q2"; the SOC that keeps two portals open; the IT lead who signs for E5 but has never switched on what is included.
  • Fix: five settings, all included in what you already pay for: Sentinel in the Defender portal, Conditional Access baseline with legacy authentication blocked, Purview auditing plus the browser extension, Defender attack disruption with device-group automation levels, and Security Copilot provisioned from your E5 units.
  • Cost: no new licence. Time: about half a day in the lab, most of it waiting for the audit log and the portal onboarding to finish.
  • Prove it: one screen per setting, listed in section 5, that you can screenshot for the CISO before the keynote.

Table of contents

1. The problem

Think of Ignite as the day the city opens a new tram line. The line is great, but your ticket only works if you are already registered in the new ticketing system. Microsoft's new ticketing system for security is the Defender portal (security.microsoft.com) for operations, the Purview portal for data, and Entra for identity. Everything announced in November lands in those three places first.

The lab tenant had three problems hiding behind "we have E5":

  1. The SOC still opened Microsoft Sentinel in the Azure portal. Support for that ends on 31 March 2027, and the new SOC features (integrated SOC without a workspace, the data lake, KQL over the lake in Advanced Hunting) only exist in the Defender portal.
  2. Purview auditing was never explicitly turned on, and no one had deployed the Purview browser extension. DSPM for AI, the dashboard that shows what people paste into Copilot, agents and third-party AI sites, had nothing to show.
  3. Conditional Access existed, but legacy authentication was still allowed and there was no policy for workload identities. The new agent identity templates assume that baseline.

Five settings, five doors into the Ignite features

2. Who gets hurt

Who What they lose
Organisation / CISO Pays for E5, cannot show any of the announced features before Q2; audit findings about "logging not enabled"
Users Nothing visible on the day, but every unlogged AI prompt is a data leak nobody can investigate later
IT / SOC Two portals, two sets of permissions, migration during the busy season instead of a quiet week in November
Security products Sentinel features frozen on the Azure portal path; DSPM for AI empty; Defender attack disruption not allowed to act; Security Copilot units unused and expiring monthly

3. Cost and value

Everything below is included in Microsoft 365 E5 or in a product you already run. List prices are not the point here; the point is that each setting costs you zero licence dollars and a few hours.

Setting Licence needed Lab time What it unlocks at Ignite
1. Sentinel in the Defender portal Existing Sentinel workspace (no XDR or E5 required since January 2026) 1 h plus onboarding wait Integrated SOC, data lake, Advanced Hunting over the lake, MCP tools
2. Conditional Access baseline Entra ID P1 (in E3/E5) 2 h in report-only, then enforce Agent identity policy templates, risky-agent blocking
3. Purview auditing + browser extension E5 for DSPM for AI; auditing itself on every plan 30 min plus up to 24 h for the audit log to start DSPM for AI, DLP for agents, AI prompt visibility
4. Defender attack disruption + automation levels Defender for Endpoint P2 and Defender XDR (in E5) 30 min Automatic device isolation, Defender Chat context
5. Security Copilot from E5 units M365 E5 (400 SCU per month per 1,000 licences, capped at 10,000) 15 min Phishing triage agent, Conditional Access optimisation agent, anything new in the Security Store

Compared with waiting: last year the lab waited for a migration window in February. By then the "new" features were six months old and the Azure portal deadline was ten months away. Doing the five settings before Ignite moves the whole year forward.

4. The five settings

Setting 1. Open Sentinel from the Defender portal

Where: Defender portal > System > Settings > Microsoft Sentinel > Workspaces, or the banner in the Azure Sentinel overview that says the Azure portal path is retiring.

  1. Connect the workspace law-contoso-sec as the primary workspace. The onboarding is one wizard; it does not move data.
  2. Open Investigation & response > Incidents and confirm Sentinel incidents appear next to Defender XDR incidents.
  3. Open Microsoft Sentinel > Content management and note which content hub solutions, playbooks and workbooks still need attention; a few of my older workbooks needed to be re-saved from the new portal.
  4. Give the SOC the new URL and stop sharing Azure portal links in runbooks.

Sentinel workspace onboarded to the Defender portal

Verify: Defender portal > Incidents shows the "Microsoft Sentinel" source in the Service/detection source filter.

Setting 2. Conditional Access baseline in report-only, then enforce

Where: Entra admin centre > Protection > Conditional Access > Policies.

  1. Block legacy authentication for all users (the Microsoft template of the same name). Run it in report-only for a week; the sign-in log tells you which printers and scripts still use basic auth.
  2. Require MFA for all users, excluding only the two break-glass accounts.
  3. Require MFA for admins and Block access for unknown or unsupported device platforms from the templates.
  4. Check that the workload identities and agent identities policy templates are visible in your tenant. They are the building blocks of the agent announcements; you do not have to enable them yet, but the templates should exist.

Verify: Conditional Access > Policies shows four policies with state "On" and a creation date before Ignite; sign-in logs report zero legacy authentication sign-ins for seven days.

Setting 3. Purview auditing on and the browser extension deployed

Where: Purview portal > Audit; Purview portal > DSPM for AI > Recommendations.

