Store your Microsoft 365 passkeys in 1Password
Check out this article via web browser: Store your Microsoft 365 passkeys in 1Password Syncable passkeys in Microsoft 365 and Entra ID are here, so...
Read Article →Search Security Blog Posts
Filter Posts
Recent Posts
Teams Messaging Gains New Protections
Teams now includes weaponized file protection and malicious URL protection to make sure that people don't share bad files or URLs in chats or chann...
Read Article →What Is Baseline Security Mode and Should You Rely on It?
Explore the new Microsoft 365 Baseline Security Mode. Learn how to enforce secure baselines, run impact simulations, and see how controls compare t...
Read Article →Autopilot Device Association
Autopilot Device Association finally gives Windows the tenant context it was missing during OOBE. With that link in place, Windows can apply OOBE s...
Read Article →Microsoft Intune Multi Admin Approval: Securing Device Actions such as Wipe, Retire and Delete
Multi Admin Approval (MAA) in Microsoft Intune is a security feature that requires a second user’s approval before critical changes can be executed...
Read Article →Automating Microsoft 365 with PowerShell December 2025 Update
The December 2025 update (version 18) of the Automating Microsoft 365 with PowerShell eBook is now available to download. Current subscribers can f...
Read Article →Defender for Endpoint - Custom Data Collection Rules
Expand the logging capability of the DFE agent using custom rules - A bit of background on this feature might be needed - and a lot of credit has t...
Read Article →Microsoft Defender for Identity Recommended Actions: Ensure that all privileged accounts have the configuration flag
Identity leverages Secure Score with twenty-seven recommended actions. In a series of blog posts, I will go through all twenty-seven recommended ac...
Read Article →How to Create an Agent Identity with Microsoft Graph PowerShell
Learn how to use Microsoft Graph PowerShell to create an Agent Identity in Microsoft Entra Agent ID from an Agent Blueprint. The post How to Create...
Read Article →KB- Windows 11 Advanced passkey settings
Check out this article via web browser: KB- Windows 11 Advanced passkey settings To whom it may concern. Since Windows 11 is capable of storing pas...
Read Article →Microsoft Defender for Identity Recommended Actions: Change password for KRBTGT account
Identity leverages Secure Score with twenty-seven recommended actions. In a series of blog posts, I will go through all twenty-seven recommended ac...
Read Article →Microsoft Defender for Identity Recommended Actions: Change password of built-in domain Administrator account
Identity leverages Secure Score with twenty-seven recommended actions. In a series of blog posts, I will go through all twenty-seven recommended ac...
Read Article →Purview Launches New DLP Policy for Copilot Prompts
A new DLP policy for Copilot prompts monitors blocked sensitive information types like credit card numbers to stop their use in Copilot prompts. Th...
Read Article →Troubleshoot configured Defender AV settings with effective settings in Defender
To ensure Microsoft Defender Antivirus (Defender AV) provides full protection and leverages all its capabilities, it must be configured with the co...
Read Article →How to Create an Agent Identity Blueprint With Graph Powershell
Learn how to create Agent Identity Blueprints and Blueprint Principals in Entra Agent ID using Microsoft Graph PowerShell. The post How to Create a...
Read Article →Intelligent Local Access Deep Dive
Global Secure Access (GSA) enforces that all client traffic is routed through the cloud before reaching the target resource via Private Network Con...
Read Article →Microsoft 365 Announcements at Ignite 2025
The Ignite 2025 keynote was a marathon 150-minute event, but some interesting Microsoft 365 announcements emerged, mostly centered on AI. Microsoft...
Read Article →Entra ID Synced Passkeys and security considerations
Introduction At Ignite 2025, Microsoft announced Entra ID would be supporting Synced Passkeys for multiple credential providers. This means users c...
Read Article →Microsoft Launches Preview of Exchange Admin API
Microsoft launched the preview of the Exchange Admin API on November 17. The new API is intended to close known feature gaps that exist in the Grap...
Read Article →What is Microsoft Entra Agent ID?
Learn about the new Agent ID (preview) functionality in Microsoft Entra as well as Agent Identities and Agent Blueprints. The post What is Microsof...
Read Article →Windows Recovery and Remediation
Wouldn’t it be nice if we finally had real controls for Quick Machine Recovery?Something that lets you trigger remediation when the device is alrea...
Read Article →PowerShell Script Support Added for Win32 Intune App Deployment
PowerShell script support has been added directly to the Intune app deployment Wizard. Learn why this is a great improvement. The post PowerShell S...
Read Article →Removing Inactive Entra ID User Accounts with PowerShell
The Entra ID Governance solution includes a workflow to detect and remove inactive user accounts. Sounds good, but the same can be done with PowerS...
Read Article →Microsoft Defender for Identity Recommended Actions: Built-in Active Directory Guest account is enabled
Identity leverages Secure Score with twenty-seven recommended actions. In a series of blog posts, I will go through all twenty-seven recommended ac...
Read Article →Copilot’s Temporary Chat
A temporary chat with Microsoft 365 Copilot is one that forgets everything discussed in the conversation once the chat is over. The idea is that by...
Read Article →Monitoring Azure Access Elevation in Entra ID
Learn how to detect when a Global Admin silently elevates their access across all Azure subscriptions using Entra ID, Log Analytics, Azure Monitor,...
Read Article →The Hidden Microsoft Entra PIM URLs Microsoft Never Documented – Even When ‘Restrict Access to Microsoft Entra Admin Center’ Is Enabled
Last Updated on November 14, 2025 by Michael Morten Sonne Introduction Many organizations are tightening there security for… The post The Hid...
Read Article →Microsoft Azure Attestation: The Next Step in Compliance
Microsoft is redefining Windows 11 compliance with Microsoft Azure Attestation (MAA). They are doing so with some new evaluation settings, such as ...
Read Article →Microsoft Makes Another Change to Teams Channel Email Storage Location
In January 2025, Microsoft changed the SharePoint folder location to store copies of the email sent to Teams channels. Apparently, this update impr...
Read Article →Why “User” Install Behavior Doesn’t Mean a User Install
This blog dives into how Intune handles MSI app deployments when you choose App Install Context: User, and why that setting doesn’t always do what ...
Read Article →Auditing Claude Usage with the Copilot Researcher Agent
The question was asked if it was possible to identify use of the Claude LLM by the Copilot Researcher Agent. Audit records often help, so that's th...
Read Article →How to Setup Synced Passkeys for Your iCloud Keychain
Learn how to opt into the public preview and setup synced Passkeys in Microsoft Entra allowing users to store Passkeys in their iCloud. The post Ho...
Read Article →New Entra Account Recovery Feature With Identity Verification
Learn about the new Account Recovery preview feature in Microsoft Entra that allows users to verify their identity during account recovery. The pos...
Read Article →A Brief History of Soft-Deleted Entra ID Groups
Entra ID has long supported soft-deleted Microsoft 365 Groups. Now support is available to list and restore soft-deleted security groups in both th...
Read Article →How to Stay up to Date With Microsoft 365 Updates
Learn how to stay up to date with constant changes to Microsoft 365 products and services and build a consistent routine. The post How to Stay up t...
Read Article →How to Use PIM with RBAC Roles: Purview, Exchange, and More
Discover how to use PIM with RBAC roles to provide just-in-time access for users. Learn setup for Purview, Exchange, and more, plus the pros, cons,...
Read Article →Teams Gains Ability to Start Chat with Email Address
A new Teams feature allows users to initiate chats with any email address. This caused some commotion in the security community, but it's not that ...
Read Article →Reporting the Use of Emojis in Teams Reactions
This article explains how to use PowerShell to extract audit data to analyze the use of emojis as Teams reactions to chat and channel messages. Thi...
Read Article →Restore Deleted Cloud Security Groups in Microsoft Entra
Learn how to restore deleted cloud security groups in Microsoft Entra using the web portal and Microsoft Graph PowerShell. The post Restore Deleted...
Read Article →Version 1.5 of the Microsoft 365 User Password and Authentication Report
The Microsoft 365 User Passwords and Authentication report now includes the last used date for authentication methods (when available). The new dat...
Read Article →WatchTra: Automated Attribute Compliance for Microsoft Entra ID
In many Microsoft Entra ID environments, the quality of user attributes remains an often underestimated factor in security and governance. WatchTra...
Read Article →Microsoft 365 Companion Apps Fail to Impress
Microsoft 365 Companion Apps are being deployed to Windows 11 PCs now. The apps don't seem to add much if any value over standard Microsoft 365 app...
Read Article →Microsoft Won’t Dump Outlook for a New AI Client
A recent report says that new Microsoft leadership wants to reimagine Outlook with lots of many AI features to make the client much more of an effe...
Read Article →Secure access to Azure VM´s with Bastion and Phising Resistant MFA
This blog explains how Azure Bastion enables secure access to virtual machines without exposing public endpoints, leveraging hub-spoke architecture...
Read Article →2025 Microsoft Defender Optimization & Configuration Cheat Sheet
With just 2 remaining months in 2025, it is a good idea to check the Microsoft Defender environment and check of new features are correctly configu...
Read Article →How to Export Microsoft Purview Permissions (RBAC Roles) Easily
I was recently asked if I knew a way to export Microsoft Purview RBAC roles with members. I couldn’t find a ready solution, so I wrote a PowerShell...
Read Article →Mastering Microsoft Entra Authentication Contexts - Part 4: Monitoring and Reporting with KQL & M365IdentityPosture
We’ve covered what Authentication Contexts are, why they matter, and how they help us strengthen access and data security in Microsoft 365. Now it’...
Read Article →Office 365 for IT Pros November 2025 Update
The Office 365 for IT Pros Team is happy to announce the availability of the November 2025 update. Subscribers can download the PDF and EPUB files ...
Read Article →Microsoft Defender for Identity Recommended Actions: GPO can be modified by unprivileged accounts
Identity leverages Secure Score with twenty-seven recommended actions. In a series of blog posts, I will go through all twenty-seven recommended ac...
Read Article →Microsoft Issues Updated Guidance for Defender for Office 365 Licensing
Some inconsistencies in the MDO P2 service description and licensing terms exposed a need for tenants to license every user and shared mailboxes. M...
Read Article →How to Find Inactive Authentication Methods in Microsoft Entra
Learn how to find all inactive authentication methods registered to users in Microsoft Entra using Microsoft Graph PowerShell. The post How to Find...
Read Article →Using the SharePoint Site Attestation Policy
The site attestation policy is designed to require site owners to make a positive statement that the settings of their site, including its current ...
Read Article →Conditional Access Cloud Apps: Why Your App Doesn’t Show Up and the Risks of Exclusions
In-depth exploration of why certain apps do not appear in the Conditional Access app picker in Microsoft Entra ID, the impact of public vs. confide...
Read Article →Bringing Order to Microsoft’s Fast‑Moving Copilot Rollout in Microsoft 365
The rapid and widespread rollout of Microsoft 365 Copilot has created a governance challenge for organizations. Features are often enabled before c...
Read Article →Modernizing Sensitivity Label Grouping for App Display
Microsoft announced the modernization of grouping for sensitivity labels to a new "dynamic architecture." It doesn't take much to be more dynamic t...
Read Article →Auto-Updating Teams Work Location is Not Employee Monitoring
As is the way of the internet, the news that a feature to automatically set the Teams work location for users created a huge fuss about the prospec...
Read Article →Governing access to app stores in Microsoft 365 apps
Introduction Within Microsoft 365, users can extend app functionality directly from built‑in app stores. Outlook add‑ins, Teams apps, and Office ex...
Read Article →KB – Enable Single Sign On for Windows 365 Cloud PC
Check out this article via web browser: KB – Enable Single Sign On for Windows 365 Cloud PC This short tutorial explains how to enable Single...
Read Article →How to Use Managed Identity for Multi-Tenant Microsoft Teams Authentication
Learn how to connect to Microsoft Teams across tenants using a multi-tenant enterprise application and managed identities in Azure. The post How to...
Read Article →Stealing Access Token Secrets from Teams is Hard Unless a Workstation is Compromised
Teams stores information in a local state file, including encrypted access tokens. A report from a French company explained how to extract and use ...
Read Article →Dynamic Conditional Access policies using custom security attributes
Check out this article via web browser: Dynamic Conditional Access policies using custom security attributes Conditional Access policies can become...
Read Article →Disable Entra Connect Seamless SSO – Step-by-Step Guide
Seamless Single Sign-On (Seamless SSO) is an optional feature in Microsoft Entra Connect that enables domain-joined Windows devices on the internal...
Read Article →How to Find All Gallery Applications in Microsoft Entra
Learn to filter Microsoft Entra Enterprise Applications with Graph PowerShell. Find apps based on creation method, like first-party, third-party, o...
Read Article →Allowing Users to Add Enterprise Apps to Entra ID is a Bad Idea
Enterprise apps can come from a variety of sources. Most are Microsoft 1st party apps, and the rest are ISV apps. It's easy to add an app without r...
Read Article →Configure Browser Policy to Preserve OneDrive and SharePoint Web Performance and Offline Capability needed for upcoming Chromium versions
Introduction Modern collaboration tools such as OneDrive and SharePoint depend on efficient browser communication to deliver both online and offlin...
Read Article →HP OneAgent Update Broke Entra Trust on HP AI Devices
This blog reveals how a silent HP OneAgent update (version 1.2.50.9581) deleted the MS-Organization-Access certificate, causing devices to disconne...
Read Article →Updating the Entra ID Password Protection Policy with the Microsoft Graph PowerShell SDK
The Entra ID password protection policy contains settings that affect how tenants deal with passwords. Entra ID includes a default policy that does...
Read Article →Important Change Coming for Entra ID Passkeys in November 2025
Entra ID is about to introduce passkey profiles, a more granular approach to passkey settings. The change is good, but you might like to check the ...
Read Article →MMP-C: The Future of Windows Device Management with Intune
For years, Intune has managed Windows devices through OMA-DM (Open Mobile Alliance Device Management). It worked, but as explained in our previous ...
Read Article →Remotely Intune wipe devices in Defender for Endpoint isolation mode!
Intro Microsoft recently announced that device isolation exclusions in Defender for Endpoint are now generally available. This made me think about ...
Read Article →Automating Microsoft 365 with PowerShell November 2025 Update
The November 2025 update for the Automating Microsoft 365 with PowerShell eBook is available online. Subscribers can download the new PDF and EPUB ...
Read Article →How to Hide Enterprise Apps from Entra with Non-privileged Access
Learn how a non-privileged owner can 'steal' an Access Token from the Entra admin centre to programmatically hide a Service Principal using the Mic...
Read Article →Physical Security Cards: Phish-Resistant Authentication
Explore how physical security cards combine passwordless login and building access, offering secure, simple authentication for modern workplaces.
Read Article →A public bug report for Entra ID application policies
Check out this article via web browser: A public bug report for Entra ID application policies I’ve spent the last couple of nights trying out...
Read Article →Balancing Control and Convenience: Preventing Edge Password Sync on Unmanaged Devices
Introduction Password managers have become a default convenience in modern browsers, including Microsoft Edge. Microsoft now recommends enabling th...
Read Article →Mastering Microsoft Entra Authentication Contexts - Part 3: Advanced Data Protection
With identities and access strengthened in part 2 , it’s time to turn our focus to real-world data protection with Authentication Contexts. One of ...
Read Article →New Audio-Only Recording Option for Teams Meetings
A new audio-only recording option for Teams meeting suppresses the video feed from meeting participants when generating the MP4 file for the meetin...
Read Article →The History of Intune: From OMA DM to Modern Windows Management
In this blog, we go back in time and look at how Windows device management really started.How Microsoft built the first framework for managing devi...
Read Article →A closer look at Entra Application policies to govern secrets and certificates
Check out this article via web browser: A closer look at Entra Application policies to govern secrets and certificates My latest post on this topic...
Read Article →Conditional Access Baseline October 2025 (v2025-10) Available on GitHub
Over the past years, I’ve been maintaining a Conditional Access baseline that organizations can use as a starting point when implementing or review...
Read Article →Extending the Migrate2GSA PowerShell Module – Why I added JSON support
Last Updated on October 20, 2025 by Michael Morten Sonne Introduction Over the last few days, I spent… The post Extending the Migrate2GSA Pow...
Read Article →Outlook Gets AI Drafting of Meeting Agendas
Agenda auto-draft is a new feature for OWA and the new Outlook to help meeting organizers create a draft meeting agenda using AI. The Copilot-gener...
Read Article →Using the Secret Management PowerShell Module with Azure Key Vault and Azure Automation
If you can't use managed identities, credential resources are a way to manage username and password credentials for Azure Automation runbooks. The ...
Read Article →The My Sign-Ins Portal, Applications, and Conditional Access
A recent change has exposed the applications used by the My Sign-ins portal for use in conditional access policies. This article discusses the app-...
Read Article →Changing the Offline Access Period for Sensitivity Labels
One of the settings for sensitivity labels governs how long items protected by a label remain accessible (including offline access) before reauthen...
Read Article →Conditional Access Essentials: From Report-Only to Enforced Mode
Moving Conditional Access policies from report-only to enforced mode can secure your environment - or lock everyone out. This post walks through sa...
Read Article →Mastering Certificate Rotation in Entra ID
Recently I posted a blog about Entra ID Application Registration secret management, in which I explained how to rotate Application Registration sec...
Read Article →Windows Finally Translates Entra Group and Role SIDs to Real Names
This blog covers one of the most requested features ever: finally being able to automatically translate Entra group SIDs into readable names on the...
Read Article →ChatGPT Enterprise Connects to SharePoint Online
OpenAI has launched a ChatGPT enterprise SharePoint Connector that allows organizations to synchronize files from SharePoint Online to ChatGPT. I c...
Read Article →Microsoft Privileged Access Workstations: A Comprehensive Guide
Copyright © 2025 Microsoft Security - All Rights Reserved.
Read Article →Configuring Conditional Access for Guest Users: Allowing Only Office 365 and Essential Apps
Introduction Configuring Conditional Access (CA) for guest users can be challenging when you want to strictly limit access to Office 365 and a few ...
Read Article →MSRC Case: When Temporary Global Admin Rights Don’t Expire in Microsoft Entra PIM
A confirmed and fixed Microsoft Entra PIM flaw reported to MSRC - learn what happened, how it was fixed, and what admins should check.
Read Article →Defender XDR VS Microsoft Sentinel table changes
Introduction When connecting Microsoft Sentinel to Defender XDR, there are a couple of changes happening in tables which you should be aware of. Ev...
Read Article →KB – Failed to verify domain name – Entra ID
Check out this article via web browser: KB – Failed to verify domain name – Entra ID This is a knowledge base item. Hope it will help y...
Read Article →Trigger Logic App on group membership changes in Entra ID
Check out this article via web browser: Trigger Logic App on group membership changes in Entra ID A couple of years ago, I stumbled upon a neat Log...
Read Article →Microsoft 365 Copilot Usage Report API General Availability
The Copilot usage report Graph API is now generally available. Like the report APIs for the other workloads, the Copilot usage API helps to underst...
Read Article →Practical Detection Engineering
A look at detection engineering from inception to completion - The concept of this blogpost is quite simple - we will start with an imaginary compa...
Read Article →Exchange 2016 and 2019 End of Life and Some Interesting Exchange Online Developments
On Oct 14, 2025, Exchange 2019 and 2016 reach end-of-life and Exchange SE becomes the only supported on-premises Exchange server. In other news, we...
Read Article →Teams Support for Emojis in Chat and Channels Section Names
Teams users can use emojis to create or rename chat section names. By incorporating emojis into section names, users create "visual anchors" to hel...
Read Article →Chromium 141 Update Will Affect Offline Access for SharePoint Online and OneDrive for Business
An update for Chromium 141 can affect the ability of SharePoint Online and OneDrive for Business to access offline content, including files and lis...
Read Article →Conditional Access Essentials: Custom Security Attributes in Entra ID and Cross Tenant Scenarios
Learn how to use custom security attributes in Entra ID to target apps that don’t appear in Conditional Access. This step-by-step guide covers attr...
Read Article →The Truth About the 8-Hour Intune Sync (and Why It’s a Myth)
This blog will address one of the biggest misunderstandings I hear regarding Intune: the misconception that Windows devices ONLY receive new polici...
Read Article →Application Registration secrets: fire & forget!
Application Registrations are an amazing feature within Entra ID, allowing you to deploy a non-personal identity for a wide array of different use-...
Read Article →How to restore deleted Entra ID Conditional Access policies and Named Locations
Check out this article via web browser: How to restore deleted Entra ID Conditional Access policies and Named Locations Entra ID Conditional Access...
Read Article →What’s the Best Way to Find SharePoint Online Sites with Graph PowerShell?
What's the best way to find SharePoint sites with the Microsoft Graph PowerShell SDK? Is the Get-MgAllSite cmdlet best or should you use the Get-Mg...
Read Article →Entra ID – Soft-delete & Restore for Conditional Access + New PowerShell Module
Last Updated on October 4, 2025 by Michael Morten Sonne Introduction Microsoft continues to improve Entra’s resilience features… The post Ent...
Read Article →Microsoft Defender for Endpoint: Getting Started with Deployment Using Intune
Devices today are diverse, mobile and therefore exposed to a wide range of threats. Traditional antivirus solutions detect known patterns but leave...
Read Article →Microsoft Introduces Restore Capability for Conditional Access Policies
New Graph APIs allow Entra administrators to restore a conditional access policy with a Graph request. This article explains how to list, restore, ...
Read Article →Autopilot Device Preparation and the Return of OOBE Controls
Hidden Device Preparation template enables OOBE controls in AP DP. Naming at OOBE, skip EULA, skip keyboard, hide privacy. Works through device ass...
Read Article →How to Convert a Synced User Source of Authority to Microsoft Entra
Learn how to convert the Source of Authority for a hybrid user from Active Directory to Microsoft Entra using PowerShell. The post How to Convert a...
Read Article →Teams Stamps External Users with Trust Indicators
Attackers might attempt to use social engineering to trick Teams users in compromise. Trusted indicators help users understand the status of extern...
Read Article →Important changes to HybridBrothers.com
What is changing As a valued member of our community, we would like to inform you that we are migrating our HybridBrothers.com blogging website to ...
Read Article →Office 365 for IT Pros October 2025 Update
Monthly update #124 for the Office 365 for IT Pros (2026 edition) eBook is now available. Current subscribers can download the updated PDF and EPUB...
Read Article →January 2026 Change for How Outlook Extracts Events from Email
The Outlook events from email feature changes from January 31, 2026. Events will only be created if notifications support the properties for events...
Read Article →Why Do Required Apps Wait 60 Minutes After Autopilot Enrollment?
This blog is about the 60-minute delay that occurs before the required Win32 apps are installed after Autopilot. ESP blocking apps complete without...
Read Article →How to Restore Deleted Conditional Access Policies
Learn how to restore deleted Conditional Access policies in Microsoft Entra using Microsoft Graph PowerShell. The post How to Restore Deleted Condi...
Read Article →Mastering Microsoft Entra Authentication Contexts – Part 2: Real-World Access & Action Controls
In Part 1 of this mini-series, we explored the what, why, and how of Microsoft Entra Authentication Contexts, laying the foundation for what they a...
Read Article →The ultimate Defender XDR RBAC visualization
Do you also struggle, like I do, to assign the correct permissions in Microsoft Defender XDR RBAC when designing your RBAC model? I recently create...
Read Article →Using the Enterprise Website Microsoft 365 Copilot Connector
Microsoft 365 Copilot Search can be extended by ingesting information from external sources through a Microsoft 365 Copilot Connector. In this arti...
Read Article →How to Configure Lifecycle Workflows for Inactive Users
Learn how to configure Microsoft Entra Life Cycle workflows to alert on and clean-up inactive users in Microsoft Entra. The post How to Configure L...
Read Article →Microsoft Use of Anthropic AI Models Creates Concerns for Tenants
On September 24, Microsoft announced that Anthrophic LLMs could be used with the Copilot Researcher agent and to build agents with Copilot Studio. ...
Read Article →SharePoint Knowledge Agent Available in Preview
With not a little hype, Microsoft launched the SharePoint Knowledge Agent on September 18. Getting some AI help to organize sites sounds good, but ...
Read Article →Assembly Clashes Make Microsoft 365 PowerShell Frustrating
An assembly clash happens when a PowerShell module attempts to load a .NET assembly only to find that a different version is already loaded in the ...
Read Article →How to Configure Password Protection with Microsoft Graph
Learn how to configure password protection settings like banned password lists in Microsoft Entra using Microsoft Graph PowerShell. The post How to...
Read Article →Microsoft Defender for Identity Recommended Actions: Remove non-admin accounts with DCSync permissions
Identity leverages Secure Score with twenty-seven recommended actions. In a series of blog posts, I will go through all twenty-seven recommended ac...
Read Article →Updating the User Password and Authentication Report
A change to a Graph beta API meant that some data used to create the user password and authentication report was no longer available. A script upda...
Read Article →Automating Microsoft 365 with PowerShell October 2025 Update
The Office 365 for IT Pros team is happy to announce the availability of the October 2025 update for the Automating Microsoft 365 with PowerShell e...
Read Article →Departmental Risk-Based Segmentation with Purview and Entra
Copyright © 2025 Microsoft Security - All Rights Reserved.
Read Article →No, your NHIs can’t use passwords either!
Check out this article via web browser: No, your NHIs can’t use passwords either! For human identities, going passwordless is becoming pretty...
Read Article →Azure Back to School 2025 – Azure Arc Under the Hood: Troubleshooting the Azure Connected Machine agent
Azure Back to School s a fantastic community initiative founded by Dwayne Natwick and Derek Smith. As in previous years,Continue Reading
Read Article →Copilot Chat Arrives in Microsoft 365 Apps
The rollout of the Copilot Chat integration with the Microsoft 365 apps has started, with the intention of making it easier to use AI in peoples’ w...
Read Article →Should You Upgrade to Exchange SE or Remove Your Last Server
With Exchange 2019 support ending, should you upgrade to the Subscription Edition or remove your last server? This guide covers the costs, hybrid c...
Read Article →What’s the Best Way to Manage Guest Accounts?
Guest account management should be a part of every Microsoft 365 tenant administrator’s checklist, unless the tenant has no guests. That’s possible...
Read Article →Entra ID’s Keep Me Signed In Feature – Good or Bad?
The Entra ID Keep Me Signed In (KMSI) feature creates persistent authentication cookies to allow users to avoid sign-ins during browser sessions. I...
Read Article →Recommended Application Policies for Microsoft Entra Apps
Discover best practices for using Application Policies to block client secrets, restrict credential lifetimes, and enforce secure identifier URIs d...
Read Article →Copilot Administrative Skills Don’t Do Much for SharePoint Management
Microsoft 365 Copilot now has some SharePoint skills to deploy in the SharePoint admin center. The problem is that the skills aren't very good and ...
Read Article →Entra ID – When Ideas Become Features: Reflections on Entra ID App Policies
Last Updated on September 17, 2025 by Michael Morten Sonne Introduction Microsoft has recently teaset App Management Policies… The post Entra...
Read Article →Understanding the Default Compliance Policy: What’s Changed and Why Devices Stay Compliant
This blog explores the behavior change in Intune’s built-in compliance policy, specifically why devices are still marked as compliant even when the...
Read Article →Copilot Transcription Behavior Changing for Teams Meetings
Microsoft plans to deploy an update to change how transcription behaves for Teams meetings where Copilot is enabled. New meetings will not generate...
Read Article →How to Actually Security Benchmark Your Microsoft 365 Tenant
Learn why understanding core principals of Microsoft 365 is important and how to properly assess the posture of your Microsoft 365 tenant. The post...
Read Article →Running Teams PowerShell Cmdlets in Azure Automation
This article describes the prerequisites and how to run cmdlets from the Teams PowerShell module in Azure Automation runbooks. We also consider whe...
Read Article →Running the SharePoint Site Content and Policy Comparison Report
A new SharePoint Site content and policy comparison report is available to tenants with Microsoft 365 Copilot or SharePoint advanced management lic...
Read Article →SignTool GUI 2.0.0.0 — Major Update Out Now!
Last Updated on September 11, 2025 by Michael Morten Sonne Introduction I’m excited to announce that SignToolGUI version… The post SignTool G...
Read Article →Microsoft’s Effort to Develop a Broad People Platform
Microsoft 365 users see the profile card and might wonder where the information displayed on the card comes from. Entra ID is the obvious source, b...
Read Article →Conditional Access Essentials: Managing Exclusions with Identity Governance and Temporary Access Pass
Conditional Access Essentials aren’t just about writing policies – it’s about managing real-world scenarios. In this guide, I show how to handle tr...
Read Article →Improving passkey registration experiences
Passkey registration problems Passkeys in Microsoft Authenticator are fantastic, assuming you can get users logged in to the app successfully. Unfo...
Read Article →Microsoft’s Push to Save Office Files in the Cloud
A new policy setting is available to force Microsoft 365 enterprise (Office subscription) applications to save to cloud locations and ignore the lo...
Read Article →What’s next for Visual Studio 2026 (v18)!
Last Updated on September 10, 2025 by Michael Morten Sonne Introduction As a Microsoft Most Valuable Professional (MVP),… The post What’s nex...
Read Article →You shall not pass(key)! (updated)
Check out this article via web browser: You shall not pass(key)! (updated) For both modes, users who have previously registered a method that can b...
Read Article →Microsoft Bolts on Copilot License Check onto ExRCA
Microsoft announced a new Copilot license check diagnostic for the Exchange Connectivity Analyzer. Sounds good, but the test is very simple, and it...
Read Article →Use EntraSort to Sort the Microsoft Entra Menu Alphabetically
How to automatically sort Microsoft Entra Menu items alphabetically using the EntraSort Chrome browser extension. The post Use EntraSort to Sort th...
Read Article →How to Update Entra ID Apps to Run Teams Cmdlets
MC1134747 describes a new permissions requirement for Entra apps that run Teams PowerShell cmdlets. Fixing apps to meet the new requirement is easi...
Read Article →People Settings Appear in the Microsoft 365 Admin Center
The Org Settings section of the Microsoft 365 admin center has a new People Settings section where you can choose properties for the Microsoft 365 ...
Read Article →Windows Autopilot: Installing Windows Updates during setup (OOBE)
Installing Windows Quality Updates during the out-of-the-box (OOBE) experience is now generally available is been pulled back! (Check out this para...
Read Article →Windows Autopilot Stuck on Identifying: The KB5065848 Story
It was a rough week for Intune. First, BitLocker policies suddenly stopped applying without any good reason. The event logs indicated that the BitL...
Read Article →Microsoft Explains the Differences Between Copilot Memories
Copilot memory is a term that refers to different things, including Copilot communication memory, a method to use the Graph to personalize response...
Read Article →BitLocker Policies Not Getting Applied in Intune (65000)
This blog will discuss a case where BitLocker policies pushed during Windows Autopilot appeared to be applied in the event logs, but they never act...
Read Article →Closing Microsoft Graph Gaps: My Feedback Portal Request Gains Top 3 in Just 4 Days
Last Updated on September 2, 2025 by Michael Morten Sonne Introduction The Microsoft Graph community is rallying for… The post Closing Micros...
Read Article →Conditional Access Essentials: Authentication contexts + Secure PIM & Resource Access
This instalment of Conditional Access Essentials explores authentication contexts, PIM, and securing sensitive resources. Learn how to enforce step...
Read Article →Microsoft Deprecates Graph CLI and Toolkit
Microsoft has depreciated the Microsoft Graph CLI and Graph Toolkit. It’s nice to see some rationalization, but the real need is for better quality...
Read Article →Protect Security Info Registration with Microsoft Entra Conditional Access and Microsoft Entra ID Protection
Registration of security information such as the Microsoft Authenticator app, FIDO2 security keys or OATH tokens is a critical component of modern ...
Read Article →AiTM/ MFA phishing attacks in combination with “new” Microsoft protections (2025 edition)
Adversary-in-the-middle phishing attacks are still more common in use, in the last year and the start of 2025 there is still a more visible increas...
Read Article →September 2025 Update for Office 365 for IT Pros
Monthly update #123 is available for the Office 365 for IT Pros eBook. Subscribers can download updated EPUB and PDF files for the main book and th...
Read Article →What is Entra Docs Tracker?
Effortlessly track and document all changes to public Microsoft Entra documentation and stay ahead of this rapidly changing product. The post What ...
Read Article →Creating and Using an Azure Automation Custom Runtime Environment
A custom runtime environment is a way of defining a specific job execution environment for Azure Automation runbooks, including Microsoft Graph Pow...
Read Article →Security Info Registration. Entra ID’s rabbit hole.
Check out this article via web browser: Security Info Registration. Entra ID’s rabbit hole. This blog post needs a brief introduction. Bear w...
Read Article →Teams Gives Users Control Over Hiding Inactive Channels
In March, Microsoft said that they'd change Teams to offer suggestions about which inactive channels a user might want to hide from client channel ...
Read Article →Guidance on how to manage products updates for Defender for Server on Linux distributions
Intro There are many helpful blog/videos posts about managing Microsoft Defender for Endpoint (MDE) updates on Windows, but there’s not much inform...
Read Article →How to Delegate Access Package Approvals in My Access
Learn how to enable and use the new delegate approvals feature in Microsoft Entra to delegate access package request approvals. The post How to Del...
Read Article →MaesterDiff: Because Comparing Maesters Just Got Twice as Fun!
Table of Contents Introduction Requirements Features How does it work? File & Folder Comparison Cross-Tenant Comparison Advanced Options Output...
Read Article →September 2025 Update for Automating Microsoft 365 with PowerShell
The Office 365 for IT Pros eBook team is proud to announce the availability of update 15 for the Automating Microsoft 365 with PowerShell eBook. Th...
Read Article →Windows Backup for Organizations: ESR 2.0 With a New Skin?
This blog outlines the new Windows Backup for Organizations feature introduced in Windows 11 by Microsoft. They replace the old “Sync your settings...
Read Article →Autopilot Enrollment Fails After Terms of Use Acceptance
This blog will be about a strange Autopilot failure we could reproduce again and again. Right after the Terms of Use was accepted, the device doesn...
Read Article →Conditional Access Essentials: RMAUs, Named Locations, Authentication Strengths, Service Principals
Strengthen your Conditional Access strategy with practical essentials. Explore how RMAUs, Named Locations, Authentication Strengths, and Service Pr...
Read Article →Microsoft Sentinel Data Lake Tier: Deep Dive and Comparison
Copyright © 2025 Microsoft Security - All Rights Reserved.
Read Article →Summarize Email Thread Feature Coming to Outlook
In late August, Microsoft plans to release the Copilot summarize email thread feature in Outlook clients without the need for a Microsoft 365 Copil...
Read Article →Windows Autopatch Client Broker: What It Is, When to Use It, and Why It Matters
In this post, we’ll break down what it does, when you need it, and how to align it with your organization’s update strategy.
Read Article →Find and Restore Deleted Cross-Tenant Access Policies
Learn how to list and restore soft-deleted cross-tenant access policies in Microsoft Entra ID using Microsoft Graph PowerShell. The post Find and R...
Read Article →Microsoft 365 Tenants Need Vanity Domains to Send External Email
Microsoft will impose a throttling limit for external recipients for tenants that use MOERA domain addresses to send outbound email. The limit is d...
Read Article →Remove old or orphaned Sentinels from the XDR Streaming API
This blog post is a sleeper. I documented it in 2023 and never came around to publish it. The post was always too short in my opinion, too niche. B...
Read Article →Entra ID – Bulk User Download – Enhanced Experience
Last Updated on August 24, 2025 by Michael Morten Sonne Introduction The short announcement about Bulk User Download… The post Entra ID – Bul...
Read Article →Finding Seamless SSO usage
A brief history Seamless Single Sign On was first introduced in late 2016 and provided a way for users to authenticate to Entra ID (Azure AD at the...
Read Article →Modern Outlook/Teams fails with WebView2 error – seen on Win11 ARM
I have experienced issues with some app pushing wrong WebView2 (X64) to a Win11 (ARM) machine. Then any apps that ... Read more
Read Article →Configure Whether Requestors Can See Access Package Approver Details
See how to hide or show approver details in access packages with this new feature and easily configure it with our guide. The post Configure Whethe...
Read Article →Microsoft Fixes Copilot Audit Records
After a report to the MSRC about some missing file data from Copilot audit records, Microsoft fixed the problem and audit records now contain detai...
Read Article →Userless Enrollment Status in Autopilot: How to Unblock Devices
This blog will be about a lesser-known feature in Windows Autopilot: the Userless Enrollment Status. We’ll look at how devices can end up in a bloc...
Read Article →Endpoint Privilege Management: Virtual Elevation Acccount Support
EPM has always relied on virtual accounts for elevation, often breaking scenarios where apps need the real user profile. A new ElevationAccount.Use...
Read Article →Microsoft Defender XDR - Take action on advanced hunting results
The level below automation and above manual actions per asset - So this is mostly a self reference post about the action button in Defender XDR whe...
Read Article →Multi-Admin Approval Extends to Device Reset Options in Intune
Discover Intune's new Multi-Admin Approval feature for device actions. This guide explains how to set up dual control for Wipe, Retire, and Delete ...
Read Article →Reporting Authentication Method Usage Data via the Graph
Three new Graph API resources provide easy access to Entra ID authentication method summary data. The information is helpful to understand the type...
Read Article →Removing Obsolete Mobile Device Partnerships from Exchange Online
This article discusses how to use PowerShell to find obsolete mobile device partnerships in Exchange Online (or Exchange Server) and remove the obs...
Read Article →Summer Recap & Time to Reconnect
Last Updated on August 20, 2025 by Michael Morten Sonne This summer has been a wonderful mix of… The post Summer Recap & Time to Reconnect fi...
Read Article →A first look at Microsoft Entra Private Access for Active Directory domain controllers
In many environments - often for historical reasons - there is no strict separation of client and server networks. And if there is a firewall betwe...
