Pick a mat
They're independent — start anywhere. Your answers about your environment carry across all eight, so you only describe your tenant once.
How the dojo works
Belts, not a wall of settings
Each dojo is six belts, white through black. Start with foundational controls and work towards advanced ones. Belts reflect recorded progress. Navigating to a belt never marks its controls complete.
It tells you when something isn't for you
Answer a few questions and the dojo filters itself to what you actually run. No Intune? Device controls show their deployment prerequisites and remain deferred. On Business Premium? You'll be told exactly which controls need a licence you don't have, rather than being sold one.
You walk out with a plan
Every dojo exports a deployment plan in Markdown and a script — Graph JSON, PowerShell, DNS records — for the controls in scope for your tenant. Scripts include a review stop. Check permissions, placeholders and scope before running a selected section; examples have not been executed against your tenant.
Further controls to assess
These complement the current 150 scored controls. Check support, entitlement and rollout impact for your estate; they do not add scored points.
- Restrict device-code and authentication-transfer flows — audit legitimate dependencies and exceptions first.
- Token protection — verify supported platforms, applications and licensing.
- Workload-identity Conditional Access — service-principal targeting and premium dependencies differ from user policies.
- Password protection — assess custom banned passwords and any on-premises deployment requirements.