I got out of the Navy about 3 years ago. There's one guy here, Alix I believe, who's in the Army right now.
This is for your friend. I'm assuming he's pre-transition. If he has had surgery, he is absolutely disqualified under all circumstances. If he's taken hormones long enough for permanent physical changes, he may have issues getting through the initial medical screening if he can't pass easily for female. If he has a GID diagnosis but hasn't taken any concrete medical steps, he needs to deny it and hope that it doesn't come up in the background check (it probably won't).
Basic stuff: It is not OK to be trans in the military. It's not one of those things like being gay where you can't even hint at the possibility, but it is grounds for a medical discharge if you actually end up getting diagnosed with GID. It also will absolutely disqualify you from enlisting; do not answer "yes" to the trans-related questions on the security and medical questionnaires, even if they're maybe sort of true.
Stuff that will get you kicked out:
Stating to a military mental health professional or doctor that you're trans
Seeking counseling for gender issues from the military mental health system, or probably from a chaplain
Taking hormones or getting surgery
Being diagnosed with GID by a civilian doctor and then allowing the military to find out about it
Changing or trying to change your legal sex
Being openly in a relationship with a woman (prior to the actual repeal of DADT)
Stating that you're attracted to women (prior to DADT repeal)(this includes on e.g. Facebook, MySpace, etc and in your military email and any letters sent to/from a combat zone)
Stuff that will get you in trouble, and possibly get you sent for a mental health evaluation if you make a big deal out of it:
Not following the gender-specific rules for women's hair, uniforms, sleeping quarters, or bathrooms
Asking people to use male pronouns (this includes online)
Using clearly male-specific references to yourself (e.g. calling yourself a man/boy or your parents' son)(this includes online)
Being seen binding without a really good explanation of what it is that doesn't reference body dysphoria/hiding your breasts
You'll also be in trouble if the military becomes aware that you have an account on a trans support site or state anywhere online that you're trans or identify as male. Just remove pictures and identifying information, though, and you'll be fine.
Stuff that may draw attention, but probably won't get you in trouble if you can play innocent:
Changing your name, or using a masculine nickname in first-name situations (this would, however, be in the "get you in trouble" category if you're MTF)
Not being visibly attracted to men, never being in a relationship with a man (prior to DADT repeal)
Having a highly masculine short haircut, if your service doesn't explicitly prohibit it
Wearing men's clothes at most/all times when not in uniform
Attending GLBT functions, marching in Pride parades, etc
Wearing a binder that looks plausibly similar to a sports bra
Stuff that you can do without worrying about it:
Acting masculine, roughhousing, swearing, shouting, being 'one of the guys'
Offhand 'joking' mentions of how you're practically a guy or wish you were a guy
Being competitive and assertive, having all those personality traits that are discouraged in civilian women
Insisting or trying to demonstrate that there's no difference between you and the males you work with
Meeting male physical fitness standards (outside of the Marines, where even if you can do pullups you can't substitute them for the required flexed-arm hang)
Wearing the gender-neutral working uniforms whenever allowed; wearing male versions of gendered working uniforms if you can find a regulation that permits it
Refusing to wear skirted dress uniforms
For the online stuff, it's only going to come out if it's readily visible, like if someone you work with friends you on Facebook or if it comes up when you Google your name and is accompanied by a photo or identifying information that connects it to what they know about you. If you've been mostly anonymous and haven't associated your photo or other easily identifying information with your trans status anywhere, you're fine.