Read Article →Conditional Access Essentials: Naming conventions, personas, emergency access & design process
Master Conditional Access with a Zero Trust, persona-based approach. Learn how to structure policies, avoid security gaps, and keep everything orga...
Read Article →Unverified Sender Messages Highlighted By Outlook Mobile
Outlook Mobile clients have started to highlight messages received from unverified senders. But what does "unverified" mean and what can be done to...
Read Article →Entra ID – Managed Identity Permission Manager: A Community-Driven Recap
Last Updated on August 18, 2025 by Michael Morten Sonne Introduction Managing permissions for Managed Identities in Azure/Entra… The post Ent...
Read Article →GraphApiAuditEvents: The new Graph API Logs
The new GraphApiAuditEvents table in Advanced Hunting have been in Public Preview since July this year. These valuable logs give new insights into ...
Read Article →Mastering Microsoft Entra Authentication Contexts – Part 1: What They Are, Why They Matter, and How to Use Them
Over my last few posts, I’ve casually mentioned Authentication Context a few times, so I thought it was about time we gave the feature a proper spo...
Read Article →Microsoft Defender for Identity Recommended Actions: Remove local admins on identity assets
Identity leverages Secure Score with twenty-seven recommended actions. In a series of blog posts, I will go through all twenty-seven recommended ac...
Read Article →Microsoft Defender for Office 365, Shared Mailboxes, and Microsoft 365 Groups
Microsoft Defender for Office 365 (MDO) requires shared mailboxes to be licensed but doesn't extend the same requirement to Microsoft 365 Groups. G...
Read Article →Recommended Settings for Windows LAPS with Intune
Deploy the recommended settings for Windows LAPS to your end-user Windows 10 and 11 devices using Microsoft Intune. The post Recommended Settings f...
Read Article →Mobile Device Management Options Disappear from OWA and the New Outlook
Microsoft plans to remove the ability of users to perform mobile device management (for their devices) from the OWA and new Outlook for Windows cli...
Read Article →Detect threats using GraphAPIAuditEvents - Part 3
For a long time now, defenders had the ability to monitor behavior of human- and workload identities in Entra tenants not only through AuditLogs bu...
Read Article →Microsoft cancels access package visibility changes
Learn why Microsoft cancelled a planned change to Entra ID access package visibility after overwhelming community feedback. The post Microsoft canc...
Read Article →Sensitivity Labels with User-Defined Permissions Gain SharePoint Support
Finally, Microsoft solved the technical issues that blocked SharePoint Online support for sensitivity labels with user-defined permissions (UDP). T...
Read Article →Unified RBAC in Microsoft Defender XDR: Simpler SecOps, fewer high‑priv roles
One portal, scoped permissions, less Entra privilege—Unified RBAC for safer, simpler SecOps.
Read Article →Purview Priority Cleanup Expands to SharePoint and OneDrive
Purview Priority Cleanup is growing its capabilities to be able to process files stored in SharePoint Online and OneDrive for Business. Public prev...
Read Article →Script: Sentinel Data Lake Table Management
Microsoft Sentinel’s data lake story is quietly powerful: you get fast, 90-day Analytics (Shortterm) for hunting and detections, plus scalable, ......
Read Article →Windows Hello PIN Stops Working After the Windows 11 24H2 Upgrade
This blog examines a login issue that may arise after the Windows 11 24H2 upgrade is complete and the device reboots. After the device reboots, the...
Read Article →Conditional Access Essentials: Introduction, use cases, the art of possible
Discover how Microsoft Conditional Access protects your Microsoft 365, Entra, and Azure environments. Learn the essentials, explore real-world use ...
Read Article →How to Visualise Microsoft Entra MFA Sign-in Metrics with PowerShell
Use PowerShell and new Microsoft Graph APIs to visualise user MFA, SSPR, and password reset activity in your Microsoft 365 tenant. The post How to ...
Read Article →Maintaining a Microsoft 365 Retention Policy with PowerShell
The Connect-IPPSSession cmdlet is needed to connect to the Security and Compliance endpoint to update a Microsoft 365 retention policy. Unhappily, ...
Read Article →How to Enforce Macro Security by running only Excel macros signed with your own public-CA–issued code-signing certificate – stored in Azure Keyvault (HSM)
It may be tempting to click “Enable Macros” when you open a spreadsheet, but macros are executable programs. Without a ... Read more
Read Article →Unexpected Microsoft Defender for Office 365 License Requirement for Shared Mailboxes
A question about shared mailboxes brought up the topic of licensing requirements when a tenant has Microsoft Defender for Office 365 (MDO). The new...
Read Article →Best Practice for Configuring Privileged Identity Management in Microsoft Entra
Discover the best practices for configuring PIM in Microsoft Entra. This guide will help you implement a robust and secure Zero Trust model. The po...
Read Article →Teams Gets a KeyQL-Powered Search Box
Microsoft is introducing a new KeyQL-powered capability for a revamped search box in Teams. The new implementation promises faster and more precise...
Read Article →Microsoft Tells Hybrid Exchange Customers to Get Going with Dedicated Hybrid Connectivity App
Microsoft says that few customers have installed the dedicated hybrid connectivity app that's needed to migrate from EWS. It's time to install that...
Read Article →Microsoft Introduces Copilot Memory
A July 14 post announces Copilot Memory, a method to personalize how Copilot responds to user prompts. Controls are available to disable Copilot me...
Read Article →Microsoft to Roll out Automatic Registration for External Authentication Methods
Upcoming in September 2025: Microsoft is rolling out automatic registration for Entra ID External Authentication Methods (EAMs). Find out how this ...
Read Article →Creating a Microsoft 365 Retention Policy for Shared Mailboxes
After being asked whether licenses are needed to include shared mailboxes in Microsoft 365 retention policies, I investigated and found that licens...
Read Article →Defender for Cloud Apps: Do you know what SaaS apps are being used in the organization?
What is Defender for Cloud Apps. Defender for Cloud Apps aims to tackle the security problems that come with the increasing use of SaaS application...
Read Article →Microsoft Entra Connect: Migration to Application Based Authentication (ABA)
With the introduction of Application Based Authentication (ABA), Microsoft introduces modern authentication mechanisms to Microsoft Entra Connect. ...
Read Article →Blocking risky users with Passwordless Authentication methods
Learn why you must evolve your Conditional Access policies to properly manage risk for your passwordless users. The post Blocking risky users with ...
Read Article →How Microsoft Graph PowerShell SDK Access Tokens Work
If you use the Microsoft Graph PowerShell SDK, you don’t need to worry about obtaining an access token because SDK cmdlets include automatic token ...
Read Article →How to store Defender XDR data for years in Sentinel data lake without expensive ingestion cost
In recent years, an increasing number of customers have requested options to extend retention in Microsoft Defender XDR beyond the default 30 days ...
Read Article →PIMActivation: The Ultimate Tool for Microsoft Entra PIM Bulk Role Activation
Getting annoyed or impatient when activating eligible roles in PIM — especially multiple roles at once? You’re not alone. Today, I’m...
Read Article →How to secure your Enterprise Application via PIM
Table of Contents Introduction What is PIM? Requirements Configuration Step 1: Create Group Step 2: Confirm Existing SSO Integration Step 3: Config...
Read Article →Monthly Update #122 Available for Office 365 for IT Pros eBook
Monthly update #122 is now available for the Office 365 for IT Pros eBook. Subscribers can download PDF and EPUB files for the update from Gumroad....
Read Article →DLP Diagnostics Available in Purview Portal
DLP diagnostics were announced in October 2024, and it’s taken quite a while for Microsoft to make the four DLP diagnostic tests available. In trut...
Read Article →Dynamic approval in Entra ID access packages using custom extensions
Check out this article via web browser: Dynamic approval in Entra ID access packages using custom extensions Microsoft Entra ID Governance Entitlem...
Read Article →How to Block OWA and Use the New Outlook
Microsoft suggests that tenants wanting to block access to OWA while allowing people to use the new Outlook should deploy a conditional access poli...
Read Article →Microsoft Sentinel data lake: How to use/enable and set-up the unified data lake
Microsoft released the new Microsoft Sentinel data lake in public preview this month. With the data lake feature, it is possible to scale and store...
Read Article →Azure Arc: Troubleshoot Azure Connected Machine agent connectivity issues
In this blog post, I’ll walk you through troubleshooting connectivity issues with the Azure Connected Machine agent and highlight someContinue Reading
Read Article →Download IntuneWin Win32 App Files Directly from Intune
This blog explains how to download the original IntuneWin Win32 app package from Intune when you no longer have the original source files. If you f...
Read Article →Entra ID Governance Levies Charges for Guest Accounts
A banner posted in the Entra admin center informs administrators that Entra ID governance features used by guest accounts incur charges from June 2...
Read Article →Important Changes to Conditional Access Policies for Azure DevOps Sign-ins
Learn how to update your Conditional Access policies to protect your environment in preparation for updates to the Azure DevOps service. The post I...
Read Article →Legacy MFA & SSPR are retiring -How to migrate MFA and SSPR settings to the Authentication methods policy
Learn how to migrate MFA and SSPR policy settings to the Authentication methods policy in Microsoft Entra before the legacy settings are retired. T...
Read Article →AI Access Governance in M365: Detect Sensitive Prompts and Output
Copyright © 2025 Microsoft Security - All Rights Reserved.
Read Article →August 2025 Update for Automating Microsoft 365 with PowerShell eBook
The August 2025 update for the Automating Microsoft 365 with PowerShell eBook is available for subscribers to download. The eBook now includes over...
Read Article →How to Block Upload to WeTransfer, DropBox & Google Drive (but Allowing Download) – using Microsoft Purview Data Loss Prevention (DLP)
This blog was created in response to recent policy changes related to the WeTransfer cloud storage service. These changes raised ... Read more
Read Article →Microsoft Sentinel Data Lake - FAQ
Answering some common questions people might have - Data lake is here, rejoice. It also brings up a bunch of questions, like do I still need Micros...
Read Article →Intune Remote Wipe ending up in “Something went wrong” (0x800f0991)?
In this blog, we’ll walk through a remote wipe issue that leaves devices in a lingering, unmanaged state, where the Intune object is removed, the d...
Read Article →New Outlook for Windows Enables S/MIME Inheritance Control
The new Outlook for Windows now supports the NoSignOnReply control for inheritance of S/MIME signatures from messages to replies. It’s an update to...
Read Article →Entra ID Introduces Linkable Token Identifiers for Audit Events
Linkable token identifiers is a new Entra ID feature that adds a GUID to all the audit events for a session. The new identifiers make it easier to ...
Read Article →Microsoft Makes Token Protection Available for Entra ID P1 Licenses
Discover a huge win for security. Token Protection in Conditional Access is now included in Microsoft Entra P1, offering a powerful defence against...
Read Article →How to Remove Members from Microsoft 365 Groups with PowerShell
After writing about how to copy group memberships from one user to another, the question arises about removing members from groups. The answer is s...
Read Article →Be Careful with Retention Labels Configured with Created Date Expiration
Retention policies and retention labels have been around for about 8 years. Some of the older retention settings might use file created dates to re...
Read Article →BeyondTrust Breaking Autopilot: 8018000a
This blog will discuss a strange Windows Autopilot failure that appeared on newly installed Windows 11 24H2 devices that had been updated with the ...
Read Article →Planned Change Prevents Microsoft Tenant Domain Enumeration
Planned Change Prevents Microsoft Tenant Domain Enumeration In a significant security-hardening move, Microsoft has altered the behaviour of its Ex...
Read Article →Quick Machine Recovery: Built-In Resilience for Windows 24H2
This blog is about a new kind of silent recovery built into Windows 24h2 (KB5062660). It’s not about Safe Mode or Startup Repair, but something mor...
Read Article →Changes Coming to Smoothen Edges in Microsoft Authenticator App
The Microsoft Authenticator app gets two important changes in September 2025 to make the app easier to use for average users. The current number ma...
Read Article →Remove Default Microsoft Store Apps: Prevents Provisioning for New Users Only
This blog will be about what actually happens when you enable the new “Remove Default Microsoft Store Packages” from the System policy designed to ...
Read Article →Streamline Your Git Workflow: (semi)-automated Branch Cleanup with PowerShell
Table of Contents Introduction Requirements Benefits Step-by-Step Guide Examples Check Current Repository for Orphaned Branches Search all subdirec...
Read Article →Microsoft to streamline the same-device sign-in experience for Microsoft Authenticator
Microsoft Authenticator simplifies same-device sign-ins, replacing number matching with a simple Yes/No prompt. The post Microsoft to streamline th...
Read Article →How to not mess up your Microsoft Sentinel deployment
Looking beyond just the technical details - I recently did a presentation with the same title as this post and figured it would be a good idea to a...
Read Article →How to Find All Inactive Guests in Microsoft 365
Find inactive guests users in your Microsoft tenant using the Entra admin center or programmatically with Microsoft Graph PowerShell. The post How ...
Read Article →Teams Gains New Accent Colors
The news that people can customize Teams by choosing one of ten accent colors for use in the Teams UX might or might not be positive, depending on ...
Read Article →Microsoft Introduces Exchange 2016/2019 Extended Security Program
The Exchange Extended Security Update program is a 6-month lifeline for organizations struggling to upgrade servers to Exchange Server SE. Although...
Read Article →Defender for Office 365 Auto-Remediation of Malicious Messages (AIR)
In Defender for Office Automated Investigation and Response (AIR) is important. Microsoft has improved the features surrounding Auto-Remediation of...
Read Article →Exchange Online Reduces Delicensing Resiliency Threshold to 5,000 Mailboxes
A July 15 announcement says that Exchange Online is reducing the Delicensing Resiliency threshold from 10,000 to 5,000 mailboxes. That’s fine, but ...
Read Article →Conditional Access Gone Too Far: Navigating Zero Trust Edge Cases
When Conditional Access meets Zero Trust, even the best intentions can backfire. In this post, we explore a real-world edge case where strict polic...
Read Article →Copilot Studio Agent Vulnerability to Prompt Injection
Security researchers documented a prompt injection vulnerability in an agent created with Copilot Studio that allowed the exfiltration of customer ...
Read Article →Intune, vTPM, and MDM Enrollment Version 6.0: What You Need to Know!
This blog will cover the latest features in MDM Enrollment Version 6.0 and explain their significance for device attestation, virtual TPMs, and Int...
Read Article →Azure Update Manager: Register all required resource providers with a PowerShell script
This blog post will show you how to use an Azure PowerShell script to register all required Azure Update ManagerContinue Reading
Read Article →Hunting Through APIs - Logic App Edition
Logic Apps allow organizations to easily automate processes, in the last blog the APIs to run KQL are discussed. This blog builds upon the knowledg...
Read Article →Managing PIM-enabled groups with Entra ID Governance Access Packages just got better!
Check out this article via web browser: Managing PIM-enabled groups with Entra ID Governance Access Packages just got better! Just a quick heads-up...
Read Article →Microsoft 365 Copilot Search Rolling Out
Microsoft 365 Copilot Search is the second iteration of Copilot Search. It borrows heavily from the older Microsoft Search in Bing feature in terms...
Read Article →Microsoft Defender for Identity Recommended Actions: Remove access rights on suspicious accounts with the Admin SDHolder permission
Identity leverages Secure Score with twenty-seven recommended actions. In a series of blog posts, I will go through all twenty-seven recommended ac...
Read Article →My First Year as a Microsoft MVP
Last Updated on August 18, 2025 by Michael Morten Sonne Introduction As I sit down to write this… The post My First Year as a Microsoft MVP f...
Read Article →Entra ID Governance Deep dive
The time has come to write a blog about Entra ID Governance. There are a lot of cool functionality that can help managing Users and their permissio...
Read Article →In-Depth Series: Shadow IDs & Workload Security in Entra
Copyright © 2025 Microsoft Security - All Rights Reserved.
Read Article →Microsoft Graph PowerShell SDK V2.29 Now Available
Version 2.29 of the Microsoft Graph PowerShell SDK can now be downloaded from the PowerShell Gallery. Initial tests show that the release is stable...
Read Article →Easier Configuration Promised for the Microsoft Authenticator App
The Microsoft Authenticator app is a secure authentication method for MFA. The app is getting an easier way for backup and recovery, which should m...
Read Article →Improving the Processing of Protected Messages in Shared Mailboxes
A sometimes overlooked 2024 update delivers easier access to protected messages delivered to shared mailboxes. Instead of direct assignment of Full...
Read Article →Microsoft to remove personal account requirement for Microsoft Authenticator backup
In September, Microsoft are to remove the personal account requirement for backing up and restoring the Microsoft Authenticator App. The post Micro...
Read Article →Configuring M365 Company Branding & Privacy Settings: Simple Tricks to Reduce Phishing Risks
Company branding isn’t just about creating a visual identity - it’s a key security measure for reducing phishing risks. In this post, I dive into h...
Read Article →Copying Group Membership with the Microsoft Graph PowerShell SDK
Sometimes tenants need to copy group membership from one user to another. Often PowerShell is used, but with the demise of the Azure AD module you ...
Read Article →Poor man’s IGA: Monitor and clean up stale guest accounts
Check out this article via web browser: Poor man’s IGA: Monitor and clean up stale guest accounts Today’s challenge Today, we are dealing with inac...
Read Article →Copilot Audio Overviews for OneDrive Documents
Microsoft 365 Copilot users can generate audio overviews from Word and PDF files and Teams meeting recordings stored in OneDrive for Business. Copi...
Read Article →Microsoft’s Evolving Zero Trust Strategy in 2025
Zero Trust is a modern security approach that assumes attackers may already be in your network and thus “never trust, always verify” every access r...
Read Article →How to Secure Redirect URIs in Microsoft Entra ID Applications
Learn how to find poorly configured Redirect URIs in Microsoft Entra Applications and why you should secure them. The post How to Secure Redirect U...
Read Article →Exchange Server Subscription Edition Now Generally Available
July 1 marked the general availability of Exchange Server SE (subscription edition), the latest in a long line of server releases going back to Exc...
Read Article →KB – We detected that this particular key type has been blocked by your organization
Check out this article via web browser: KB – We detected that this particular key type has been blocked by your organization This is a knowle...
Read Article →Transition from Microsoft Sentinel to Defender XDR - Practical challenges
Introduction Microsoft announced on the 1st of July 2025 that the Microsoft Sentinel Azure Portal UI will be deprecated at the 1st of July 2026, an...
Read Article →How to Ensure Microsoft Entra Licensing Compliance
Learn how to monitor for license compliance for Microsoft Entra and ensure you remain compliance with Microsoft licensing terms. The post How to En...
Read Article →New Outlook for Windows Support for Export to PST
The New Outlook for Windows supports an export to PST function. Unfortunately, exporting mailbox items is very slow – roughly ten times slower than...
Read Article →Data Strategy Breakdown Series - Entra ID (5)
In this final installment of the Data Strategy Breakdown series, we dive into Entra ID and why securing your identity is crucial for a strong data ...
Read Article →Microsoft Defender Attack Simulation Training: Boosting Real-World Security Awareness
Phishing, malware, and social engineering remain among the most common entry points for cyberattacks. While technical safeguards play a crucial rol...
Read Article →Microsoft Launches New Way to Consume Documentation
The MCP server for Microsoft Learn is available in public preview. It can be installed to allow AI agent real-time access to Microsoft documentatio...
Read Article →A Native Way to Remove Default Microsoft Store Packages
This blog will focus on the new Windows 11 25h2 feature, “Remove Default Microsoft Store Packages.” It’s a long-awaited Group Policy and (eventuall...
Read Article →Announcing Office 365 for IT Pros (2026 Edition)
Office 365 for IT Pros (2026 edition), the 12th in an eBook series going back to May 2015, is now available. Covering all the essential aspects of ...
Read Article →How the IME Cleans up the IMECache folder
This blog explains how the Intune Management Extension (IME) handles the cleanup of the IMECache folder after it has finished installing a Win32App...
Read Article →Automating Microsoft 365 with PowerShell Second Edition
The Office 365 for IT Pros team are thrilled to announce the availability of Automating Microsoft 365 with PowerShell (2nd edition). This completel...
Read Article →Azure Arc: Uninstall the Connected Machine agent and clean up related resources on Windows using a PowerShell script
In this blog post, I’ll walk you through removing the Azure Arc Connected Machine agent from a Windows machine and cleaning up all related folders,...
Read Article →Configure Microsoft Entra Trusted Network Locations for Better Protection
Trusted locations are the foundation of location-based security policies and risk in Microsoft Entra, learn how they enhance the user experience. T...
Read Article →Secure Score Series: A Comprehensive Guide
Copyright © 2025 Microsoft Security - All Rights Reserved.
Read Article →🛠️ Releasing my legacy PowerShell AD Service Account Tool (Yes, it still works great)
Last Updated on June 29, 2025 by Michael Morten Sonne Introduction A throwback tool built for real-world IT… The post 🛠️ Releasing my legacy ...
Read Article →Copilot Agent Governance Product Launched by ISV
Agent governance is the framework that allows tenants to deploy agents safely, securely, and under control. A new ISV offering from Rencore helps t...
Read Article →Token Protection Extends to Microsoft Graph PowerShell SDK Sessions
The conditional access policy condition for token protection now extends to Microsoft Graph PowerShell SDK interactive sessions. Any account within...
Read Article →Microsoft 365 PowerShell Modules Need Better Testing
Recent problems with Microsoft 365 PowerShell modules afflicted the ability of Azure Automation runbooks to execute cmdlets Microsoft Graph PowerSh...
Read Article →Why you should disable Seamless SSO in Microsoft Entra Connect
Learn why you should and how you can disable Seamless SSO in Microsoft Entra Connect to improve security in your environment. The post Why you shou...
Read Article →Autopilot Unexpected Reboot: What Really Triggers a Device Restart (and How to Fix It)
If you’ve ever run into an Autopilot Unexpected Reboot right after Device setup, before the account setup even starts, you’re not alone. This post ...
Read Article →Launch Plan for Office 365 for IT Pros (2026 Edition)
We're a week away from the launch of the Office 365 for IT Pros (2026 edition) eBook, the 12th edition issued since the first book appeared in 2015...
Read Article →Defender AV Mystery: Solving the ‘Source Files could Not be Found’
Intro This week I bumped into a problem that I had not experienced for several years at one of my customers. The customer was migrating from a 3rd-...
Read Article →“Everyone Gets the Same Toolbox” PowerShell Script
Table of Contents Introduction Requirements Benefits Step-by-Step Guide Conclusion Introduction As someone who’s spent way too much time trou...
Read Article →In-Depth Series: Mastering DSPM in Microsoft Purview
Copyright © 2025 Microsoft Security - All Rights Reserved.
Read Article →Intune Policies showing error code -2016281112
This blog covers a weird issue where Windows Update client policies deployed through Intune began to fail after devices were upgraded to Windows 11...
Read Article →Outlook’s New Summarize Option for Email Attachments
Among the blizzard of Copilot changes is one where Outlook can summarize attachments. That sounds small, but the feature is pretty useful if you re...
Read Article →Inside My Toolkit: Dev Tools, Productivity Apps, and More 🛠️
Last Updated on June 28, 2025 by Michael Morten Sonne Introduction I’m happy to share something I’ve been… The post Inside My Toolkit: ...
Read Article →Introducing Azure DevOps Backup Tool 1.2.0.0: Update with new features and bug fixes!
Last Updated on June 21, 2025 by Michael Morten Sonne Introduction I’m thrilled to announce the latest release… The post Introducing Az...
Read Article →Configure Passkey Profiles for Group-Based Passkey Restrictions
Learn about the new Passkey Profiles features of Passkeys in Microsoft Entra to provide group-based Passkey flexibility. The post Configure Passkey...
Read Article →Microsoft to Block Users Granting Third-Party App Access to User Sites and Files
In July, Microsoft plans to introduce an app consent policy to stop users granting access to third-party apps to their files and sites. Letting use...
Read Article →Require admin consent for third-party apps accessing files and sites
Learn how to configure the require admin consent for third-party apps accessing files and sites and understand the impact to your business. The pos...
Read Article →Updating the Entra ID Custom Banned Password List with PowerShell
Microsoft 365 tenants with Entra P1 or P2 licenses can use a custom banned password list to stop people using specific terms in their passwords. Th...
Read Article →Microsoft Pushes European Sovereign Solutions
On June 16, Microsoft announced European sovereign solutions, including a new offering called Microsoft 365 Local that has nothing to do with Micro...
Read Article →People Skills Rolling Out Within Microsoft 365
People Skills is a new Microsoft 365 solution that uses AI to determine what skills are possessed by users based on their profile and activities. T...
Read Article →Using a Copilot Agent in SharePoint to Interact with Office 365 for IT Pros
Copilot Studio Agents can use files as knowledge sources to reason over when they respond to user prompts. We explain how to use the monthly PDFs i...
Read Article →How to Remove Exchange Without Breaking Hybrid Mail Management
Learn how to conveniently manage mail attributes for cloud mail users after decommissioning your hybrid Exchange Server. The post How to Remove Exc...
Read Article →AI Generative Summaries Make Life Even Harder for Technology Websites
The AI-based generative summaries featured by Google and other search engines remove organic traffic from technology websites and make it less attr...
Read Article →Intune Anomalies Report
Table of Contents Introduction Requirements Features How does it work? Interactive Authentication Client Secret Authentication Certificate Authenti...
Read Article →Win32 Apps not Installing During Autopilot Device Preparation
This blog started with a support case from a customer who ran into an issue where Autopilot Device Preparation (AP DP) got stuck at “Installing req...
Read Article →Azure Update Manager: Failed to update a dynamic scope for resources on a newly added subscription
In this blog post, you’ll learn how to resolve the error that occurs when updating or creating dynamic scopes forContinue Reading
Read Article →In-Depth Series: Architecting Microsoft Defender
Copyright © 2025 Microsoft Security - All Rights Reserved.
Read Article →Remote Speedtest in CLI: Easy & Quick Network Troubleshooting
Table of Contents Introduction Requirements Benifits Step-by-Step Guide Conclusion Introduction As an IT professional, diagnosing performance issue...
Read Article →When the Invoke-MgGraphRequest Cmdlet Needs Help to Fetch Responses
Sometimes it's hard to get a response back from running a Graph API request with the Invoke-MgGraphRequest cmdlet. Graph Explorer helps. So does re...
Read Article →How to Block Ad-Hoc Email-Based Subscriptions
The old Set-MsolCompanySettings cmdlet is no more, so how can a Microsoft 365 tenant block email-based subscriptions? With the Graph, of course! Se...
Read Article →Hunting Through APIs
In today’s blog, we’re diving into the world of hunting through APIs. In the blog, the advantages, limitations, and scopes of the Graph...
Read Article →Poor man’s IGA: Generate Temporary Access Pass for joiners
Check out this article via web browser: Poor man’s IGA: Generate Temporary Access Pass for joiners Today’s challenge Today, we look at a join...
Read Article →Say Goodbye to Basic Authentication in Exchange Online: What You Need to Know
Prepare for the deprecation of Basic Authentication in Exchange Online by September 2025. Start detect legacy sign-ins (including ROPC) using Micro...
Read Article →SharePoint Online Dumps OTP Authentication for Sharing Links
After July 1, 2025, any sharing links generated with one-time passcodes (OTP) will stop working. Only links based on Entra ID B2B Collaboration wil...
Read Article →Data Strategy Breakdown Series - Defender XDR and Intune (4)
In Part 4 of the Data Strategy Breakdown Series, we explore how Defender XDR and Intune in your data strategy can transform security operations. Fr...
Read Article →How to Block PST Files for the New Outlook for Windows
An OWA mailbox setting is available to block PST access for the new Outlook for Windows client. The setting mimics controls available for Outlook c...
Read Article →Microsoft Entra Restricted Management Administrative Units: Delegating Control Without Sacrificing Security
Today, I’ll take a closer look at Microsoft Entra Administrative Units (AUs) and Restricted Management Administrative Units (RMAUs)...
Read Article →MDE-Troubleshooter v1.6.1 available
What’s new:– Inspired by Yong Rhee “Resolving High CPU Utilization in MDE” session, added additional options to run the Per...
Read Article →Respond to Teams Messages with Multiple Emoji Reactions
The need for more nuanced responses to Teams chat and channel messages can apparently be met through multiple emoji reactions instead of a basic on...
Read Article →Exchange Online Upgrades Its Message Tracing Capabilities
Microsoft announced the GA for the new message tracing feature on June 3. The old code will be deprecated in September 2025, so it's time to update...
Read Article →How to Enable Token Binding With Microsoft Graph PowerShell
Learn how to enable Token Binding for securely connecting to Microsoft Graph PowerShell with Token Protection. The post How to Enable Token Binding...
Read Article →Mailbox Import-Export Graph APIs Leave No Audit Trail
A recent post revealed that the Mailbox Import-Export Graph API doesn't capture audit events for its operations. The API is in beta, but this is di...
Read Article →Poor man’s IGA: Revoke all refresh tokens for user
Check out this article via web browser: Poor man’s IGA: Revoke all refresh tokens for user Today’s challenge Today, we look at Microsof...
Read Article →New Outlook and OWA Control for Viewing Protected Email
The new TwoClickMailPreviewEnabled setting in the Exchange organization configuration controls if OWA and the new Outlook for Windows use two-click...
Read Article →June 2025 Update Available for Office 365 for IT Pros (2025 Edition)
Monthly update #120 (June 2025) is available for the Office 365 for IT Pros eBook. This is the last update for the 2025 edition as the 2026 edition...
Read Article →Defender XDR - Custom Detection Rules Push/Pull via API
A little primer to pushing and pulling new content via the graph beta API - Jumping straight into this one, custom detection rules are similar to a...
Read Article →In-Depth Series: Microsoft Entra Risky Users and Risky Sign-Ins
Copyright © 2025 Microsoft Security - All Rights Reserved.
Read Article →How to Tell if Entra Connect is Using Application-Based Authentication
Learn how to use PowerShell to verify the authentication method your Entra Connect configuration is using to connect to Entra. The post How to Tell...
Read Article →Microsoft Launches the Copilot Interaction Export API
Microsoft will launch the aiInteractionHistory Graph API (aka, the Copilot Interaction Export API) in June. The API enables third-party access to C...
Read Article →Entra ID – Entra Connect – Secure App & Certificate-Based Authentication is here! Plus: I built you a better way to manage it
Last Updated on August 1, 2025 by Michael Morten Sonne Introduction Yes finally, it’s here! No more need… The post Entra ID – Entra Con...
Read Article →How to List Hidden Group Memberships with the Graph
A user reported that a script didn't list any details of hidden group memberships and asked why. The reason is that a separate Graph permission con...
Read Article →How to register all required Azure Compute resource providers with Azure PowerShell on a new subscription
In this blog post, you’ll learn how to use an Azure PowerShell script to automatically register all the necessary AzureContinue Reading
Read Article →Data Strategy Breakdown Series - Secure Collaboration (3)
In today’s hybrid work environment, secure collaboration is more crucial than ever. Over-sharing, under-securing, and mismanaging collaboration too...
Read Article →The Case of the Mysterious SharePoint Embedded Containers
A set of 80 mysterious SharePoint Embedded containers turned up because Microsoft pre-provisioned storage for files used as knowledge sources by Co...
Read Article →Microsoft Launches Agent Management in the Entra Admin Center
The prospect of agents running amok in Microsoft 365 tenants lessened a tad with the introduction of Entra Agent ID. Tenants will be able to manage...
Read Article →In-Depth Series: DLP Strategy with Microsoft Purview
Copyright © 2025 Microsoft Security - All Rights Reserved.
Read Article →Securing Microsoft Business Premium Part 05: Efficient Identity Management for External Users with Microsoft Entra
Managing external users is one of the most tedious—but also critical—challenges in a Microsoft Business Premium environment. With...
Read Article →Teams Tweaks its Discover Feed
The Teams Discover Feed highlights unread items from channels that users might have missed. Microsoft tweaked the feature so that it only works wit...
Read Article →Tutorial: Integrate AI into your Powershell scripts
I have been playing around with integrating AI into my favorite scripting tool: Powershell. This blog serves as a quick-guide ... Read more
Read Article →Troubleshooting Windows Feature Updates not being deploying using Intune/AutoPatch/WUfB
I have been banging my head why some machines wouldn’t deploy Windows 11 Windows Feature Updates (24H2) as part of ... Read more
Read Article →Azure Arc – Introducing AACMAToolkit: A New Azure Arc Management Tool
Last Updated on May 23, 2025 by Michael Morten Sonne Introduction Managing Azure Arc Connected Machine Agents just… The post Azure Arc – Intr...
Read Article →June 2025 Update for the Automating Microsoft 365 with PowerShell eBook
The June 2025 update for the Automating Microsoft 365 with PowerShell eBook is now available. Coding automation with Microsoft 365 PowerShell can b...
Read Article →Microsoft Defender for Identity Recommended Actions: GPO assigns unprivileged identities to local groups with elevated privileges
Identity leverages Secure Score with twenty-seven recommended actions. In a series of blog posts, I will go through all twenty-seven recommended ac...
Read Article →How to Add a Loop Workspace to a Standard Teams Channel
The update to allow team members to add a Loop workspace as a channel tab is now rolling out and should be available worldwide soon. Microsoft is c...
Read Article →M365 License Assignment Report
Table of Contents Introduction Requirements Features How does it work? Interactive Authentication Client Secret Authentication Certificate Authenti...
Read Article →Quest Tool Migrates Protected Email and Files Between Tenants
A new feature of the Quest On Demand migration suite supports the tenant-to-tenant migration of Exchange and SharePoint content protected by sensit...
Read Article →Unlocking the Power of employeeHireDate in Entra ID Dynamic Groups
Check out this article via web browser: Unlocking the Power of employeeHireDate in Entra ID Dynamic Groups Disclaimer: The main structure of this b...
Read Article →Entra ID Admin Roles Report
Table of Contents Introduction Requirements Features How does it work? Interactive Authentication Client Secret Authentication Certificate Authenti...
Read Article →Export Conditional Access Policy Files With CA Policy Copier
Use the CA Policy Copier browser extension to conveniently copy and export Conditional Access policies to JSON. The post Export Conditional Access ...
Read Article →Why Copilot Access to “Restricted” Passwords Isn’t as Big an Issue as Uploading Files to ChatGPT
Some sites picked up the Microsoft 365 Copilot penetration test that allegedly proved how Copilot can extract sensitive data from SharePoint Online...
Read Article →Microsoft 365 Copilot Gets Viva Insights Service Plans
Two new service plans are now in the Microsoft 365 Copilot license to allow users access to Viva Insights. The new service plans enable the Copilot...
Read Article →Whats New in Windows Autopatch
Learn how Windows Autopatch lets you orchestrate updates for Windows, Microsoft 365 Apps, Microsoft Edge, and Teams. All from a single automated so...
Read Article →Time to Review How to Preserve Ex-Employee Data
This week's Microsoft layoffs provide a timely reminder to review how to retain and secure ex-employee data. OneDrive for Business might be the big...
Read Article →Microsoft Graph PowerShell SDK V2.28 Attempts to Restore Stability
On May 10, 2025, Microsoft released V2.28 of the Microsoft Graph PowerShell SDK in the hope that the new version would fix a bunch of annoying prob...
Read Article →Replacing Litigation Holds with Microsoft 365 Retention Policies
Litigation holds can retain mailbox data, but that's it. You can swap litigation holds out for a Microsoft 365 retention policy and gain extra func...
Read Article →Entra ID – Managed Identity Permissions Manager – Performance Stats and Community Insights
Last Updated on May 13, 2025 by Michael Morten Sonne Introduction Here is a small update on my… The post Entra ID – Managed Identity Permissi...
Read Article →Use an OWA Mailbox Policy to Block Attachment Download for the New Outlook for Windows
The ConditionalAccessPolicy setting in an OWA mailbox policy can be configured to work with Entra ID conditional access so that OWA blocks access t...
Read Article →Eligible PIM Enabled Group Membership via Access Packages
How to create an Access Package that enables you to become eligible for a PIM enabled group in Microsoft Entra. The post Eligible PIM Enabled Group...
Read Article →Microsoft Sentinel UEBA: 2025 Guide to Behavior Analytics
Copyright © 2025 Microsoft Security - All Rights Reserved.
Read Article →Penetration Test Asks Questions About Copilot Access to SharePoint Online
An article by a company specializing in penetration tests raised some questions about how attackers might use Copilot for Microsoft 365 to retrieve...
Read Article →Register Yubikeys on behalf of your users with YubiEnroll
Check out this article via web browser: Register Yubikeys on behalf of your users with YubiEnroll In an earlier post, I showed several ways to (bul...
Read Article →How to Enhance Copilot Usage Data
Copilot usage data can be pretty sparse, but it's easy to enhance the data to gain extra insight into how Microsoft 365 Copilot is used within a te...
Read Article →Use Custom Extensions for Access Package approval in Entra
You can now use custom extensions to enable an external system to determine the approver of an Access Package in Microsoft Entra. The post Use Cust...
Read Article →The Downside of Losing the Exchange Mailbox Audit Search Cmdlets
Microsoft recently announced the deprecation of the Exchange cmdlets to search for mailbox audit data. The audit data is ingested into the Microsof...
Read Article →Azure Arc: Keep your Azure Connected Machine agent up-to-date on a Windows Server
In this blog post, you’ll learn how to keep the Azure Connected Machine agent up-to-date on Azure Arc-enabled Windows servers,Continue Reading
Read Article →Data Strategy Breakdown Series - Basic Security Hygiene (2)
A rapid-fire guide to basic security hygiene in Microsoft 365. This no-fluff checklist covers MFA, legacy auth, admin protection, spoofing preventi...
Read Article →Defender for Office 365: Visualisation of the Tenant Allow/Block List features
During my work with customers, when I explain the tenant allow and block features in Microsoft Defender for Office 365 P1/P2, I often get the quest...
