Introduction Like always, it’s great to try new things early and share feedback and feature requests with the team behind them at Microsoft before everything goes public. This time, I’ve been looking at the Live response file library in Defender for Endpoint – and it’s a very welcome addition – a new small feature! Microsoft Defender
Introduction Managing and securing your on-premises Active Directory (AD) environments has traditionally required deep expertise and direct access to domain controllers and all parts arount it. With the new Active Directory Domain Page in Microsoft Defender, that experience is now significantly streamlined – in the same place your cloud assets are (Endpoints,
Here is a very important update in the relation to the upcoming Microsoft Boot Manager updates also – and Windows itself in the April 14 updates! Microsoft also states in the release notes that this update address an issue there could set a device to enter BitLocker Recovery after Secure
Introduction Imagine this: a compromised password from a single account quietly makes its way into the hands of attackers. In minutes, what seems like a small leak can become a full-blown security incident. That’s why we built the new Password Protection experience in Microsoft Defender to help security and identity teams stop
The recent cyberattack against a major U.S. organization, now widely referred to as the Stryker attack, serves as a stark reminder that our management tools are often the most targeted assets. When an adversary compromises an endpoint management system like Microsoft Intune, they don’t just get a foothold; they get
INFO: This feature relies on the App Access Policies, which are in the process of being replaced by Role-Based Access Control (RBAC) for applications. More information will be shared in an upcoming post about RBAC for Exchange applications. This is provided for your awareness, so please review and manage it
Introduction In 2026, it’s easy to overlook the security features that have been protecting Windows devices for years. Secure Boot is one of them. Introduced with Windows 8, it changed how PCs defend themselves during startup by blocking an entire class of pre-boot attacks—before the operating system even loads. Today,
Combine the power of Entra ID Conditional Access and Defender for Cloud Apps Conditional Access policies to gain even more control over how apps in your tenant can be accessed. A common scenario would be to block access from Tor/Botnet/Anonymous Proxy networks as there’s really no use-cases for end-users to
Introduction Microsoft has begun the rollout of a new and powerful reporting capability to Windows Autopatch customers: Common Vulnerabilities and Exposures (CVE)/KB Reporting. While still in preview and it’s subject to change before GA, this feature is already proving to be one of the most valuable additions to the Autopatch reporting
Recently, I’ve assisted a customer with uplifting their security around Enterprise Applications. This is an area we see many of our customers struggle with as by default, Microsoft lets users register apps all by themselves. This leads to a sprawl of registered apps that may or may not still be
Microsoft Entra ID Privileged Identity Management (PIM) for Groups allows organizations to control and audit elevated group memberships through just-in-time access. Managing elevated permissions in Microsoft Entra ID can sometimes be tricky, especially when it comes to Privileged Identity Management (PIM) for Groups. While the Entra portal allows users to
Back in September Microsoft has recently teaset App Management Policies in Microsoft Entra ID UI, which let you set tenant-wide restrictions on how applications and service principals can be configured from the UI – for example restricting certificate lifetimes, blocking new passwords/secrets, enforcing valid URI formats, etc. (as it looks like for now
Introduction Microsoft Purview is Microsoft’s unified data governance, compliance, and risk platform. It lets you discover, classify, label, protect, retain, and monitor data across Microsoft 365, On-Premises, multicloud, and SaaS sources. It centralizes policies (like sensitivity labels) to enforce consistent security and compliance. During our Governance workshops, we initiate the
What is Azure Arc Azure Arc is a Microsoft service that extends your Azure management and governance capabilities to your resources outside of Azure, and this can include on-premises servers, virtual machines, and other cloud environments. With Azure Arc, you can centrally manage, secure, and automate workloads across hybrid and
In this small blog post, I will try to give you some insights on what Advanced hunting´s custom detection rules is – and how you can use it! Introduction Microsoft Defender XDR is a powerful security platform that uses AI, machine learning, and behavioral analytics to detect and respond to
Intro If you’re diving into Microsoft Security Copilot, one of the first things you’ll want to get right is who can do what. That’s where Role-Based Access Control (RBAC) comes in. Whether you’re working in Defender, Intune, Entra, Sentinel, or Purview, understanding and configuring RBAC is essential to ensure secure,
Intro AI, AI, AI… Yes, we’ve heard it over and over again. Get used to it! 🤣 If you work within one of these portals (Defender, Intune, Entra, Sentinel, Purview, you are the perfect candidate to continue reading. My view might differ from others, I’m not easily sold or impressed.
Managing permissions for Managed Identities in Azure/Entra ID has been a long-standing challenge. Microsoft has yet not provided a built-in interface for this, leaving administrators reliant on PowerShell to handle permissions – even if the “same” exists for App Registrations and Enterprise Applications. To bridge this gap, I developed this
After reading about cross-tenant quirks in sensitivity labels, I got curious: how are these labels stored in a .DOCX file—and can they be removed without encryption? Short answer: yes, and it’s surprisingly easy.
Managing server configurations in hybrid or on-premises environments can be challenging, with outdated tools and manual processes leading to errors and inefficiencies. This post explores how to simplify configuration management with Desired State Configuration (DSC) and Azure Automanage Machine Configuration. Ever noticed this Machine Configuration option under VMs and wondered
Introduction In case you missed the update about the new announcement Microsoft is tightening security around Azure and Microsoft admin portals, by enforcing multifactor authentication (MFA) for all interactive sign-ins. This change has sparked a lot of questions across social medias, and in this post, I aim to address these
Hey, folks! – It’s been a while since I last wrote a blog post. A lot has happened in my personal life over the past six months that is beyond my control, which has forced me to prioritize my family above everything else. But now I’m back with a backpack
It’s been almost a year since I published my original post about how to migrate BitLocker Recovery Key(s) to Azure AD (Microsoft Entra ID) using a remediation script. It didn’t take long before several companies started using it, and since then, I’ve received a few inquiries about support for multiple
Microsoft Remote Help is a powerful tool that allows users to get technical support and assistance from your company’s IT Pros without leaving the comfort of their own homes or offices. With Microsoft Remote Help, users can connect remotely to a support technician who can troubleshoot, diagnose, and solve technical
This blog post is original from my own blog, re-posted here Introduction What is a Break Glass Account? Break Glass accounts are emergency access accounts that are used to access critical systems or resources when other authentication mechanisms fail or are unavailable. In Azure AD, Break Glass accounts are used to provide emergency access to
Modern Workplace consultant and a Microsoft MVP in Windows and Devices.
Infrastructure architect with focus on Modern Workplace and Microsoft 365 security.
Cloud & security specialist with focus on Microsoft backend products and cloud technologies.
Cloud & security specialist with focus on Microsoft 365.
Cloud & Security Specialist, with a passion for all things Cybersecurity
Cloud and infrastructure security specialist with background in networking.
Infrastructure architect with focus on design, implementation, migration and consolidation.
Infrastructure consultant with focus on cloud solutions in Office365 and Azure.
Modern workplace and infrastructure architect with a focus on Microsoft 365 and security.
