Threat Protection Engagement FY25

Engagement Overview

Here’s what you can expect from this engagement:

• Discover threats: Help the customer gain visibility into threats to their Microsoft 365 and Azure clouds and on-premises environment across email, identity, endpoints, servers and data in order to better understand, prioritize and mitigate potential cyberattack vectors.
• Understand how to mitigate threats: Help the customer understand how the included Microsoft Security products can help them mitigate and protect against the threats found during the period of this engagement.
• Discover and understand how to address vulnerabilities: Help the customer understand how to discover, prioritize and address vulnerabilities and misconfigurations across their organization.
• Define next steps: The customer will work together with the delivery resource to define a list of next steps based on their needs, objectives, and results from the Threat Protection Engagement.
• Security Strategy Documentation: Comprehensive documentation of your security strategy for key stakeholders.

Engagement Approach

The Threat Protection Engagement can be grouped into the following phases that are delivered over a 5-week period:

• Pre-engagement
  • Pre-engagement Call
  • Prepare, Send and Review the Threat Protection Engagement Questionnaire
• Readiness (Optional)
• Engagement Setup
  • Kick-off meeting
  • Define Scope
  • Change Management (Optional)
  • General Setup
  • Mandatory and Selectable Modules Configuration
• Data Collection
• Threats and Vulnerabilities Exploration
  • Threats and Vulnerabilities Exploration – Mandatory Modules and Selectable Modules
• Results Presentation
  • Results Presentation and Next Steps Discussion
• Engagement Decommissioning

In-scope activities for the Threat Protection Engagement

The standard scope of this part of the engagement includes:

• Deployment of Threat Protection Engagement Microsoft 365 trial licenses in the customer tenant.
• Configuration of following mandatory modules and each of the included products:
  • Microsoft Defender Portal
  • Microsoft Defender XDR
  • Cloud Identity Protection
    • Entra ID Protection
    • Entra Conditional Access
• Selection and configuration of at least three of following selectable modules:
  • Unified SecOps Platform
    • Microsoft Sentinel
  • Email Protection
    • Microsoft Defender for Office 365
  • Endpoint and Cloud Apps Protection
    • Microsoft Defender for Endpoint
    • Microsoft Defender for Cloud Apps
  • Microsoft Copilot for Security Demonstration
• Remediation of potential technical issues during the deployment.
• Threat exploration to discover threats actively attacking the customer.
• Vulnerabilities exploration to discover and prioritize vulnerabilities and misconfigurations.
• Mapping threats discovered to a recommended method of mitigation.
• Demonstration of how the relevant Microsoft security products work, going through key scenarios that will help land product value and key differentiators.
• Decommissioning of configuration and licenses at the end of engagement.