Read Article →How to Permanently Remove Mailbox Items with the Graph API
Some new Graph APIs were announced on April 1 to close a feature gap with EWS. The new APIs permanently remove mailbox items and other objects, inc...
Read Article →How Microsoft 365 Copilot Tenants Benefit from SharePoint Advanced Management
At Ignite 2024, Microsoft said that Copilot for Microsoft 365 tenants would benefit from SharePoint Advanced Management (SAM). What does that mean?...
Read Article →How to restrict Device Code Flow in Entra ID
Check out this article via web browser: How to restrict Device Code Flow in Entra ID For good reasons, device code flow in Entra ID is getting a lo...
Read Article →Investigating ClickFix Incidents
With ClickFix being one of the popular delivery methods for malware, infostealers and state-sponsored hackers it is time to share a blog on investi...
Read Article →Microsoft Extends DLP Policy for Copilot to Office Apps
First introduced in March 2025 to block access to sensitive documents by BizChat, Microsoft has extended the DLP policy for Copilot to cover the we...
Read Article →Time for a new lab enviroment – Part 1
Last Updated on May 4, 2025 by Michael Morten Sonne Introduction 🧑💻 I’m excited to share that I’m… The post Time for a new lab envirom...
Read Article →Find Least Privileged Roles for Delegated Graph API Permissions
Learn how to find least privileged Microsoft Entra roles for Microsoft Graph API delegated permissions to align with best practice. The post Find L...
Read Article →The Return of the General Channel
Last year, Microsoft removed the need to have a General channel in a team. Now the General channel is making a comeback, and you can choose to have...
Read Article →May 2025 Update for the Office 365 for IT Pros eBook
Subscribers for Office 365 for IT Pros (2025 edition) eBook can download the May 2025 updates (#119) now. Update #11.3 for the PowerShell book is a...
Read Article →Data Strategy Breakdown Series - Defence in depth & Zero Trust (1)
In this first post, we explore how to create a strong data security foundation using defence in depth and Zero Trust strategies. With identity now ...
Read Article →Microsoft 365 Security & Compliance User Group
Together with Thijs, I gave our updated session on how we architect a SOC on top of Microsoft Defender XDR and Microsoft Sentinel. Since there were...
Read Article →Microsoft Introduces Control for Direct Send in Exchange Online
The Direct Send feature allows apps and devices to send unauthenticated email via Exchange Online to internal receipts. Microsoft doesn’t want unau...
Read Article →How to Find Active EWS-Based Apps in a Microsoft 365 Tenant
Microsoft will retire Exchange Web Services (EWS) from Exchange Online on October 1, 2026. A new usage report helps tenants understand what apps us...
Read Article →Automating Microsoft 365 with PowerShell Update #11
Update #11 for the Automating Microsoft 365 with PowerShell eBook is now available for subscribers to download. The eBook is now over 300 pages lon...
Read Article →Creating a CCP connector: Part 4
Hi there! Welcome (back) to my blog series about building a connector using Microsoft’s Sentinel Codeless Connector Platform (CCP). In the previous...
Read Article →Go With the Flow: Mastering Microsoft Entra User Flows—Self-Service Sign-Up in a Workforce tenant
Managing new guest accounts can be a daunting task—especially when you’re dealing with high turnover, distributed teams, or unknown user...
Read Article →How to Block the Use of Direct Send in Exchange Online
Block direct send capabilities in Exchange Online and encourage stronger email authentication for devices and applications. The post How to Block t...
Read Article →How to block the creation of Client Secrets on Entra applications
Learn how to prevent application owners in Microsoft Entra create new client secrets or certificates on their application. The post How to block th...
Read Article →Detecting non-privileged Windows Hello abuse
Introduction I recently followed a live session of Dirk-Jan Mollema and Ceri Coburn on how Windows Hello for Business can be abused as a non-privil...
Read Article →Copilot’s Solution to Fix Grammar and Spellings
Microsoft 365 Copilot will soon introduce a feature to fix spelling and grammar errors with one click. At least, that's the promise when Microsoft ...
Read Article →Replacing Litigation Holds with an eDiscovery Case
Litigation holds were great when introduced with Exchange 2010. Fifteen years on, better methods exist to preserve user information, like eDiscover...
Read Article →Microsoft Retires Exchange Server OWA Access to Online Archives
Microsoft's April 17 announcement that OWA in Exchange Server will not support access to online archives after May 12, 2025, surprised quite a few ...
Read Article →Modern data security challenges: defence in depth approach
When we talk about data security, we’re essentially talking about cybersecurity at large - because data is what the bad actors are ultimately after...
Read Article →Exchange Online Moves Closer to Dumping EWS
Microsoft is introducing a Dedicated Exchange Hybrid App to facilitate the transition away from EWS to use Graph API requests for rich hybrid coexi...
Read Article →Microsoft Defender for Identity Recommended Actions: Unsafe permissions on the DnsAdmins group
Microsoft Secure Score helps organizations get insights into security posture based on security-related measurements. Microsoft Defender for Identi...
Read Article →An Account Blocked by MACE Credential Revocation is A Good Way to Start a Saturday Morning
The last thing you want on a Saturday morning is to find that Entra ID has blocked your account because of leaked credentials. Even though the acco...
Read Article →Report Conditional Access Blocked Sign-in Metrics with PowerShell
How to use getMetricsForConditionalAccessBlockedSignIn Graph API to report Conditional Access blocked sign-in metrics. The post Report Conditional ...
Read Article →Continue to Sign in Prompt Part 2: Disable the DMA SSO Compliance
In this blog, we will examine how a recent big Windows change was introduced to meet Digital Markets Act (DMA SSO Compliance) requirements. This ch...
Read Article →How to Report the Sponsors of Entra ID Guest Accounts
Entra ID populates the sponsor property for new guest accounts with details of the person who invites the guest to the tenant. It's data that can b...
Read Article →Important Purview eDiscovery Changes Take Effect in May 2025
Microsoft is making some important changes to Purview eDiscovery from May 26, 2025. The changes affect how content searches work and are likely to ...
Read Article →Introducing the Microsoft Graph Copilot PowerShell module
Introducing the Microsoft.Graph.Copilot PowerShell module to help with interacting with Copilot related Graph APIs. The post Introducing the Micros...
Read Article →Licensing Auto-Label Policies for Sensitivity Labels
Microsoft Purview makes it easy to apply sensitivity labels to Office documents and PDF files with auto-label policies. Licenses are needed for aut...
Read Article →🚀 A huge thank you — and a little update behind the scenes
Last Updated on April 15, 2025 by Michael Morten Sonne First off — thank you so much for… The post 🚀 A huge thank you — and a little update b...
Read Article →Comprehensive Guide to Configuring Advanced Auditing
This post provides everything you need to ensure Advanced Auditing is fully configured and auditing everything we possibly can for both existing an...
Read Article →Entra ID to Disable Service Principal-Less Authentication
Microsoft will disable service principal-less authentication in March 2026. This step closes a hole that doesn't exist today but might in the futur...
Read Article →Microsoft Attempts to Fix Microsoft Graph PowerShell SDK Problem with Azure Automation
V2.26 and V2.26.1 of the Microsoft Graph PowerShell SDK were low-quality, buggy disasters. Microsoft aims to fix the problem in the next version to...
Read Article →Using Azure Arc only for Defender for Servers or Azure monitoring Agent? Lock it down!
Intro While reviewing Defender for Servers and AMA agent implementations across various customers, I noticed that not all of them are following bes...
Read Article →Defender for Identity – Unveiling Enhanced Visibility – New Service Account Monitoring Capabilities
Last Updated on April 13, 2025 by Michael Morten Sonne Introduction Service accounts are often the unsung heroes… The post Defender for Ident...
Read Article →Implementing Attack Surface Reduction Policies
Start implement Microsoft's Attack Surface Reduction (ASR) policies today!
Read Article →Are Microsoft E5 Licensing Add-Ons a Good Deal?
The Microsoft E5 Security add-on is available for Microsoft 365 Business Premium (and other) tenants. The add-on looks like a bargain because the b...
Read Article →Reporting the Creation of SharePoint Agents
Any site member can create a SharePoint agent. There’s no out-of-the-box method to report the creation of agents, but agents are created like any o...
Read Article →The “Continue to Sign in Prompt” That breaks the SSO
In this blog, we will examine why Windows shows the “Continue to sign in?” prompt when launching apps like Edge or Company Portal for the first time
Read Article →Use Auto-Label Policies to Protect Old Files from Copilot
Often Microsoft 365 tenants have large numbers of old but confidential documents that they need to protect and stop Microsoft 365 Copilot finding. ...
Read Article →Why Microsoft Purview projects fail before they even begin - and how to stop that from happening
Microsoft Purview isn’t just another tool you switch on and walk away from. It’s a full-on transformation.
Read Article →How to find non-privileged applications owners in Microsoft Entra
Use Microsoft Graph PowerShell to identify Entra applications that have owners who are not privileged users. The post How to find non-privileged ap...
Read Article →How to Report Who Shared What File From SharePoint Online Sites
File sharing is at the heart of SharePoint Online. Being able to report file sharing events by analyzing the audit log is a good skill for Microsof...
Read Article →🚀Introducing ASR Rule Inspector V2
Table of Contents Introduction What’s New in the V2? Intune vs Local Comparison – No More Policy Guesswork Detecting Duplicate and Conflictin...
Read Article →Microsoft Defender for Office 365 Exposes Bad Links in Email Preview
Microsoft Defender for Office 365 includes many tools to help investigators manage threat. The Email Preview tool shows the layout and appearance o...
Read Article →Entra Private Access and the future of the Entra App Proxy
Since the release of Entra Private Access, I have been getting more and more questions about the future of the Entra App Proxy. Will it still be ne...
Read Article →Bringing Artificial Intelligence to Entra ID Conditional Access
The Conditional Access Optimization Agent is one of 6 Security Copilot agents unveiled by Microsoft on March 24, 2025. The idea is that the agent c...
Read Article →Managing Restricted Groups with Access Packages
👮 Restricted Management Admin Units (RMAU) in #EntraIDHackers HATE This Hidden Entra ID Feature Most Admins Never Use@NathanMcNulty breaks it down ...
Read Article →Securing Microsoft Business Premium Part 04: Passwords Unlocked – Mastering Self-Service Password Reset and Password Protection
With authentication & authorization covered in the previous posts of the series, it's now time to dive into strengthening our password...
Read Article →Transferring Meeting Ownership From an Ex-Employee Can Be Hard Work
Neither Outlook nor Teams includes a transfer meeting ownership feature for user calendars. Moving meetings owned by an ex-employee to give someone...
Read Article →How SharePoint Online Restricted Content Discovery Works
Restricted Content Discovery (RCD) is a solution to prevent AI tools like Microsoft 365 Copilot and agents accessing files stored in specific sites...
Read Article →Office 365 for IT Pros April 2025 Update
The April 2025 Update for the Office 365 for IT Pros eBook is now available for subscribers to download. This is monthly update #118 for Office 365...
Read Article →How to Find Who Assigned Retention Labels to SharePoint Files
A reader asked if it's possible to discover who made retention label assignments for SharePoint files. The Files Graph API can't tell you who (or w...
Read Article →QuickPIM a multi-role PIM activation extension for Google Chrome
Use the QuickPIM Google Chrome extension to select and activate multiple PIM roles in Microsoft Entra at the same time. The post QuickPIM a multi-r...
Read Article →Another day, another Purview solution: Data Security Investigations
You know that saying "another day, another dollar"? Pretty sure when the songwriters came up with that, they weren’t talking about...
Read Article →Duplicate Mail User Objects Created for Guest Accounts
The February 2025 EX1015484 incident explains why mail user objects with duplicate SMTP addresses are created for guest accounts. That’s a problem ...
Read Article →Artificial Intelligence, PowerShell, and Microsoft 365 Administration
Artificial Intelligence and PowerShell should be a good thing to help hard-pressed Microsoft 365 tenant administrators cope with common tasks. The ...
Read Article →Entra Chat with Merill Fernando
It was such an honor to join Merill Fernando on Entra Chat, and I hope to join him again in the future. Be sure to check out Entra Chat: https://en...
Read Article →Automated incident triage with Security Copilot and Microsoft Sentinel/ Defender XDR
With the use of Security Copilot, it is possible to enrich and triage alerts automatically using GenAI data. Microsoft recently developed new SOC a...
Read Article →How to Stop Microsoft 365 Users Uploading SharePoint Online and OneDrive for Business Files to ChatGPT
Microsoft 365 users can connect their OneDrive for Business account to ChatGPT. This is not a great thing because it exposes the potential for sens...
Read Article →Microsoft Azure – Secure your Code with Trusted Signing: A Practical Guide
Last Updated on March 25, 2025 by Michael Morten Sonne Intoduction 🥳 Exciting News! Trusted Signing has launched… The post Microsoft Azure – ...
Read Article →New MiToken Graph PowerShell module for multi-tenant apps
Connect to multi-tenant apps using a managed identity using Microsoft Graph PowerShell with the MiToken PowerShell module. The post New MiToken Gra...
Read Article →Proactive Exposure hunting: OAuth Applications and Azure permissions
Intro Microsoft recently announced that OAuth applications are now integrated into the attack path experience within Exposure Management. This...
Read Article →Why Teams Clients Prompt for Your Location
Teams Windows and Mac desktop clients have started to prompt users about location privacy. Location data is used by several Teams features like the...
Read Article →ASR Rules: The Importance of Configuration and Verifying with the “ASR Rule Inspector”
Introduction In today’s evolving threat landscape, cybercriminals continuously exploit vulnerabilities in systems and applications. Attack Surface ...
Read Article →Creating a CCP connector: Part 3
Hey there, glad to see you’re still with me on this journey! If this is your starting point, you might want to considered reading the previous part...
Read Article →Defender for Cloud: AI Posture Management & AI Workload Protection
Artificial intelligence (AI) tools and Large Language Models (LLM) behind those tools have become a talking point and for some, the new Google sear...
Read Article →Microsoft’s Attempts to Improve the Teams UI Are Not Always Successful
Microsoft is tweaking the auto-hide inactive channels feature to make it less automatic and more user controllable (opt-in). It's a good change for...
Read Article →Seal the gaps: new Microsoft Purview data security controls for the browser & network
Introduction Microsoft Purview is stepping up its game again, and this time, they’re bringing data security to the network layer and...
Read Article →Microsoft Purview Series - Part 4
Copyright © 2025 Microsoft Security - All Rights Reserved.
Read Article →Copilot in Outlook Gets a Revamp
Microsoft has given the Copilot for Outlook UI a revamp to make the UI easier to use. The new UI is certainly better and reveals the option to rewr...
Read Article →Use Data Loss Prevention to Stop Microsoft 365 Copilot Chat from Processing Documents in Its Responses
The DLP policy for Microsoft 365 Copilot blocks access to sensitive files by checking for the presence of a sensitivity label. If a predesignated l...
Read Article →AI workload threat protection in Microsoft Defender for Cloud
Recently, Microsoft announced a new protection plan for AI workloads as part of the Microsoft Defender for Cloud suite. AI security is becoming mor...
Read Article →Create a free Enterprise App Permissions report in Microsoft Entra
Quickly report on all Enterprise Application Permissions and Activity using this Free script in Microsoft Entra. The post Create a free Enterprise ...
Read Article →Creating a CCP connector: Part 2
Hey there, welcome back! In this blog series I’ll show you how you can make your own Sentinel Codeless Connector Platform (CCP) connector. If you h...
Read Article →MDE Device Discovery - Improving the monitored network page
Introduction This blogpost is probably the first of a series that I will create in the coming months on Device Discovery. I regularly see organizat...
Read Article →Securing Azure PaaS Resources With Network Security Perimeter
Have you seen Azure environments with resources that have public access allowed or just some limitations to the IP addresses in place? Well, I have...
Read Article →Securing Microsoft Business Premium Part 03: Authorization Best Practices from Zero Trust to Complete Access Control
In Part 02 , we explored authentication , the process of verifying user identities—ensuring users are who they claim to be. Today we’ll...
Read Article →Updating Email Addresses After Removing Domains
Microsoft 365 makes it easy to remove domains. However, if you remove a domain and don't adjust email proxy addresses, some fix-up might be needed ...
Read Article →Facilitator Agent Brings AI-Powered Notetaking to Teams Chat
The Facilitator agent can make sense of the messages posted to a Teams chat and summarize the discussion and extract to-do items and unanswered que...
Read Article →How to authenticate with Windows Hello for Business or FIDO security key in RDP session ?
This little guide will show how you can authenticate with Windows Hello for Business and FIDO2 security key in a ... Read more
Read Article →Securing Azure Identities: The “New” Perimeter in Cybersecurity
As cloud computing becomes more integrated into our daily operations, the importance of securing identities in Azure can’t be overstated. Gone are ...
Read Article →Creating a CCP connector: Part 1
Hey there! In this blog series I’ll be going to walk you through a step by step guide on how to build your own Codeless Connector Platform (CCP) da...
Read Article →Future-Proofing Microsoft Entra Logs: Practical Azure Storage
Copyright © 2025 Microsoft Security - All Rights Reserved.
Read Article →Signtool GUI – v. 1.4.0.0 is out!
Last Updated on March 17, 2025 by Michael Morten Sonne Introduction I’m thrilled to announce the latest release… The post Signtool GUI ...
Read Article →Time to Remove the Old Report Message Add-Ins
Microsoft says that the Report Button is now available for all Outlook clients and it's time to remove the old Report Phishing and Report Message a...
Read Article →MS MFA Mandate: Essential Insights and Strategies
Introduction: Setting the Stage for Microsoft’s Secure Future Initiative
Read Article →Common mistakes you may be making with Data Loss Prevention
Avoiding data breaches starts with knowing what not to do. In this guide, we break down the common mistakes in Data Loss Prevention that even exper...
Read Article →SharePoint Online PowerShell Module Gets Modern Authentication
Microsoft has announced that the SharePoint Online PowerShell module will be upgraded from the very old and now obsolete IDCRL protocol to use mode...
Read Article →Secure Score Series - Disable Local Storage of Passwords
Copyright © 2025 Microsoft Security - All Rights Reserved.
Read Article →Why Only Web-Based Outlook Clients Can Recall Encrypted Email
The new message recall facility has been around since 2022. Even after Microsoft revamped the feature in 2023, it's still only possible to recall p...
Read Article →Defender For Vulnerability Management
It's been a while since I have written a new blog. Today, I will discuss about Microsoft Defender Vulnerability Management add-on.
Read Article →How to Send Outlook Newsletters with Email Communication Services
Outlook Newsletters are intended for internal communications, at least for the preview. It's possible to take the HTML for a newsletter and send it...
Read Article →Create a free interactive Entra Authentication methods report
Use this free Microsoft Graph PowerShell script to create an interactive authentication methods report for Entra users. The post Create a free inte...
Read Article →Microsoft Imposes 1-Year Retention for Teams Meeting Attendance Reports
Microsoft has enabled a one-year retention policy for Teams meeting attendance reports. Tenants can't opt out of the policy or set a different rete...
Read Article →Declarative Device Management with Intune
How Microsoft / Intune is shifting to Declarative Device Management (DDM) by using the declared configuration service
Read Article →Exchange Online Restricts the Number of Dynamic Distribution Groups
Exchange Online is imposing a new tenant-wide limit of 3,000 Dynamic Distribution Groups. Few tenants might be affected, but the question might be ...
Read Article →Evilginx loves Temporary Access Passes too
Check out this article via web browser: Evilginx loves Temporary Access Passes too Evilginx is known for capturing user cookies, even if they are s...
Read Article →The New Outlook Gains Colored Folder Icons
Colored folder icons does not seem like a new feature that should appear in an email client that's been around for a long time, but the new Outlook...
Read Article →Using iOS Build Numbers in Exchange ActiveSync Device Access Rules
A change made in late 2024 allows Microsoft 365 tenants to use IOS build numbers in Exchange ActiveSync device access rules. Apparently, the idea i...
Read Article →How to Create and Send an Outlook Newsletter
Outlook Newsletters is an app for the new Outlook and OWA that allows users to create and send good-looking newsletters to internal recipients. It’...
Read Article →Create a Free Interactive License Usage Report for Microsoft 365
Easily identify wasted Microsoft 365 licenses with this free PowerShell script to generate an interactive HTML report. The post Create a Free Inter...
Read Article →Microsoft Graph PowerShell SDK V2.26.1 Remains Flawed
The developers rushed out Version 2.26.1 of the Microsoft Graph PowerShell SDK to fix some obvious issues. Alas, problems persist in PowerShell SDK...
Read Article →Configure automatic Attack Disruption in Microsoft Defender XDR
Microsoft Defender XDR includes a powerful response capability with the name Attack Disruption. As part of the Defender XDR solution attack disrupt...
Read Article →God Mode with a Timer: Using Logic Apps to Restrict Elevated Access in Entra
In my last post I covered how to monitor the GOD Mode in Azure (Coined by the great John Savill ). While visibility and monitoring are...
Read Article →Office 365 for IT Pros March 2025 Update
The Office 365 for IT Pros writing team is thrilled to announce that monthly update #117 for March 2025 is now available for subscribers to downloa...
Read Article →New PAYG Service to Classify Historical SharePoint Data
There's no doubt that SharePoint Online sites and OneDrive for Business accounts hold lots of old files. A new On Demand Classification PAYG servic...
Read Article →Azure Spring Clean - Maestering Azure Tenant Security
A look into how we can utilize Maester to secure our Azure Tenant with a sprinkle of AI on top - Welcome back! This time, I’m writing a contributio...
Read Article →Language Packs? I Just Told My Computer to ‘Figure It Out.’ Apparently, It Did.
Do you know that moment? You’ve got your Intune environment perfectly set up, Autopilot profiles configured, and you think, ‘Yes, world...
Read Article →SharePoint Online Adds Support for Sensitivity Labels with User Defined Permissions
SharePoint Online will add support for files protected with user-defined permissions from March 2025. This step will enable support for Microsoft S...
Read Article →Microsoft Removes Reactivation Fee for Archived SharePoint Sites
Microsoft 365 Archive will no longer charge fees to reactivate archived SharePoint Online sites after March 31, 2025. The good news might encourage...
Read Article →Things you should know before rolling out device-bound passkeys in Microsoft Authenticator App
Check out this article via web browser: Things you should know before rolling out device-bound passkeys in Microsoft Authenticator App As passkeys ...
Read Article →How to bulk provision QR code authentication in Microsoft Entra
Learn how to use Microsoft Graph PowerShell to bulk provision the QR Code method authentications for users. The post How to bulk provision QR code ...
Read Article →Microsoft Graph PowerShell SDK Runs into Choppy Waters
A bunch of problems with V2.26 of the Microsoft Graph PowerShell SDK V2.26 make the software unusable. Not only did Microsoft do a horrible job of ...
Read Article →Why Using a DEM Account for Windows Autopilot is a Bad Idea
In this blog (not technical this time…sorry), we’ll explore why Microsoft does NOT support Device Enrollment Manager (DEM) for Autopilot, the...
Read Article →Tracking Down Bootleg Copies of Office 365 for IT Pros
Free downloads of Office 365 for IT Pros, normally in PDF format, are available from sites around the internet. All are illegal and outdated copies...
Read Article →Workspace Transformation Rules in Practice
This post will show you two very useful workspace transformation rules that you can use to save money on your data ingestion in Microsoft Sentinel....
Read Article →Another Nail in the Exchange Web Services Coffin
Exchange Web Services (EWS) will retire in October 2026. Tenants that still need to use EWS must explicitly set EWSEnabled to true in the organizat...
Read Article →Here we go!
Its time to start my blog… 🥳 It has been some time since I had a blog. I have been writing into company blogs and LinkedIn but the idea brewe...
Read Article →How to convert PSCustomObject to Hashtable with PowerShell
Learn how to convert a PSCustomObject to a Hashtable in PowerShell making it filterable using the Where cmdlet. The post How to convert PSCustomObj...
Read Article →Why Microsoft 365 Copilot Works for Some and Not for Others
Some people get great results from AI tools like Microsoft 365 Copilot. Others struggle to make Copilot useful. As an article by a Microsoft produc...
Read Article →Device Query for Multiple Devices, Device Inventory, and Single Device Query: Connecting the Dots
If you’ve ever tried troubleshooting a single device, you know how useful tools like Single Device Query can be pretty helpful. It’s fast, accurate...
Read Article →Processing Multiple Message Attachments with the Microsoft Graph PowerShell SDK
Many examples are available online to explain how to add a single attachment to messages using the Microsoft Graph PowerShell SDK. Here we look at ...
Read Article →Unleash the power of Enterprise Exposure Graph: Create a Managed Identities Permissions Overview
Intro Lately, I’ve been exploring Microsoft Exposure Management, particularly the data available in the Enterprise Exposure Graph. One intere...
Read Article →How to find over licensed privileged accounts in Microsoft Entra
Learn how to find over licensed accounts with privileged roles in Microsoft Entra using Microsoft Graph PowerShell. The post How to find over licen...
Read Article →Unlocking Microsoft Entra’s Elevated Access Logs: Better Security, Better Insights
Elevating access to manage Azure subscriptions is a valuable tool for administrators, particularly when dealing with unknown or orphaned...
Read Article →Update #9 for Automating Microsoft 365 with PowerShell eBook
The Automating Microsoft 365 with PowerShell eBook is now at update #9. The latest update spans 300 pages of content covering how to use PowerShell...
Read Article →Purview Retires the Events Alert Capability from Audit Solution
Microsoft has announced the removal of events alerts from the Purview Audit solution. Fortunately, the decision doesn't affect activity alerts. Aud...
Read Article →Correlating Defender for Endpoint and Global Secure Access Logs
Introduction If you are working with Microsoft security solutions, you might have heard of the new kid on the block called Microsoft Global Secure ...
Read Article →How to protect against Device Code Flow abuse (Storm-2372 attacks) and block the authentication flow
Since August 2024 there has been a sophisticated phishing campaign actively leveraging the device code authorization flow. Currently, there is a wi...
Read Article →Microsoft Graph PowerShell SDK Needs to Fix Its Password Problem
The Microsoft Graph PowerShell SDK offers developers easy access to data across the Microsoft 365 ecosystem and that’s good. However, there's a pro...
Read Article →How to Index and Search SharePoint Online Custom Columns
SharePoint Online is basically a big Azure SQL application. Custom columns for sites and libraries enhance metadata and are even better if they're ...
Read Article →Common mistakes during Microsoft Defender for Endpoint deployments
Microsoft Defender for Endpoint (MDE) is part of Microsoft Defender XDR and can be deployed via multiple configurations. During my experience with ...
Read Article →How to Use Bulk User Operations in Entra Admin Center
A new preview option in the Entra admin center supports the ability to update multiple Entra ID accounts. You can update properties, add managers a...
Read Article →Conditional Access risk policies. Don’t get fooled!
Check out this article via web browser: Conditional Access risk policies. Don’t get fooled! Microsoft Entra ID Protection and Microsoft Entra...
Read Article →MAM vs. MDM: Choosing the Right Mobile Management Approach
With the increasing reliance on mobile devices in the workplace, organizations must choose the right strategy to manage and secure corporate data. ...
Read Article →New bulk edit features for users in Microsoft Entra ID
Microsoft have released new bulk edit functionality in the Microsoft Entra admin center, check out how to use it and how it works. The post New bul...
Read Article →Use Protected Actions to Stop Attackers Hard-Deleting Entra ID Accounts
An article about the horrible devastation that an attacker can wreak inside a compromised Microsoft 365 tenant highlighted how protected actions ca...
Read Article →Primer: Using Exchange Online PowerShell in Azure Automation Runbooks
In this primer, we cover how to create and execute Azure Automation Exchange Online runbooks (scripts) using cmdlets from the Exchange Online manag...
Read Article →Securing Microsoft Business Premium Part 02: Your Authentication is Broken—Here’s How to Fix It
In the first part of this series, we laid the foundation for securing Microsoft Business Premium environments, covering the core security...
Read Article →How to check for OAuth apps with specific Graph permissions assigned
OAuth apps are still an important target for attackers to misuse in organizations. Since the MFA baseline is improved with number matching and addi...
Read Article →Maester Framework Continues to Prosper
The Maester project continues to prosper with a bunch of new features added, including several in the DevOps space. Maester usually tests tenant se...
Read Article →🚀 Managed Identity Permission Manager v1.1.0.0 is here! 🚀
Last Updated on February 6, 2025 by Michael Morten Sonne Introduction I’m beyond excited to announce that the… The post 🚀 Managed Ident...
Read Article →MC2MC Connect
Speaking at my very own event, that was something else! I brought my session about how Microsoft Defender for Endpoint and Global Secure Access to ...
Read Article →Microsoft Introduces People Administrator Role
A new people administrator role is available in Entra ID. The new role allows holders to manage settings associated with people, like pronouns and ...
Read Article →How to register for QR code authentication in Microsoft 365
Learn how to register a QR code authentication in Microsoft 365 and enforce the policy via Conditional Access. The post How to register for QR code...
Read Article →Interpreting SignIn Audit Records for Service Principals
Entra ID retains audit log records for service principal signins for 30 days. The audit data can reveal some interesting insights such as the prese...
Read Article →Workplace Ninja Connect Netherland
I was honored to bring my session on how Microsoft Defender for Endpoint and Global Secure Access can be used together to have better network detec...
Read Article →Entra ID Introduces New Graph Permissions for User Accounts
A set of new granular Graph permissions for User account management is now available to handle common operations like changing account passwords or...
Read Article →Protect deletion of directory objects using Conditional Access
Microsoft adds protection for permanently delete objects, which can no longer be restored using Protected Actions in Microsoft Entra. The post Prot...
Read Article →Tutorial: The fastest way to report a False negative in Defender for Endpoint!
Intro Encountering a false negative during a customer engagement can be a critical issue. Recently, I faced a similar situation where a particular ...
Read Article →Monthly Update #116 for Office 365 for IT Pros
Monthly update #116 (February 2025) is available for the Office 365 for IT Pros eBook. The refresh includes update #8 new files for the Automating ...
Read Article →Your Microsoft Entra Tenant Isn’t as Secure as You Think – Fix It with Protected Actions!
Protecting highly critical configurations in our Entra tenants has never been easier! Join me as we explore Protected Actions in...
Read Article →Find multi-tenant applications using weak authentication methods
Using Microsoft Graph PowerShell to filter the Entra sign-in logs to find multi-tenant applications using weak sign-in methods. The post Find multi...
Read Article →Operational Collections 2.0
I absolutely love the SCCM Operational collections from System Center Dudes, and while Intune has a different design that negates the need for scop...
Read Article →Readme
Blog Content Disclaimer 🤖 All content provided on this blog is for informational purposes only. The owner of this blog makes no representations as ...
Read Article →Getting more data from the CA Insights and Reporting Workbook
Log Analytics workbooks are pretty intuitive, but KQL is one of those things that can take a while to learn and use effectively. One of the coolest...
Read Article →Microsoft Azure – Elevate Access to Resources with Entra ID Audit Logs – Now Available!
Last Updated on January 31, 2025 by Michael Morten Sonne Introduction During my time in IT, I’ve occasionally… The post Microsoft Azure – Ele...
Read Article →Microsoft Reannounces Teams Policy to Suppress In-Product Messages
Microsoft reannounced the Teams policy to suppress certain categories of in-product advertising messages but has done nothing to control Teams pop-...
Read Article →Microsoft announce new People administrator role in Microsoft Entra
Learn about the new People Administrator roles recently announced by Microsoft as a built-in Microsoft Entra role. The post Microsoft announce new ...
Read Article →Microsoft Cloud Revenues Keep on Heaping Up
Microsoft’s FY25 Q2 results featured bumper Microsoft Cloud revenues, which broke the $40 billion mark for the first time. Although they wanted to ...
Read Article →The ShadowAdminPairs: A Deep Dive into Administrator Protection
Learn how the Administrator Protection feature in Windows 11 uses the ShadowAdminPairs key to map ENTRA user SIDs to local admins
Read Article →Monitor For New Actions In Sentinel And MDE
Sometimes I get the question, how can I keep up with all the new actions that are added to our security solutions? This question is very valid, as ...
Read Article →Primer: Using Exchange High Volume Email with Azure Automation
This article covers how to use HVE with Azure Automation to send email. HVE is Exchange Online's High Volume Email solution for internal communicat...
Read Article →Comparing Web Filtering and Security: Microsoft Entra Internet Access (Global Secure Access) vs. Microsoft Defender for Endpoint (MDE)
Organizations face increasing challenges in securing internet traffic and enforcing web access policies in today’s hybrid work environment. Two key...
Read Article →Entra ID – New build-in audit feature in Entra Connect is finally here!
Last Updated on January 28, 2025 by Michael Morten Sonne Introduction What is Entra Connect Sync Connect your… The post Entra ID – New build-...
Read Article →Primer: Running Audit Searches and Sending Email from Azure Automation
This article describes how to use Azure Automation for audit searches. The runbook runs an audit search to find events for specific operations, ref...
Read Article →Securing Microsoft Business Premium Part 01: The First Step to an Unbreakable Defense
Today kicks off a comprehensive blog series where I’ll delve into the security features of the Business Premium license SKU, offering...
Read Article →Super Advanced Auditing
This solution provides automation that ensures all available auditable events are enabled for all users in a tenant. By default, not all events are...
Read Article →Update #8 Available for Automating Microsoft 365 with PowerShell
Monthly update #8 is now available for the Automating Microsoft 365 with PowerShell ebook. Subscribers can download the updated files from Gumroad....
Read Article →Defender AutoConfig
This solution will eventually be a PowerShell module, but the initial goal was to map out all of the internal service APIs used in the Defender por...
Read Article →Microsoft accidentally allows users to update their own username
For a short while Microsoft allowed standard users in Microsoft Entra to change their own username. Learn how to remediate issues caused by this. T...
Read Article →One Full Scan
Microsoft typically recommends against scheduled full scans, but there are a few scenarios where we still want to perform a full scan outside of sc...
Read Article →Expanding on Cyber Threat Intelligence for Security Monitoring
Three levels of detection engineering using Threat Intelligence as our guiding light - This blog will serve as a guide to understanding how we can ...
Read Article →Entra ID Allows People to Update their User Principal Names
Entra ID allows unprivileged users to update the user principal name for their accounts via the admin center or PowerShell. It seems silly because ...
Read Article →Managed Identity Permission Manager – v. 1.0.0.4 is out!
Last Updated on January 24, 2025 by Michael Morten Sonne Introduction I´m thrilled to announce the release of… The post Managed Identity Perm...
Read Article →Navigating New Authentication Methods: SMS for Password Reset, Not for MFA
With the introduction of a converged policy combining settings from the legacy MFA portal and SSPR configuration, separating the use of SMS for pas...
Read Article →CAPremortem
Note Development on this solution is on hold until some other projects are finished. Plan to revisit in the second half of 2025.
Read Article →From SPF to DANE: Securing Microsoft 365 Email Communications
Enhancing the security of your organization’s communication channels is more critical than ever. Building on foundational protocols like SPF, DKIM,...
Read Article →Primer: How to Schedule Azure Automation Runbooks to Process Microsoft 365 Data
After creating a runbook to process Microsoft 365 data, registering the runbook with an automation schedule means that the runbook will execute on ...
Read Article →Device cleanup
Note This is currently being rewritten and should be completed in February 2025 :)
Read Article →MDE Analyzer²
This solution analyzes the output from the MDE Client Analyzer for common issue or things we might typically want to know for troubleshooting purpo...
Read Article →Primer: Output Data Generated with an Azure Automation Runbook to a SharePoint List
The second part of the Azure Automation runbook primer brings us to output, specifically how to create items generated by a runbook in a SharePoint...
Read Article →Primer: How to Use Azure Automation to Run Microsoft Graph PowerShell SDK Scripts
A reader asked why it seems so difficult to use Azure Automation runbooks to process Microsoft 365 data. In fact, it's not so hard, and here's a pr...
Read Article →Dual Enrollment / MMP-C Light for Workplace Joined Devices?
Explore WorkplaceJoin_DualEnrollment, dual enrollment for Workplace Join devices, and the role of MMP-C Light in shifting Intune policies
Read Article →Enable all auditable events
You likely aren’t collecting all available events to the Unified Audit Log :( First, not all events are enabled or retained optimally. Consid...
Read Article →How to Replace Group Owners When They Leave the Organization
Deleting an Entra ID user account can result in ownerless groups if the account being removed is the only group owner. Before deleting accounts, it...
Read Article →Kung Fu MMP-C Onboarding
This blog will show how I onboarded multiple Microsoft 365 Tenants to the new MMP-C infrastructure (Microsoft Management Platform – Cloud) and expl...
Read Article →Mastering Plus Addressing in Microsoft: Simplify Email Management
Managing emails for unlicensed admin accounts? Juggling a shared mailbox flooded with notifications from services and clients? Today’s...
Read Article →Restore Microsoft 365 users with a new username using PowerShell
Learn how to use Microsoft Graph PowerShell to restore Microsoft Entra users and issue them a new username at the same time. The post Restore Micro...
Read Article →Privacy Policy
Privacy Policy How to contact us Should you have any questions about this privacy policy, the data we hold on your, or you would like to exercise o...
Read Article →Microsoft 365 User Profile Card Gets Name Pronunciation
The Microsoft 365 user profile card offers users the chance to record and playback name pronunciations, if tenant settings allow. The new setting i...
Read Article →Microsoft Defender for Cloud Apps – Permissions filter and export capability is here!
Last Updated on January 16, 2025 by Michael Morten Sonne Introduction Microsoft Defender for Cloud Apps (MDA) has… The post Microsoft Defende...
Read Article →Microsoft Launches Copilot for All Initiative
The Microsoft 365 Copilot Chat app is the free to use chat app available to commercial Microsoft 365 customers. The free chat app now supports Copi...
