The goal of this toolkit is to bring a Microsoft 365 tenant to Microsoft's recommended Data Security baseline — sensitivity labels, DLP, retention and audit — without surprising a single end user. Business Premium is the baseline floor, but the toolkit is license-aware: it auto-detects the tenant's licensing and applies the controls that licence actually supports. A BP tenant gets Exchange + SharePoint/OneDrive DLP and the core baseline; on an E5 / Microsoft Purview Suite tenant extra controls switch on automatically — Endpoint DLP (device copy / print / USB, in simulation) and AI governance (Copilot DLP) — while higher-SKU extras like Premium Audit and retention stay opt-in. It does that with one repeatable method: every tenant-wide control is piloted, applied idempotently, run in simulation first, and only switched to enforcement after a human passes a Day-30 promotion gate. Click any phase below to see what happens, how the app does it, the safety gate, and the rollback path.
Every change is read-modify-write: read current state, preserve other tools' settings, merge our intent. Re-running never clobbers and never double-applies.
DLP policies are created in test/simulation mode. They observe and report matches for ~30 days with zero user impact before anyone flips them to enforce.
Graph-first connect order, WAM broker, and the smallest consent scopes that satisfy the run. Read-only scopes for detection; write scopes only when a write feature is on.
Ran, skipped or failed — each step writes to a persistent HTML + JSON report. Host output disappears; the report is the audit trail and the regression guard.
One-way operations (retention delete, co-authoring) are never default-on. The safe value ships by default; the operator must consciously pass a named switch.
The method assumes a test-tenant pilot first. Tenant-wide changes can take up to 24h to propagate, so nothing reaches production users unrehearsed.