# Microsoft 365 — Acquisition Readiness Brief

**Audience:** Technical due-diligence reviewers, potential acquirers, or the founder making
infrastructure investment decisions. Provides an honest assessment of the M365 posture, what
has been hardened, what gaps remain, and the single highest-leverage upgrade available.

---

## Summary

Cold Bore Ballistics operates a Microsoft 365 Business Standard tenant under
`coldboreballistics.onmicrosoft.com`, with `coldboreballisticsllc.com` as the primary
identity domain. The tenant is purpose-built for a single licensed user (the founder)
with a full org-structure scaffold (shared mailboxes, security groups, distribution
lists, departmental M365 Groups) ready for team growth. Mail authentication (SPF, DKIM,
DMARC), EOP hardening, and external sharing restrictions are scripted, repeatable, and
version-controlled in `cbb-utils/M365/`. All infrastructure automation is committed to
git — there are no hand-built resources outside of a one-time portal toggle for Security
Defaults.

**Acquisition readiness: Good baseline, one clear upgrade path before due diligence.**

---

## What Is In Place

### Identity and Access

| Control | Status |
|---|---|
| MFA for primary admin (`jschwefel@`) | Registered |
| Break-glass Global Admin (`admin@coldboreballistics.onmicrosoft.com`) | Exists; cloud-only |
| Security Defaults (enforces MFA tenant-wide) | Scripted — `enable_security_defaults.ps1` |
| Mailbox audit logging | Scripted — `enable_mailbox_audit.ps1` |
| Purview alert notifications | Scripted — `configure_alert_policies.ps1` |
| Office Message Encryption | Scripted — `enable_ome.ps1` |
| Unified audit log | Enabled by default on Business Standard |

### Mail Authentication

Per-domain mail-auth records (SPF, DKIM, DMARC, MX, autodiscover) are generated by
`generate_dns_records.ps1` and pushed to Namecheap via `namecheap_dns.sh`. The workflow is
scripted, idempotent, and uses a read-merge-write pattern that preserves existing DNS records.

| Control | Status |
|---|---|
| MX records pointing to Exchange Online | Scripted — `generate_dns_records.ps1` |
| SPF (`-all` hard fail) | Scripted — `generate_dns_records.ps1` |
| DKIM (2048-bit, per domain) | Scripted — `generate_dns_records.ps1` |
| DMARC | `p=quarantine` to start; graduate to `p=reject` after ~2 weeks |
| Autodiscover CNAME | Scripted — `generate_dns_records.ps1` |

### EOP Hardening

`harden_eop.ps1` tunes the following on the default policies:

- Anti-malware: aggressive file-type blocking + immediate quarantine
- Anti-spam: tuned bulk complaint level and spam confidence thresholds
- Anti-phishing: impersonation protection + mailbox intelligence
- Outbound spam: restricted relay to prevent tenant from being blacklisted
- Transport rule: `[EXTERNAL]` banner on all inbound mail from outside the org

### External Sharing

`sharing_policy.ps1` restricts SharePoint and OneDrive external sharing to existing guest
users only — no new anonymous links, no external invites. This matters for IP due diligence:
trade-secret materials in SharePoint cannot be accidentally shared externally via a link.

### Org Structure

9 departmental M365 Groups (`grp-*`), 36 security groups (`sg-*` — 4 cross-cutting, 12 infrastructure access, 8 CBB_Corporate content tier, 8 ScopeDOPE content tier, 4 base org), 1 distribution list (`dl-Everyone`), and 11 shared function mailboxes are provisioned. All follow a documented naming convention (`cbb-utils/M365/NAMING.md`). An acquirer's onboarding team can populate these with real staff without restructuring.

---

## What Is Not In Place (Gaps by Tier)

Business Standard ($12.50/user/mo) includes Security Defaults and Exchange Online Protection
only. The following controls are **not available** without an upgrade:

| Control | Requires | Acquisition relevance |
|---|---|---|
| Conditional Access policies (device compliance, location-based) | Business Premium / Entra ID P1 | Reduces risk exposure; buyers expect CA in any IP-sensitive company |
| Intune device management (MDM/MAM) | Business Premium | Full device lifecycle management; currently replaced by Basic Mobility & Security (limited) |
| Microsoft Defender for Office 365 — Safe Links / Safe Attachments | Business Premium | Advanced phishing/malware protection beyond EOP |
| Sensitivity labels (classify + protect documents/email) | Business Premium | Direct mapping to trade-secret protection of SPEC/engine; IP due diligence examines this |
| Data Loss Prevention (DLP) policies | Business Premium | Prevents accidental exfiltration of sensitive data; required by most enterprise compliance frameworks |
| Dynamic group membership | Business Premium | Automates group assignments as users are added; reduces admin overhead at scale |
| **Email retention policy (Purview Data Lifecycle Management)** | **Business Premium** | `INFORMATION_PROTECTION_COMPLIANCE` service plan required — not present in Business Standard (No Teams) SKU. Script `purview_retention_policy.ps1` is written and ready; run it immediately after upgrading. Target: `CBB-7yr-Email-Retention`, Exchange All, retain 7 years, no auto-delete. |