Read Article →Final Days for the MSOnline and AzureAD PowerShell Modules
After many twists and turns since August 2021, the MSOnline module retirement will happen in April 2025. The AzureAD module will then retire in the...
Read Article →List all directory objects owned by a user in Entra with PowerShell
Learn how to use Microsoft Graph PowerShell to list all directory objects, such as apps and groups a user owns in Microsoft Entra. The post List al...
Read Article →Using the SharePoint Pages Graph API
Microsoft released the SharePoint Pages API in mid-2024. This article describes how to create and publish a news item using cmdlets from the Micros...
Read Article →How to Post Video Clips in Teams Channel Posts and Replies
In January 2025, Teams will support the ability to post video clips to channel conversations in posts and replies. The feature is similar to that r...
Read Article →Parsing CEF messages without Azure Monitor Agent
Introduction During my time as SOC Engineer, I do a lot of third-party data source ingestion projects for clients into their Microsoft Sentinel ins...
Read Article →On the use of Threat Intelligence in Detection
If applied correctly, Threat Intelligence can be a useful tool in your belt. Mostly, however, it might be barking up the wrong tree depending on yo...
Read Article →Seamlessly Migrating from Symantec Endpoint Protection to Microsoft Defender for Business
Discover how to migrate from Symantec Endpoint Protection to Microsoft Defender for Business seamlessly with tips and tools!
Read Article →The curious case of the missing Enterprise App
Troubleshooting a missing enterprise app issue in Entra ID during a zero-trust Conditional Access policy rollout with workaround solutions.
Read Article →All About the Office 365 for IT Pros GitHub Repository
The Office365ITPros GitHub repository holds over 300 PowerShell scripts showing how to interact with Microsoft 365 and Entra ID. Anyone can contrib...
Read Article →Enabling QR code sign-in for Microsoft Entra ID
Learn how to enable new preview QR code sign-in features using the Microsoft Graph API, which supports sign-factor sign in to Entra ID. The post En...
Read Article →9 ways to improve your M365 MFA deployment in 2025
Here are 9 ways you can improve the multi-factor authentication deployment in Microsoft 365 for your organisation in 2025. The post 9 ways to impro...
Read Article →OTP Verification Option for Teams Meetings
Microsoft is deploying the option for meeting organizers with Teams Premium licenses to use OTP verification to allow anonymous users to verify the...
Read Article →Protecting your Break Glass accounts in Entra now that MFA gets enforced on more and more Admin portals
As Microsoft continues to enhance security across its platforms, Multi-Factor Authentication (MFA) is becoming mandatory for an increasing number o...
Read Article →Teams Splits Recording and Transcription Settings for Meetings and Events
Microsoft plans some big changes for Teams recording and transcription policies in February 2025. Events like webinars and town halls get separate ...
Read Article →After 2 years a new release of MDE-Troubleshooter!
Lately, I’ve been doing a lot of Defender for Endpoint deployment/configuration troubleshooting, which prompted me to dust off my MDE-Troubleshoote...
Read Article →Governing OS Versions in Microsoft Intune: Best Practices and Configuration
In a modern managed workplace environment, ensuring that devices meet minimum operating system (OS) requirements is a critical aspect of security a...
Read Article →Microsoft Describes Top Five SharePoint Features Shipped in 2024
An interesting article by Microsoft’s Mark Kashman lists his top five SharePoint features shipped in 2024. Four of the five features involve extra ...
Read Article →Mastering Microsoft Azure RBAC & Entra ID Roles: Automated Role Assignment Reporting Across Your Tenant
As the season for audits approaches (though, let’s be honest, auditing should be an all-year-round endeavor), I’m excited to share a...
Read Article →Renewing Apple Enrollment Program, VPP Token, and MDM Push Certificate in Microsoft Intune and SCIM token in Entra.
Introduction Managing Apple devices in Microsoft Intune requires maintaining active integrations with Apple services. To ensure continued functiona...
Read Article →SharePoint Online Intelligent Versioning and the 500 Version Limit
SharePoint Online intelligent versioning uses algorithms to decide what file versions must be kept for file recoverability. Unwanted versions are d...
Read Article →How to check and block “malicious” browser extensions with Microsoft Defender and Intune?
In the past years, malicious browser extensions have been on the rise and are more popular to be used as part of cyberattacks. With the use of mali...
Read Article →How to use Microsoft Security Exposure Management (XSPM)
Microsoft Security Exposure Management is a new product/feature in the Defender XDR suite. This blog will explain more about it and the difference ...
Read Article →How to Create a Teams Avatar from a Photo
I've used Teams avatars for a couple of years but never liked them all that much. The chance to create a Teams avatar from a photo seemed like a gr...
Read Article →New eBook, “Demystifying Microsoft Defender for Servers” by James Agombar
I’m thrilled to share the launch of the new eBook, “Demystifying Microsoft Defender for Servers” by James Agombar 🎉 I had the ple...
Read Article →Microsoft Entra ID Governance: Show suggested access packages in My Access
Check out this article via web browser: Microsoft Entra ID Governance: Show suggested access packages in My Access Today’s post is about a ne...
Read Article →Viva Engage Items Show Up in Search Results
News that Viva Engage search results are included in the results generated by Office.com and SharePoint.com is not unexpected. Only certain Viva En...
Read Article →KQL Sources - 2025 Update
What started as a single blog is now becoming a yearly trend. More and more KQL related repositories are created, not only with a focus on security...
Read Article →Office 365 for IT Pros January 2025 Update
Monthly update #115 is now available for download by subscribers to the Office 365 for IT Pros (2025 edition) eBook. The files available to subscri...
Read Article →What a 2024 – a new year is now over and a new begings
Last Updated on January 2, 2025 by Michael Morten Sonne Introduction As 2024 is now over, I’ve been… The post What a 2024 – a new year is now...
Read Article →How to use Managed Identities for multi-tenant app authentication
Learn how to use Managed Identities for multi-tenant app authentication when using Microsoft Graph PowerShell in Azure Automation. The post How to ...
Read Article →MDM / Intune policies moving over to MMP-C
This blog will focus on how Wi-Fi and VPN resource access policies are being transferred (Authority change) from the old-school MDM stack to the MM...
Read Article →Tool Release: pwshuploadindicatorsapi
This module is a wrapper for the Microsoft Sentinel related Upload Indicators API, allowing you to upload indicators of compromise (IOC) to a Micro...
Read Article →Managed Identity Permission Manager – v. 1.0.0.3 is out!
Last Updated on December 23, 2024 by Michael Morten Sonne Introduction I’m thrilled to announce the latest release… The post Managed Identity...
Read Article →Microsoft now allows connecting to Multi-tenant apps using Managed Identities
Learn how to connect to other tenants using Managed Identity federation on your app registration in Microsoft Entra. The post Microsoft now allows ...
Read Article →Microsoft Search in Bing Gets the Bullet
On 19 December 2024, Microsoft announced the retirement of the Microsoft Search in Bing feature. Copilot is better at searching and presenting web ...
Read Article →Tool Release: pwshmisp
In an attempt to make using MISP easier, I have created a PowerShell module to interact with MISP. The release of this module is the first step tow...
Read Article →The Confusing Renaming of Microsoft 365 Copilot
Microsoft loves branding exercises. At least, that can be the only reason why the Microsoft 365 Copilot rename is happening. I can think of no othe...
Read Article →Blocking Microsoft 365 Copilot Making Inferences in Teams Meetings
The Copilot inference and evaluation policy controls if users can ask Copilot in Teams to evaluate the emotions of other meeting participants. It s...
Read Article →MC2MC Live - Forward to the Past
At MC2MC Live: Forward to the past I was able to give a session on how to manage Azure Bicep templates at scale and automatically. Very happy to ha...
Read Article →Microsoft Defender for Cloud Apps – Visibility into applications with highly privileged permissions, whether used or unused
Last Updated on December 19, 2024 by Michael Morten Sonne Intoduction The principle of Zero Trust emphasizes that… The post Microsoft Defende...
Read Article →Processing Microsoft 365 Retention Labels with the Microsoft Graph PowerShell SDK
Two types of retention labels are in use: Microsoft 365 retention labels and MRM retention tags. Clients hide the difference, but the Microsoft Gra...
Read Article →IOC hunting at scale
As the holiday season approaches and our schedules hopefully begin to open up, many of us find ourselves with a bit more time on our hands. This ti...
Read Article →Microsoft Entra Identity Governance Fundamentals: Lifecycle workflows
Join me as I connect the dots from my previous posts on the fundamental Identity Governance features in Microsoft Entra with Lifecycle...
Read Article →Microsoft Proposes a Horrible Change for the Search-UnifiedAuditLog Cmdlet
On December 12, Microsoft said that they want to make the Search-UnifiedAuditLog cmdlet use high completeness for all its searches. If implemented,...
Read Article →Troubleshooting the Properties Catalog Error 2147749902:
Troubleshooting error 2147749902 (WBEM_E_INVALID_NAMESPACE) isn’t always straightforward. What started as a simple Intune error turned into a Devic...
Read Article →Teams Gets Resizable Windows and More Pop-Out Panes
In January 2025, Microsoft will introduce resizable Teams windows for the Windows and Mac desktop clients. This is a fundamental change to the clie...
Read Article →Microsoft 365 Users to Get Outlook’s Org Explorer
Microsoft originally were going to license the Outlook Org Explorer to E3 and E5 users. Then they had the clever plan to license the feature throug...
Read Article →How to Configure Sensitivity Labels to Block Document Downloads from SharePoint Sites
The SharePoint Online Block Download Policy controls the ability to use features that rely on downloaded files (including temporary files), such as...
Read Article →February Deadline Looms for Legacy Exchange Tokens Used by Outlook Add-Ins
A February 2025 deadline looms for Outlook classic add-ins that use legacy Exchange tokens for authentication. Add-ins must switch to nested app au...
Read Article →New Option Available to Update Microsoft 365 User Profile
The scheduled retirement of Delve on December 16, 2024, meant that Microsoft had to create a new way for users to update their profile settings. Th...
Read Article →Device isolation and containment strategies
Introduction As a Security Operation Center, you want to be able to contain devices and users on a network as a response to an adversary event. How...
Read Article →Life is like a box of Enhanced Device Inventory Properties.
This blog will focus on a new Intune Core Feature called Windows Device Inventory (Resource Explorer). I will show you how this new Intune Feature ...
Read Article →Microsoft Entra Identity Governance Fundamentals: Access Packages
In this blog post, we’ll be covering the fundamentals of Access Packages in Microsoft Entra—it’s all about getting a solid understanding...
Read Article →Microsoft Kills Viva Goals
Microsoft's announcement of the Viva Goals retirement came as a complete surprise to the customers using Viva Goals to implement the OKR methodolog...
Read Article →How to receive Entra admin email notifications without a mailbox
Learn how to receive admin email notifications without a mailbox license using Plus addressing in Microsoft Entra. The post How to receive Entra ad...
Read Article →Under the hoods of the Windows Device Inventory Agent
This blog will show you the inner workings of the Device Inventory Agent
Read Article →Thwarting Social Engineering Attacks Against Teams Federated Chat
A recent report noted an increase in social engineering attacks through Teams federated chat. You can stop these attacks by limiting external acces...
Read Article →Use Requestor information in Entra ID Access Packages as input for Custom Extensions
Check out this article via web browser: Use Requestor information in Entra ID Access Packages as input for Custom Extensions In a previous blog pos...
Read Article →Workshop: Kusto Graph Semantics Explained
Ho, ho, ho… In Germany on the 6th of December we celebrate “Nikolaus”. Kids put out one shoe the night before in the hopes that,...
Read Article →Microsoft 365 Unifies Video Under Clipchamp Brand
A November 26 announcement says that Microsoft 365 Video will bring Stream and Clipchamp together under the Clipchamp brand. A lot of hard work ove...
Read Article →How to Switch OneDrive for Business Accounts to Intelligent Versioning
Intelligent versioning means that SharePoint Online manages file versions automatically and only keeps what's needed. The feature works for OneDriv...
Read Article →Request Temporary Access Pass on behalf of others via Entra ID Governance Access Package
Check out this article via web browser: Request Temporary Access Pass on behalf of others via Entra ID Governance Access Package While looking at t...
Read Article →The 0x80072F9A We Start From
This blog is a follow-up to the Windows Enrollment Attestation series. I’ll dive into why the AllowRecovery CSP is a game-changer and how it helped...
Read Article →Report Copilot user prompts and AI responses with PowerShell
Report a history of user prompts and the AI responses from Microsoft 365 Copilot using Microsoft Graph PowerShell. The post Report Copilot user pro...
Read Article →Using the Audit Log to Generate a Daily Action Summary for a User
This article describes how to report the audit events for a user over a single day. The task seems simple, but inconsistency in audit payloads make...
Read Article →Office 365 for IT Pros December 2024 Update
The Office 365 for IT Pros writing team is thrilled to announce the availability of the December 2024 update (monthly update #114). Current subscri...
Read Article →Passkeys 101: How Microsoft Entra Simplifies Passwordless Authentication
Today, we’re exploring passkeys—what they are, how they work, and how Microsoft’s latest GA features make passwordless authentication...
Read Article →Windows – Hotpatching is now possible on clients – rebootless updates is here!
Last Updated on June 2, 2025 by Michael Morten Sonne Introduction In a major step forward for reliability… The post Windows – Hotpatching is ...
Read Article →EDR Silencers and Beyond: Exploring Methods to Block EDR Communication - Part 1
For red teams and adversary alike it’s important to stay hidden. As many companies nowadays have EDR agents deployed those agents are always in foc...
Read Article →Finding Inactive Mailboxes Based on Message Trace Data
This article covers how to use Exchange Online message trace data to find inactive mailboxes based on their message send activity. The script proce...
Read Article →Announcing the Netskope CCP connector!
Over the past couple of weeks I’ve been working in close collaboration with the Netskope team to build and design a new Sentinel data connector for...
Read Article →Evilginx Mastery Course | What I learned
Check out this article via web browser: Evilginx Mastery Course | What I learned A couple of years back, I was really struggling to get Evilginx up...
Read Article →Proof of possession, Token Protection and Graph PowerShell, what’s next?
Learn about proof of possession and how it protects against access token replay attacks when using Microsoft Graph PowerShell. The post Proof of po...
Read Article →Fix: SENSE Service stuck in START_PENDING on WS2012R2 or WS2016? Check OOBE !
Intro This blog discusses a challenge I encountered with a client. They reached out for assistance in addressing issues during the deployment of De...
Read Article →Microsoft Changes Names for Sensitivity Label Permissions
Microsoft recently renamed the default set of sensitivity label permissions. Each permission defines the usage rights for a labelled item for users...
Read Article →The Problem of Document Mismatches and Cloudy Attachments
SharePoint generates document mismatch notifications when users create or update files with sensitivity labels that are higher than the site's cont...
Read Article →The Impact of Generative AI on Technology Websites
Generative AI tools are nice to have, but the LLMs used by these tools must come from somewhere. The impact of generative AI on technology websites...
Read Article →Microsoft’s Simple Message at Ignite: It’s All About AI
The slew of product announcements at the Microsoft Ignite 2024 conference included lots about AI and Copilot. This article covers some of the more ...
Read Article →Use the Microsoft Graph to Report Service Principal Sign-In Activity
Service principal sign-in activity is a new insight available in the Entra admin center. As explained here, it's also possible to use PowerShell to...
Read Article →Selfservice for hardware (OATH) tokens in Entra ID.
Check out this article via web browser: Selfservice for hardware (OATH) tokens in Entra ID. One of the longest-running previews in Entra ID is the ...
Read Article →Track Sensitivity Label Downgrades and Removals with Audit Log Data
The Purview Insider Risk Management solution can do all sorts of clever things, like tracking sensitivity label downgrades and removals as an indic...
Read Article →Microsoft Details Progress Towards a More Secure Exchange Online
In a November 18 post, Microsoft describes some Exchange Online security updates that are due to land between now and 2026. Some of the news is a r...
Read Article →Fixing Time Zone Issues in Windows Autopilot
Deploying Windows devices using Autopilot can be challenging, especially when devices are shipped from a supplier in China to various global locati...
Read Article →Microsoft to Enforce Mandatory MFA Requirement for Microsoft 365 Admin Center
In February 2025, Microsoft will begin enforcing a mandatory MFA requirement for the Microsoft 365 admin center. All connections to the Microsoft 3...
Read Article →Use the Audit Log to Find the Last Accessed Date for Documents
The unified audit log is full of interesting information about who did what and when they did it. In this article, I describe how to use file opera...
Read Article →GitHub Backup Tool – update 1.3.1.0 is out
Last Updated on November 14, 2024 by Michael Morten Sonne Introduction I’m thrilled to announce the latest release… The post GitHub Bac...
Read Article →Manage PIM Role Assignments with the Microsoft Graph PowerShell SDK
This article describes how to create eligible and active PIM role assignment requests using cmdlets from the Microsoft Graph PowerShell SDK. Althou...
Read Article →Graph permission scopes and delegate access in Microsoft Entra
Learn how Graph permission scopes and Entra RBAC roles enable users access to resources in the delegated auth type scenario. The post Graph permiss...
Read Article →How SharePoint Online Intelligent Versioning Interacts with Retention Policies and Labels
Intelligent versioning recently appeared in SharePoint Online. The purpose is to save storage by removing unnecessary versions. But retention polic...
Read Article →UAL = Unaligned Activity Logs
The unified audit log is a centralized repository for M365 user and admin activities. The activities originate from different applications, such as...
Read Article →Device Compliance: The Tpm-PreAttestationHealthCheck in Windows 24H2
Troubleshooting health attestation just got easier. With the introduction of the Tpm PreAttestationHealthCheck task, Windows now generates a detail...
Read Article →Microsoft to Separate Copilot and Teams Compliance Records
In a November 8 post, Microsoft says that Purview Data Lifecycle Management will allow tenants to split processing of Copilot interactions and Team...
Read Article →Microsoft Recommends the UnifiedRoleDefinition Graph API for Role Assignment Automation
Microsoft recommends that developers move from the older DirectoryRoles Graph API and use the UnifiedRoleDefinition API instead. Changing APIs will...
Read Article →Private Channels Just Don’t Get Any Respect
Microsoft launched private channels in November 2019. A lot has happened since, and private channels don't really get much attention these days. Th...
Read Article →How Microsoft Copilot Generates Compliance Records
A recent article about analyzing interaction records for Microsoft 365 Copilot led to the question if it’s possible to do the same for Microsoft Co...
Read Article →Microsoft recommends use of the unifiedRoleDefinition APIs
Look in the difference between the directoryRole and unifiedRoleDefinition APIs to understand what Microsoft is now recommending change. The post M...
Read Article →Exchange Online Adds Delicensing Resiliency
Microsoft announced Delicensing Resiliency, a new feature for tenants with over 10,000 paid seats, to avoid inadvertent data loss due to licensing ...
Read Article →Loop App Adds More Support for Sensitivity Labels
Container management label support is coming to the Loop app. Before it arrives, we look at how Loop supports sensitivity labels assigned to pages ...
Read Article →Entra ID Private Access with private integrated storage accounts
Introduction In the past couple of weeks, I worked on a project where I needed to provide access to a securely private integrated Azure Storage Acc...
Read Article →Fix Subscription Activation by automatically Removing Secondary Work or School Accounts.
When subscription activation gets stuck, it could be due to conflicting tenant accounts. This blog dives into how to fix subscription activation by...
Read Article →How to Use the Graph SDK to Manage Group-Based Licensing
Group-based licensing is a mechanism to make it easier to assign and manage product licenses for large sets of user accounts. In this article, we d...
Read Article →Restrict non-admin access to the Microsoft Entra portal with PowerShell
Learn how to restrict non-admin users access to the Microsoft Entra admin portal using Microsoft Graph PowerShell. The post Restrict non-admin acce...
Read Article →Managed Identity Permission Manager – v. 1.0.0.2 is out!
Last Updated on November 2, 2024 by Michael Morten Sonne Introduction I’m thrilled to announce the latest release… The post Managed Ide...
Read Article →Office 365 for IT Pros November 2024 Update
Monthly Update #113 (November 2024) for the Office 365 for IT Pros eBook is now available for download by current subscribers from Gumroad.com. An ...
Read Article →Create a Custom Copilot Agent for SharePoint Online
Copilot agents are part of Microsoft's Wave 2 initiative launched in September 2024. Basically, an agent restricts Copilot queries to a defined set...
Read Article →Autopilot Device Preparation (AVP2/AP-DPP): Hiding the Privacy Settings
In this post, I’ll show you how to streamline the Out-of-Box Experience (OOBE) setup process even if you’re using Autopilot Device Preparation ( AV...
Read Article →Introducing Azure DevOps Backup Tool 1.1.2.0: Security update!
Last Updated on January 21, 2025 by Michael Morten Sonne Introduction I’m thrilled to announce the latest release… The post Introducing...
Read Article →Why Are Per-User MFA Settings Available in the Entra Admin Center?
A reader asked why the Entra admin center includes an option to manage per-user MFA settings for accounts. I don't know why Microsoft added this op...
Read Article →Enablement of Passkeys in Authenticator with no key restrictions
Microsoft to enable passkeys in the Microsoft Authenticator app without the need to implement key restrictions. The post Enablement of Passkeys in ...
Read Article →How to Restore the Service Plan for a Microsoft 365 Product License
Many articles describe how to disable a service plan for a product license assigned to a Microsoft 365 account, but few cover how to enable service...
Read Article →How to bypass Microsoft Graph PowerShell access restrictions
Learn how to bypass Microsoft Graph PowerShell access restrictions and gain full directory access using PowerShell. The post How to bypass Microsof...
Read Article →How to Search for Email Protected by Sensitivity Labels
A reader asked how to find emails with sensitivity labels. Everyone knows that you can find SharePoint files protected by sensitivity labels, but w...
Read Article →Improving automated Sentinel detection validation.
IntroductionMicrosoft Sentinel offers a lot of features, one being the ability to manage your analytic rules (detection rules) as infrastructure as...
Read Article →Patch My PC Home Updater 5.0: Effortless Updates for Over 500 Apps
On October 23rd, 2024, Patch My PC dropped their brand new Home Updater version 5.0, and it’s a serious game-changer for home users. If you’ve been...
Read Article →The Incredible story of using the Windows Performance Recorder to troubleshoot your Enrollments.
In this blog, I will show you how to set up the Windows Performance Recorder and the Windows Performance Analyzer to troubleshoot Autopilot and Int...
Read Article →Entra ID Security Config Analyzer - Deep Dive into Configuration Assessment
A comprehensive analysis of security configuration assessment tools and methodologies for Microsoft Entra ID, including automated checks for condit...
Read Article →Conditional Access Policy Design Patterns for Zero Trust
Explore advanced design patterns for implementing Conditional Access policies in Microsoft Entra ID as part of a Zero Trust security strategy. Cove...
Read Article →Cyber back to school: Microsoft Token Theft Unveiled
Introduction I am thrilled to participate in the Cyber Back to School initiative hosted during cyber awareness month! This session is all about Pri...
Read Article →Managed Identity Permission Manager – A new tool is out to test – v. 1
Last Updated on October 25, 2024 by Michael Morten Sonne Introduction Introducing a new PowerShell tool for Managing… The post Managed Identi...
Read Article →Microsoft Says SMEs Can Benefit from Microsoft 365 Copilot
An October 17, 2024 report highlights how Microsoft 365 Copilot can benefit SMEs in terms of increased revenue and ROI. But the report is a marketi...
Read Article →Test Yourself Part 1: Identity
Some tips, tricks and tools to help you get started testing your own infrastructure. This is the part 1 where we'll look into identity and how you ...
Read Article →Securing Workload Identities in Microsoft Entra ID
Best practices for securing workload identities including service principals and managed identities in Microsoft Entra ID. Discusses credential man...
Read Article →How to Set Directory Synchronization Features with the Graph
Directory synchronization features control how the Entra Connect tool works when synchronizing accounts from Active Directory to Entra ID. The curr...
Read Article →Autopilot Error 0x80280009: TPM Attestation. What is going on?
In this blog, we’ll explore why 0x80280009 (aka TPM_E_FAIL) is becoming a more common headache, particularly in virtual machines. We’ll look at wha...
Read Article →How to Force Users to Sign in Weekly
A recent question asked how to force users to reauthenticate at 7AM every Monday. The solution seems to revoke access for user accounts. This artic...
Read Article →Advanced Privileged Identity Management in Entra ID
Deep dive into Microsoft Entra Privileged Identity Management (PIM) covering just-in-time access, approval workflows, access reviews, and integrati...
Read Article →Entra ID Protection: Understanding and Implementing Risk-Based Policies
Comprehensive guide to Microsoft Entra ID Protection's risk detection capabilities, including sign-in risk and user risk policies, risk investigati...
Read Article →Microsoft Releases Beta Version of New Cloud Licensing Graph API
A new Cloud Licensing API has turned up in the Microsoft Graph beta endpoint. Apparently, the new API aims to improve license management in various...
Read Article →Azure RBAC Security Best Practices and Common Misconfigurations
Detailed analysis of Azure Role-Based Access Control (RBAC) security considerations, including custom role design, least privilege principles, scop...
Read Article →Client Credentials - Client Certificate
Introduction The process is quite similar to the client secret flow described here, so be sure to take a look! The challenge here lies in generatin...
Read Article →Microsoft Graph Doesn’t Support Custom Attributes for Groups
Container management labels are an effective way to ensure that groups, teams, and sites have the right settings. The Graph doesn't support custom ...
Read Article →Report license usage rights with Microsoft Graph PowerShell
Learn how to report assigned license and service plans for users in Microsoft 365 using Microsoft Graph PowerShell. The post Report license usage r...
Read Article →Securing External Identities in Microsoft Entra ID
Security considerations for external collaboration using Microsoft Entra External Identities (B2B). Covers guest user lifecycle management, cross-t...
Read Article →Will Microsoft 365 Copilot Errors and Hallucinations Eventually Corrupt the Microsoft Graph?
Copilot errors in generated text can happen for a variety of reasons, including poor user prompts. If the errors end up in documents, they can infe...
Read Article →Hardening Entra ID
This is an update to a previous article I wrote on hardening Azure Active Directory. The idea of this update is to provide a table of default setti...
Read Article →Teams Revamps its Calendar with Outlook Components
The Teams calendar app is being refreshed in November 2024 when Teams takes on the calendar UI used by OWA and the new Outlook for Windows. The uni...
Read Article →Working with Copilot Pages
Copilot Pages are part of the September 2024 Copilot Wave 2 announcement. They're a good way to capture the text generated by Copilot in response t...
Read Article →Using the Members of a Dynamic Microsoft 365 Group to Populate an Adaptive Scope
Adaptive searches are a nice way to target users, sites, and groups for Purview retention processing. But a user adaptive scope can't select member...
Read Article →Client Credentials - Client Secret
Introduction The next authentication flow in my series will be the Client Credentials Flow. Be sure to check out the first one here! We will first ...
Read Article →Local Administrator Protection vs. EPM: The Differences Explained!
After posting the blog about Administrator Protection, one question kept coming up: What are the key differences between Administrator Protection v...
Read Article →No Reason to “Upgrade” Distribution Lists to Microsoft 365 Groups
The Exchange admin center feature to allow administrators to initiate an upgrade distribution list process to request group owners to migrate distr...
Read Article →How I Write PowerShell Scripts for Microsoft 365
The question of how best to write PowerShell for Microsoft 365 was asked during a TEC 2024 PowerShell workshop. There are many variables, and one h...
Read Article →The New Outlook for Windows Can Start without an Internet Connection…
Offline access is a fundamental feature for email clients. The new Outlook introduced initial support in June 2024. Now it can start without a netw...
Read Article →Free Teams Licenses Now Blocked for Federated Communications
Microsoft announced blocked Teams federated chat for trial tenants in June 2024. That block is now well and truly enforced. If you use an account i...
Read Article →Unleash The Power Of DeviceTvmInfoGathering
The DeviceTvmInfoGathering table in Defender XDR is one of the understudied tables of Defender For Endpoint. With only the small amount of four lis...
Read Article →Delve Retirement and User Profiles
The Delve browser app retires on December 16, 2024. It's time to check if the change will affect how people interact with user profiles in Microsof...
Read Article →How to automatically migrate to Authentication Methods policies
Learn how to automatically migrate to Authentication Methods policies in Microsoft Entra using the built in Wizard. The post How to automatically m...
Read Article →Adding a Custom Test to the Maester Tool
The Maester tool is a great way to get a security assessment for a Microsoft 365 tenant. Being able to create custom Maester tests makes it even be...
Read Article →Administrator Protection in Windows 11 Explained: How Microsoft Rebuilt Local Admin Security
This blog will focus on a new Windows 11 insider build feature, Administrator Protection, announced in the latest Windows Insider Canary build (277...
Read Article →Microsoft Defender for Identity – New posture recommendations focusing on Active Directory
Last Updated on January 21, 2025 by Michael Morten Sonne Introduction Here at my blog, im committed to… The post Microsoft Defender for Ident...
Read Article →Microsoft Retires the Revoke-SPOUserSession Cmdlet
Unsurprisingly, Microsoft announced the deprecation of the Revoke-SPOUserSession cmdlet for November 2024. The cmdlet is replaced by the Revoke-MgU...
Read Article →Bicep: Dynamic naming technique
Introduction When designing IaC modules finding the correct syntax to deploy a certain resource type is often not the hardest thing to do. What I f...
Read Article →How to deploy Enterprise App Catalog updates with PowerShell
Learn how to manage and deploy apps updates in the Intune Enterprise App Catalog using Microsoft Graph PowerShell. The post How to deploy Enterpris...
Read Article →SharePoint Oversharing, Governance, and Lifecycle
SharePoint Advanced Management (SAM) is a $3/user/month add-on that can help Microsoft 365 tenants manage problems like oversharing, data governanc...
Read Article →Making Sure that Outlook Puts Deleted Items in the Right Place
The Outlook (classic) client has a registry setting to control moving deleted items from a shared mailbox. The new Outlook for Windows client doesn...
Read Article →Cyber Back to School
I spoke together with my colleague Thijs Lecomte at Cyber back to School, where we recorded our session on how to architect a SOC on top of Microso...
Read Article →Office 365 for IT Pros October 2024 Update
The Office 365 for IT Pros team is delighted to announce the availability of monthly update #112. Subscribers for the 2025 edition can now download...
Read Article →Windows 11 24H2 released with Windows LAPS improvements
Windows 24H2 has been released with improvements to Windows LAPS, including new automatic account management features. The post Windows 11 24H2 rel...
Read Article →Accessing Online Archives with Outlook Mobile
Following a change made to Microsoft Synchronization Technology to support the new Outlook for Windows, Outlook mobile supports access to archive m...
Read Article →Report Enterprise App Catalog Updates in Intune with PowerShell
Learn how to use PowerShell to report available Enterprise App Catalog updates in Microsoft Intune with Microsoft Graph PowerShell. The post Report...
Read Article →Microsoft Graph PowerShell Book
Get the Microsoft Graph PowerShell book and learn to master managing your Microsoft tenant with Microsoft Graph PowerShell. The post Microsoft Grap...
Read Article →TEC 2024 Rolls Into Dallas
TEC 2024 (aka "The Experts Conference") takes place on Oct 1-2 at the Loews Arlington Hotel. TEC is a great conference for many reasons, notably th...
Read Article →Understanding Microsoft Entra Licensing With Multiple Tenants
Understand the one-person, one-license philosophy for when users need to be assigned Microsoft Entra licenses in multiple tenant scenarios. The pos...
Read Article →Azug @ Noest
At a recent community event, I presented a deep dive into various authentication flows in Entra Id, showcasing how to retrieve an ARC server from a...
Read Article →No Practical Way to Disable OneDrive for Business
Some organizations want to disable OneDrive for Business to force people to use SharePoint Online. This might have been possible in the past. It is...
Read Article →Troubleshooting Intune Enrollment: Solving the 0x80180031 MDM Not Configured Error
In this blog, we’ll dive into the common headache of enrolling existing devices to Intune and hitting the 0x80180031 error, often caused by the fac...
Read Article →DLP Policy Tips Get New Premium Conditions
MC894577 announces that DLP policy tips displayed in Outlook will soon support a set of new conditions. That's good, but the text of the announceme...
Read Article →Import and Export Automation rules for Microsoft Sentinel – Unified SOC Platform
Last Updated on January 21, 2025 by Michael Morten Sonne Intoduction Microsoft Sentinel, a security information and event… The post Import an...
Read Article →Installing the Entire Microsoft Graph PowerShell SDK Seems Like the Right Idea
An article described some benefits that could be gained from not installing the complete Microsoft Graph PowerShell SDK. The question is whether th...
Read Article →SecureChannelFailure Errors, and the Curious Case of the Failing IME
Have you ever struggled with Lenovo T480 or HP Elitedesk 800 G4 devices that refused to cooperate with Intune? In this blog, we unravel the saga of...
Read Article →How to Add Contacts to User Mailboxes From a CSV File
A recent script demonstrated how to import contacts into user mailboxes using a list in a SharePoint site as the source. With a quick change, a CSV...
Read Article →Introducing Azure DevOps Backup Tool 1.1.1.0: Update with new features and bug fixes!
Last Updated on June 21, 2025 by Michael Morten Sonne Introduction I’m thrilled to announce the latest release… The post Introducing Az...
Read Article →How Outlook Suppresses Duplicate Contacts (or Not…)
The new Outlook for Windows and OWA now can suppress duplicate contacts. This means duplicate contacts are hidden, not removed. Tests reveal that d...
Read Article →AI Revolution in Cybersecurity: Will It Replace or Redefine Them?
Copyright © 2025 Microsoft Security - All Rights Reserved.
Read Article →Get-Mailbox Versus Get-ExoMailbox
Microsoft's advice is to use the Get-ExoMailbox cmdlet instead of its older Get-Mailbox counterpart. Generally, this is good advice that you should...
Read Article →Windows Service Monitoring at Scale using Cloud Native Azure Components
Recently, I was challenged to build a scalable, cloud native solution that should be used for monitoring of critical Windows ... Read more
Read Article →Understanding ConsistencyLevel Eventual with Microsoft Graph PowerShell
Understand the difference between eventual and session consistency when writing and reading changes with Microsoft Graph PowerShell. The post Under...
Read Article →Using the Get-RecoverableItems Cmdlet to Report Recoverable Items
Sometimes you don't need the full-fledged Graph API to report details of items in Recoverable Items and the Get-RecoverableItems cmdlet can do the ...
Read Article →How to Report the Information Stored in Recoverable Items
This article explains how to use the Microsoft Graph PowerShell SDK to report Recoverable Items in a form that is usable for eDiscovery investigato...
Read Article →Register Yubikeys on behalf of your users with Microsoft Entra ID FIDO2 provisioning APIs
Check out this article via web browser: Register Yubikeys on behalf of your users with Microsoft Entra ID FIDO2 provisioning APIs Microsoft recentl...
Read Article →The New Entra ID Photo Update Settings Policy for User Profile Photos
A new Entra ID photo update settings policy aims to cure the mish-mash of existing settings controlling how user profile photos are updated in Micr...
Read Article →Deep Dive SSO in Entra Private Access
A few days ago, Microsoft announced that Global Secure Access is now generally available. Since I have been working with the product for some time ...
Read Article →Optimize Costs using Auxiliary Logs for Verbose Logging
Today, we use logging for many purposes including security hunting with SIEM (Sentinel), troubleshooting, performance telemetry, compliance reporti...
Read Article →Troubleshooting & Monitoring of Log Ingestion with Data Collection Rules
As I have outlined in the series of blogs, Azure Logging is based on Data Collection Rules (DCRs) and Azure ... Read more
Read Article →Copilot Usage Report APIs Available
In MC877369, Microsoft announced the availability of three Copilot usage reports in the Graph usage reports API to track usage of Copilot for Micro...
Read Article →Speaking at the Workplace Ninja Summit 2024
Next week it’s time again for the annual Workplace Ninja Summit in Lucerne, Switzerland. The summit will start on Monday September 16th till ...
Read Article →The Subscription Activation Journey: Stuck on Pro
The May update broke Windows Subscription Activation, causing devices to drop from Enterprise to Pro. The primary culprit was a breakdown in Multi-...
Read Article →Microsoft 365 Licensing Report Script V1.94
The Microsoft 365 Licensing Report PowerShell script has been upgraded to generate detailed license information and to deal with expired license su...
Read Article →Automatic Hiding of Teams Channels Continues
The Teams feature to hide inactive channels is now fully rolled out. Another recent change suppresses notifications from hidden channels, and this ...
Read Article →Configure File Integrity Monitoring (FIM) using Defender for Endpoint
Previously the File Integrity Monitoring (FIM) feature in Defender for Server P2 was based on the MMA and/or Azure Monitor Agent. Since the MMA age...
Read Article →Microsoft 365 Admin Center to Support Continuous Access Evaluation
The Microsoft 365 admin center will support continuous access evaluation (CAE) from September 2024 to help revoke access from accounts more quickly...
Read Article →Use Cases For Sentinel Summary Rules
Microsoft has announced a new Sentinel feature: Summary Rules. Those rules are aimed at aggregating large sets of data in the background for a smoo...
Read Article →Exploring the Microsoft Sentinel Codeless Connector Platform (CCP)
There are many different ways of getting your security data into Microsoft Sentinel: You can use agent based software, play around with Diagnostic ...
Read Article →Purview eDiscovery’s Big Makeover
eDiscovery is a calling best left to skilled investigators. But Microsoft 365 administrators need to know how to search and how the new Purview eDi...
Read Article →Deep Dive DNS in Entra Private Access
A few days ago, Microsoft announced that Global Secure Access is now generally available. Since I have been working with the product for some time ...
Read Article →“No Internet access” on Azure VM in new VNET Subnet
Struggling to get internet access from a newly deployed VM in Azure on a new subnet, then check if VM ... Read more
Read Article →Using Guest Accounts to Bypass the Teams Meeting Lobby
One of the things that vexes me is the need to change account to attend a Teams meeting. I forget this all the time and end up with unexpected wait...
