In what order should Microsoft 365 be hardened for CMMC Level 2?

Identity first, then the doors attackers use most, then devices, then data. Week 1 covers the tenant snapshot, break-glass accounts, multifactor authentication, admin roles and sign-in protections. Week 2 blocks legacy authentication and covers email protection, external sharing and app consent. Week 3 covers device compliance, configuration baselines, encryption at rest and endpoint protection. Week 4 covers sensitivity labels, data loss prevention, audit logging and alerting, then the evidence checklist and readout. A pre-flight checklist comes first.

Does hardening Microsoft 365 meet NIST SP 800-171?

No setting meets a requirement on its own. Each step supports specific NIST SP 800-171 Rev. 2 requirements (44 across the whole blueprint), but a requirement is met only when all of its assessment objectives are, usually with policy, procedure and evidence that no tenant setting provides. Some requirements, such as awareness training, incident response and physical protection, aren't touched by any tenant setting at all.

Which NIST SP 800-171 revision does this use?

Revision 2. NIST withdrew Rev. 2 on May 14, 2024 and replaced it with Rev. 3, but CMMC Level 2 is built on the 110 requirements of Rev. 2, so the IDs here use Rev. 2 numbering.

Do I need E5 to do this?

No. Most steps use features Microsoft includes in Business Premium, E3 and E5: Conditional Access needs Microsoft Entra ID P1, which is in all three. A few features need more, such as automatic sensitivity labelling and endpoint data loss prevention (E5-class licensing or a Purview add-on), and Privileged Identity Management (Entra ID P2 or Entra ID Governance). Each step's licence line says what it needs, and the Tenant Fit Check maps them to your plan.

What's in the poster and the tracker?

The A2 poster shows all four weeks on one sheet: every step, the requirements it supports, the feature, the licence and the evidence. The Excel tracker has a row per step with shaded columns for your owner, change date, approver, rollback step, evidence location and status, plus the list of requirements no tenant setting covers. Keep both in your own tenant.

What happens to my details?

The explorer runs in your browser and sends nothing. If you ask for the downloads, ForgePoint keeps your name, work email, company, platform, the suggested next step and the date in its CRM. Nothing else is stored.

Free tool · A2 poster + Excel tracker

Microsoft 365 hardening for CMMC Level 2, week by week.

Four weeks, in order: identity, then email, sharing and app consent, then devices, then data and evidence. That's 18 steps after a pre-flight checklist. Click a week, then a step, to see the Microsoft 365 feature, the NIST SP 800-171 Rev. 2 requirements it supports, the licence it needs and the evidence to keep.

Supports, never meets. Every step supports specific requirements. None of them, alone or together, means a requirement is met.

Identity first: the snapshot, break-glass accounts, multifactor authentication, admin roles and sign-in protections.

Week 1

Tenant snapshot

Snapshot: cloud, licences, admins, where CUI lives, first boundary sketch; you run ScubaGear and record Secure Score

Supports · NIST SP 800-171 Rev. 2: 3.4.1 · 3.4 Configuration Management
3.12.1 3.12.4 (input) · 3.12 Security Assessment
Microsoft 365 feature: Microsoft 365 admin center, Microsoft Secure Score, CISA ScubaGear
Licence: Any
Evidence to keep: Licence export, ScubaGear report, Secure Score snapshot

Find a requirementA requirement such as 3.5.3, or a whole family such as 3.1.

Every step supports the requirements listed. None of them, alone or together, means a requirement is met: that is decided against all of its assessment objectives, usually with policy, procedure and evidence that no setting provides.

Get the poster and the evidence tracker

An A2 poster of all four weeks for the wall by your admin, and an Excel tracker with a row per step for owner, change date, approver, rollback and evidence location. Tell us where your systems live and we'll point you to the right next step.

Where do your email, files and user accounts live?

The whole blueprint · licence facts as of Nov 4, 2026

Every step, and what it supports

The same blueprint as plain text, for reading, printing or forwarding.

Pre-flight

Your admin confirms licences, roles and feature presence a week before session 1, so gaps surface before the paid sessions.

Pre-flight checklist
Evidence: completed checklist (you keep it).

Week 1

Identity first: the snapshot, break-glass accounts, multifactor authentication, admin roles and sign-in protections.

Tenant snapshot
Supports 3.4.1, 3.12.1, 3.12.4 (input). Evidence: licence export, ScubaGear report, Secure Score snapshot.
Break-glass accounts
Supports 3.1.1, 3.1.5, 3.3.1. Evidence: break-glass procedure, last test date, alert configuration.
MFA through Conditional Access
Supports 3.5.2, 3.5.3, 3.5.4. Evidence: conditional Access policy export, authentication-methods policy, MFA registration report.
Admin roles
Supports 3.1.4, 3.1.5, 3.1.6, 3.1.7. Evidence: role-assignment export, admin account list, review record.
Sign-in protections
Supports 3.1.8, 3.1.9, 3.1.11. Evidence: settings exports, Conditional Access policy export.

Week 2

Close the doors attackers use most: legacy authentication, email threats, external sharing and app consent.

