Tenant security monitoring

Introduction

The Microsoft tenant is an early business control plane. Tenant identity, the default onmicrosoft.com domain and core identity alerts should be understood before product delivery starts.

Knowledge scope

This is startup-specific guidance in the public playbook. It is framed around the Day Zero -> Company Ready decision point and the practical trade-offs a small company faces while moving from idea to Production.

Why it matters

Identity compromise quickly becomes business compromise. Early tenant setup should create visibility over privileged changes, suspicious sign-ins and risky users before product infrastructure exists.

How it fits the playbook

This reference supports the Day Zero -> Company Ready stage of the startup CTO playbook. It gives the public context for the decision without exposing the deeper assessment method behind the agentic operating model.

Design considerations

• Record the tenant name, default onmicrosoft.com domain and verified custom domains.
• Understand when the default domain is useful for setup, recovery or administration.
• Alert on SSO, enterprise application, Conditional Access and MFA changes.
• Detect high failed-login volume and risky users.
• Route identity alerts into a response process rather than leaving them as noise.

What good looks like

The company can explain its tenant identity surface and can detect critical identity changes or suspicious sign-in behaviour.