Read Article →Copilot’s Automatic Summary for Word Documents
The automatic document summary feature for Word duly turned up and Copilot for Microsoft 365 has been busy generating summaries ever since. The fea...
Read Article →Cloud PCs? Where we’re going we don’t need Device Query and Support Approved?
Are you using a nice Windows 365 Cloud PC and want to use kickass Intune Suite features like Device Query or EPM Support Approved? If you’re ...
Read Article →Teams Improves Text Pasting and Mic Pending
Thankfully, Teams pasted text no longer contains a timestamp and the author's name. The change is effective worldwide and addresses a longstanding ...
Read Article →Transferring Reusable PowerShell Objects Between Microsoft 365 Tenants
People often need to transfer objects or code between Microsoft 365 tenants. When it comes to dealing with objects, the Microsoft Graph PowerShell ...
Read Article →Mastering the MFA Mandate: Considerations and Recommendations for a Smooth Transition
Prepare for Microsoft’s mandatory MFA with practical tips on securing accounts, migrating services, and optimizing Conditional Access.
Read Article →Office 365 for IT Pros September 2024 Update
Files are available to download for the September 2024 update for the Office 365 for IT Pros (2025 edition) eBook. This is monthly update #111 for ...
Read Article →Speaking at the Cloud Identity Summit 2024 on Thursday September 5th
This Thursday, I will visit and speak at the Cloud Identity Summit in Cologne, Germany. The Cloud Identity Summit is organized by Thomas Naunheim, ...
Read Article →Detect Impact MFA Enforcement
You may have noticed that Microsoft will enforce MFA requirement per October 15, 2024 for Azure/Entra/Intune. If this is new ... Read more
Read Article →Microsoft Withdraws Copilot Catch Up Feature
After reaching 50% deployment and on track to general availability, Microsoft decided to withdraw the Copilot catch up feature. Catch up shows a se...
Read Article →Mrs. Resource Performance, you’re trying to seduce me with your CPU Spike. Aren’t you?
Two powerful features have been introduced in the latest update to Microsoft Intune Advanced Analytics: CPU Spike and Memory Spike monitoring. We c...
Read Article →PnP PowerShell Changes Its Entra ID App
On August 21, 2024, news emerged that the PnP PowerShell module will transition from using a multi-tenant Entra ID app to a tenant-specific app. Th...
Read Article →The Lakehouse of EPM: Easily Create EPM Elevation Rules based on the Elevation Requests
Create EPM Elevation Rules in just a few seconds. It sounds like a dream, right? As IT professionals, we’re always on the lookout for ways to...
Read Article →Microsoft Defender for Identity – Expands support to servers with Microsoft Entra Connect
Last Updated on June 2, 2025 by Michael Morten Sonne Intoduction What is Microsoft Defender for Identity Microsoft… The post Microsoft Defend...
Read Article →Why Entra ID can Restore Some Types of Deleted Groups and Not Others
The ability to restore deleted groups only covers Microsoft 365 groups. That's an odd situation to be in given the different types of groups in Mic...
Read Article →FooUser@ meets the Cosmic Autopilot@ user
This blog will be about me wrecking a Windows device during Autopilot Pre-Provisioning to see what is happening underneath. While doing so, I stumb...
Read Article →The Problem with Scoped Audit Log Searches
Microsoft Purview and the Exchange Online Search-UnifiedAuditLog cmdlet both perform searches of the Microsoft 365 unified audit log. Both mechanis...
Read Article →Finding Non-Compliant Shared Mailboxes
Shared mailboxes have Entra ID accounts. No one needs to sign into the accounts because Exchange Online manages connections using mailbox permissio...
Read Article →Microsoft Purview Series - Part 3
Copyright © 2025 Microsoft Security - All Rights Reserved.
Read Article →Security Monitoring - Threat Modeling and Data Sources
One of the most misunderstood aspects of security monitoring is determining what data sources to use for what purpose. In this post, we will go thr...
Read Article →Teams External Domain Activity Report Gets a Refresh
Microsoft says that they plan to refresh the Teams external domain activity report from September 2024. But access to the report requires a Teams P...
Read Article →You always trust your CSP - Cross Tenant MFA and GDAP
Entra ID Multifactor Authentication is on everyone’s mind, as Microsoft will enforce the usage of MFA for most of the Admin portals starting ...
Read Article →Best practice for emergency access accounts in Microsoft Entra
Follow best practice to configure your emergency access accounts in Microsoft Entra to ensure you always can access them securely. The post Best pr...
Read Article →Evolving Subscription Activation: From Workarounds to a Robust Solution
Microsoft has continuously refined how Windows handles Subscription Activation, particularly in environments with strict Conditional Access policie...
Read Article →Report Detailing Unlicensed OneDrive for Business Accounts Available
Microsoft announced their plan to charge for unlicensed OneDrive for Business accounts in July. Now we have an unlicensed OneDrive accounts report ...
Read Article →The Benefits of Rationalizing License Management in the Microsoft 365 Admin Center
The decision to rationalize license management in the Microsoft 365 admin center wasn't popular but the signs are that it could deliver benefits to...
Read Article →Reporting Entra ID Administrative Role Assignments
A recent report highlighted the problem of on-premises accounts synchronized to Entra ID that receive administrative role assignments. This article...
Read Article →Mandatory MFA Requirement for Access to Azure Sites and Tools
Microsoft's project to impose a mandatory MFA requirement for access to Azure management tools and sites will start enforcement on or after October...
Read Article →All you need to know about the mandatory multifactor authentication for Azure and other administration portals
Check out this article via web browser: All you need to know about the mandatory multifactor authentication for Azure and other administration port...
Read Article →Security Monitoring Antipatterns
A little bit of a deconstruction of some antipatterns in Security Operations - Welcome back to another post - this time we are talking about antipa...
Read Article →Microsoft Copilot to Get Enterprise Data Protection
The August 15 announcement that Microsoft Copilot (the version that doesn’t use the Graph) will benefit from enterprise data protection from Septem...
Read Article →WINDOWS SERVER AUG2024 PATCH ISSUES | KB5041578
I have seen big problems with KB5041578 on Windows 2019 causing disk i/o issues with massive writes to c:\windows\catroot2\edb.log. In ... Read more
Read Article →Adding Graph API permissions to Managed Identities
Making a little note of this in Graph API so it's easy to find for using it - In this post, we will go over how to simply add a Graph API permissio...
Read Article →Microsoft Defender for Identity – How to manually remove a malfunctioning sensor that can’t be installed, uninstalled or removed
Last Updated on September 28, 2024 by Michael Morten Sonne Introduction Microsoft Defender for Identity (MDI) is designed… The post Microsoft...
Read Article →Switching Microsoft 365 Data Report Privacy On and Off
The Usage Reports Graph API is now generally available, which means that it's fully supported. In other news, a Graph API is available for Microsof...
Read Article →Handling the Too Many Retries Error and Dealing with Odd Numbers of Audit Events
The AuditLog Query Graph API remains in beta status but cmdlets are now available in the Microsoft Graph PowerShell SDK. This led to some oddities ...
Read Article →How to check your tenants Entra license plan with PowerShell
Learn how to check the license plan level of a Microsoft Entra tenant using the Microsoft Graph PowerShell SDK. The post How to check your tenants ...
Read Article →Comparing Microsoft Cloud Email Services
HVE and ECS are two competing Microsoft Cloud Email Services. At least, they seem to compete. In reality, HVE and ECS serve different target audien...
Read Article →A Deep Dive into Microsoft's SSE Solution - Part 1
Copyright © 2025 Microsoft Security - All Rights Reserved.
Read Article →Handling Online Teams Meetings Organized by Ex-Employees
When someone leaves a Microsoft 365 organization, the possibility exists that they leave some active Teams online meetings dangling behind them. Wh...
Read Article →Demystifying New Azure Monitor Auxiliary Logs Plan
Copyright © 2025 Microsoft Security - All Rights Reserved.
Read Article →Introducing Azure DevOps Backup Tool 1.1.0.0: Major update with new features, bug fixes and enhanced security!
Last Updated on September 24, 2024 by Michael Morten Sonne Introduction I’m thrilled to announce the latest release… The post Introduci...
Read Article →Microsoft 365 Admin Center to Take Over License Assignments
Microsoft is removing license assignments from the Entra admin center. From Sept 1, new license assignments are done in the Microsoft 365 admin cen...
Read Article →How to List Details of Teams Apps
A question asked about filtering Teams apps based on their blocked status. The Teams admin center doesn't support this kind of filter and getting d...
Read Article →Microsoft to reduce permissions on Directory Synchronization Accounts
Microsoft are reducing the effective permissions on Directory Synchronization Accounts in Microsoft Entra, learn more about it now. The post Micros...
Read Article →Dealing with Teams Chat Messages When People Leave
Tenant administrators know that they need to deal with mailboxes and OneDrive accounts when people leave, but what about Teams chat messages? Or ra...
Read Article →Global Secure Access in Conditional Access
A few days ago, Microsoft announced that Global Secure Access is now generally available. Since I have been working with the product for some time ...
Read Article →Keep your Interactive Logons close, but your EPM Virtual Account closer.
In this blog, I will show you why existing GPO policies could potentially break new products like Intune Endpoint Privilege Management (EPM). I wil...
Read Article →Teams Tightens Access Controls for Meeting Recordings and Transcripts
Teams meeting transcripts are enormously helpful and are used by many features, including Copilot for Microsoft 365. Access to transcript files nee...
Read Article →How to check for a healthy Defender for Endpoint environment?
When using Defender for Endpoint it is important to make sure the agent are healthy. I performed many reviews/ configurations in the past years and...
Read Article →MDM vs. MAM | Personal vs. Corporate
In our previous blog, we explored how to register devices with Entra and manage them, despite certain prerequisites for using Intune. In this blog,...
Read Article →Microsoft Quashes Bad Habit of Sending Passwords in Email
MC837081 announces that the Microsoft 365 admin center is to lose its ability to send password in email after updating a user account. It’s the rig...
Read Article →Identify minimum graph permissions for scripts with the Dev Proxy
Learn how to use the Microsoft Graph Developer Proxy to find minimum permissions for your Microsoft Graph PowerShell scripts. The post Identify min...
Read Article →Microsoft Cloud Revenues Keep on Growing
The Microsoft FY24 Q4 results delivered solid growth in Microsoft Cloud revenues. No new numbers were given for Office 365 or Teams users, possibly...
Read Article →How to secure OAuth apps with App Governance in Defender XDR
OAuth apps are still an important target for attackers to misuse in organizations. Since the MFA baseline is improved with number matching and addi...
Read Article →Identify and prevent abuse of Managed Identities with Federated Credentials from unauthorized entities
In this article, I would like to point out options to identify, monitor and avoid persistent access on Managed Identities privileges by adding fede...
Read Article →Office 365 for IT Pros August 2024 Update
The first update for Office 365 for IT Pros (2025 edition) or monthly update #110 is now available for subscribers to download. The update covers b...
Read Article →IsTPMAttested: The Ultimate Attestation Security Gate
This is the fourth and, for now, last blog post in the Windows Enrollment Attestation series. In it, I will explain how the three previous blogs le...
Read Article →Return a permanently deleted user’s sign-in info with Get-MgUser
Learn how to use the Get-MgUser cmdlet in Microsoft Graph PowerShell to return the ID and Sign-in information for deleted users. The post Return a ...
Read Article →Teams App-Centric Management (ACM)
Teams ACM replaces app permission policies with an easier method of defining who can use Teams apps. A wizard in the Teams admin center runs a one-...
Read Article →Microsoft to Charge for Unlicensed OneDrive for Business Accounts
Microsoft plans to archive unlicensed OneDrive sites starting in January 2025. The obsolete sites will end up in Microsoft 365 archive, from where ...
Read Article →Overview to Global Secure Access
A few days ago, Microsoft announced that Global Secure Access is now generally available. Since I have been working with the product for some time ...
Read Article →Finding Managers of Users with the Microsoft Graph PowerShell SDK
The task to find manager for Entra ID accounts seems simple until you find the bunch of utility accounts created by Exchange Online that should be ...
Read Article →Find all permissions assigned to all applications in Microsoft Entra
Use Microsoft Graph PowerShell to export a list of all permissions assigned to all application in Microsoft Entra. The post Find all permissions as...
Read Article →Analyzing MDE Network Inspections
Microsoft Defender for Endpoint and Network Monitoring In November 2022, Microsoft announced they integrated the Zeek open-source network traffic a...
Read Article →How to find settings in the Setting Catalog by custom OMA-URI
Learn how to use PowerShell to find if the Settings Catalog in Intune contains settings by the custom OMA-URI path. The post How to find settings i...
Read Article →Saving Upgrade Ryan: How KB5040527 fixed the Subscription Activation issue!
Great news! The July Preview KB5040527 update has finally fixed the Windows subscription activation issue that plagued the upgrade from Windows 11 ...
Read Article →The Maddening Side of the Microsoft Graph PowerShell SDK
All software has unique quirks, and the foibles of the Microsoft Graph PowerShell SDK are well known. But it’s much harder when the underlying foun...
Read Article →The OneDrive for Business Problem Created When Deleting User Accounts
On the surface, the work to delete OneDrive for Business accounts seems straightforward because Microsoft provides a 30-day deletion period to revi...
Read Article →InitiateRecovery: The Power of Hardening the Intune Enrollment
This is the third blog in the Windows Enrollment Attestation / MDM Hardening series. In it, I will examine what happens when we combine the amazing...
Read Article →Stream Moves to Intelligent Versioning
In a change designed to reduce the consumption of storage quota, Stream video versions are no longer being generated for non-video updates such as ...
Read Article →Adding Cost Center Reporting to the Microsoft 365 Licensing Report
The Microsoft 365 licensing report now supports a cost center analysis based on cost center values stored in an Exchange custom attribute. The new ...
Read Article →Comparing Shared and Inactive Mailboxes for Retaining Ex-Employee Content
Every Microsoft 365 tenant must deal with ex-employee mailboxes. The default choice is to make the mailboxes into shared mailboxes. But inactive ma...
Read Article →Microsoft Purview Series - Part 2
Copyright © 2025 Microsoft Security - All Rights Reserved.
Read Article →Entra Suite License Explained
Copyright © 2025 Microsoft Security - All Rights Reserved.
Read Article →How to rotate BitLocker keys with Microsoft Graph PowerShell
Learn how to rotate BitLocker keys for devices managed with Microsoft Intune using Microsoft Graph PowerShell. The post How to rotate BitLocker key...
Read Article →Microsoft to start blocking custom OMA-URI settings in Intune
Microsoft will soon start blocking the use of custom OMA-URI settings in Microsoft Intune for settings that existing in the settings catalogue. The...
Read Article →CrowdStrike issue: Workarounds
From X/Twitter. Thx to @r3srch3r for summarization. Physical machine physical server VM on Hyper-V VM on AWS VM on Azure ... Read more
Read Article →Self-Service Purchase Notifications for Tenant Administrators
I dislike the Microsoft 365 self-service purchase mechanism and disable it in any tenant where I can. Global and Billing administrators for tenants...
Read Article →All the Intune MDM Certificate Recovery We Cannot See
This blog will be the second one in the Windows Enrollment Attestation Series!! And let me promise you one thing!!! The words rabbit hole will get ...
Read Article →Exchange Online Previews Inbound SMTP DANE with DNSSEC
On July 17, Microsoft announced the public preview of inbound SMTP DANE with DNSSEC for Exchange Online, a welcome step forward to improve messagin...
Read Article →SignToolGUI – A new tool is here for your digital signing experience – Now public!
Last Updated on September 29, 2024 by Michael Morten Sonne Introduction In today’s fast-paced digital world, ensuring the… The post Sig...
Read Article →How to delete Cloud PKI CAs in Microsoft Intune
Learn how to delete Microsoft Cloud PKIs in Microsoft Intune using the portal and Microsoft Graph PowerShell. The post How to delete Cloud PKI CAs ...
Read Article →MDM x TPM: The MDM Hardening
This blog will be the first one in the Windows Enrollment Attestation / MDM Hardening series. In it, I will take a closer look at a beautiful funct...
Read Article →Team Owners Can Rename the General Channel
In what seems to be a small change, team owners can rename general channels (naturally with 'meaningful names.' The change is more important than i...
Read Article →Monitoring Updates to Sensitivity Label Policies and Labels
A reader wanted to know why the Purview Compliance portal doesn't show who last updated sensitivity label policies. The reason why is unclear, but ...
Read Article →Windows Enrollment Attestation 76: MDM Hardening
Welcome to our Windows Enrollment Attestation series overview. This feature is also known as MDM Hardening and MDM Device Attestation. In this blog...
Read Article →Azure Arc – Windows Admin Center – Cant connect with error: Couldn´t get server data, ajax error
Last Updated on January 21, 2025 by Michael Morten Sonne Introduction If you’re encountering this error message in… The post Azure Arc ...
Read Article →Upgrading the Teams and Groups Activity Report to 6.0
The Teams and Groups activity report is a popular script that helps administrators identify inactive teams and groups within a Microsoft 365 tenant...
Read Article →Entra ID – Global Secure Access – Now Generally Available!
Last Updated on December 18, 2024 by Michael Morten Sonne Introduction Yes – now its announce that the… The post Entra ID – Global Secu...
Read Article →Conditional Access Staged Rollout settings
A new status filter named 'Staged rollout' has appeared in the Conditional Access portal of Microsoft Entra recently, so what is it? The post Condi...
Read Article →Outlook Mobile Continues to Set the Standard for Microsoft 365 Email Mobility
It's common to be asked which is the best mobile email client for Exchange Online. My view is that Outlook Mobile is the only client to use (if pos...
Read Article →The Right Way to Replace the Remove-SPOExternalUser Cmdlet
Microsoft says they will remove the Remove-SPOExternalUser cmdlet starting July 29. They recommend using Remove-AzureADUser as a replacement. It's ...
Read Article →Introducing Azure DevOps Backup Tool 1.0.5.9: Enhanced security, optimization and bug fixes!
Last Updated on July 10, 2024 by Michael Morten Sonne Intoduction I’m thrilled to announce the latest release… The post Introducing Azu...
Read Article →Office Connectors Retirement for Teams
In June, Microsoft retired Office Connectors for SharePoint Online and Microsoft 365 Groups. Starting on August 15, they're retiring connectors for...
Read Article →Configuring Outlook DLP Policy Pop-Ups for Sensitive Content
A cloud policy setting enables a delay for evaluating message content and allows Outlook DLP Policy Tips to be displayed after detection of a polic...
Read Article →Die Hard with a UTC: Fixing Autopilot Device Preparation
Enrolling devices into Windows Autopilot Device Preparation should be straightforward, but sometimes, unexpected issues require a deeper dive into ...
Read Article →5 Years On - The Microsoft Sentinel Experience
Around 5 years ago, Microsoft announced the general availability of Azure Sentinel. This post aims to assess how far we along we have come - the go...
Read Article →Find lateral movement paths using KQL Graph semantics
Graph databases offer great insights into existing data, that relational databases cannot or can only solve with more resources. Tools that leverag...
Read Article →How to filter users with Extension Attributes using Microsoft Graph
Learn how to use Extension Attributes in Microsoft Entra to filter users based on the extension property using Microsoft Graph. The post How to fil...
Read Article →Outlook Mobile Introduces Synchronization Window
A new Outlook Mobile synchronization setting allows users to select a window of between 1 and 90 days to download copies of email and attachments. ...
Read Article →Reflecting on a remarkable first half of the year 2024! ✨
Last Updated on September 24, 2024 by Michael Morten Sonne Intoduction As we cross the midpoint of 2024,… The post Reflecting on a remarkable...
Read Article →New Policy to Disable Some In-Product Messages in Teams
In a welcome update, the Teams development group have provided a new policy setting to control the display of some in-product messages in Teams cli...
Read Article →All SharePoint Online Sharing Links Now Support Expiration Dates
A very useful update to support sharing links expiration for all link types used by SharePoint Online and OneDrive for Business is now rolling out ...
Read Article →EPM Error 0x8007010B: The Debugging Game
In this blog, I will examine a funny 0x8007010B error that Endpoint Privilege Management (EPM) could give you when you try to elevate the CMD using...
Read Article →Teams to Begin Automatically Hiding Inactive Channels
From mid-July 2024, Teams will begin hiding inactive channels for users. The inactive channels can be unhidden, and users can opt out of the automa...
Read Article →Temporary exclusions for Conditional Access using PIM for Groups
Check out this article via web browser: Temporary exclusions for Conditional Access using PIM for Groups Conditional Access include and exclude gro...
Read Article →Introducing the Microsoft Entra Suite license
Find out about the new Microsoft Entra Suite licensing which includes step-up features from the Microsoft 365 E5 license, including verified ID, ID...
Read Article →Prevent Conditional Access bypass with Restricted Management Administrative Units in Entra ID
Check out this article via web browser: Prevent Conditional Access bypass with Restricted Management Administrative Units in Entra ID Bypassing Con...
Read Article →Using Company-wide Sharing Links with Copilot for Microsoft 365
Some folks wonder why they can't use documents shared with them using company-wide links with Copilot for Microsoft 365. As it turns out, the answe...
Read Article →Office 365 for IT Pros 2025 Edition is Now Available
Office 365 for IT Pros 2025 edition, the 11th edition of the most comprehensive and in-depth book covering the Microsoft 365 Office servers, is now...
Read Article →Veeam Backup M365 – Exchange Online backup fails with error: Failed to get folder properties. Not allowed to access non IPM folder
Last Updated on September 24, 2024 by Michael Morten Sonne Intoduction This blog post is about an issue… The post Veeam Backup M365 – Exchang...
Read Article →Teams Chat Gets the Shared Tab
The old Files tab in Teams chat is being replaced by the Shared tab. The new tab exposes both files and hyperlinks and Microsoft says that the Shar...
Read Article →How to assess the impact of MFA enforcement in Azure
Learn how to assess how the impact of MFA enforcement on Azure service will impact your users. The post How to assess the impact of MFA enforcement...
Read Article →Teams to Block Federated Communications with Trial Tenants
Microsoft is moving to block federated communications with trial Microsoft 365 tenants to cut off a potential exploitation route for attackers. The...
Read Article →I was MSI and PS1. Nothing but Endpoint Privilege Management and a couple of file extensions
With all the new features added to Microsoft Endpoint Privilege Management (EPM), we must not forget another new and long-awaited feature. This blo...
Read Article →T1556.009 - Detect and prevent suspicious conditional access policy modifications
Introduction In April 2024, MITRE came with their new V15 version of ATT&CK. In this version a new sub-technique was introduced called ‘T...
Read Article →The Curiously Unfinished Outlook Settings API
The Outlook settings API is a unfinished Graph API that can read and update some but not all mailbox settings. It's a pity that the API is incomple...
Read Article →Adding Details of Authentication Methods to the Tenant Passwords and MFA Report
V1.2 of the User Passwords and MFA report includes the names of authentication methods registered for user accounts. V1.3 expands the amount of det...
Read Article →Microsoft Graph Command Line Tools to become verified in Entra
Microsoft have announced that the Microsoft Graph Command Line Tools application will soon become a verified application. The post Microsoft Graph ...
Read Article →How to find specific permissions assigned to applications in Entra
Learn how to find which applications in Microsoft Entra have specific permissions assigned using Microsoft Graph PowerShell. The post How to find s...
Read Article →Outlook (Win32) Becomes Outlook (Classic)
Microsoft has announced the formal renaming of the Win32 version of Outlook to be Outlook (classic). It's preparing for the general availability of...
Read Article →Authorization Code Flow
Introduction In the past, I was always curious about the workings of Connect-AzAccount, the authentication command from the Az.Accounts PowerShell ...
Read Article →Planner User Policy Stops Task and Plan Deletions
The Set-PlannerUserPolicy cmdlet allows Microsoft 365 tenant administrators stop users deleting tasks created by other users. However, an undocumen...
Read Article →Autopilot Device Preparation and the Enrollment Time Grouping
This blog will focus on the importance of the Enrollment Time Group (JustIntTimeConfiguration), which is currently only used with Autopilot Device ...
Read Article →How to onboard and getting started with Copilot for Security
Microsoft Copilot for Security is a new tool based on AI, it takes signals from various sources to use the data as additional input and research la...
Read Article →Test Yourself: The Prelude
Some tips, tricks and tools to help you get started testing your own infrastructure. This is the start, where I'll just lay out some basic principl...
Read Article →Version 1.9 of the Microsoft 365 Licensing Report
The Microsoft 365 Licensing Report is a popular PowerShell script that's just been updated to V1.9 with a bunch of changes to highlight different a...
Read Article →Data Protection Made a Breeze: MDA integration in Edge for Business
Microsoft Defender for Cloud Apps is one of the many puzzle pieces of the Microsoft XDR solution that helps you to secure your corporate environmen...
Read Article →Microsoft Intune to require iOS 16 and macOS 13
Microsoft Intune will soon require a higher version of MacOS and iOS later this year. Learn how to identify the impact in your tenant. The post Mic...
Read Article →Microsoft Urges Consumer and Enterprise Users to Move to Newer Outlook Versions
Microsoft wants users to upgrade from legacy Outlook clients. The biggest impact for Microsoft 365 tenants might be the loss of OWA light, but cons...
Read Article →Working with Calendar Permissions using the Microsoft Graph PowerShell SDK
The Set-MailboxFolderPermission cmdlet is usually used to set calendar permissions, including the permission for the default user to allow everyone...
Read Article →Using PowerShell to Post Channel Messages with Teams Workflows
The incoming webhook connector is a popular method to post information to Teams channels, but Microsoft seems set on retiring the Office connectors...
Read Article →How to disable per-user MFA using Microsoft Graph PowerShell
Learn how to use Microsoft Graph PowerShell to disable per-user MFA in Microsoft Entra to support migration to Conditional Access. The post How to ...
Read Article →Per-User MFA State Added to Tenant Passwords and MFA Report
A Microsoft Graph update makes per-user MFA state available for user accounts. Being able to access the data means that we can include it in the Us...
Read Article →Blocking Download Access to Teams Channel Meeting Recordings
Our review of the Videos chapter for the Office 365 for IT Pros eBook found a Teams meeting policy setting we hadn't documented to block downloads ...
Read Article →Debugging the Autopilot Device Preparation Profile
In this blog, I’ll explain how we resolved an issue where saving the new Autopilot device preparation profile failed to save the device group...
Read Article →Report per-user MFA status in Entra using Microsoft Graph PowerShell
Learn how to use Microsoft Graph PowerShell to view the per-user MFA state and method for users in Microsoft Entra. The post Report per-user MFA st...
Read Article →To Splat or Not to Splat, That’s the Question
Splatting is an optional PowerShell technique designed to make it easier to pass parameter values for cmdlets. It’s a personal choice whether to us...
Read Article →Azure Monitor alerting with Azure Resource Graph data – using Azure LogAnalytics integration
If you need to get an Azure Monitor alert using Azure Resource Graph data, this can easily be accomplished using ... Read more
Read Article →Platform-level device cleanup rules added to Microsoft Intune
Learn how to configure device clean-up rules at a platform level in Microsoft Intune to target Windows, IOS, Android, Mac or Linux devices. The pos...
Read Article →The Battle Of The Local Administrator And Autopilot Device Preparation
In this blog, I will discuss how I found out a specific entra setting was interfering, AKA breaking my Windows Autopilot device preparation deploym...
Read Article →The End for Office 365 Connectors Comes Into Sight
Office 365 Connectors bring data from external sources into Microsoft 365 apps like Teams and Outlook. Workflows and Power Automate are replacing C...
Read Article →Understanding SharePoint Online Storage
Understanding SharePoint Online storage used to be easy. Then applications like Loop arrived. Other influences like retention and archive can affec...
Read Article →Interpreting Audit Records for Teams Meeting Recordings (Again)
Three years ago, I wrote a script to analyze the audit records generated for Teams meeting recordings. Then things changed in terms of how the audi...
Read Article →Report Delegated Permission Assignments for Users and Apps
This article describes how to use the Microsoft Graph PowerShell SDK to report delegated permission assignments to user accounts and apps. Like in ...
Read Article →Autopilot and the Sundance Device Preparation
In this blog, I will explore the wonders of Autopilot Device Preparation (AP-DP), from the first step of signing in to the last step in the Autopil...
Read Article →Choosing Between Graph API Requests or Graph SDK Cmdlets
Deciding whether to use Microsoft Graph PowerShell SDK cmdlets or Graph API requests is sometimes not easy. Some say that it's best to use Graph AP...
Read Article →Entra ID – Global Secure Access Client – Assign users and groups to forwarding profiles
Last Updated on June 5, 2024 by Michael Morten Sonne Intoduction Finally, with the Global Secure Access traffic… The post Entra ID – Global S...
Read Article →How to deploy Autopilot Device Preparation Policies with PowerShell
Learn how to deploy Device Preparation Policies in Microsoft Intune programmatically using Microsoft Graph PowerShell. The post How to deploy Autop...
Read Article →Understanding Primary Refresh Tokens in the Entra ID Sign-in logs
Learn about the different types of security tokens in Microsoft Entra and the Primary Refresh Token in the sign-in logs. The post Understanding Pri...
Read Article →Experts Live Netherlands
I spoke together with my colleague Thijs Lecomte at Experts Live, where we talked about how we architecture a Security Operations Center on top of ...
Read Article →Teams Custom Emojis Arrive in June 2024
The latest technology initiative from Microsoft comes in the form of Teams custom emojis, designed to bring light and happiness to Microsoft 365 te...
Read Article →Notify When Available Comes to Teams 2.1
Without any fuss or bother, Microsoft announced that the Teams 2.1 client has regained the Notify When Available feature. This functionality allows...
Read Article →Autopilot Device Preparation: The Hardware Hash Voyage home
In this blog, I’ll dive into a key difference between traditional Autopilot and Autopilot Device Preparation (APv2). I’ll explain why the har...
Read Article →Entra Private Access/GSA – Automatic Network Detection
This blog covers a custom script solution for Intune, that can be used to automatically detect, if the Entra Private ... Read more
Read Article →Office 365 for IT Pros June 2024 Update
The June 2024 update for the Office 365 for IT Pros 2024 edition ebook is available for download. We're also announcing the availability of the 202...
Read Article →Better Copilot Audit Records and Copilot Chat Appears in Classic Outlook
Copilot audit records generated for the Microsoft 365 audit log capture details of the resources (files, emails, and documents) used by Copilot in ...
Read Article →Teams Meeting Audit Events Available to Purview Audit Standard Customers
Microsoft is deploying additional audit events to tenants with Purview Audit (Standard) licenses. Among the 15 Teams events in the set are Teams me...
Read Article →How to Manage Microsoft Entra sign-in logs with PowerShell
Learn how to use Microsoft Graph PowerShell to filter, find and manage the sign-in logs for Microsoft Entra. The post How to Manage Microsoft Entra...
Read Article →Teams Adjusts the Activity Feed
The Teams Activity feed received two recent major changes. First, calendar notifications now show up in the feed. Second, the set of filters that w...
Read Article →Reporting Mailbox Audit Configurations
A request came in for a PowerShell script to report mailbox audit configurations to check that the important new events are being generated by mail...
Read Article →Entra ID Dynamic Groups – Direct reports of a manager
Check out this article via web browser: Entra ID Dynamic Groups – Direct reports of a manager Here’s a quick tip that I discovered only...
Read Article →Teams Changes Location for Meeting Transcripts
Microsoft is changing the storage location for Teams Meeting Transcripts from Exchange Online to OneDrive for Business. The change is designed to s...
Read Article →Guided application upgrades announced for Microsoft Intune
Enterprise Application Management has announced Guided application upgrades later this year in Microsoft Intune. The post Guided application upgrad...
Read Article →Introducing a new tool – Lookup IP to DNS Tool – v. 1.0.0.3!
Last Updated on June 29, 2024 by Michael Morten Sonne Intoduction I’m thrilled to announce the latest release… The post Introducing a n...
Read Article →Stream Development Presses Ahead After Migration Finishes
The Stream browser client has received some nice new features including the ability to trim videos in a very efficient manner and to add callouts t...
Read Article →Microsoft Finally Delivers Promised Audit Events to Purview Audit Standard Tenants
A May 20 post contains the welcome news that the new audit events promised for Purview Audit standard customers should be available in June 2024. S...
Read Article →Autopilot Device Preparation: First Contact
Are you anxiously waiting for the Autopilot V2 Announcement? APv2 has just been officially announced and has a nice new shiny name: Autopilot Devic...
Read Article →New granular security policy permissions in Microsoft Intune
Microsoft are to release new granular security permissions relating to security baselines in Microsoft Intune. The post New granular security polic...
Read Article →Nobody makes me Config Refresh my own Provider. Nobody!
Welcome to the Config Refresh Blog! Today, I’ll be diving into the fascinating world of Config Refresh. Specifically, we’ll explore how...
Read Article →Organizers of Teams Recurring Meetings Can Create Loop Workspaces for Shared Content
A new feature for Teams recurring meetings allows meeting organizers to create Loop workspaces to hold content shared within the meetings. It's an ...
Read Article →Big Change Coming in Authentication for Outlook Add-ins
On April 9, 2024, Microsoft announced a big change in authentication for Outlook add-ins. It's likely that people don't realize the kind of change ...
Read Article →European Union Lines up Anti-Trust Charges Against Microsoft Over Teams
The Financial Times reported that the EU is lining up new charges against Microsoft for Teams anti-competitive behavior. Given that Microsoft has a...
Read Article →Microsoft Causes Fuss Around Azure MFA Announcement
On May 14, Microsoft announced that they will require Azure MFA for connections to services starting in July 2024. No details about the implementat...
Read Article →Teams Adds Slash Commands to the Message Compose Box
Teams has added the ability to use slash commands (shortcuts) to the message compose box. Although the feature seems useful, I wonder about its pot...
Read Article →SharePoint Online Deletion of Non-Empty Folders
A recent SharePoint Onlne update enables folder deletion when items are present in a folder. This is probably the way that things should have alway...
Read Article →Configure External Authentication Methods in Entra ID with Duo Security
Setup Cisco Duo as an External Authentication Method in Microsoft Entra ID and satisfy MFA requirements in Conditional Access. The post Configure E...
Read Article →The Extremely Useful Meeting Follow Response
The Follow response is a new option for people invited to a meeting to indicate that they can't attend but are interested in what happens. Replying...
Read Article →Block Device Code Authentication Requests with Conditional Access
This article describes the process of blocking device code authentication requests against Entra ID with a preview feature for conditional access p...
Read Article →Thoughts on Copilot for Security’s Early Days
April 1, 2024, seen the release of Microsoft Copilot for Security to general availability (GA). It is a generative AI solution integrating with Def...
Read Article →Entra ID – Exploring the new feature: What’s New
Last Updated on May 10, 2024 by Michael Morten Sonne Introduction Let´s explore some of the new in… The post Entra ID – Exploring the new fea...
Read Article →Team and Channel Creation Simplified in New Design
Team channel collaboration might be a better choice than always creating a new team to host discussions about a topic, especially if channels grow ...
Read Article →Update Entra ID User Role Permissions to Secure Your Tenant
The user authorization policy defines user role permissions, or actions that non-admin users can take within an Entra ID tenant. The default settin...
Read Article →Microsoft Launches Support for Entra ID External Authentication Methods
In a May 2 announcement, Microsoft said that they have signed up 9 ISVs to add support for Entra ID authentication methods. The third-party methods...
Read Article →Remember, remember, the Hybrid Device, the MDM only enrollment Treason and The EPM Agent
Are you dealing with Hybrid joined, Intune enrolled devices and wondering why the EPM agent isn’t showing up on your device after activating ...
Read Article →Teams Adds Background Effects for Mobile Video Messages
The Teams iOS client can send one-minute Teams video messages (or clips) to chats or channels conversations. Now, the videos can use image or blur ...
Read Article →More Microsoft Graph PowerShell SDK Problems
Some problems emerged in V2.17 and V2.18 of the Microsoft Graph PowerShell SDK. In one case, Microsoft changed cmdlet names. In another, it's an id...
Read Article →KB5036980 breaks the Windows 11 Enterprise Subscription Activation.
Are you experiencing problems with the automatic upgrade from Windows 11 Pro to Windows 11 Enterprise during Autopilot on the latest Windows build?...
Read Article →Microsoft Retires Stream Mobile App
On May 2, 2024, Microsoft announced the retirement of the Stream Mobile app on July 1, 2024. It's all to do with rationalization and focus, or so M...
Read Article →Setup External Authentication Methods in Microsoft Entra ID
Learn about External Authentication Methods in Microsoft Entra and how to setup new External Authentication methods for Entra ID. The post Setup Ex...
Read Article →Defender for Cloud – Reset to free tier via PowerShell
Last Updated on May 2, 2024 by Michael Morten Sonne Intoduction Resetting Microsoft Defender for Cloud Configuration Are… The post Defender f...
Read Article →Removing Outlook Add-ins From Mailboxes with PowerShell
The Share to Teams Outlook add-in posts an email to a Teams chat or channel conversation. I was asked how to disable the add-in for some mailboxes....
Read Article →Office 365 for IT Pros May 2024 Update Available
Another month, another update for the Office 365 for IT Pros eBook. In this case, it's monthly update #107 for Office 365 for IT Pros (2024 edition...
Read Article →Report assigned Autopilot profiles with Microsoft Graph PowerShell
Use Microsoft Graph PowerShell to report which Autopilot profile is assigned to each device in Microsoft Intune. The post Report assigned Autopilot...
Read Article →Disabling Bits of Copilot for Microsoft 365
The Copilot for Microsoft 365 license has 8 service plans to govern feature availability. You can disable individual components, if you know what y...
