(cross-posting from the O365 Admin Center space)
Since I don't remember seeing this document here, and the question on how to follow best practice for O365 admins is often asked, I decided to share it. It's a long read, but very comprehensive list of all the different settings, features and best practices one should know about, and use!
Securing privileged access for hybrid and cloud deployments in Azure AD
And maybe also disable legacy auth... oh wait 🙂
