Microsoft 365 Security Hardening — a fixed-fee accelerator from EPC Group
Last updated by Errin O'Connor, Founder & Chief AI Architect, EPC Group
- Duration
- 3–4 weeks
- Team
- Senior architect named on the Statement of Work; engagement lead where the program size warrants it.
- How it is priced
- Fixed fee, quoted after a 30-minute scoping call. EPC Group does not publish price ranges.
What it is
The hardening engagement enforces the controls Microsoft 365 already includes but most tenants leave half-configured: Conditional Access policies that match how people actually sign in, multi-factor authentication for every account including the forgotten ones, data loss prevention for the sensitive information types the organization handles, Microsoft Defender configured rather than merely licensed, and an insider-risk baseline.
Every policy is staged — report-only first, then enforced for a pilot group, then tenant-wide — so the security gain is real and the help desk is not flooded. The closing report records the posture before and after and the recommendations that need a longer programme.
Who it is for
Organizations that need immediate, measurable security improvements on Microsoft 365: after an incident, before an audit, or because the tenant grew faster than its controls.
Start here by size — Stand up the controls. Governance frameworks, security hardening and quick-starts for organizations that already run the platform and need it governed. The organizations EPC Group serves, and the ones it does not, are set out on the fit page.
Deliverables
Conditional Access policy implementation
Policies designed from sign-in logs, staged report-only before enforcement.
MFA enforcement across all users
Including break-glass and service accounts handled deliberately, not skipped.
DLP policies for sensitive data types
The information types the organization actually handles, tuned to limit false positives.
Microsoft Defender configuration
Defender for Office 365 and Endpoint policies set to the organization's risk, not the defaults.
Insider Risk Management baseline
Policies and the review workflow for the signals that matter to the business.
Security posture report and recommendations
Before/after posture with the longer-term programme items named.
What is not included
- Microsoft 365 license changes needed to unlock a control (the report names them; procurement is the organization's).
- Endpoint enrolment or device management at scale — see the Intune consulting service.
- Incident response or forensics for an active breach.
Anything outside the deliverables above is a change order under the Engagement Charter — written, priced and approved before the work starts.
When to start
- An audit or insurer questionnaire is due and the tenant's controls cannot be evidenced.
- MFA coverage is "mostly" and nobody can name the exceptions.
- Defender and Purview are licensed but still on defaults.
How it is priced
Fixed fee, quoted after a 30-minute scoping call. EPC Group does not publish price ranges. The scoping call is run by the architect who would lead the work; the fixed fee, the deliverables and the acceptance criteria are written into the Statement of Work, and the change-control, escalation and acceptance rules are the ones in the Engagement Charter.
Frequently Asked Questions
Policies run in report-only mode first and are enforced for a pilot group before the tenant; the staged rollout is the reason the engagement takes three to four weeks rather than three days.
Book the scoping call
A 30-minute call with the architect who would lead the M365 Security Hardening engagement; the fixed fee follows in writing.
Contact EPC Group