Read Article →Find all license-enabled groups in Microsoft Entra with PowerShell
Learn how to use Microsoft Graph PowerShell and filtering to find all license-enabled groups in Microsoft Entra. The post Find all license-enabled ...
Read Article →Teams Classic Client Slipping Away
The Teams classic client has been replaced by the Teams 2.1 client. Microsoft will block access to the Teams classic client for people running the ...
Read Article →Analyzing MDE Network Inspections
Introduction Defender for Identity is a very important sensor to detect threats in an Active Directory environment. Therefore, it is important to m...
Read Article →Create client secrets during App Registration in Microsoft Entra
You can now create client secret during app registration in Microsoft Entra using Microsoft Graph PowerShell. The post Create client secrets during...
Read Article →Microsoft Cloud Exceeds 50% of Microsoft Total Revenues
The Microsoft FY24 Q3 results didn't contain any new user numbers for Office 365 or Teams. However, we did learn that Copilot and Azure are popular...
Read Article →Defender for Endpoint status report with Microsoft Graph PowerShell
Learn how to generate and export a Defender For Endpoint agent status report using Microsoft Graph PowerShell. The post Defender for Endpoint statu...
Read Article →Teams Meet Now Feature Gets a Makeover for Group Chats
Teams group chats are getting a new Meet Now experience. Is that good news? Well, it's not an earthshattering change, but it is a nice change becau...
Read Article →MFA issues for Invited guest – Cause: Cross-Tenant Access due to Partner Relationship
This blog is about an issue, I experienced when I was invited as Guest to a tenant, where cross-tenant access ... Read more
Read Article →Sending Urgent Teams Chats with PowerShell
A reader asked if it is possible to script sending chat messages. In this article, we explore how to compose and send Teams urgent messages to a se...
Read Article →Conditional Access Policies - An In-depth Guide
Copyright © 2025 Microsoft Security - All Rights Reserved.
Read Article →How to auto-update apps assigned as Available in Microsoft Intune
Learn how to auto-update applications using supersedence in Microsoft Intune for apps assigned as available. The post How to auto-update apps assig...
Read Article →How to Remove a Single Service Plan from User Accounts with PowerShell
Some years ago, I wrote a script to demonstrate how to remove service plans with PowerShell. This article describes some upgrades to make the scrip...
Read Article →May the Intune Suite be with You!
This blog will show you something you need to be aware of when you purchase the Intune Suite and use the Cisco DUO desktop app. When activating the...
Read Article →Disappointing Session Schedule for M365 Conference
The M365 Conference takes place in Orlando, FL from April 28 to May 2, 2024. I have two sessions, but my attempts to find sessions that cover all o...
Read Article →Microsoft Fix Intune Personal Device Enrollment Restriction Bypass
Microsoft fix a bypass technique where you can register personal Windows devices in Intune even while they are blocked. The post Microsoft Fix Intu...
Read Article →Microsoft Purview Series - Part 1
Copyright © 2025 Microsoft Security - All Rights Reserved.
Read Article →Removing Licenses from Entra ID Accounts When a Replacement License Exists
License management is a core competence for Microsoft 365 tenant administrators. This article explains how to use PowerShell to remove licenses fro...
Read Article →Microsoft Graph Activity Logs Hit General Availability
April 11 saw the general availability of Microsoft Graph activity logs, a new set of data recording details of Graph API HTTP requests made in a te...
Read Article →How to Create a Password Expiration Report
Although the trend is toward password authentication, many Microsoft 365 tenants still use passwords and some force users to change passwords regul...
Read Article →Authenticate to Azure DevOps using Managed Identity and REST API
How to add a managed identity to Azure DevOps and get access tokens for Azure Devops - This one is very short and sweet - how to authenticate to Az...
Read Article →Download Azure DevOps Repositories using a Managed Identity and REST API
Everything you need to know to download Azure DevOps repositories using a Managed Identity and REST API - In this post, we will go over how to down...
Read Article →Exchange Online Moves to Tighten Platform Security
Exchange Online announced two important changes on April 15. SMTP AUTH is being depreciated and a new external recipient rate limit is being introd...
Read Article →List All Passkeys and AAGUIDs in Microsoft Entra with PowerShell
Use Microsoft Graph PowerShell to create a report of all Passkeys and their AADGUIDs current in use in your Tenant. The post List All Passkeys and ...
Read Article →Maester: Microsoft Security Test Automation Framework
The Maester tool is a community initiative to create a tool to help tenant administrators improve the security of their Entra ID tenants. It’s stil...
Read Article →Prepare for Exchange Online Basic Auth Permanent Retirement
Learn how to prepare your email environment for the permanent retirement of SMTP auth in Exchange online by September 2025. The post Prepare for Ex...
Read Article →Get control over corporate networks with device discovery
Introduction During the last few years, I worked with a couple of customers who struggle with getting control over their corporate networks. Even t...
Read Article →Get started with passkeys in Microsoft 365
Check out this article via web browser: Get started with passkeys in Microsoft 365 It’s here! A long-awaited feature in Microsoft 365 is fina...
Read Article →Introducing Azure DevOps Backup Tool 1.0.5.8: Enhanced security, optimization and bug fixes!
Last Updated on July 10, 2024 by Michael Morten Sonne Intoduction I’m thrilled to announce the latest release… The post Introducing Azu...
Read Article →Passkey Public Preview for Entra ID
With the release of the public preview for Passkey in Entra ID, I think, the broad adoption of passwordless and phishing resistant authentication a...
Read Article →Teams Adds Support for Customizable Group Chat Pictures
Microsoft Teams now boasts the ability to add customizable group chat pictures to what might be otherwise a set of chats with not-very-good generat...
Read Article →Automated Microsoft 365 Security Posture Monitoring with Maester
Configure an automation Microsoft 365 Security Poster Monitoring solution using the Maester tool using Azure Automation. The post Automated Microso...
Read Article →How to enable Passkeys for the Microsoft Authenticator app
Learn how to enable Passkeys in the Microsoft Authenticator app for FIDO2 compliance authentication to Microsoft Entra. The post How to enable Pass...
Read Article →Security and Privacy Concerns Continue Swirling Around the new Outlook for Windows
Monarch client security became an issue last year when a German website reported some issues. It turns out that the reported problems are mostly hy...
Read Article →I can only show you the Programs Entity, you’re the one that has to Device Query it!
This small blog will examine how the Program entity in the Intune suite feature Device Query is a work in progress. I will update this blog every t...
Read Article →Upgrade Classic Azure Administrator Roles by August 2024
A recent note from Microsoft advised that if your tenant uses classic Azure administrative role, you need to switch to Azure RBAC roles by 31 Augus...
Read Article →Modifying the Teams Tenant Federation Configuration with PowerShell
A new parameter for the Set-CsTenantFederationConfiguration cmdlet made me look at the Teams tenant federation configuration again to improve how a...
Read Article →How to Retrieve Loop Workspaces Data with PowerShell
A previous attempt to write a script to report all Loop workspaces in a tenant was flawed because it only retrieved the first 200 workspaces. I had...
Read Article →I have the 2024-03 update! Microsoft, Could you Config Refresh me?
Did Microsoft fix the Config Refresh bug with the March update? However, that doesn’t mean it also works. In this blog, I will examine how Config R...
Read Article →Use Certificate-Based Authentication in Entra with Cloud PKI
Learn how to configure Certificate-based authentication in Microsoft Entra using certificates issues from your Intune Cloud PKI. The post Use Certi...
Read Article →P4: Hidden Gems & Least Used Features
Copyright © 2025 Microsoft Security - All Rights Reserved.
Read Article →P5: Live Response in MDE
Copyright © 2025 Microsoft Security - All Rights Reserved.
Read Article →Protecting Against QR Code Phishing in Defender for Office 365
Copyright © 2025 Microsoft Security - All Rights Reserved.
Read Article →Security Copilot Cost Management for SOC
Copyright © 2025 Microsoft Security - All Rights Reserved.
Read Article →Microsoft Toughens Premium Sensitivity Label License Requirements
According to Microsoft 365 notification MC736438, Microsoft is getting tougher at enforcing the rules for Purview information protection licenses. ...
Read Article →Security Copilot Scalable Capacity Management for non-24×7 SOC scenario
Background Some of my customers are not having 24×7 SOC but still wants to utilize Microsoft Security Copilot during their ... Read more
Read Article →Microsoft Defender XDR – Unified Security Operations Platform (Sentinel and Defender)
Last Updated on April 4, 2024 by Michael Morten Sonne Intoduction What is comming to the Microsoft Defender… The post Microsoft Defender XDR ...
Read Article →Microsoft Increases Number of Self-Purchase Product Licenses to 25
A new major version of the MsCommerce PowerShell module makes you hope that something good is included in the new code. In this case, it’s hard to ...
Read Article →Defender for Office 365 – Hunting and responding to QR code-based phishing attacks
Last Updated on April 3, 2024 by Michael Morten Sonne Intoduction Now you can strengthening your defense against… The post Defender for Offic...
Read Article →Enable High Volume Email for Microsoft 365
Learn how to configure High Volume Email in Microsoft 365 to increase the Exchange Online messaging limits for your applications. The post Enable H...
Read Article →Interpreting Audit Events for Microsoft 365 Copilot
The unified audit log includes Copilot for Microsoft 365 audit events captured when users interact with Copilot through apps. The information is ve...
Read Article →Keeping up with the EmmDeviceID And Config Refresh Bug
This blog will supplement my previous one, in which I explored the new DMClient LinkedEnrollment DiscoveryEndpoint Node. I will guide you through t...
Read Article →The New Manage Distribution Groups OWA Component Has a Problem with Role Assignments
Microsoft announced a new component for OWA distribution list management but clearly the engineers never took role assignment policy customizations...
Read Article →LAPS Unleashed: Navigating the Future of Windows Admin Security
Dive into LAPS for Windows: a game-changer in admin account security. Discovery of the new CSP settings and configurations.
Read Article →Office 365 for IT Pros April 2024 Update
The April 2024 update for the Office 365 for IT Pros eBook is now available for subscribers to download from Gumroad.com or Amazon.com. Like every ...
Read Article →When and how does a device sync with MMP-C (Next Gen Intune)”
In this blog, I will examine the same things as Niehaus but this time the next-generation Intune, MMP-C. I will also examine the sync scheme and sh...
Read Article →Update Branding With the Organizational Branding Administrator Role
Use the Organizational Branding Administrator role to update your organisations branding in Microsoft Entra. The post Update Branding With the Orga...
Read Article →Introducing GitHub Backup Tool 1.3.0.0: Enhanced customization, security and bug fixes!
Last Updated on June 29, 2024 by Michael Morten Sonne Intoduction I’m thrilled to announce the latest release… The post Introducing Git...
Read Article →Limit local administrators on Microsoft Entra joined devices
Prevent the global administrators in Microsoft Entra from being added to the local administrators group on Microsoft Entra joined devices. The post...
Read Article →Local Administrator, and Autopilot Settings, and Entra Settings! Oh, my!
In this blog, I will examine the new Entra local administrator settings, which prevent users from becoming local administrators on their devices du...
Read Article →SharePoint Marks Its 23rd Anniversary
On March 27, SharePoint history reached its 23rd year. That's a great achievement and SharePoint Online powers many apps. But dark clouds are on th...
Read Article →Trimarc Happy Hour
I had a great time hanging out and talking about a little bit of everything with some of the Trimarc folks. Thanks to Brandon for inviting me on! :)
Read Article →All About Microsoft 365 Tenant Identifiers
Every Microsoft 365 tenant has a tenant identifier, a unique GUID that's used within the Entra ecosystem to identify a tenant and its objects. Much...
Read Article →Demystifying Security Copilot Features & Licensing
Copyright © 2025 Microsoft Security - All Rights Reserved.
Read Article →Do not try and bend the EPM. That’s impossible. Instead… only try to use Support Approved
In this blog, I will dive deep into the Endpoint Privilege Management feature “Support Approved” once more. I will show you how Support Approved wo...
Read Article →How Many Licensed Microsoft 365 Accounts Use the Loop App?
After the welcome announcement that the Loop app will support external access, thoughts might turn to figuring out who uses the app. Fortunately, i...
Read Article →P2: Securing with Intelligence: Role of AI in Defender
Copyright © 2025 Microsoft Security - All Rights Reserved.
Read Article →P3: Attack Surface Reduction (ASR) Deployment Using MDE
Copyright © 2025 Microsoft Security - All Rights Reserved.
Read Article →Search-UnifiedAuditLog Gets High Completeness Capability
A new preview feature supports high completeness audit log searches. These searches are optimized to make sure that they find every matching audit ...
Read Article →Microsoft Grounds Copilot Apps with Graph and Web Content
Message center notification MC734281 explains that Copilot for Microsoft 365 will get better grounding for Word, Excel, PowerPoint, and OneNote fro...
Read Article →Re-onboard LogAnalytics to Sentinel, if SecurityInsights solution is deleted by mistake
Critical features will break or stop working, if you delete too much in Legacy solutions like SecurityInsights, SQLAdvancedThreatProtection or SQLV...
Read Article →Azure – Automating Management Group Removal in Azure with PowerShell
Last Updated on March 23, 2024 by Michael Morten Sonne Intoduction Are you tired of spending valuable time… The post Azure – Automating Manag...
Read Article →Demystifying Microsoft Entra Workload ID Licensing
Copyright © 2025 Microsoft Security - All Rights Reserved.
Read Article →Graph and PowerShell Hiccups for the Groups and Teams Report Script
The Microsoft 365 Groups and Teams Activity Report is a PowerShell script that I've worked on since 2016 (not all the time). Some recent Graph hicc...
Read Article →How to Convert an Entra ID External Account to Internal
A new convert to internal user preview feature allows Entra ID administrators to convert external accounts to internal accounts. An option is avail...
Read Article →Restrict Windows Registry Access with Intune Policy
The Windows Registry serves as a repository for critical system configurations and preferences, essential for the smooth operation of the Windows O...
Read Article →Microsoft Entra App Registration Exploitation
Copyright © 2025 Microsoft Security - All Rights Reserved.
Read Article →Understanding How Much Microsoft 365 Backup Charges to Protect Data
Microsoft 365 Backup costs are charged on a PAYG basis against an Azure subscription. You pay a flat fee of $0.15 per month per gigabyte of protect...
Read Article →Does Microsoft Care about SharePoint Online PowerShell?
Microsoft's support for SharePoint Online PowerShell has degraded over the last few years. Pnp.PowerShell is now the best option as not much is hap...
Read Article →How to simulate risk in Microsoft Entra ID Protection
Check out this article via web browser: How to simulate risk in Microsoft Entra ID Protection Entra ID protection is an excellent feature amongst t...
Read Article →Infusing Sensitivity Labels with Vibrant Colors
Copyright © 2025 Microsoft Security - All Rights Reserved.
Read Article →P1: Microsoft Defender for Endpoint Architecture
Copyright © 2025 Microsoft Security - All Rights Reserved.
Read Article →The Abuse of Teams Inbound Webhook Connectors and Channel Email Addresses
An article by security researchers Black Hills pointed to some vulnerabilities with incoming webhook connectors and email connections for Teams cha...
Read Article →Convert External Users to Internal Users in Microsoft Entra
Learn how to converted guests to internal using in Microsoft Entra using the web portal or Microsoft Graph PowerShell. The post Convert External Us...
Read Article →How to a Find Microsoft 365 Tenant ID Without Tenant Access
Use these 3 methods to find the tenant ID of any Microsoft Entra tenant without access to the tenant. The post How to a Find Microsoft 365 Tenant I...
Read Article →Introducing GitHub Backup Tool 1.2.0.0: Enhanced Security and Customization
Last Updated on June 29, 2024 by Michael Morten Sonne Intoduction I’m thrilled to announce the latest release… The post Introducing Git...
Read Article →Microsoft Lifts External Sharing Restriction for Loop App
The Loop app is a powerful collaborative platform that has been handicapped up to now with a restriction on its External Sharing capabilities. That...
Read Article →Finding Devices Used for Multifactor Authentication
This article describes how to use sign-in data to identify unused Entra ID registered devices. It’s an imperfect solution because Entra ID doesn’t ...
Read Article →Microsoft 365 Developer Program – Attention to all Microsoft 365 developers and learners!
Last Updated on July 27, 2024 by Michael Morten Sonne Intoduction The Microsoft 365 Developer Program is an… The post Microsoft 365 Developer...
Read Article →Customizing Quarantine Notification Messages
This article describes the experience of creating a custom quarantine message for Exchange Online Protection to send to those with email held in qu...
Read Article →Can Copilot for Microsoft 365 Save Users 14 Hours a Month?
An interesting LinkedIn post by a Microsoft employees relates how Copilot for Microsoft 365 saves him 14 hours monthly. Reports like this must be t...
Read Article →Outlook Classic Support Until At Least 2029
On March 7, Microsoft published a timeline for the New Outlook for Windows client that says that support for the classic client will be until at le...
Read Article →Despite the Doubters, Microsoft 365 Administrators Should Continue Using PowerShell
A recent article by a Microsoft MVP attempted to lay out a case that tenants should not use Microsoft 365 PowerShell and use ISV products instead. ...
Read Article →Houston, we have a TPM Attestation problem
This blog will be an additional blog to the TPM attestation series I wrote some time ago. In this one, I am going to take a closer look at why [...
Read Article →Setup cloud-based RADIUS for Entra Joined Devices using Cloud PKI
Learn how to setup RADIUS wireless network authentication in a completely cloud environment using Microsoft Entra, Cloud PKI and RADIUSaaS. The pos...
Read Article →Microsoft Announces Restricted SharePoint Search
Restricted SharePoint Search is an answer for customers who don't like the idea of Copilot for Microsoft 365 being able to find documents in any si...
Read Article →Entra ID – Global Secure Access Client – Setup of the Microsoft 365 Profile – Part 3
Last Updated on March 23, 2024 by Michael Morten Sonne Intoduction In an era defined by the dynamic… The post Entra ID – Global Secure Access...
Read Article →Secure Boot – What it is and how to update Secure Boot keys
Last Updated on March 6, 2024 by Michael Morten Sonne Intoduction Microsoft have in collaboration with partners and… The post Secure Boot – W...
Read Article →The Question of Information Protection Sublabels
The use of Information Protection sublabels is one of the questions for teams implementing sensitivity labels in Microsoft 365 tenants. Some like t...
Read Article →Tutorial: How to enable/disable Defender for Servers Plans at resources level
Intro I noticed that more and more clients are starting to use mixed license model for Defender for Servers. Previous you could only enable Defende...
Read Article →Autopilot: Escape the Administrator
Did you ever run into an issue in which the user was still in the local administrator group after the device was enrolled with Windows Autopilot (a...
Read Article →Entra Private Access & Windows Hello for Business Kerberos Trust – Network Drive Fails for 10 min. after restart and user login
If you are using Entra Private Access (or other SSE solutions) – together with Windows Hello for Business Kerberos Trust, ... Read more
Read Article →GitHub – Get a local backup of your code repositories – v. 1 of the tool
Last Updated on June 29, 2024 by Michael Morten Sonne Introduction The GitHub Backup Tool provides an intuitive… The post GitHub – Get a loca...
Read Article →Under the hood: Preparing your device for mobile device management
This blog will investigate what happens under the hood when our device is enrolled with Windows Autopilot during the “preparing your device f...
Read Article →Why It’s a Good Idea to Archive Teams Channels
An update allows Teams owners to archive Teams channels. This is an excellent way of keeping old channels online while removing them from open view...
Read Article →Microsoft Releases View Another Mailbox for the New EAC
Microsoft has released the View Another Mailbox feature for the new EAC. This is part of the build-out of the new EAC functionality before the reti...
Read Article →Office 365 for IT Pros March 2024 Update
The Office 365 for IT Pros eBook team has released the March 2024 update for the only eBook covering the Microsoft 365 ecosystem that's updated mon...
Read Article →Using WDAC to ingest missing MDE events and detect token stealing
Introduction In a previous blog post I talked about how adversaries can exploit SSO capabilities of Hybrid or fully Entra ID joined devices. I ment...
Read Article →Honored to receive the Microsoft MVP Award in Security – Febuary 2024!
Last Updated on March 15, 2024 by Michael Morten Sonne Intoduction 🎉 I am so thrilled to share… The post Honored to receive the Microsoft MVP...
Read Article →Restoring Data with Microsoft 365 Backup (Preview)
Microsoft has created an easy to use Microsoft 365 Backup solution. Its key feature is speed, including speed to restore data. I tested restores fo...
Read Article →Reporting Soft-Deleted Entra ID Objects
A Microsoft Technical Community article gave some interesting information about how to report soft-deleted Entra ID objects. We think we can improv...
Read Article →Autopilot: Only fail selected blocking apps in technician phase.
This blog will explain everything you want to know about this new ESP function called “Only fail selected blocking apps in technician phase (preview).
Read Article →How to Setup Cloud PKI in Microsoft Intune Step by Step
Learn how to configure you own Certificate Authority in Microsoft Intune Step by Step using Cloud PKI feature of Intune Suite. The post How to Setu...
Read Article →Protect your users from Device Code Flow abuse
Device Code Flow is a great feature. You are signed in on a machine that does not have any UI but need to connect to an Azure or Microsoft 365 reso...
Read Article →Report OneDrive for Business Storage Based on Usage Data
If you wanted to write a PowerShell script to create a OneDrive storage report, you'd probably use the cmdlets from the SharePoint Online managemen...
Read Article →Speaking at the February 2024 Azure APE Meetup
Today (Tuesday February 27th) I have the pleasure to speak at the February 2024 Azure APE Meetup organized by the Azure Platform Engineering (APE) ...
Read Article →Microsoft Releases Entra ID License Utilization Insights
Microsoft has released the preview of the Entra ID usage insights for premium license consumption. This could be the harbinger of a more restricted...
Read Article →PowerShell – Code Sign and validate files in a folder with optimized logic
Last Updated on February 25, 2024 by Michael Morten Sonne Intoduction Let’s delve into what makes this script… The post PowerShell – Co...
Read Article →Microsoft Defender for Identity – Updated Advanced Settings Page
Last Updated on February 24, 2024 by Michael Morten Sonne Intoduction Introducing the Updated Advanced Settings Page for… The post Microsoft ...
Read Article →Protect the Device Code Authorisation Flow With Conditional Access
Learn how to protect the device code authorisation flow in Microsoft Entra using Conditional Access policies. The post Protect the Device Code Auth...
Read Article →Microsoft Kills Viva Topics to Focus on Copilot
The Viva Topics retirement announced on February 22, 2024 is an inevitable side-effect of Microsoft's ongoing focus on Copilot. It is difficult to ...
Read Article →The Lord of Compliance: The War of the Check Access Button
In this updated blog, I will take a closer look at what exactly happens when you press the “Check Access” button in the Company Portal and why it t...
Read Article →Teams Private and Shared Channels Get Support for Tags
Teams Tags Support for Private and Shared Channels should arrive in targeted tenants soon. The new tag capability uses channel memberships instead ...
Read Article →Entra ID – Global Secure Access Client – Installation of the Agent on Windows – Part 2
Last Updated on February 22, 2024 by Michael Morten Sonne Intoduction In an era defined by the dynamic… The post Entra ID – Global Secure Acc...
Read Article →Microsoft 365 end-user notifications for changes in authentication methods
Check out this article via web browser: Microsoft 365 end-user notifications for changes in authentication methods When moving away from traditiona...
Read Article →Report Microsoft Entra License Utilisation with PowerShell
Learn how to report on Microsoft Entra Premium license utilisation using Microsoft Graph PowerShell to identify utilisation metrics. The post Repor...
Read Article →Stopping Copilot Access to SharePoint Online Sites and Document Libraries
Two methods exist to exclude a SharePoint sites from Copilot being able to use its contents - you can exclude the site (or document library) from s...
Read Article →Windows LAPS Under the Hood Part 2: Defuncted!
This blog will show you how the new Automatic Account Management feature in Windows LAPS, in combination with another new “hidden defunctR...
Read Article →Automatic attack disruption in Microsoft Defender XDR and containing users during Human-operated Attacks
Microsoft announced last year a new feature with the name; Automatic Attack Disruption in Defender XDR (Microsoft 365 Defender). Since October last...
Read Article →Why You Should Not Upgrade to Microsoft Graph PowerShell SDK V2.14
Usually, we recommend that Microsoft 365 tenants use the latest version of the Microsoft Graph PowerShell SDK. However, a serious bug in V2.14 mean...
Read Article →Microsoft Defender XDR – Offboarding scripts will now expire in 3 days and not 30 days
Last Updated on February 21, 2024 by Michael Morten Sonne Intoduction In a proactive move to give us… The post Microsoft Defender XDR – Offbo...
Read Article →Problems Retrieving SharePoint Online Usage Data with Graph APIs
A longstanding problem (SP676147) open since September 2023 causes problems retrieving important SharePoint usage data like site URLs and user acti...
Read Article →Entra ID – Global Secure Access Client – What it is about – Part 1
Last Updated on February 21, 2024 by Michael Morten Sonne Intoduction In an dynamic nature of work, where… The post Entra ID – Global Secure ...
Read Article →Microsoft maked the source code for MS-DOS and Word for Windows available to the public
Last Updated on February 17, 2024 by Michael Morten Sonne Intoduction Unlocking Digital Time Capsules In a noteworthy… The post Microsoft mak...
Read Article →Office 365 for IT Pros eBook Team Welcomes Michel de Rooij
The Office 365 for IT Pros team welcomes Michel de Rooij as a new author. As a PowerShell Pro, he'll like the code to update the impersonation prot...
Read Article →[Updated Feb 2024] Ultimate Comparison of Defender for Endpoint Features by OS
Finally, it’s time for a refresh. It’s been a while! Due to personal circumstances, I haven’t been able to keep the U...
Read Article →Copilot for Microsoft 365 to Support Outlook Classic
Microsoft originally said that Copilot for Microsoft would only support the Monarch client. Now it turns out the Outlook Win32 Copilot support is c...
Read Article →Logging Into the Future: Smart Strategies for Storing Microsoft Entra Logs in Azure
Explore storing Microsoft Entra logs via Azure Monitor, Storage Accounts, and Event Hubs, each offering unique benefits for IT security.
Read Article →Migrate Identity Protection Risk Policies to Conditional Access
Learn how to Migrate Identity Protection Risk policies in Microsoft Entra to Conditional Access Policies before they are retired. The post Migrate ...
Read Article →Tracking Licensing Costs for Microsoft 365 Tenants
The latest version of the Microsoft 365 Licensing Report script includes code to generate cost analyses for the departments and countries assigned ...
Read Article →Checking Out Entra Identity Secure Score
If your Microsoft 365 tenant has Entra P2 licenses, you can use the Entra Identity Secure Score feature to measure your tenant against Microsoft be...
Read Article →New Teams Telephony Admin Role in Teams Admin Center
Learn about the Teams Telephony Admin Role in the Teams Admin Center which is specifically designed to managed telephony-related functions in teams...
Read Article →Send High Volume Email in Microsoft 365
Learn about the High Volume Email service in Microsoft 365's Exchange Online platform so send bulk emails to external recipients. The post Send Hig...
Read Article →Configure email authentication for domains you own in Exchange Online (SPF, DKIM, DMARC and MTA-STS)
Last Updated on February 15, 2024 by Michael Morten Sonne Intoduction Why set this up? Configuring email authentication… The post Configure e...
Read Article →Viewing changes to Conditional Access policies just became easier!
Check out this article via web browser: Viewing changes to Conditional Access policies just became easier! Today, a quick tip for all Entra admins ...
Read Article →Why MFA, Conditional Access, and Sensitivity Labels can Combine to Give Outlook a Problem
If conditional access policies impose MFA for all cloud apps, it gives external users a problem when they use Outlook desktop to read protected ema...
Read Article →How Many Message Center Announcements End Up Being Delayed?
This article describes how to use the Microsoft Graph PowerShell SDK to retrieve and interpret Microsoft 365 message center posts with the intentio...
Read Article →I’m Gonna Config Refresh You So Hard!
This blog introduces a new Intune feature: ConfigRefresh, also known as Config Refresh, designed to enhance device security without the need for re...
Read Article →Teams Users Can Hide the General Channel
Message center notification MC711019 covers the ability to hide the General channel for a team, a feature designed to free up space in the teams an...
Read Article →Entra ID Protection – Common Microsoft 365 Security Mistakes Series
Signals from across Microsoft’s services and ecosystems inform Entra ID Protection to detect risk. The risk detections can alert administrato...
Read Article →List All Available Apps in the Intune Enterprise App Catalog
How to quickly list all applications in the Microsoft Intune Enterprise App Catalog using Microsoft Graph PowerShell. The post List All Available A...
Read Article →Use the Graph SDK to Access Microsoft 365 Service Health Information
The Microsoft Graph includes the Service Communications API. SDK cmdlets can use the API to retrieve and work with service health data. In this art...
Read Article →Defender for Cloud – Permissions Management – New Features added to Cloud Infrastructure Entitlement Management (CIEM)
Last Updated on April 27, 2024 by Michael Morten Sonne Intoduction In the ever-evolving landscape of cloud-based infrastructures,… The post D...
Read Article →Register New Applications With Microsoft Graph PowerShell
Learn how to register new applications in Microsoft Entra and assign permissions using Microsoft Graph PowerShell. The post Register New Applicatio...
Read Article →Reporting App Permissions Used by Managed Identities
This article explains how to check Managed Identity permissions, or rather the set of consented Graph and other permissions held by the service pri...
Read Article →New MSIdentityTools Cmdlet to Report OAuth Permissions
The latest version of the MSIndentityTools PowerShell module includes the Export-MsIdAppConsentGrantReport cmdlet to generate a report of OAuth app...
Read Article →Anonymous IP address involving Apple iCloud Private Relay
Since a few weeks I recognized an uptick in Entra ID Protection alerts regarding “Anonymous IP address” detections. Normally this is a ...
Read Article →A Thread on Frosty Fiascos: Delving into the Microsoft Midnight Blizzard Hack
Check out this article via web browser: A Thread on Frosty Fiascos: Delving into the Microsoft Midnight Blizzard Hack This post is all about the ha...
Read Article →Device Query: Dead of 64-bit
This blog will show you why the new Device Query Intune Suite feature could give you the wrong information when you are using the WindowsRegistry e...
Read Article →Microsoft Defender Vulnerability Management – Common Microsoft 365 Security Mistakes Series
Microsoft Defender Vulnerability Management (MDVM) is an often overlooked service that can be licensed standalone or is included in other Microsoft...
Read Article →Five Push Notifications at Device Query
In this blog, I am going to take a closer look at how we can troubleshoot a new feature in Intune called Device Query, also known as Intune Pivot. ...
Read Article →How to Hide Individual Distribution List Members
A question asked if it's possible to hide individual distribution list members. It's easy to hide the complete membership but not as simple to hide...
Read Article →AitM detection with Sentinel via custom CSS
Introduction You are probably wondering, what has CSS to do with detecting AitM sites. In this blog post, we will go over how we can use a custom C...
Read Article →Device Query: A Mad Max Intune Suite Feature
This blog will show you how Microsoft is stepping up the real-time reporting game by introducing a new wonderful feature called: Intune Pivot Devic...
Read Article →How to Deploy Apps from the Enterprise App Catalog In Intune
Learn how to deploy applications from the Enterprise App Catalog in Microsoft Intune using the web portal and PowerShell. The post How to Deploy Ap...
Read Article →Office 365 for IT Pros February 2024 Update
The February 2024 update for the Office 365 for IT Pros eBook (monthly update #104) is now available for download. Lots happened during January in ...
Read Article →Microsoft Cloud Revenues Powered by Office 365
Office 365 Reaches 400 million. Well, to be precise, in their FY24 Q2 results, Microsoft said that the figure is "over 400 million paid seats," but...
Read Article →Pivot via OAuth applications across tenants and how to protect/detect with Microsoft technology? (Midnight blizzard)
Recently threat actors like Midnight Blizzard use the OAuth applications in tenants that they can misuse for malicious activity. Actors use comprom...
Read Article →Windows LAPS Under the Hood: Automatic Account Management
This blog is going to show you some magical things that are happening in the background when you have enabled and configured Windows LAPS Automatic...
Read Article →Global Reader in Microsoft Entra to Allow Access to Teams Devices
The Global Administrator role in Microsoft Entra will soon enable administrators to access the Teams Devices section of the Teams admin center. The...
Read Article →Graph User.ReadBasic.All Application Permission Available
The Graph User.ReadBasic.All permission is now available for both delegated and application usage. Think before rushing to use the permission. Alth...
Read Article →Microsoft Deprecates Old Exchange Audit Search Cmdlets
A January 26 post announces the deprecation of four old Exchange audit cmdlets in favor of the Search-UnifiedAuditLog cmdlet. Removing old cmdlets ...
Read Article →How to Enable Automatic Account Creation for LAPS in Intune
Learn how to Automatically create new accounts using Windows LAPS configuration settings in Microsoft Intune The post How to Enable Automatic Accou...
Read Article →Exchange Online Optimizes Online Address Book Lookups
Microsoft is changing the way that Exchange Online address book updates work to force users to use search rather than browsing through the GAL/OAB....
Read Article →Improve Microsoft Graph PowerShell Performance with Batching
Learn how to improve the performance of your Microsoft Graph PowerShell scripts by using Graph request batching. The post Improve Microsoft Graph P...
Read Article →How to Update Tenant Corporate Branding for the Entra ID Sign-in Screen with PowerShell
The ability to apply custom corporate branding for Entra Id screens has existed since 2020. You can update elements through the admin center or Pow...
Read Article →Protect against QR Code phishing with Microsoft Defender products
In the past months, there has been a growing increase in QR Code phishing, since attackers are using new creative ways to bypass existing protectio...
Read Article →Windows LAPS: The Desolation of PAA Reboots
While playing around with Windows LAPS with an insider Windows canary build, I noticed that some improvements were made to Post Authentication Acti...
Read Article →How to Use PowerShell to Retrieve Permissions for Entra ID Apps
Recent attacker activity made me think that access might have been gained through an OAuth app. Keeping an eye on app permissions is important. Fro...
Read Article →Speaking at the Cloud Guardians Unleashed event of the Microsoft Cloud and Client Management Community
Tomorrow (Thursday January 25th) I have the pleasure to speak at the Cloud Guardians Unleashed event organized by the Microsoft Cloud and Client Ma...
Read Article →Teams Retires Client Ability to Load Websites from Channel Tabs
Microsoft plans to change the way that the Teams website channel tab works in early April 2024. Instead of the client opening a site, a new browser...
Read Article →Copilot for Teams Extracts Real Value from Meeting Transcripts
Lots of hype surrounds Copilot for Microsoft 365, but I like the way that Copilot for Teams extracts real value from meeting transcripts to generat...
Read Article →Configure LAPS in Intune using Microsoft Graph PowerShell
Quickly configure baseline settings for Windows LAPS in Microsoft Intune using Microsoft Graph PowerShell. The post Configure LAPS in Intune using ...
Read Article →Microsoft Defender for Identity – What is it, how to install it and setup requirements
Last Updated on September 26, 2024 by Michael Morten Sonne Intoduction What is Defender for Identity Microsoft Defender… The post Microsoft D...
Read Article →Microsoft Encourages More Performant Membership Rules for Dynamic Groups
MC705357 (9 Jan 2024) says that the dynamic group rule builder in the Entra ID and Intune admin centers no longer supports the contains and notCont...
Read Article →A winget match made in heaven
Learn how to package and auto-update apps in Intune using community-driven tools, WinTuner and Winget-AutoUpdate-Intune, for an efficient, l
Read Article →Ignore the Hype Surrounding the Copilot Announcement
Microsoft's January 15 announcement reduced deployment costs and opened the possibility for Copilot for Microsoft 365 deployments to many Office 36...
Read Article →Teams Naming Should be Clear and Simple
The essence of a good teams naming convention is simplicity and clarity. This article explains why those aspects are so important in terms of helpi...
Read Article →How to Report Expiring Credentials for Entra ID Apps
Entra ID registered apps can authenticate using app secrets and certificates. These credentials expire over time, so it’s good to review app creden...
Read Article →How to use deception in Microsoft Defender for Endpoint/ Defender XDR
Microsoft Defender XDR is expanding in the full attack stage. With the new Deception capability in Microsoft Defender XDR, it is possible to detect...
Read Article →How to Stop Users Receiving Document Mismatch Notifications
Document mismatch notifications tell users when they apply a higher-priority sensitivity label to documents than applied to the site. Some organiza...
Read Article →PowerShell – Automatically retrieve download links from Microsoft Evaluation Center
Last Updated on February 19, 2024 by Michael Morten Sonne Intoduction In the ever-evolving realm of IT, efficiency… The post PowerShell – Aut...
Read Article →Report all Application Owners in Microsoft Entra with PowerShell
Learn how to report the owners of all applications in Microsoft Entra using Microsoft Graph PowerShell and export to CSV. The post Report all Appli...
Read Article →Entra ID – Stale Application Analysis with PowerShell
Last Updated on February 19, 2024 by Michael Morten Sonne Stale Application Analysis for Entra ID – some… The post Entra ID – Stale App...
Read Article →Export Microsoft 365 Mailboxes with Microsoft Graph PowerShell
Learn how to quickly backup any Exchange Online mailbox using Microsoft Graph PowerShell and export the files locally. The post Export Microsoft 36...
Read Article →Connect to Microsoft Graph PowerShell Using Certificates with Azure Automation
Learn how to Connect to Microsoft Graph PowerShell using certificate based authentication in Microsoft Entra. The post Connect to Microsoft Graph P...
Read Article →How to Deploy Microsoft 365 Apps With Intune
Learn how to deploy the Microsoft 365 applications to Windows 10 and 11 devices using Microsoft Intune. The post How to Deploy Microsoft 365 Apps W...
Read Article →Mastering Microsoft Graph PowerShell SDK Foibles
Entra ID supports user extension attributes but the same facility is unavailable for group objects. That seems strange, but it might be due to the ...
