3 hour done-with-you session: enable MFA, tune spam/virus filtering, review encryption and sharing. Ends with a one-page what-we-changed summary.