---

## Business Premium Upgrade — Recommendation

**Upgrade to Microsoft 365 Business Premium ($22/user/mo) before due diligence.**

At a single licensed user, the cost delta is $9.50/mo ($114/year). The acquisition-readiness
return on that delta is disproportionate:

1. **Sensitivity labels + DLP** — these are the controls that a technical reviewer looks for
   when a company claims trade-secret IP. The DOPE-Blend™ engine methodology lives in OneDrive.
   Without labels and DLP, there is no technical enforcement preventing that material from
   being emailed out or shared externally. Labels and DLP provide the enforcement layer that
   makes the IP-protection claim credible in due diligence.

2. **Conditional Access** — Security Defaults is an on/off control; Conditional Access is
   policy-based (require compliant device, block legacy auth, restrict by location). For a
   company with a sole founder admin, a compromised credential under Security Defaults means
   full tenant access. CA adds a meaningful additional control layer.

3. **Intune** — replaces Basic Mobility & Security with full MDM/MAM. At current team size
   this is a nice-to-have; at acquisition it signals mature device governance.

4. **Defender for Office 365** — Safe Links and Safe Attachments protect against weaponized
   documents and URLs that EOP alone does not catch. Business email compromise is the most
   common attack vector for small companies.

**Action:** Upgrade in the Microsoft 365 admin center (Billing → Purchase services → Business
Premium). All existing objects, scripts, and configurations carry over with no changes required.
Run `audit_posture.ps1` after the upgrade to verify the new controls are available.

---

## Infrastructure Reproducibility Assessment

| Criterion | Assessment |
|---|---|
| All provisioning is scripted | Yes — `cbb-utils/M365/` in git |
| Scripts are idempotent | Yes — re-running any script is safe |
| No hand-built resources | One exception: Security Defaults toggle (portal-only on Standard; CA replaces it on Premium) |
| Naming conventions documented | Yes — `NAMING.md` |
| Credential rotation procedure documented | Yes — `M365_Operating_Runbook.md` |
| Break-glass account exists | Yes |
| Audit capability | Yes — unified audit log enabled by default |

A buyer's infrastructure team can reproduce the full tenant configuration from the scripts in
`cbb-utils/M365/` and this documentation set. There is no tribal knowledge dependency.

---

## Outstanding Items Before Due Diligence

The following items should be completed before any external technical reviewer is given access:

1. **Run remaining unrun scripts** — `harden_eop.ps1`, `sharing_policy.ps1`, `exo_auto_replies.ps1`, `purview_retention_policy.ps1`, `enable_mailbox_audit.ps1`, `configure_alert_policies.ps1`, `enable_ome.ps1`, `enable_security_defaults.ps1` (see `M365_Operating_Runbook.md` for the full run order)
2. **Graduate DMARC to `p=reject`** after 2 weeks of clean aggregate reports at `dmarc@coldboreballisticsllc.com`
3. **Consider Business Premium upgrade** — highest-leverage action for IP due diligence posture
4. **Verify SendGrid domain authentication** — DNS records published 2026-06-06; trigger verification in the SendGrid console

---

## Document Control

| Field | Value |
|---|---|
| **Document owner** | `jschwefel@coldboreballisticsllc.com` |
| **Classification** | Confidential (03_-_Confidential/) |
| **Location** | `OneDrive/CBB_Corporate/03_-_Confidential/Infrastructure/M365/M365_Acquisition_Brief.md` |
| **Cross-references** | `M365_Architecture_Reference.md`; `M365_Operating_Runbook.md`; `M365_Rebuild_Guide.md` |
| **Created** | 2026-06-06 |
| **Last updated** | 2026-06-06 |
| **Next full review due** | 2027-06-06 |

---

## Revision Control Block

| Rev | Date | Changed By | Reviewed By | Approved By | Summary |
|-----|------|------------|-------------|-------------|---------|
| 0.9 | 2026-06-06 | jschwefel | — | — | Initial release |
