Guests themselves don’t need P1 assigned, but the policy won’t do anything until the tenant has P1 active for its own members.

Enforcement is currently soft, not hard. Microsoft doesn’t technically block Conditional Access from working if you’re short on licenses — Entra ID processes connections that require multifactor authentication no matter if the account has a premium license — but Microsoft has started surfacing warnings about it: tenants are now seeing informational messages in the Entra admin center flagging that some Conditional Access policies are protecting more users than their current licensing entitlements allow, though this is not a precursor to billing and there’s no automated enforcement yet.

A lot of Microsoft 365 “security” starts with an upsell: Defender for Office 365, Entra ID P1, P2, the Worksuite. But a large share of the highest-impact hardening is already included in the subscription you pay for — it’s just switched off by default. This post is a practical, no-extra-cost checklist: what’s free, what it actually does, and the commands to verify it.

Companion reading: PowerShell + Microsoft Graph — Connection & Command Reference covers the PowerShell/Graph setup used in the verification commands below.

If your fleet is more than one machine, it’s probably more than one distro. Mine is: Ubuntu LTS boxes, Debian, Fedora, and — the interesting one — XCP-ng hypervisors. The goal is simple: one control node, a handful of playbooks, and the ability to answer two questions at any time: what updates are pending? and are these hosts fully patched?

This post builds the whole system from zero. Every file and command is copy-pasteable. The hostnames and IPs below are made up — swap in your own. At the end there’s a list of the quirks that actually cost me debugging time, so you can skip my detours.

A practical reference for connecting PowerShell to Exchange Online and Microsoft Graph from Linux (Fedora), plus the exact commands used during the SUSF admin MFA registration and legacy auth hardening project.

One-Time Setup on Fedora

Install PowerShell 7

sudo dnf install powershell

If not in Fedora’s repos, add Microsoft’s repo first:

sudo rpm --import https://packages.microsoft.com/keys/microsoft.asc
curl -sSL -o /etc/yum.repos.d/microsoft.repo https://packages.microsoft.com/config/rhel/9/prod.repo
sudo dnf install powershell

Launch PowerShell

pwsh

Trust PSGallery (First Run Only)

Set-PSRepository -Name PSGallery -InstallationPolicy Trusted

Connecting to Exchange Online

Install module (once)

Install-Module -Name ExchangeOnlineManagement -Scope CurrentUser

Connect

Import-Module ExchangeOnlineManagement
Connect-ExchangeOnline -UserPrincipalName itadmin@yourdomain.onmicrosoft.com

Uses a browser/device-code sign-in flow.

Nemo vel ad consectetur namut rutrum ex, venenatis sollicitudin urna. Aliquam erat volutpat. Integer eu ipsum sem. Ut bibendum lacus vestibulum maximus suscipit. Quisque vitae nibh iaculis neque blandit euismod.

Lorem ipsum dolor sit amet consectetur adipisicing elit. Nemo vel ad consectetur ut aperiam. Itaque eligendi natus aperiam? Excepturi repellendus consequatur quibusdam optio expedita praesentium est adipisci dolorem ut eius!

Creative Design

Nam ut rutrum ex, venenatis sollicitudin urna. Aliquam erat volutpat. Integer eu ipsum sem. Ut bibendum lacus vestibulum maximus suscipit. Quisque vitae nibh iaculis neque blandit euismod.

Nemo vel ad consectetur namut rutrum ex, venenatis sollicitudin urna. Aliquam erat volutpat. Integer eu ipsum sem. Ut bibendum lacus vestibulum maximus suscipit. Quisque vitae nibh iaculis neque blandit euismod.

Lorem ipsum dolor sit amet consectetur adipisicing elit. Nemo vel ad consectetur ut aperiam. Itaque eligendi natus aperiam? Excepturi repellendus consequatur quibusdam optio expedita praesentium est adipisci dolorem ut eius!

Creative Design

Nam ut rutrum ex, venenatis sollicitudin urna. Aliquam erat volutpat. Integer eu ipsum sem. Ut bibendum lacus vestibulum maximus suscipit. Quisque vitae nibh iaculis neque blandit euismod.

Nemo vel ad consectetur namut rutrum ex, venenatis sollicitudin urna. Aliquam erat volutpat. Integer eu ipsum sem. Ut bibendum lacus vestibulum maximus suscipit. Quisque vitae nibh iaculis neque blandit euismod.

Lorem ipsum dolor sit amet consectetur adipisicing elit. Nemo vel ad consectetur ut aperiam. Itaque eligendi natus aperiam? Excepturi repellendus consequatur quibusdam optio expedita praesentium est adipisci dolorem ut eius!

Creative Design

Nam ut rutrum ex, venenatis sollicitudin urna. Aliquam erat volutpat. Integer eu ipsum sem. Ut bibendum lacus vestibulum maximus suscipit. Quisque vitae nibh iaculis neque blandit euismod.

Nemo vel ad consectetur namut rutrum ex, venenatis sollicitudin urna. Aliquam erat volutpat. Integer eu ipsum sem. Ut bibendum lacus vestibulum maximus suscipit. Quisque vitae nibh iaculis neque blandit euismod.

Lorem ipsum dolor sit amet consectetur adipisicing elit. Nemo vel ad consectetur ut aperiam. Itaque eligendi natus aperiam? Excepturi repellendus consequatur quibusdam optio expedita praesentium est adipisci dolorem ut eius!

Creative Design

Nam ut rutrum ex, venenatis sollicitudin urna. Aliquam erat volutpat. Integer eu ipsum sem. Ut bibendum lacus vestibulum maximus suscipit. Quisque vitae nibh iaculis neque blandit euismod.

n8n Setup

Created: 2026-06-02 | Status: Running (systemd managed)

Overview

n8n workflow automation server deployed on Fedora workstation via Podman, managed by systemd for auto-start on boot.

Access

Container Details

Systemd Service

Auto-start managed by systemd service file.

Management Commands

sudo systemctl status n8n.service
sudo systemctl restart n8n.service
sudo systemctl stop n8n.service
journalctl -u n8n.service -f   # live logs

Environment Variables

Authentication

n8n v2.x uses built-in user management (no Basic Auth middleware). Create an owner account through the web UI on first login. API access requires an API key generated in Settings.