Block legacy authentication
Supports 3.5.3, 3.5.4, 3.1.1. Evidence: conditional Access policy export, sign-in log query.
Email protection
Supports 3.14.2, 3.14.4, 3.14.5, 3.14.6. Evidence: policy exports, quarantine report.
External sharing and guests
Supports 3.1.3, 3.1.20, 3.1.22. Evidence: sharing-settings export, guest inventory.
App consent
Supports 3.1.1, 3.1.2, 3.4.9. Evidence: consent settings, approved-app list.

Week 3

Devices: enrolment and compliance, configuration baselines, encryption at rest, endpoint protection and updates.

Device compliance
Supports 3.1.1, 3.1.18, 3.5.1, 3.4.1. Evidence: device inventory export, compliance policy export.
Configuration baselines
Supports 3.4.2, 3.4.6, 3.4.7, 3.4.9, 3.1.10, 3.1.9, 3.8.7, 3.1.5. Evidence: profile exports, assignment report.
Encryption at rest
Supports 3.13.16, 3.1.19. Evidence: encryption report, proof of recovery-key escrow.
Endpoint protection and updates
Supports 3.14.1, 3.14.2, 3.14.4, 3.14.5, 3.14.6, 3.14.7, 3.11.2, 3.11.3. Evidence: onboarding report, vulnerability export, update-ring report.

Week 4

Data and evidence: sensitivity labels, data loss prevention, audit logging, alerting, then the evidence checklist and readout.

Sensitivity labels
Supports 3.8.4, 3.1.3, 3.13.16. Evidence: label policy export, label usage report.
Data loss prevention
Supports 3.1.3, 3.1.22. Evidence: dLP policy export, sample incident report.
Audit logging
Supports 3.3.1, 3.3.2, 3.3.8, 3.3.9. Evidence: audit status, role-group membership, retention or export procedure.
Alerting and review
Supports 3.3.5, 3.14.6, 3.14.7. Evidence: alert policy list, review log template.
Evidence checklist and readout
Supports 3.4.3, 3.12.1, 3.12.3. Evidence: change log, evidence checklist, readout.

Not touched by hardening

No tenant setting satisfies these. They go to your assessment and your SSP.

Awareness and training (3.2)
Incident response (3.6)
Maintenance (3.7), apart from multifactor authentication for remote maintenance
Most media protection (3.8.1–3.8.3, 3.8.5, 3.8.8)
Personnel security (3.9)
Physical protection (3.10)
Risk assessment (3.11.1)
The POA&M (3.12.2) and the SSP (3.12.4) as documents
The policy and procedure objectives of every requirement

A planning aid from ForgePoint Cyber, not an assessment, an SPRS score or a determination of compliance. ForgePoint is a readiness advisor, not a C3PAO. Licence contents change; Microsoft's own pages win, and the pre-flight checklist confirms your plan.

Sources

Questions

Microsoft 365 hardening and NIST SP 800-171, answered

In what order should Microsoft 365 be hardened for CMMC Level 2?: Identity first, then the doors attackers use most, then devices, then data. Week 1 covers the tenant snapshot, break-glass accounts, multifactor authentication, admin roles and sign-in protections. Week 2 blocks legacy authentication and covers email protection, external sharing and app consent. Week 3 covers device compliance, configuration baselines, encryption at rest and endpoint protection. Week 4 covers sensitivity labels, data loss prevention, audit logging and alerting, then the evidence checklist and readout. A pre-flight checklist comes first.
Does hardening Microsoft 365 meet NIST SP 800-171?: No setting meets a requirement on its own. Each step supports specific NIST SP 800-171 Rev. 2 requirements (44 across the whole blueprint), but a requirement is met only when all of its assessment objectives are, usually with policy, procedure and evidence that no tenant setting provides. Some requirements, such as awareness training, incident response and physical protection, aren't touched by any tenant setting at all.
Which NIST SP 800-171 revision does this use?: Revision 2. NIST withdrew Rev. 2 on May 14, 2024 and replaced it with Rev. 3, but CMMC Level 2 is built on the 110 requirements of Rev. 2, so the IDs here use Rev. 2 numbering.
Do I need E5 to do this?: No. Most steps use features Microsoft includes in Business Premium, E3 and E5: Conditional Access needs Microsoft Entra ID P1, which is in all three. A few features need more, such as automatic sensitivity labelling and endpoint data loss prevention (E5-class licensing or a Purview add-on), and Privileged Identity Management (Entra ID P2 or Entra ID Governance). Each step's licence line says what it needs, and the Tenant Fit Check maps them to your plan.
What's in the poster and the tracker?: The A2 poster shows all four weeks on one sheet: every step, the requirements it supports, the feature, the licence and the evidence. The Excel tracker has a row per step with shaded columns for your owner, change date, approver, rollback step, evidence location and status, plus the list of requirements no tenant setting covers. Keep both in your own tenant.
What happens to my details?: The explorer runs in your browser and sends nothing. If you ask for the downloads, ForgePoint keeps your name, work email, company, platform, the suggested next step and the date in its CRM. Nothing else is stored.

Where it leads

Microsoft 365 Hardening

Four guided sessions in which your own admin works through this blueprint in your tenant, with ForgePoint holding no accounts and seeing no CUI. See Microsoft 365 Hardening → Want it mapped to your licence first? Run the Tenant Fit Check →