Microsoft Ignite runs 17 to 20 November. In that one week Microsoft announces most of the year's security changes for Sentinel, Defender, Entra, Purview and Security Copilot, and the Book of News lists all of them. The teams that get value from it on day one are not the ones who read fastest. They are the ones whose tenant was already in the right starting position.

In the lab tenant (contoso.com, 200 users, Microsoft 365 E5) I found that four of the five "new" things I was excited about last year were blocked by a setting that had nothing to do with the announcement: a portal nobody had opened, an audit log that was off, a browser extension that was never deployed. This post is the five checks I now do before every Ignite, in order of how much they unblock.

TL;DR

Problem: Ignite announcements land in the Defender portal, the Purview portal and Entra.…