Microsoft Detection and Response Team (DART) AMA

Thanks for hosting the AMA, DART Team. I'd like to know, as you're wrapping up an engagement, what are the most frequent tips you find you give clients in the spirit of: "If you had done {x} before this incident, it would have been easier for us to help you recover...." I know sadly it probably isn't a true assumption, but so we get best value from your answers to this, let us assume everyone is already well on top of their game when it comes to a) making appropriate backups and keeping them out of attacker reach, and b) centralised log collection and management. If those were nailed, what else would be your top tips?