Your first three policies
Compliance, configuration, and a baseline. The minimum viable policy stack for a brand new tenant.
New tenant, no policies, where do you start? These three. In this order.
1. A compliance policy
Compliance is the contract that lets Conditional Access trust the device. Minimum viable compliance policy:
- OS minimum version (don't pin to "current" — pin to a real version).
- Disk encryption required (BitLocker on Windows, FileVault on macOS).
- Firewall enabled.
- No jailbroken or rooted devices.
2. A configuration profile
One Settings Catalog profile, scoped to all enrolled devices, that does the boring required things: Wi-Fi if you have one, certificate trust if you need it, and a couple of safe defaults like requiring a password to install profiles.
3. A security baseline
Microsoft's security baseline for Windows is opinionated and mostly correct. Apply it in report-only first, look at what fails, then enforce. Don't apply baselines blind — some settings break legitimate workflows in regulated industries.
Then, and only then
Wire compliance into a Conditional Access policy that requires "device must be marked compliant" for access to Microsoft 365. That's the loop closed.