/tags/m365/Recent content in M365 on IT AdminHugoen-usSun, 27 Sep 2026 00:00:00 +0000/posts/post-9/Sun, 27 Sep 2026 00:00:00 +0000/posts/post-9/<p>Guests themselves don&rsquo;t need P1 assigned, but the policy won&rsquo;t do anything until the tenant has P1 active for its own members.</p> <p>Enforcement is currently soft, not hard. Microsoft doesn&rsquo;t technically block Conditional Access from working if you&rsquo;re short on licenses — Entra ID processes connections that require multifactor authentication no matter if the account has a premium license — but Microsoft has started surfacing warnings about it: tenants are now seeing informational messages in the Entra admin center flagging that some Conditional Access policies are protecting more users than their current licensing entitlements allow, though this is not a precursor to billing and there&rsquo;s no automated enforcement yet.</p>/posts/post-7/Sun, 27 Sep 2026 00:00:00 +0000/posts/post-7/<p>A lot of Microsoft 365 &ldquo;security&rdquo; starts with an upsell: Defender for Office 365, Entra ID P1, P2, the Worksuite. But a large share of the highest-impact hardening is already included in the subscription you pay for — it&rsquo;s just switched off by default. This post is a practical, no-extra-cost checklist: what&rsquo;s free, what it actually does, and the commands to verify it.</p> <p>Companion reading: <a href="/blog/post-6/">PowerShell + Microsoft Graph — Connection &amp; Command Reference</a> covers the PowerShell/Graph setup used in the verification commands below.</p>