| Tenant and domains | Tenant naming, verified domains, data residency, Multi-Geo where needed, admin role model with Privileged Identity Management | Some choices (tenant name, initial domain, geography) are hard or impossible to change later |
| Identity | Entra Connect / Cloud Sync, password hash sync or pass-through authentication, federation retirement, Conditional Access, phishing-resistant MFA | Every Microsoft 365 service depends on Entra ID; weak identity design is the most common root cause of incidents |
| Messaging | Exchange Online, hybrid with Exchange Server where required, mail flow, connectors, SPF/DKIM/DMARC, Defender for Office 365 policies | Mail flow and authentication errors are what users notice first |
| Collaboration | Teams policies and provisioning, SharePoint and OneDrive sharing settings, external access, information architecture | Default sharing settings are the main source of Copilot oversharing risk |
| Endpoints | Intune, Windows Autopilot, compliance policies, app deployment, co-management with Configuration Manager | Device compliance feeds Conditional Access decisions |
| Security and compliance | Secure Score baseline, Defender XDR, Purview sensitivity labels, retention, DLP, audit | Regulated clients need evidence, not just configuration |