One PowerShell Runbook That Stands Up an Entire M365 Business Baseline
TL;DR
- Repeating the same M365 Business setup across a customer base wastes time and invites human error, which is the case for automating it with a runbook.
- The PowerShell runbook configures an entire M365 environment in a single command, built for the M365 Business SKU.
- It provisions users, groups, and licenses, enforces MFA, sets up DLP encryption rules, AIP labels, ATP safe links and safe attachments, Intune compliance and configuration policies, and BitLocker.
- Every setting is customizable, so you can add or remove pieces and adapt the runbook into a template that fits your standards.
As the Modern Desktop takes hold, M365 Business becomes the baseline subscription for most clients, which means standing up the same set of controls over and over. That repetition is slow and it invites mistakes. The answer is automation: a PowerShell runbook that configures an entire M365 environment in a single command. It was built for the M365 Business SKU, but it is a template you can customize to match whatever standards you set.
Click here for the runbook guide (opens in new tab).
What the runbook configures
Run it once and the environment comes up with:
- All users and groups created, with licenses assigned.
- MFA for all users.
- Encryption rules set up to auto-apply for DLP.
- An Azure Information Protection label for encrypting documents and emails.
- Advanced Threat Protection policies for safe links and safe attachments.
- Microsoft Authenticator pushed out as a required app for iOS and Android devices.
- A device compliance policy for iOS, Android, and Windows.
- A device configuration policy for Windows devices to enforce BitLocker.
- Terms and conditions presented when users enroll.
- Office 365 Business pushed as a required app to Windows 10 devices, with existing ProPlus versions uninstalled.
Customize the runbook to fit your standards
The runbook is a starting point, not a fixed script.
Configure individual settings
You can customize each configuration setting if you do not want to match the default settings selected as best practices.
Add or remove pieces
Find what works best across your customer base and cut what does not.
Frequently asked questions
Which SKU is the runbook built for?
The M365 Business SKU. It can be customized to meet the requirements of whatever template you want to build.
What does the runbook configure out of the box?
Users, groups, and licenses; MFA for all users; DLP encryption rules; an Azure Information Protection label; ATP safe links and safe attachments; the Microsoft Authenticator app as required on iOS and Android; device compliance policies for iOS, Android, and Windows; a Windows BitLocker configuration policy; enrollment terms and conditions; and Office 365 Business pushed to Windows 10 devices with older ProPlus versions uninstalled.
Can I change the default settings?
Yes. You can customize each configuration setting if you do not want to match the defaults, and you can add or remove pieces of the runbook to fit your customer base.
Automating the baseline is half the job. Proving it held is the other half.
A runbook sets the baseline once. CloudCapsule rechecks MFA, DLP, ATP, Intune, and 250+ other controls across every tenant you manage in about 60 seconds each, so a setting that reverted does not go unnoticed.
Run a free scan
Written by
Nick Ross
CEO · Microsoft MVP · Founder, T-Minus 365
Nick is not just a CEO, he's a respected thought leader and influencer in the MSP space. Tens of thousands of MSPs learn through his YouTube channel, T-Minus365. Nick has been honored as a three-time Microsoft MVP for his educational content; his expertise and influence are the backbone of our mission, ensuring that you are in the best hands when it comes to security.
Nick joined Pax8 in 2017, where he would ultimately oversee product management for PSA and Microsoft integrations. Following his tenure at Pax8, Nick has continued to demonstrate his leadership prowess as an executive at various MSPs, culminating in his most recent role at Sourcepass.
Nick holds a Bachelor's Degree in Business Management from Florida State University, as well as a Minor Degree in Entrepreneurship. In his free time, Nick is an avid hiker, reader, and fitness-junkie.