Read Article →Race for Experiments: EPM vs. Ecs
In this blog, I am going to take a closer look at another EPM “flight” (AKA new feature) that Microsoft seems to be working on in Endpoint Privileg...
Read Article →Interpreting Audit Events for the New Stream
Audit events generated for the new Stream look like any other SharePoint Online event. Extracting the Stream audit events takes a little more effor...
Read Article →Microsoft Entra Workload ID - Incident Response with Microsoft Sentinel Playbooks and Conditional Access
In the recent parts of the blog post series, we have gone through the various capabilities to detect threats and fine-tune incident enrichment of W...
Read Article →How to protect Microsoft Teams with Microsoft 365 Defender
Microsoft released in the past months additional protections for Microsoft Teams. The new Office protection is part of the Defender for Office prod...
Read Article →Recent Stream Updates Enhance Video Functionality
The Stream browser app has received a bunch of recent enhancements, some of which are still deploying to tenants. The changes make it easier for Mi...
Read Article →Speaking at the MCT Summit Europe 2024
This year, the annual Microsoft Certified Trainer (MCT) summit will be held in the Netherlands. The event which takes place between 14-17 January w...
Read Article →How to Share Contact Information in Teams Chat
A new Share Someone's Contact Info feature is available for Teams one-to-one and group chats. The option inserts a link to the person's profile car...
Read Article →Microsoft Defender XDR – Activity log and change incident severity
Last Updated on February 19, 2024 by Michael Morten Sonne Intoduction Have you ever thinked about the Activity… The post Microsoft Defender X...
Read Article →How to Install and Use WinGet During AutoPilot
Learn how to install WinGet on Windows 10 and 11 devices using Microsoft Intune to help with installing and updating applications during the AutoPi...
Read Article →How to Report User-Consented Permissions on Applications in Microsoft Entra
Learn how to use Microsoft Graph PowerShell to generate a report of user permissions consented to applications in Microsoft Entra. The post How to ...
Read Article →Managing Passwords for Entra ID Accounts with PowerShell
Password profiles store the password settings for Entra ID user accounts. By updating the password profile, you can update an account's password an...
Read Article →Microsoft Defender XDR – Experience Improvements for Advanced Hunting
Last Updated on February 19, 2024 by Michael Morten Sonne Intoduction This blog post covers a few of… The post Microsoft Defender XDR – Exper...
Read Article →Microsoft Attempts to Retire Search-Mailbox Again
In message center notification MC703706 Microsoft announces yet another attempt to retire the Search-Mailbox cmdlet. This time it's due to happen i...
Read Article →How to Use SharePoint Metadata with Word Documents
This article explains how I use custom document properties with SharePoint Online to track the topics covered by blog articles that I write. The cu...
Read Article →Creating Viva Engage Communities with the Graph API
A new beta Graph API supports the creation of a Viva Engage community. This article explains how to use the Graph SDK to create a new community wit...
Read Article →Getting started with Microsoft Entra Private Access
Discover Microsoft Entra Private Access: advanced, secure remote access for corporate resources, surpassing traditional VPN limitations.
Read Article →Don’t Feed Large Reference Documents to Copilot for Word
Copilot for Word reference documents help to ground the prompts sent to LLMs for processing. The documents can be too large, which means that their...
Read Article →EPM: And the “Flights” of Support Approved
This is the first unofficial blog about a nice new Endpoint Privilege Management feature called Support Approved. I will show you what it looks lik...
Read Article →Office 365 for IT Pros January 2024 Update
The January 2024 update for the Office 365 for IT Pros eBook is available for subscribers to download from Gumroad.com or Amazon. Like any monthly ...
Read Article →Reflecting on 2023: A Year of Achievements, Growth, and Gratitude
Last Updated on December 31, 2023 by Michael Morten Sonne Intoduction As we near the end of 2023,… The post Reflecting on 2023: A Year of Ach...
Read Article →Obtain an Access Token for Graph API PowerShell Using a Device Code
Learn how to connect to Microsoft Graph PowerShell using a device code and obtain an access token without the PowerShell modules. The post Obtain a...
Read Article →Reporting Entra ID Admin Consent Requests
A question came in about how to report admin consent requests as viewed through the Entra ID admin center. PowerShell does the trick, once you know...
Read Article →Blocking the Welcome Message for Microsoft 365 Groups
This article describes how to block welcome messages for new members of Microsoft 365 groups using a resource behavior option (a group setting). Th...
Read Article →Entra ID – Quota Limit – Learn to manage your usage to avoid maxing it out and extend it before it’s too late
Last Updated on February 19, 2024 by Michael Morten Sonne Intoduction The inability to create new users in… The post Entra ID – Quota Limit –...
Read Article →From hybrid / fully joined devices to Entra ID
Introduction Adversaries are more and more interested in the data and infrastructure that lives in Cloud environments like Azure and Microsoft 365 ...
Read Article →How to Enable Defender for Endpoint in Microsoft Intune
Learn how to enable and deploy Microsoft Defender for Endpoint to Windows 10 and 11 devices using Microsoft Intune. The post How to Enable Defender...
Read Article →Using the SharePoint Online Sensitive by Default Control
The Sensitive by Default control allows tenants to prevent external access to newly uploaded documents until DLP processing checks their content. T...
Read Article →Creating a Hold Report for Purview eDiscovery Cases
Microsoft plans to make an eDiscovery hold report available to tenants in January 2024. This article explains how to use PowerShell to create a sim...
Read Article →Exchange Online Protection & Defender for Office 365 – Common Microsoft 365 Security Mistakes Series
Exchange Online Protection (EOP) and Microsoft Defender for Office 365 (MDO) are the email and collaboration security services native to Microsoft ...
Read Article →How to Configure Web Content Filtering with Global Secure Acess
Learn how to configure web filtering policies using the Global Secure Access, Internet Access profile in Microsoft Entra. The post How to Configure...
Read Article →The Demise of Office Delve
The Delve web app will be deprecated by Microsoft in December 2024. It's the end of a line for an app that once promised to reimagine search. The p...
Read Article →Microsoft Entra Workload ID - Advanced Detections and Enrichment in Microsoft Sentinel
Collecting details of all workload identities in Microsoft Entra ID allows to build correlation and provide enrichment data for Security Operation ...
Read Article →Perform Bulk On-demand Remediation with Microsoft Intune
Learn how to initiate bulk on-demand remediation packages on multiple machines at once using Microsoft Intune. The post Perform Bulk On-demand Reme...
Read Article →Threat Actors Increase Misuse of OAuth Applications
OAuth apps are a big part of the extensibility picture for Microsoft 365 tenants. As such, they are targeted by attackers as a good way to gain acc...
Read Article →Using Microsoft 365 Copilot for Word
Copilot for Word is an application-specific implementation of Microsoft 365 Copilot. Amongst its capabilities, Copilot can generate and rewrite tex...
Read Article →How to Create a Local Admin Account on Windows Devices with Intune
Lean how to create a local administrator account on your Windows devices really simple with Microsoft Intune. The post How to Create a Local Admin ...
Read Article →Microsoft’s AI Strategy for Security Depends on Data
Microsoft's security strategy is all about AI with Security Copilot leading the charge. Even in a world of AI tools, knowing how to use KQL and Sen...
Read Article →Exchange Online Retention Policies and the Deleted Items Folder
For whatever reason, it's not possible to update the Default MRM policy to add the DeletedItems retention tag to process items in the Deleted Items...
Read Article →The 0xd000000d Job 2: Nutty by Intune
In this blog post, a fellow Dutchman (Jos Lieben) asked me if I could assist him with a weird error that occurred during the Intune/MDM enrollment....
Read Article →Entra ID Improves Registered App Security
The preview app instance property lock feature designed to improve the security of Entra ID registered apps is becoming the default for new apps. I...
Read Article →How to Create and Manage Access Reviews for Group Owners
Learn how to enable group owners to managed access reviews for guests in groups/teams that they are the own off. The post How to Create and Manage ...
Read Article →Microsoft Defender for Endpoint plug-in for Windows Subsystem for Linux (WSL) – finally!
Last Updated on February 19, 2024 by Michael Morten Sonne Intoduction Yes – now we can see information… The post Microsoft Defender for...
Read Article →What is this Microsoft SSE solution that everyone is talking about?
On July 11th, Microsoft announced that Azure AD would be renamed to Microsoft Entra ID. Microsoft also announced two new security offerings called ...
Read Article →Entra ID Captures Timestamp for Last Successful Sign In for User Accounts
Entra ID captures the lastSuccessfulSignInDateTime property to record the last successful sign-in action against user accounts. The new property is...
Read Article →Exclude Breakglass Accounts from Conditional Access Policies with PowerShell
Conditional access policies control access to Entra ID connections. Policies should have exclusions for breakglass accounts, but sometimes this doe...
Read Article →Get email notifications for actions performed in Defender XDR (Defender for Endpoint)
Last Updated on May 5, 2024 by Michael Morten Sonne Intoduction Enhancing Cybersecurity Operations Through Timely Stakeholder Notifications… ...
Read Article →The Day that the Microsoft Teams Group Chats stood still.
This time not a deep dive blog but a simple little blog about fixing the missing Microsoft Teams group chats and the “Unknown User” in the mobile T...
Read Article →What problem do passkeys solve?
Sometimes unlearning things is harder than learning As you might have read somewhere Microsoft is busy implementing support for passkeys in their p...
Read Article →How the Auto-label Policy for Cloudy Attachments Works
Cloudy attachments are links to files sent in messages. An auto-label policy can capture copies of cloudy attachments and make them available for e...
Read Article →How to Find OS Details From an ISO File
Learn how to find which Operating System versions are within an ISO file and the OS details, using DISM commands. The post How to Find OS Details F...
Read Article →How to Prevent Users From Accessing The Microsoft Entra Portal
Learn how to prevent users from accessing the Microsoft Entra Admin portal and understand the impact of restricting access. The post How to Prevent...
Read Article →Checking Exchange Online Distribution List Activity Over 90 Days
Exchange Online keeps message trace data online for 10 days and that's what's normally used to check for unused distribution lists. Checking over 9...
Read Article →Configuring even better Windows Update for Business settings for your Microsoft Intune managed Modern Workplace
In March 2021, I published the blogpost “Configuring Windows Update for Business settings for your Microsoft Endpoint Manager managed Modern ...
Read Article →SharePoint Online Powers Ahead with Embedded Service
SharePoint Embedded is a new Microsoft offering for application developers. The big upside is that apps can take advantage of the Microsoft 365 eco...
Read Article →How to Deploy the Global Secure Access Client with Intune
Learn how to mass-install the Global Secure Access Client using Microsoft Intune. The post How to Deploy the Global Secure Access Client with Intun...
Read Article →Microsoft Entra Workload ID - Threat detection with Microsoft Defender XDR and Sentinel
Attack techniques has shown that service principals will be used for initial and persistent access to create a backdoor in Microsoft Entra ID. This...
Read Article →December 2023 Update for Office 365 for IT Pros eBook is Available
The December 2023 update (monthly update #102) for the Office 365 for IT Pros eBook is now available for subscribers to download. While Microsoft h...
Read Article →Belgium Microsoft Cloud & Security Community
“If you know the enemy and know yourself, you do not need to fear the result of a hundred battles.” ~ Sun Tzu ⚔ I spoke at the Belgian ...
Read Article →Declined Meetings Show Up in OWA and Monarch
A new setting in OWA options allows users to choose to preserve declined meetings. Keeping details of declined meetings can help users to find info...
Read Article →Prevent AiTM with Microsoft Entra Global Secure Access and Conditional Access
Check out this article via web browser: Prevent AiTM with Microsoft Entra Global Secure Access and Conditional Access Microsoft Entra Global Secure...
Read Article →Use Dictation to Compose Outlook Messages
Now available for OWA and the Monarch client, Outlook voice dictation allows users to compose the body text of messages with speech-to-text transcr...
Read Article →Speaking at the European SharePoint Conference (ESPC) about Microsoft Entra ID Conditional Access
This week, the European SharePoint Conference (ESPC) is held between November 27 – 30 in Amsterdam the Netherlands. The event which will attr...
Read Article →The Wonderful Story of APV2 Device Preparation
In one of my last blog posts, I described how I noticed that Autopilot Version 2, AKA APV2, was coming. This blog is the second in the Autopilot v2...
Read Article →Evilginx resources for Microsoft 365
Check out this article via web browser: Evilginx resources for Microsoft 365 Okay, let’s start with a disclaimer. This post is created for ed...
Read Article →Generate Mailbox Usage Reports with Microsoft Graph PowerShell
Learn how to generate and export Microsoft 365 mailbox usage reports for Exchange Online using Microsoft Graph PowerShell. The post Generate Mailbo...
Read Article →Privileged Identity Management (PIM) – Common Microsoft 365 Security Mistakes Series
Entra ID’s P2 license (previously Azure AD Premium P2) unlocks the Privileged Identity Management (PIM). PIM is part of broader identity gove...
Read Article →Microsoft Error Codes
Here’s a comprehensive overview of all Microsoft error codes. For deeper insights, I’ve linked to the detailed write-ups I’ve created for specific ...
Read Article →Microsoft Intune Application Deployment Best Practices
In December 2012, I blogged about best practices for deploying applications using System Center Configuration Manager, and while many of those reco...
Read Article →A love story about Role Based Access Control for Applications in Exchange Online, Managed Identities, Entra ID Admin Units, and Graph API
Check out this article via web browser: A love story about Role Based Access Control for Applications in Exchange Online, Managed Identities, Entra...
Read Article →SslClientCertReference Without a Cause
This blog will focus on the 0x80190190 Bad Request (400) we could get because the SslClientCertReference is not configured and maybe a couple of ot...
Read Article →How to Force a Password Change in Microsoft 365 Without Password Reset
Learn how to force a password change for a Microsoft 365 user on the next log on, without changing the users password. The post How to Force a Pass...
Read Article →Customise or Disable Microsoft Managed Conditional Access Policies
Learn how to turn off Microsoft Managed Conditional Access policies in Microsoft Entra to prevent them from being created. The post Customise or Di...
Read Article →New Experience For Resetting Your Microsoft 365 Password Online
Users can now change their password in Microsoft 365 online from the My Security Info page without having to enter their existing password. Learn h...
Read Article →You can now finally upgrade to Windows 11 23H2!
Last Updated on November 2, 2023 by Michael Morten Sonne Intoduction The next Windows 11 version is here!… The post You can now finally upgra...
Read Article →How to Simplify using Microsoft Graph PowerShell with PIM
Learn how to best use the Directory.AccessAsUser.All permissions as the signed in user with Microsoft Graph PowerShell. The post How to Simplify us...
Read Article →In the Shadow of the DiscoveryEndpoint
This blog will discuss my attempt to enroll my device with the latest 25977.1000 insider preview using Autopilot. I will show you how I stumbled up...
Read Article →How to Forward Messages in Microsoft Teams Chats
Learn how to forward messages in Microsoft Teams chats from one chat to another and quote the original message. The post How to Forward Messages in...
Read Article →Microsoft Defender for Endpoint: New and more streamlined device connectivity on the way
Last Updated on June 2, 2025 by Michael Morten Sonne Intoduction Update – 31/10/2023 – MacOS and Linux… The post Microsoft Defend...
Read Article →How to Change the Default MFA Method for Microsoft 365 Users
As an Microsoft 365 admin, you can use the Microsoft Entra admin portal to change a users default MFA method. The post How to Change the Default MF...
Read Article →Microsoft Sentinel User Forum
Together with my colleague Louis Mastelinck, we talked on the Microsoft Sentinel user forum about Microsoft Sentinel data ingestion and avoiding al...
Read Article →Protect Microsoft 365 Break Glass Accounts with Azure Automation
Learn how to protect your Microsoft 365 Break Glass accounts and never get locked out of your organisations tenant with Azure Automation. The post ...
Read Article →Entra ID – Comming: Auto-rollout of basic Conditional Access policies to protect your tenant – is missing in so many tenants so finally!
Last Updated on February 19, 2024 by Michael Morten Sonne Intoduction Background Companies that do not implement Multi-Factor… The post Entra...
Read Article →What are Microsoft Applied Skills? Microsoft’s new free certification
Microsoft Applied Skills have now been released. A new and free verifiable credentials from Microsoft earned through lab-based assessments. The pos...
Read Article →There will be…..Autopilot Version 2 (APv2)
This blog will be about my first encounter with APv2. Yeah!! APv2 As in Autopilot version 2. Did I get your attention??? I am going to assume I do....
Read Article →Microsoft 365 ends support for Office 2016 and Office 2019 clients
Microsoft 365 ends support of older clients including Office 2016 and Office 2019. Take action now to ensure you can continue to use the latest Mic...
Read Article →Microsoft Global Secure Access: Empowering Secure and Seamless Connectivity
Boost security, speed, and access with Microsoft's Entra Internet for M365. A game-changer!
Read Article →Prepare for passkeys in Entra ID!
Check out this article via web browser: Prepare for passkeys in Entra ID! Only a few months until Microsoft Entra ID will support device-bound pass...
Read Article →How to create a Temporary Access Pass using Logic Apps
Check out this article via web browser: How to create a Temporary Access Pass using Logic Apps Now that more and more organizations are moving towa...
Read Article →Get Ahead of Microsoft’s New Free Purview Discovery Plan
Microsoft has released a new free Microsoft Purview Discovery plan which includes brand new features available for free tier users. The post Get Ah...
Read Article →Take Advantage of New Exchange and SharePoint Audit logs for Standard Users
Microsoft expands their Microsoft Purview audit log availability to standard users for premium exchange and SharePoint activities. The post Take Ad...
Read Article →How to Apply Conditional Access to PIM Activation in Microsoft Entra
Apply strong authentication methods through Conditional Access for PIM (Privileged Identity Management) role activation. The post How to Apply Cond...
Read Article →Assign Permissions to a Managed Identity with Graph PowerShell
Learn how to assign Microsoft Graph API permissions to Managed Identities using Microsoft Graph PowerShell. The post Assign Permissions to a Manage...
Read Article →The Positively True Adventures of the Alleged MigrateRefreshTask
This blog will be the 7th one in the Windows Declared Configuration series (WinDc). In this WinDc series I am focusing on what the “Refresh Schedul...
Read Article →Allow Unlimited Snoozes for Microsoft Authenticator Registration
Learn how to modify the Microsoft Authenticator Registration Campaign settings to allow unlimited snoozes when prompted to register. The post Allow...
Read Article →How to Bulk Update Microsoft 365 Groups Owners with PowerShell
Learn how to perform bulk management of group owners for Microsoft 365 groups using Microsoft Graph PowerShell. The post How to Bulk Update Microso...
Read Article →How to Output Invoke-MgGraphRequest Responses as a PowerShell Object
Learn how to change the output type to a PowerShell Custom Object when working with the Invoke-MgGraphRequest cmdlet in Microsoft Graph. The post H...
Read Article →Hunting for the Curl vulnerability
With the outlook of the release of the new Curl version, I thought it would be nice to know where Curl is being run and where it is making network ...
Read Article →[issue] Connect-AzAccount : Method not found: System.Threading.Tasks.Task
Error Connect-AzAccount : Method not found: ‘System.Threading.Tasks.Task`1 Azure.Identity.InteractiveBrowserCredential.AuthenticateAsync(Azur...
Read Article →Microsoft Entra MFA Fraud Deep Dive
Microsoft Entra MFA Fraud Deep Dive Tags: Entra, ITDR, MFA Published at: October 7, 2023 Summary: Recently, Microsoft released the new feature Repo...
Read Article →Conditional Access – Common Microsoft 365 Security Mistakes Series
Conditional Access (CA) is front and center of any attempt to secure Microsoft 365. If you’ve spent any time securing your tenant and Entra r...
Read Article →How to Update User Photos with Microsoft Graph PowerShell
Learn how to update user photos in Microsoft 365 using Microsoft Graph PowerShell with the Set-MgUserPhoto cmdlet. The post How to Update User Phot...
Read Article →Lenovo Bios: Dead of Autopilot Marker
After “finishing” (or maybe not yet) my WinDc blog series I am going to start looking at other stuff. One of the things that I am always interested...
Read Article →Declared Configurations and the MI Provider
This blog will zoom in on, the MOF file and how the MI provider is being used when the declared configuration policies are being set
Read Article →Sentinel & SOAR: Part 4 - Error handling
IntroductionHello there, welcome back to part 4 of my Sentinel & SOAR series! If you’re new to this series you might want to check out any earl...
Read Article →Allow On-Premise Password Change to Reset User Risk in Microsoft Entra
Learn how to enable the Allow On-Premise Password Change to Reset User Risk feature in Microsoft Entra to manage risky users. The post Allow On-Pre...
Read Article →How to Block User Access to BitLocker Keys in Microsoft Entra
Learn how to prevent users from accessing BitLocker keys for the devices they own in the Microsoft Entra portal. The post How to Block User Access ...
Read Article →Along With the Gods: The Two PushLaunch Tasks
This blog will be about a big underestimated schedule!! I am going to dive into the PushLaunch scheduled task once again. This Task is responsible ...
Read Article →How to Modify Security Defaults with Microsoft Graph PowerShell
Learn how to enable and disable security defaults in Microsoft Entra programmatically using Microsoft Graph PowerShell. The post How to Modify Secu...
Read Article →10 Great Tips for Admins Working With Microsoft Graph PowerShell
Here are ten of my top tips for admins working with Microsoft Graph PowerShell to get the most out of their scripts. The post 10 Great Tips for Adm...
Read Article →ReconstructQueueAndExecute: The Last Crusade for Declared Configuration Recovery
This blog post will be the fifth in the WinDC Refresh Schedule series. In it, I will zoom into what happens when we run into corrupted Declarative ...
Read Article →Deploying MDE to macOS
This guide will get you up and running with MDE for macOS in no time.
Read Article →How to Restrict Guest User Invites in Microsoft Entra
Learn how to restrict who can invite guest users to your tenant in Microsoft Entra and using Microsoft Graph PowerShell. The post How to Restrict G...
Read Article →Easily import, export and document Intune configurations!
Need to bulk import, export or document your Intune configurations, this guide has you covered.
Read Article →Speaking at the Workplace Ninja Summit, September 27-29 2023
Starting on Wednesday September 27, till Friday September 29 the Workplace Ninja Summit which is an in-person event will take place in Baden, Swits...
Read Article →Messed up NTFS permissions? – how to cleanup and remove users/groups there should NOT be there
Last Updated on February 19, 2024 by Michael Morten Sonne Intoduction Fileservers – the never ending story for… The post Messed up NTFS...
Read Article →How to Deploy Conditional Access Templates with Graph PowerShell
Learn how to deploy conditional access policies from pre-defined templates using Microsoft graph PowerShell. The post How to Deploy Conditional Acc...
Read Article →Enforce FIDO2 PIN complexity with Microsoft Entra Conditional Access Authentication Strengths.
Check out this article via web browser: Enforce FIDO2 PIN complexity with Microsoft Entra Conditional Access Authentication Strengths. As you may o...
Read Article →How to enable Enterprise Voice with Microsoft Teams PowerShell
Learn how to enable Enterprise Voice for Microsoft Teams direct routing users using Microsoft Teams PowerShell. The post How to enable Enterprise V...
Read Article →How to Target Specific Tenants with Conditional Access
Learn how to target specific Microsoft Entra tenants in Multitenant organisations using Conditional Access policies. The post How to Target Specifi...
Read Article →How to Add Users to Groups with Microsoft Graph PowerShell
Learn how to use the New-MgGroupMember cmdlet to add users to groups in Microsoft 365 using Microsoft Graph PowerShell. The post How to Add Users t...
Read Article →Close Encounters of the Microsoft Azure Attestation
This blog will be about my first and second encounters with Microsoft Azure Attestation(MAA) and how this new kind of attestation will be dropped d...
Read Article →How to Setup Multi-Tenant Organisation in Microsoft 365
Learn how to Setup Cross-Tenant Synchronisation in Microsoft Entra step by step to automatically provision B2B user access. The post How to Setup M...
Read Article →How to use Automatic Attack Disruption in Microsoft 365 Defender (BEC, AiTM & HumOR)
Last year Microsoft announced a new feature called; Automatic attack disruption which uses correlated insights from the Microsoft 365 ecosystem and...
Read Article →Defender for Endpoint for Linux: new capabilities and enhancements
Intro Microsoft published this summer new capabilities and enhancements for Defender for Endpoint on linux. In my opinion Defender for Endpoint on ...
Read Article →How to Report All Users and Group Membership With Microsoft Graph PowerShell
Learn how to use Get-MgUserMemberOf in Microsoft Graph PowerShell to find which groups a user is a member of and report for all users. The post How...
Read Article →How to use Strictly Enforce Location Policies in Conditional Access
Learn how to when and how to use the strictly enforce location policies setting in Conditional Access. The post How to use Strictly Enforce Locatio...
Read Article →Speaking at the Cloud Identity Summit 2023, on September 7th 2023
On Thursday September 7th, the annual Cloud Identity Summit will take place as an in-person event in Koblenz Germany. This event is organized by Th...
Read Article →The Adventures of WinDC, Queen of the MMP-C
This blog post will be the third one in my journey to discover what the “refresh schedule created by Declared Configuration to refresh any settings...
Read Article →Microsoft Entra Workload ID - Lifecycle Management and Operational Monitoring
Workload identities should be covered by lifecycle management and processes to avoid identity risks such as over-privileged permissions but also in...
Read Article →How to Block a Domain or Email Address in Exchange Online
Learn how to block an email address or Domain for all users in Exchange Online using the Microsoft 365 defender portal. The post How to Block a Dom...
Read Article →Enabling Time-based Restrictions in Conditional Access
Learn how to apply Conditional Access policies based on the time of day and the day of the week by configuring time-based conditions. The post Enab...
Read Article →Windows Autopilot Profile Resiliency
In this blog, I am going back to my “roots” and taking another look at Autopilot. To be a bit more precise, I am going to look at how the […]
Read Article →How to Create Conditional Access Policies with Microsoft Graph PowerShell
Learn how to use New-MgIdentityConditionalAccessPolicy to create Conditional Access policies with Microsoft Graph PowerShell. The post How to Creat...
Read Article →How to Revoke Application API Permissions with Microsoft Graph PowerShell
Learn how to revoke API permissions assigned to applications in Microsoft Entra using Microsoft Graph PowerShell. The post How to Revoke Applicatio...
Read Article →How to troubleshoot Live Response in Defender for Endpoint
Live Response is a powerful feature as part of the Microsoft 365 Defender portal. With the use of Live Response Security Operations Teams can estab...
Read Article →How to Setup User Risk Reports to Email in Microsoft Entra
Learn how to setup User Risk and Sign-in Risk reports in Microsoft Entra using the admin center and Microsoft Graph PowerShell. The post How to Set...
Read Article →Entra Registered Devices in Intune: What You Need to Know
This blog is an addition to my previous blog, which showed you the difference between Entra Registered devices and Entra Joined devices. In this bl...
Read Article →[issue] Connect-MgGraph : Method not found: ‘System.Action`1 Azure.Identity.IMsalPublicClientInitializerOptions.get_BeforeBuildClient()’.
Cause Old version of Az.Accounts v2.9.1 was being installed on the computer as part of Az.Portal installation, even though newer ... Read more
Read Article →Collecting DNS events using Azure Monitor Agent
This blog will give you insight on how to setup collection of DNS Events from Windows devices using Azure Monitor ... Read more
Read Article →Turn off Directory synchronization with Microsoft Graph PowerShell
Learn how to turn off directory synchronisation (Azure AD Connect) using Microsoft Graph PowerShell to disable on-premise synchronisation. The post...
Read Article →How to Apply Conditional Access to Protected Actions in Microsoft Entra
Learn how to configure Protected Actions in Microsoft Entra with an Authentication Context to protect with Conditional Access policies. The post Ho...
Read Article →Onboard and configure Defender for Endpoint for non-persistent VDI environments
Microsoft supports multiple onboardings methods for Defender for Endpoint. For non-persistent VDI’s there is always a challenge since non-per...
Read Article →How to Modify DMARC Policies in Microsoft 365 for Inbound Mail
Learn how to modify how Microsoft 365 handles DMARC for inbound mail with DMARC policies in Microsoft Defender. The post How to Modify DMARC Polici...
Read Article →Microsoft Defender for Endpoint security management (MDE Attach v2) on Linux : A deep dive
Intro This blog post is inspired by Rudy Ooms, who wrote a excellent write up about the behind the scenes of the MDE attach v2 process and security...
Read Article →Using Managed Identities in Logic App HTTP triggers
Warning We ‘archived’ this blogpost during a migration from the old HybridBrothers website framework to the new one, since it is more t...
Read Article →In the name of MMP-C
This blog will be just me changing 1 of the four words of MMP-C, nothing more! Curious how I am writing a whole blog about it? Please read on!
Read Article →Microsoft Entra Workload ID - Introduction and Delegated Permissions
Workload identities will be used by applications, services or cloud resources for authentication and accessing other services and resources. Especi...
Read Article →ERROR: Could not load type ‘Microsoft.Graph.Authentication.AzureIdentityAccessTokenProvider’ from assembly ‘Microsoft.Graph.Core
After upgrading Microsoft Graph, I noticed an issue when trying to run cmdlet Get-MgGroup or Get-MgUser. I could connect to ... Read more
Read Article →How to Setup Registration Campaigns for MFA in Microsoft Entra
Learn how to configure Registration Campaigns in Microsoft Entra to prompt users to configure the Authenticator app for MFA. The post How to Setup ...
Read Article →PnP.Powershell – important changes to Powershell version requirement
[Important changes] PnP.Powershell – Are you using PnP.Powershell (or considering to update) to manage your Microsoft 365 environments and pr...
Read Article →Refreshing the Declared Configuration Policies
This blog post will be the second one in my journey to discover what the “refresh schedule created by Declared Configuration to refresh any setting...
Read Article →How to Fix Error 550 5.7.509: Access denied in Exchange Online
Learn how to fix 550 5.7.509: Access denied, sending domain contoso.com does not pass DMARC verification and has a DMARC policy of reject in Exchan...
Read Article →How to use Defender for IoT firmware Scanning for checking potential security vulnerabilities and weaknesses
Recently Microsoft announced a new firmware scanning feature in Defender for IoT. With the new Defender for IoT Firmware analysis, it is possible t...
Read Article →Azure Backup: Do I have resources NOT protected by backup?
This blog will show you how you can automate an overview using Kusto queries against Azure Resource Graph (ARG) to ... Read more
Read Article →0x80072f8f : A BitLocker Odyssey
This time, a simple blog about a BitLocker escrow error (0x80072f8f )that started happening (all of a sudden) on multiple devices when you were try...
Read Article →Block apps (discovered/ shadow IT) with Defender for Cloud Apps and Defender for Endpoint
With the use of Defender for Cloud Apps in combination with Defender for Endpoint it is possible to block unsanctioned apps, the block of apps is p...
Read Article →How is it now you get a refund for Microsoft 365 and Azure downtime and see service status?
Last Updated on September 24, 2024 by Michael Morten Sonne This may be split up in 2 parts..… The post How is it now you get a refund for Mic...
Read Article →Protect Microsoft Graph PowerShell Logins with Conditional Access
Learn how to use Conditional Access to protect user logins to Microsoft Graph using the Microsoft Graph PowerShell SDK. The post Protect Microsoft ...
Read Article →The Treasure of the MMP-C Madre
This time, a simple blog without technical details. It will be just me showing you why I am so enthusiastic about a specific service called MMP-C a...
Read Article →Unleash the power of defender plan 2: Just-in-time VM access – part 4
Intro Malicious actors actively search for machines with open management ports, such as RDP or SSH, to exploit. All of your virtual machines are po...
Read Article →Manage Defender for Endpoint for Windows, macOS, and Linux via Security settings management
Recently Microsoft announced a couple of new improvements related to the new security settings management for Windows, macOS, and Linux as part of ...
Read Article →Under the Hood of: MDE Attach V2 / Security settings management
I will guide you through my MDE Attach V2 (Security Management) journey and explain which "service" delivers the Intune policies to your NOT AADJ (...
Read Article →How to Setup Microsoft Entra Internet Access
Learn how to setup Microsoft Entra Internet Access with Conditional Access to secure access to Microsoft 365 apps and services. The post How to Set...
Read Article →Manage user-preferred multi-factor authentication method in Microsoft Entra ID
Check out this article via web browser: Manage user-preferred multi-factor authentication method in Microsoft Entra ID This post is all about setti...
Read Article →The WinDC Refresh Schedule and the Dudes
In this series, I will try to explain more about a wonderful "refresh schedule" I noticed in the task scheduler after EPM was deployed. This first ...
Read Article →How to use The Microsoft Graph Explorer Tool
Learn how to use the Microsoft Graph Explorer tool to support you with understand the Graph API and writing PowerShell Scripts. The post How to use...
Read Article →Microsoft Improves and Simplifies Defender for Endpoint Management Capabilities
In one of the biggest changes to Microsoft Defender for Endpoint (MDE) in its product history, you no longer need a separate management engine to c...
Read Article →How to Monitor for Application Admin Permission Consent in Microsoft Entra
Learn how to monitor for application admin permission consents in Azure AD using PowerShell and Azure Automation. The post How to Monitor for Appli...
Read Article →How to protect Azure storage accounts (Blob) using Defender for Storage
Defender for Storage is the Azure-native layer of security intelligence that detects potentially harmful attempts to access or malicious activity. ...
Read Article →Lets create a Free Lab with Microsoft Defender for Endpoint and Simulate some Ransomware Attacks – get the correct free trial
Last Updated on October 6, 2024 by Michael Morten Sonne Intoduction Microsoft’s Defender for Endpoint (MDE) – is… The post Lets create ...
Read Article →Azure AD – Why use Cloud-Only Administrative/normal accounts and how to protect them in Azure AD from on-premises attacks
Last Updated on June 2, 2025 by Michael Morten Sonne Intoduction Frist – sorry for the size og… The post Azure AD – Why use Cloud-Only ...
Read Article →How to use Managed Identities with Microsoft Graph PowerShell
Learn how to use the Connect-MgGraph cmdlet with the -Identity parameter to connect with System and user-assigned managed identities. The post How ...
Read Article →Tool: MDE-Troubleshooter is born !
Background story During my consultancy work, I have received feedback from numerous clients indicating that they consistently encountered difficult...
Read Article →The Importance of Updating Installed PowerShell Modules – And automate it too with my script
Last Updated on January 19, 2024 by Michael Morten Sonne Intoduction In the world of PowerShell, modules play… The post The Importance of Upd...
Read Article →The 0x800705B4 error in our stars
In this blog, I am going to scuba dive a bit into the wonders of SyncML and how all devices ended up with sync errors and all new Autopilot enrollm...
Read Article →Secure your Azure Management portal
Last Updated on June 25, 2023 by Michael Morten Sonne How secure your Azure Management Portal?. By default,… The post Secure your Azure Manag...
Read Article →Your isolated device stuck in Defender for Endpoint Isolation mode , not anymore !
Intro When you want to investigate a endpoint that has indication of being comprised you might want to put the endpoint in Defender for Endpoint is...
Read Article →MC2MC
My first public speaking experience! I spoke together with my colleague Sander Bougrine on MC2MC, where we deep dived into how to integrate 3th par...
Read Article →Company branding and custom CSS in Azure Active Directory
Check out this article via web browser: Company branding and custom CSS in Azure Active Directory Company branding in Azure AD is a nice feature th...
Read Article →A Guide to Recognizing Your Post Authentication Actions
LAPS everywhere!!!! This time I am deep-diving into the wonders of the Post Authentication Actions (PAA) and what is actually happening (or maybe n...
Read Article →Azure AD Application Activity Report Analysis
In the today’s digital age and use all over the world, maintaining the security of an organization has… The post Azure AD Application Activit...
Read Article →Sending email with Azure Automation and Managed Identity
Using Azure Automation Accounts to send scheduled emails, ditch those scheduled tasks and insecure scripts!
Read Article →12 quick tips to secure your identities in Microsoft 365
Last Updated on March 14, 2024 by Michael Morten Sonne In the post here, I will share 10… The post 12 quick tips to secure your identities in...
Read Article →The Infernal MMP-C Discovery
This blog will be an additional blog post to the MMP-C one. In this blog, I am deep-diving into the first MDE / MMP-C / Declared Configuration enro...
Read Article →What is Customer lockbox in Azure, and how to use it?
Last Updated on March 14, 2024 by Michael Morten Sonne Customer Lockbox is a security feature in Microsoft… The post What is Customer lockbox...
Read Article →Microsoft Defender for Endpoint settings management: Enhancements
*UPDATE 17/07/2023* Added extra information about system labels Intro Microsoft is doing a very good job at listening to their customers, partners ...
Read Article →Unleash the power of Defender for Servers Plan 2: Agentless scanning – part 3
Intro Welcome to part three of the blog series on Unleach the power of Defender for Servers Plan 2! In our previous blog, we explored how to start ...
Read Article →LogAnalytics table migration from Classic (v1) to Data Collector Rule-based (v2) video’s – to replace HTTP Data Collector API (v1) with Log Ingestion API (v2)
Check out my latest 2 videos, which will cover both migration scenarios using my AzLogDcrIngestPS PS-module: Side-by-Side Migration (new table, ......
Read Article →Running Evilginx 3.0 on Windows
Check out this article via web browser: Running Evilginx 3.0 on Windows In case you missed it: Evilginx 3 was recently launched to the public. This...
Read Article →Protection of privileged users and groups by Azure AD Restricted Management Administrative Units
Restricted Management Administrative Unit (RMAU) allows to protect objects from modification by Azure AD role members on directory-level scope. Man...
Read Article →What is Customer lockbox in Microsoft 365, and how to use it?
Last Updated on March 14, 2024 by Michael Morten Sonne Best known as “Customer lockbox”, the new name… The post What is Customer ...
