The Secure foundation set

If I inherited a tenant tomorrow with no Conditional Access at all, Microsoft's Secure foundation templates are where I'd start, in report-only first. This is the longer version of Sheet 10.

The eight templates

These are the eight templates Microsoft lists in the Secure foundation group as of October 2026:

1. 01Require multifactor authentication for admins
2. 02Securing security info registration
3. 03Block legacy authentication
4. 04Require multifactor authentication for admins accessing Microsoft admin portals
5. 05Require multifactor authentication for all users
6. 06Require multifactor authentication for Azure management
7. 07Require compliant or Microsoft Entra hybrid joined device or multifactor authentication for all users
8. 08Require compliant device

Before enabling any of them

• Turn off security defaults. Microsoft is explicit that organizations replacing security defaults with Conditional Access must disable them.
• Create two emergency access accounts and exclude them through a dedicated group. Templates only exclude the admin who creates the policy, so add that group to each one.
• Find out which clients still use legacy authentication before you block it. The sign-in logs will tell you.
• Leave 7 and 8 for later if device compliance isn't in place yet.

Then run each one in report-only before enforcing it. Sheet 06 covers the four stages every policy I built went through.

Which of these do you find missing most often in tenants you inherit?