  1. In Audit, click Start recording user and admin activity if the banner is shown. It can take up to 24 hours before searches return results.
  2. In DSPM for AI, open the recommendations and deploy the Microsoft Purview browser extension through Intune or your browser policy. Without it, prompts typed into third-party AI sites are invisible.
  3. Turn on the one-click policy "Detect risky interactions in AI apps" so the dashboard starts filling.
  4. Check the licence: DSPM for AI needs E5 or the compliance add-on; the audit log itself is on every plan.

DSPM for AI prerequisites: audit on, extension deployed

Verify: DSPM for AI overview shows activity counts for Copilot and for "other AI apps" within 48 hours of deploying the extension.

Setting 4. Attack disruption allowed to act

Where: Defender portal > System > Settings > Endpoints > Device groups; Settings > Microsoft Defender XDR > Attack disruption.

  1. Check that attack disruption is on for the tenant and that automated responses are allowed.
  2. For each device group, set the automation level to Full - remediate threats automatically. Attack disruption only isolates devices in groups where automated response is allowed.
  3. Exclude the two domain controllers and the backup server by tag, not by switching the whole group to "no automated response".
  4. Note the exclusions in the runbook; they are the first thing an auditor asks about.

Verify: Settings > Attack disruption shows "On"; the device group table shows "Full" for every group except the named exclusions.

Setting 5. Security Copilot provisioned from your E5 units

Where: securitycopilot.microsoft.com > Owner settings > Capacity.

  1. If the tenant has Microsoft 365 E5, the included capacity (400 security compute units per month per 1,000 licences, capped at 10,000) appears without a purchase. Confirm the capacity is created and assigned to your region.
  2. Turn on the Phishing Triage Agent in Defender and the Conditional Access Optimization Agent in Entra; both are included and both show up in the Copilot owner's usage view.
  3. Set the usage alert so you know when the month's units are spent.

Verify: the Capacity page shows "Included with Microsoft 365 E5" and a non-zero monthly allowance.

5. Prove it

One screen per setting, taken before the keynote:

Setting Screen Expected
1 Defender portal > Incidents, filtered by source Microsoft Sentinel Sentinel incidents listed
2 Entra > Conditional Access > Policies Four policies On, legacy auth sign-ins = 0 for 7 days
3 Purview > DSPM for AI > Overview Activity for Copilot and other AI apps
4 Defender > Settings > Attack disruption On, automation level Full on device groups
5 Security Copilot > Capacity Included with E5, units available

Before and after: the five doors in the lab

Gotchas

  • Onboarding Sentinel to the Defender portal does not migrate Azure portal bookmarks or RBAC on the workspace. People with "Microsoft Sentinel Reader" on the workspace still need the Defender portal permission model (unified RBAC) to see the same data there.
  • "Block legacy authentication" in report-only looks clean until month end, when the finance export script runs. Keep report-only for a full billing cycle if you have batch jobs.
  • The Purview browser extension only covers managed browsers. Personal devices stay invisible; that is a policy decision, not a technical one.
  • Attack disruption is on by default in many tenants but device groups created years ago often sit on "Semi - require approval". The feature then alerts and waits.
  • Security Copilot units reset every month and do not roll over. An unused allowance is simply lost.

Checklist

  • [ ] Sentinel workspace shows in the Defender portal; SOC runbooks use the new URL
  • [ ] Conditional Access: legacy auth blocked, MFA for all users and admins, agent and workload identity templates visible
  • [ ] Purview auditing recording; browser extension deployed; DSPM for AI shows activity
  • [ ] Attack disruption on; device groups on Full automation except named exclusions
  • [ ] Security Copilot capacity visible as included with E5; two agents switched on
  • [ ] Five proof screenshots saved for the CISO

What changed recently

Checked against Microsoft Learn on 2026-10-29:

  • Sentinel: Azure portal support ends 31 March 2027; Sentinel in the Defender portal is generally available without Defender XDR or E5 (January 2026). The September 2026 updates added integrated SIEM and data lake onboarding, data lake tier table management and KQL over the lake in Advanced Hunting.
  • Defender XDR: Integrated SOC preview for E5 and E7 tenants without a Sentinel workspace (September 2026); attack disruption device isolation and Defender Chat (May 2026).
  • Entra: Agent ID is generally available, with Conditional Access templates for autonomous agents, agents acting on behalf of users, and blocking risky agent identities.
  • Purview: the new DSPM is generally available (May 2026) and unifies discovery, risk assessment, protection and remediation; DSPM for AI prerequisites still list auditing and the browser extension.
  • Security Copilot: included with Microsoft 365 E5 since November 2025 (400 SCU per month per 1,000 licences, capped at 10,000); Phishing Triage Agent preview and Conditional Access Optimization Agent GA (July 2025); Security Analyst Agent preview (April 2026).

Sources

Cheat sheet: five settings before Ignite

Thanks for reading! I'm Cuong, and on CD Security Lab I rebuild real Microsoft security cases in a safe lab and explain them simply. Follow along:

Got a question about your own tenant? Drop it in the comments.

Top comments (0)