Read Article →Step-up authentication with Defender for Cloud Apps and Authentication Context
Check out this article via web browser: Step-up authentication with Defender for Cloud Apps and Authentication Context In this post, I will show yo...
Read Article →The Password Rotation: The Ballad of Windows LAPS and Threadpools
In this blog post, I will explore the wonders of Windows LAPS and what happens when you remotely perform a password rotation from Intune—nothing mo...
Read Article →Direct on board your non-Azure servers to defender for cloud WITHOUT Azure Arc
Intro Up until now, onboarding non-Azure servers to Defender for Servers required Azure Arc as a mandatory pre-requisite. With this new release, Mi...
Read Article →Evaluation Center was unavailable. Where do I download ISOs now if this happen again?
Last Updated on January 10, 2024 by Michael Morten Sonne In case you were trying to download evaluation… The post Evaluation Center was unava...
Read Article →Exchange Online – Block sign-in from shared mailboxes
Last Updated on January 10, 2024 by Michael Morten Sonne When you create a new Shared Mailbox in… The post Exchange Online – Block sign-in fr...
Read Article →Onboard Defender for Endpoint without Azure Arc via Direct onboarding
Previously, onboarding hybrid servers to Defender for Servers with MDE required Azure Arc as a pre-requisite for the deployment. Since the standalo...
Read Article →Send an email on a new Azure MFA method registration
Check out this article via web browser: Send an email on a new Azure MFA method registration I’ve done quite some Azure MFA projects over tim...
Read Article →Microsoft Defender Threat Intelligence (Defender TI) integrations with Microsoft Sentinel
Microsoft Defender Threat Intelligence (MDTI) previously known as RiskIQ brings the threat intelligence data together from multiple sources. With t...
Read Article →The Virtual Account that rocks the EPM!
Are you using Intune Endpoint Privilege Management (EPM) and wondering what is “needed” when you launch a process with elevated access?...
Read Article →Demystifying Data Collection Rules and Transformations
Warning We ‘archived’ this blogpost during a migration from the old HybridBrothers website framework to the new one, since it is more t...
Read Article →Microsoft icons
Check out this article via web browser: Microsoft icons That’s the post for today. Just a bunch of sources with icons from Microsoft 365, Azu...
Read Article →Easy Riders, Intune Bulls: How the Defender for Endpoint, Live Response, and Rock ‘N’ Roll PowerShell Script Recovered the Intune Certificate
We talked about this in our MMSMOA session, but I still needed to write something about it…..so here we go! This blog will be “again...
Read Article →Unleash the power of Defender for Servers Plan 2: Adaptive Application Controls – Part 2
Welcome, this is the second part of the Defender for server P2 advanced protection series I will blog about. If you want to read the other pa...
Read Article →Building an Active Directory/Windows Server Lab
Last Updated on March 14, 2024 by Michael Morten Sonne So you’d like to build an Active Directory… The post Building an Active Directory/Wind...
Read Article →Block gTLD (.zip)/ FQDN domains with Windows Firewall and Defender for Endpoint
Recently there was some news with new gTLD domains. Google Registry launched eight new top-level domains: .dad, .phd, .prof, .esq,&#...
Read Article →Azure DevOps – Use Azure Key Vauls for secrets in your Pipelines
Last Updated on June 19, 2023 by Michael Morten Sonne Intoduction What is Azure DevOps Azure DevOps is… The post Azure DevOps – Use Azure Key...
Read Article →Azure AD Admin and use of PIM Email forwarding for your admin accounts notifications
Last Updated on June 19, 2023 by Michael Morten Sonne Intoduction Seperate accounts in Azure AD for Administrative… The post Azure AD Admin a...
Read Article →Network Device Discovery & Vulnerability Management with Microsoft 365 Defender
Last Updated on March 14, 2024 by Michael Morten Sonne Discover & manage vulnerabilities in your network devices… The post Network Device...
Read Article →Secure authentication method provisioning with Temporary Access Pass
Last Updated on March 14, 2024 by Michael Morten Sonne What is TAP? TAP is a time-limited passcode… The post Secure authentication meth...
Read Article →Azure DevOps – Get a local backup of your code repositories
Last Updated on February 18, 2024 by Michael Morten Sonne Introduction This tool offers a user-friendly interface and… The post Azure DevOps ...
Read Article →Break Glass account – and how to get notified when a Break Glass account is used
Last Updated on August 13, 2023 by Michael Morten Sonne Intoduction What is a Break Glass Account? Break… The post Break Glass account – and ...
Read Article →How to work around the Azure Security Agent extension not deploying by default on the latest VM windows images, a currently know limitation…
Intro This blog will be about an issue I bumped into when deploying one of the enhanced protection features in defender for cloud. The enhanced fea...
Read Article →Lab - Certificate Authority Setup
Note This article was last updated on 01/30/2025 for readability and updated URLs
Read Article →Report Suspicious Activity & Fraud Alert for Azure MFA
Check out this article via web browser: Report Suspicious Activity & Fraud Alert for Azure MFA A new feature popped up in Azure AD. Well, not ...
Read Article →Set up a free Microsoft Intune lab tenant with Microsoft 365 developer subscription
Last Updated on March 14, 2024 by Michael Morten Sonne Intro Do you want to get started learning… The post Set up a free Microsoft Intune lab...
Read Article →Veeam Backup for Microsoft 365 – Why you need to back up your Microsoft 365 data!
Last Updated on March 14, 2024 by Michael Morten Sonne Are backups required for Microsoft 365? We look… The post Veeam Backup for Microsoft 3...
Read Article →How works Microsoft Defender Threat Intelligence / Defender TI – and what is the difference between free and paid
Microsoft Defender Threat Intelligence (MDTI), previously known as RiskIQ brings threat Intelligence data together from multiple sources. With Micr...
Read Article →Endpoint Privilege Management and the Device Health Monitoring Reports: Quantumania
This blog will be small and simple, but it will be about me looking at how the Endpoint Privilege Management reports will be delivered to Intune. O...
Read Article →How to disable Automapping for a shared mailbox in Outlook for Office 365?
Last Updated on March 14, 2024 by Michael Morten Sonne If you are like me, you probably use… The post How to disable Automapping for a shared...
Read Article →The War of the Endpoint Privilege Management Enrollment
This blog will show you how to “Kickstart” your Declared Configuration enrollment on your own turf when the EPM agent is not being depl...
Read Article →Block C2 communication with Defender for Endpoint
Human-operated ransomware (HumOR) is growing and needs different layers of protection. Microsoft released some new features to protect against C2 c...
Read Article →Intune - Microsoft Tunnel VPN Gateway
Note This article was last updated on 01/30/2025 for readability and updated URLs. I am working on updating this for the UI changes that have been ...
Read Article →Configure Exchange Online Certificate Based Authentication for unattended scripts
Last Updated on March 14, 2024 by Michael Morten Sonne How to schedule an Exchange Online PowerShell script… The post Configure Exchange Onli...
Read Article →How to use Windows LAPS – PowerShell
Last Updated on June 19, 2023 by Michael Morten Sonne Intoduction This is in relation to my last… The post How to use Windows LAPS – PowerShe...
Read Article →I Killed My Endpoint Privilege Management Enrollment, Hung Her on a Meathook, and Now I Have a Three Picture Deal at MMP-C
This blog will be just me looking at the delivery of the EPMagent in my own troubleshooting style. While doing so, I got focused on something even ...
Read Article →Find Active Directory accounts configured to use DES and RC4 Kerberos encryption (is insecure!)
Last Updated on March 14, 2024 by Michael Morten Sonne While DES has long been considered insecure, CVE-2022-37966… The post Find Active Dire...
Read Article →Microsoft 365: What is and how to set up “Idle session timeout”?
Last Updated on March 14, 2024 by Michael Morten Sonne Microsoft has finally implemented the feature “Idle session… The post Microsoft 365: W...
Read Article →The Microsoft Defender for Office 365 Recommended Configuration Analyzer (ORCA)
Last Updated on March 14, 2024 by Michael Morten Sonne Introduction ORCA is a report that you can… The post The Microsoft Defender for Office...
Read Article →Windows LAPS and management through Microsoft Intune
Last Updated on June 19, 2023 by Michael Morten Sonne What is Windows LAPS Exciting News! New Built-in LAPS… The post Windows LAPS and m...
Read Article →Azure Automation - Device Cleanup v2
Note This article was last updated on 01/30/2025 for readability and updated URLs. We no longer need to manually load modules as shown, and this ar...
Read Article →Self Service Password Reset write-back problem – error hr=80230818
Last Updated on March 14, 2024 by Michael Morten Sonne This is a knowledgebase item. Hope it helps… The post Self Service Password Reset writ...
Read Article →Securing your Azure/Microsoft 365 environment with Principle of Least Privilege and Azure PIM
Last Updated on July 9, 2023 by Michael Morten Sonne Secure your Azure environment with the power of… The post Securing your Azure/Microsoft ...
Read Article →Are You There Intune? It’s Me, Health Attestation Certificate
A Compliant device, I want myself to have a working Intune enrolled compliant device!!!! Nothing more! Just a compliant device! In this blog, I wil...
Read Article →Unleash the power of Defender for Servers Plan 2: File integrity monitoring – Part 1
Intro Welcome to part 1 of the blog series about enhanced protection features available in Defender for Servers Plan 2. Part 1 will be about ...
Read Article →Configure Azure AD Connect Health email notifications to continue to receive notifications when synchronization errors occur in Azure AD Connect
Why is this needed? Admins who are using Azure AD Connect are currently receiving email notifications when there… The post Configure Azure AD...
Read Article →AzLogDcrIngestPS – how to do data manipulation before sending data via Azure Pipeline, Log ingestion API & Azure Data Collection Rules into Azure LogAnalytics ?
If you are sending data using HTTP Data Collector API (REST) today, you should continue reading, as this API will ... Read more
Read Article →AzLogDcrIngestPS – tips & tricks sending data via Azure Pipeline, Azure Log Ingestion API, Azure Data Collections into Azure LogAnalytics
If you are sending data using HTTP Data Collector API (REST) today, you should continue reading, as this API will ... Read more
Read Article →Unleash the power of Defender for Servers Plan 2: The Intro – Part 0
Introduction I decided to start a blog series about the Advanced protection features which are included in the Defender for Servers Plan 2 provided...
Read Article →Microsoft Defender for Cloud– The ultimate blog series (Intro) – P0
Microsoft Defender for Cloud is a cloud-native application protection platform (CNAPP). Defender for Cloud contains a large set of features and cap...
Read Article →Block “vulnerable/unwanted” applications with Defender for Endpoint and Vulnerability Management
In all environments, reducing the vulnerability surface and getting insights into the vulnerable applications are recommended and important. Micros...
Read Article →Deploy Microsoft Teams on Azure Virtual Desktop using Intune
Deploy Microsoft Teams to Azure Virtual Desktop using Intune.
Read Article →Intune - Discover Defender AV exclusions using Proactive Remediation
Note This article was last updated on 01/30/2025 for readability and updated URLs. I am working on updating this for the UI changes that have been ...
Read Article →Microsoft Defender for Identity Deployment Guide
Deployment guide for Microsoft Defender for Identity.
Read Article →Intune - Block mounting of ISO files
Note This article was last updated on 01/30/2025 for readability and updated URLs
Read Article →“AnyConnector” AzLogDcrIngestPS – your helper to send data via Azure Pipeline, Azure Log Ingestion API & Azure Data Collection Rules into Azure LogAnalytics table
If you are sending data using HTTP Data Collector API (REST) today, you should continue reading, as this API will ... Read more
Read Article →ClientInspector – a cool showcase to demonstrate Log ingestion API, Azure Log Ingestion Pipeline, Azure Data Collection Rules and my new Powershell module AzLogDcrIngestPS
Are you in control? – or are some of your core infrastructure processes like patching, antivirus, bitlocker enablement driftin...
Read Article →Collecting CEF Syslogs using Azure Monitor Agent
This blog will give you insight on how to setup collection of syslogs (CEF) using Linux forwader server using Azure ... Read more
Read Article →Collecting IIS logs using Azure Monitor Agent
This blog will give you insight on how to setup collection of IIS logs from Windows devices using Azure Monitor ... Read more
Read Article →Collecting Performance data using Azure Monitor Agent, VMInsights and ServiceMap
This blog will give you insight on how to setup collection of Performance and ServiceMap information from Linux and Windows ... Read more
Read Article →Collecting Security events using Azure Monitor Agent
This blog will give you insight on how to setup collection of Security Events (eventlog) from Windows devices using Azure ... Read more
Read Article →Collecting Syslogs using Azure Monitor Agent
This blog will give you insight on how to setup collection of syslogs using Linux forwader server using Azure Monitor ... Read more
Read Article →Collecting System & Application events using Azure Monitor Agent
This blog will give you insight on how to setup collection of System & Application Events (eventlog) from Windows devices ... Read more
Read Article →Collecting text logs using Azure Monitor Agent
This blog will give you insight on how to setup collection of text logs from Linux and Windows devices using ... Read more
Read Article →How to do data transformation using Workspace transformation for legacy upload methods
This blog will demonstrate how you can do workspace transformation to support legacy data transformation where data is being uploaded ... Read more
Read Article →Master Azure Logging in depth
I am really passioned about the logging capabilities in M365 Defender and Azure with the power to bring data back from cli...
Read Article →Tutorial – How to make data transformations using Data Collection Rules?
This section will show you the steps for setting up data transformations – and how you can do the transformation ... Read more
Read Article →Understanding Azure Data Collection Endpoint
Azure Data Collection Endpoint (DCE) provide a connection for certain data sources of Azure Monitor. This article gives you an ... Read more
Read Article →Understanding Azure logging capabilities in depth
Azure includes lots of great technologies, which can be used for logging purpose. Currently, Microsoft is transitioning from v1-method (MMA) ... Re...
Read Article →Understanding the fundamentals of log-collection with Azure Monitor Agent & Azure Data Collection Rules
This blog will take you “under the hood” of extensions, Azure Monitor Agent (AMA) and Azure Data Collection Rules for ... Read more
Read Article →AWS - Integrating PIM with Azure AD SSO for AWS Single-Account Access
Note This article was last updated on 01/30/2025 for readability and updated URLs
Read Article →Welcome!
Last Updated on April 15, 2023 by Michael Morten Sonne Welcome to My New Blog! Hey there! If… The post Welcome! first appeared on Blog - Sonn...
Read Article →AWS - Integrating PIM with Azure AD SSO for AWS IAM Identity Center
Note This article was last updated on 01/30/2025 for readability and updated URLs
Read Article →Triangle of TPM Attestation Sadness
This small blog will be about the errors 0x81039001 and 0x80190190 you could get when enrolling your device with Autopilot (Self Deploying or Pre-P...
Read Article →Tutorial: Change the workspace destination of your already provisioned Data Collection Rule used by the Azure Monitoring Agent
Intro This post is inspired on different setups I saw while working with my clients. More and more clients are leveraging the Azure Monitoring Agen...
Read Article →Mapping MDE and Windows Security Events overlap
Warning We ‘archived’ this blogpost during a migration from the old HybridBrothers website framework to the new one, since it is more t...
Read Article →Abuse and Detection of M365D Live Response for privilege escalation on Control Plane (Tier0) assets
Live Response in Microsoft 365 Defender can be used to execute PowerShell scripts on protected devices for advanced incident investigation. But it ...
Read Article →Don’t Tell Mom the Pre-Provisioned Autopilot device is Compliant.
When using Autopilot for pre-provisioned deployments, you might encounter non-compliant devices that have yet to be evaluated. This blog will expla...
Read Article →Authenticator Lite – Approve Azure MFA prompts with the Outlook app
Check out this article via web browser: Authenticator Lite – Approve Azure MFA prompts with the Outlook app Microsoft released a new feature ...
Read Article →Azure - Securing Subscriptions
Note This article was last updated on 01/30/2025 for readability and updated URLs
Read Article →The Yin-Yang Store Apps: VPN of Eternity
This blog will show you how I started troubleshooting an issue in which Microsoft Store Apps failed to install. I will guide you through the PowerS...
Read Article →System-preferred multifactor authentication in Azure AD. Don’t settle for less.
Check out this article via web browser: System-preferred multifactor authentication in Azure AD. Don’t settle for less. A new feature has pop...
Read Article →Microsoft Defender SmartScreen – how to use SmartScreen and Phishing protection
Microsoft Defender SmartScreen is available in various Microsoft products and adds an extra/first layer/filter of protection. The core component of...
Read Article →Are Proactive Remediations run during Autopilot?
This blog takes a closer look at if—and how Remediations (former name ProActive Remediations) are executed during the Enrollment Status Page (ESP),...
Read Article →Deploy Microsoft Defender for Endpoint on iOS using Intune/MEM
Microsoft Defender for Endpoint is available for multiple platforms including Windows, macOS, and Linux. For mobile platforms Defender for Endpoint...
Read Article →Only Autopilot WhiteGlove in the Building
This blog focuses on Windows Autopilot, specifically taking a closer look at the 'Allow Autopilot Pre-Provisioning' option in your Windows Autopilo...
Read Article →Azure AD Conditional Access authentication context now also available for Azure AD Privileged Identity Management
Microsoft has extended the capabilities of Azure AD authentication context to Azure AD Privileged Identity Management (PIM). By doing this we can t...
Read Article →Duplicate Azure Active Directory Conditional Access policies
Check out this article via web browser: Duplicate Azure Active Directory Conditional Access policies In this post, we look at managing Conditional ...
Read Article →[Feb 2023] Ultimate Comparison of Defender for Endpoint Features by OS
Microsoft Defender for Endpoint (MDE) is a massive stack of endpoint protection and endpoint detection and response (EDR) capabilities. It integrat...
Read Article →How MSA Tickets are used during Autopilot
In this blog, I will show you how important MSA Tickets are. These tickets are of utmost importance when the device needs to authenticate a Microso...
Read Article →Azure Arc - Onboarding Servers with Group Policy
Note This article was last updated on 01/30/2025 for readability and updated URLs
Read Article →Microsoft Defender for Endpoint series – Tips and tricks/ common mistakes – Part10
It is time for part 10 of the Microsoft Defender for Endpoint (MDE) series. The final part of the series. Part 10 is focussed on tips and tricks ar...
Read Article →Deploy sentinel analytic rules with bicep and PowerShell
Warning We ‘archived’ this blogpost during a migration from the old HybridBrothers website framework to the new one, since it is more t...
Read Article →Microsoft Defender for Endpoint series – Automation via Logic Apps and Sentinel – Part9
It is time for part 9 of the Microsoft Defender for Endpoint (MDE) series. Part 9 is focused on the automation part of Defender for Endpoint with t...
Read Article →Orphaned Azure Security Principals Clean-up & Azure Policy Managed Identity Role Assignment Automation
This blog covers 2 topics : (1) how you can automate clean-up of any orphaned security principal role assignments – ... Read more
Read Article →Getting started with Azure AD cross-tenant synchronisation
Cross tenant sync is a feature I've been waiting to see for a while and with the announcement of cross tenant access settings, I knew it...
Read Article →Automate Reporting of Defender for Cloud recommendations & Role Assignments with 35 different views
Background Recently, I was asked to build a simple reporting-script, which integrates data from Microsoft Defender for Cloud and Azure ... Read more
Read Article →Block the automated onboarding of Defender for Endpoint without disabling the integration in Defender for Cloud:
You can find my previous blog posts on my medium site. Block the automated onboarding of mde without disabling the mde integration: https://medium....
Read Article →Azure Automation - Advanced Auditing
Note This article was last updated on 01/27/2025 for readability and updated URLs, and the content itself will be updated in the near future :)
Read Article →Ghost blogging on Azure Container Apps
Introduction Hosting a blog these days can easily be done without having to cost anything. There are a lot of solutions in the likes of Medium, Wee...
Read Article →Deploy Sysmon and collect additional data with Sentinel and the AMA agent
System Monitor (Sysmon) is one of the most common add-ons for Windows logging. With Sysmon, you can detect malicious activity by tracking code beha...
Read Article →Microsoft Defender for Endpoint series – Advanced hunting and custom detections – Part8
It is time for part 8 of the Microsoft Defender for Endpoint (MDE) series. Part 8 is focused on the hunting experience in Microsoft 365 Defender. T...
Read Article →Lab - Server Build
Back in May of last year, I started building a new server and had planned to fully share the process of putting it together, setting up the OS, tem...
Read Article →Using transport rules as a security tool
Note Unfortunately, the images from this article were never able to be recovered, and it is unlikely I will be able to recreate them. Email securit...
Read Article →Something Went Wrong – Fury of the Gods
This blog will be about me troubleshooting the “Something Went Wrong” error you could get during the Account Enrollment Status Page when enrolling ...
Read Article →How to implement a gradual (ring) rollout-process for Microsoft Defender updates
It is important to ensure that your security posture systems are up-to-date to be able to prevent attacks. Microsoft Defender ... Read more
Read Article →How to save $$$ by storing your Syslog and Defender for Endpoint long-term logs in Azure Data Explorer cluster using Azure Data Factory and Azure Storage Account export – while keeping Kusto query functionalities ?
This blog is about keeping long-term Sentinel logs, giving you insight to the options today – with great opportunities to ... Read more
Read Article →Microsoft Defender for Endpoint series – integrations with other products – Part7
It is time for part 7 of the Microsoft Defender for Endpoint (MDE) series. All previous parts were focused on Defender for Endpoint and additional ...
Read Article →The School for Autopilot and DeviceAddRequest
In this blog, I will focus a bit more on what Windows Autopilot is and what it is built upon. To explain the building blocks of Windows Autopilot, ...
Read Article →Sentinel Alert Rules Management with Add / Update / Remove & Alert Rule Action automation
Do you want to automate alert rules including creating new alert rules and update existing – with checks every x ... Read more
Read Article →OfflineDeviceID, Multiverse of Madness
The first blog of 2023 will be about me staring, gazing, and trying to explain the funny parts of the OfflineDeviceID. While trying to explain, I w...
Read Article →Microsoft Defender for Endpoint series – Validate Defender protection and additional troubleshooting – Part6
It is time for part 6 of the Microsoft Defender for Endpoint (MDE) series. All previous parts were focused on onboarding and configuration and Micr...
Read Article →Mailbox usage reports, Graph API, and Logic Apps. What’s not to like?
Check out this article via web browser: Mailbox usage reports, Graph API, and Logic Apps. What’s not to like? Exchange Online does a pretty g...
Read Article →Real example with 43% cost savings on Sentinel log-costs: How to exclude Syslog log-events from banned IPs using AbuseIPDB-service with integration to firewalls
This is a real-life example of how I helped reduce the log-cost by 43% for LogAnalytics & Sentinel combined for ... Read more
Read Article →Microsoft Defender Antivirus Performance Analyzer – understand which files, file extensions, or processes that might be causing performance issues on endpoints during antivirus realtime protection scans
Have you ever wondered what is causing your ‘Antimalware service executable’ (Defender Antivirus) to spike the CPU for longer times? .....
Read Article →How to do a Password Audit of your Active Directory passwords using DSInternals?
Great job Michael Grafnetter Initially, I would like to thank the author of DSInternals, Microsoft MVP Michael Grafnetter, for creating ... Read more
Read Article →How to run custom scripts on thousands of servers within a few minutes using Azure Custom Scripts extension and multithreaded jobs – and have them re-run daily?
Have you ever had a need to collect vital configuration status (inventory) from thousands of servers – with a defined ... Read more
Read Article →How to migrate from Qualys and enable Microsoft Defender Vulnerability Management (MdeTvm) in Microsoft Defender for Cloud?
Microsoft’s Defender Vulnerability Management is a built-in module in Microsoft Defender for Endpoint that can: If you’ve enabled ...
Read Article →How to detect File Deletions using Audit-data (SecurityEvent) & Azure LogAnalytics ?
Recently I was asked to provide a solution to detect file deletions on a file server in a sensitive folder ... Read more
Read Article →How to detect impacted files by Controlled Folder Access and Attack Surface Reduction rules using Advanced Hunting queries ?
CONTROLLED FOLDER ACCESS RULES ControlledFolderAccess – All excluding Temp ControlledFolderAccess – Only Temp ATTACK SURFACE REDUCTION ...
Read Article →How to do data transformation with Azure LogAnalytics – to enrich information, optimize cost, remove sensitive data?
One of the cool features in Azure LogAnalytics is the capability to do data-transformation before the data enters your LogAnalytics ... Read more
Read Article →How to manually remove a malfunctioning MDI sensor, which cannot be removed through add/remove programs?
Microsoft Defender for Identity (MDI) has a built-in process that handles continues updates. I had a situation, where this process ... Read more
Read Article →Meet me in Microsoft Security Insights Show Episode 132 – Security Private Preview MVPs!
On December 14, I had the pleasure of participating in a live show, Microsoft Security Insights Show. The topic was ... Read more
Read Article →Break glass accounts and Azure AD Security Defaults
Check out this article via web browser: Break glass accounts and Azure AD Security Defaults Security Defaults is the best thing since sliced bread....
Read Article →The Kid Who Would Remediate Hardware Data
In this blog, I will examine the Autopilot Hardware Mismatch Remediation Data thoroughly. Please note: I will make many assumptions and guesses abo...
Read Article →Securing privileged user access with Azure AD Conditional Access and Identity Governance
Conditional Access and Entitlement Management plays an essential role to apply Zero Trust principles of “Verify explicitly“ and “Use least-privileg...
Read Article →December 2022 update of the conditional access demystified whitepaper and workflow cheat sheet.
I’m proud to announce the December 2022 update of my Conditional Access demystified whitepaper. With this release, we have reached the fifth ...
Read Article →Step by Step: How Windows Retrieves the Autopilot Profile
This blog shows how a Windows device retrieves its Autopilot profile from the ztd.dds.microsoft.com service during OOBE. More importantly, we’ll se...
Read Article →Secret Society of Second-Born DesktopAppInstaller CSP’s
This blog will be an additional part of the blog I wrote about my experiences when deploying UWP /Store Apps with the New store App functionality i...
Read Article →Hotel Microsoft Store Apps: Transformania
This blog will show my experiences with Intune’s new Microsoft Store App functionality. I wanted to publish the next part of my Autopilot ser...
Read Article →How to manage your Microsoft Edge Enterprise Cloud Site List like a boss
In this article I describe how to enable IE mode on your Intune enabled devices and how you can easily manage a corporate site list!
Read Article →Windows Autopilot and the Autopilot_Marker
This new blog will be about me (again) dealing with some issues while enrolling a device with Autopilot. While trying to re-enroll the same device ...
Read Article →Conditional Access public preview functionality reviewed (22H2) – Part 3: Granular control for external user types
In the last couple of months, Microsoft released new functionality for Azure AD Conditional Access. All of this functionality is still in public pr...
Read Article →All quiet on the Intune Detection Rules
This blog will not be a deep dive into a weird issue but will be more like an explanation of when you want to silently install and uninstall a Win3...
Read Article →Conditional Access public preview functionality reviewed (22H2) – Part 2: Conditional Access filters for Apps and Workload Identities
In the last couple of months, Microsoft released new functionality for Azure AD Conditional Access. All of this functionality is still in public pr...
Read Article →Operationalizing MITRE ATT&CK to support Microsoft Sentinel deployments and detections
Warning We ‘archived’ this blogpost during a migration from the old HybridBrothers website framework to the new one, since it is more t...
Read Article →Conditional Access public preview functionality reviewed (22H2) – Part 1: Authentication Strength
In the last couple of months, Microsoft released new functionality for Azure AD Conditional Access. All of this functionality is still in public pr...
Read Article →Microsoft Defender for Endpoint series – Defender Vulnerability Management – Part5
It is time for part 5 of the Microsoft Defender for Endpoint (MDE) series. All previous parts were focused on the Defender for Endpoint onboarding ...
Read Article →Goodbye legacy SSPR and MFA settings. Hello Authentication Methods Policies!
Check out this article via web browser: Goodbye legacy SSPR and MFA settings. Hello Authentication Methods Policies! I’ve got some exciting n...
Read Article →Microsoft Store the Movie: Hoopa and the Clash of Winget
This blog will show you my first experiences dealing with Winget and installing Store Apps from the Microsoft Store as a regular user. I will try t...
Read Article →Automated Lifecycle Workflows for Privileged Identities with Azure AD Identity Governance
Microsoft has been released a feature to automate on- and off-boarding tasks for Azure AD accounts. Lifecycle workflows offers built-in workflow te...
Read Article →Intune - Using Access Packages to Enable User Device Enrollment
Note This article was last updated on 01/27/2025 for readability and updated URLs, but content review and image updates are in process :)
Read Article →Synchronize attributes for Lifecycle workflows – Azure AD Connect Sync
Check out this article via web browser: Synchronize attributes for Lifecycle workflows – Azure AD Connect Sync Azure AD Lifecycle Workflows c...
Read Article →Defender for Endpoint - Implementing ASR Rules
Note This article was last updated on 01/27/2025 for readability and updated URLs, but content review is in process. New guidance is to enable the ...
Read Article →Autopilot: Convert your devices!
This blog will be about an old Autopilot feature called “Convert All targeted devices to Autopilot”. I dedicated a small blog to this wonderful fea...
Read Article →Microsoft Defender for Endpoint series – Attack Surface reduction and additional protection – Part4B
It is time for part 4B of the ultimate Microsoft Defender for Endpoint (MDE) series. Part 4A explains the AV policy baseline. Now it is time f...
Read Article →The Device With A Clock In Its Service
This blog will be about (yes… again) an Intune sync issue. After we took over management of a Microsoft Tenant from a new customer, we notice...
Read Article →Which data connector and activity is free in Microsoft Sentinel?
After the initial onboarding of Microsoft Sentinel, connectors can be used for ingesting data. Microsoft invested in pre-build connectors which can...
Read Article →Microsoft Defender for Endpoint series – Define the AV policy baseline – Part4A
It is time for part 4A of the ultimate Microsoft Defender for Endpoint (MDE) series. Part 4 explains the AV/ next-generation protection component. ...
Read Article →Microsoft Defender for Endpoint series – Configure AV/ next-generation protection – Part4
It is time for part 4 of the ultimate Microsoft Defender for Endpoint (MDE) series. All previous parts were focused on the initial Defender for End...
Read Article →The school for ADMX upload and Evil
In this blog, I will summarize some of the ADMX/ADML upload errors I got while playing around with them. Of course, I will also try to show you wha...
Read Article →ADMX: When Nature Calls
Today, I wrote a simple blog that will be about troubleshooting one of the ADMX upload (file referenced not found) error you could endure when uplo...
Read Article →Intune Sync Debug Tool: The Last Royal Treasure
This blog will be about me showing and explaining the Intune Sync Debug PowerShell tool I wrote to fix those damn Intune MDM device CA certificate ...
Read Article →How to use Microsoft Defender EASM (External Attack Surface Management)
Microsoft released a new product with the name; Microsoft Defender EASM (External Attack Surface Management). The new product is based on the earli...
Read Article →Fullmetal Certificate: The Intune Revenge of Renewal
This blog will be about me looking at the Intune Device Certificate renewal process and what happens behind the curtains 1. Introduction I guess we...
Read Article →How to keep track of changes on Microsoft Docs & Learn?
Check out this article via web browser: How to keep track of changes on Microsoft Docs & Learn? When working with cloud services like Microsof...
Read Article →Setting up Azure MFA for VPN and Remote Desktop Gateway
This article will go into detail on how to configure Azure MFA for access to on-premises VPN and RD Gateway.
Read Article →The road to Microsoft MVP and beyond
Check out this article via web browser: The road to Microsoft MVP and beyond Today, a slightly different post. I think it’s time to step away...
Read Article →Convert Registry Settings to ADMX
This blog is going to show you how to create custom ADMX templates within a couple of minutes to deploy some HKEY_CURRENT_USER settings to your Int...
Read Article →How to implement Defender for Identity and configure all prerequisites
Microsoft Defender for Identity MDI (previously called Azure Advanced Threat Protection or Azure ATP) is a Microsoft security solution that capture...
Read Article →Automate issuing Temporary Access Pass for joiners with LifeCycle Workflows
Check out this article via web browser: Automate issuing Temporary Access Pass for joiners with LifeCycle Workflows On September 30th, 2022, Pim Ja...
Read Article →Speaking about Mobile Application Management at the AppManagEvent 2022 on October 7 in Utrecht
On October 7, 2022 the AppManagEvent will be organized in the Media Plaza, Jaarbeurs Utrecht. The AppManagEvent is an initiative from PDS b.v. in t...
Read Article →Microsoft Defender for Endpoint series – Onboard using Configuration Manager/ GPO – Part3D
It is time for part 3D of the ultimate Microsoft Defender for Endpoint (MDE) series. After Part 3C (Onboard Defender for Endpoint using Azure Arc) ...
Read Article →The Man Who Knew Autopilot
In this new blog, I will discuss a big Windows Autopilot misunderstanding. I will try to explain and convince you why blaming Autopilot is not alwa...
Read Article →Speaking about Conditional Access at Experts Live Netherlands 2022 on September 30 in Den Bosch
Besides helping organizing Experts Live NL 2022 in my role as speaker manager together with Erik Loef, I’m also happy to announce that I will...
Read Article →Deploying winget apps with Microsoft Endpoint Manager and auto-update!
A brief overview on how you can deploy applications using winget in Microsoft Intune and even keep them updated!
Read Article →How to mitigate MFA fatigue and learn from the Uber breach for additional protection
Hackers are more frequently using social engineering attacks to gain access to corporate credentials and breach large networks. With the rise of mo...
Read Article →Autopilot & Pre-Provisioning’s Infinite Play…uh…Waiting list
This blog will show how a broken PowerShell script could cause a 30-minute delay in your Enrollment Status Page (ESP) when enrolling a device with ...
Read Article →KB – Write requests (excluding DELETE) must contain the Content-Type header declaration.
Check out this article via web browser: KB – Write requests (excluding DELETE) must contain the Content-Type header declaration. This is a kn...
Read Article →Configure File Integrity Monitoring (FIM) using Defender for Cloud and AMA-agent
File Integrity Monitoring (FIM) is a technology that monitors and detects file changes that could be indicative of a cyberattack. File Integri...
Read Article →Take control of your guests with the External Identities Policy
Check out this article via web browser: Take control of your guests with the External Identities Policy Today we take a look at the brand new Exter...
Read Article →Blocking web push notifications with Endpoint Manager and why you should!
Admit it, we've all fallen foul of that annoying (and scary for some) popup that seems to rear it's ugly head after you've spent the last...
Read Article →Microsoft Defender for Endpoint series – Onboard using Azure Arc or Direct onboarding – Part3C
It is time for part 3C of the ultimate Microsoft Defender for Endpoint (MDE) series. After Part 3B (Onboard Defender for Endpoint using Defender fo...
Read Article →Microsoft Defender for Endpoint series – Onboard using Defender for Cloud – Part3B
It is time for part 3B of the ultimate Microsoft Defender for Endpoint (MDE) series. After Part 3A (Onboard Defender for Endpoint using Microsoft I...
Read Article →How to make a Team or Microsoft 365 group calendar accessible in Outlook
Recently I found myself in a scenario where I needed to quickly and easily access a calendar from a Microsoft Teams group, I didn't think...
Read Article →Microsoft Defender for Endpoint series – Onboard using Microsoft Intune – Part3A
It is time for part 3A of the ultimate Microsoft Defender for Endpoint (MDE) series. After Part 3 (Onboard Defender for Endpoint) it is now time fo...
Read Article →Intune: The Legend of the Certificate
Do you have devices that are missing the Intune Device Certificate or have sync issues? This blog will show you a possible root cause and how to so...
Read Article →Tips for preventing against new modern identity attacks (AiTM, MFA Fatigue, PRT, OAuth)
Identity attacks are currently changing and focussing on new techniques. In the past years, many organizations protected accounts with MFA/ FIDO2 a...
Read Article →Microsoft Defender for Endpoint series – Onboard Defender for Endpoint – Part3
It is time for part 3 of the ultimate Microsoft Defender for Endpoint (MDE) series. After part 2 (configuration MDE) we are now going to ...
Read Article →The Last TPM Attestation Script from Your Lover
This blog will discuss some TPM Attestation issues you could encounter when running Windows Autopilot for Pre-provisioned deployments and how to tr...
Read Article →Ultimate Comparison of Defender for Endpoint Features by OS [Updated August 2022]
This is the updated “matrix” of OS supported for the almost 80 features, services, and important components that make up Microsoft Defe...
Read Article →Ready For Attestation: A True Underdog Story
This blog will explain what the “Ready for Attestation” flag truly means and show you how to ensure the device is Ready for Attestation so you won'...
Read Article →Speaking about Conditional Access at the Workplace Ninja Summit 2022 on September 12th in Luzern Switzerland
After speaking virtually on the Workplace Ninja Summit 2020 and Workplace Ninja Summit 2021, I’m really proud to announce that I will also sp...
Read Article →Block users from viewing their BitLocker keys
Check out this article via web browser: Block users from viewing their BitLocker keys This post is mainly focused on a new tenant setting, where yo...
Read Article →The Last thing Edge Wanted
After being on a nice vacation for 2 weeks now, I felt the urge to write this simple blog to show you how to deal with a not responding Microsoft [...
Read Article →Use the Azure Monitor Agent (AMA) for Defender for Cloud and migrate from MMA agent
Defender for Cloud was since the release based on the Microsoft Monitoring Agent (MMA). Since august 2022 it is possible to auto-deploy the Azure M...
Read Article →Autopilot: Delay Win32 App Installation
This blog shows how to hold off required Intune app installs until after Autopilot enrollment, using a practical PowerShell script as a requirement...
Read Article →Protect against AiTM/ MFA phishing attacks using Microsoft technology
In the last couple of weeks, many researchers warns of a new large-scale phishing campaign that is using the adversary-in-the-middle (AiTM) techniq...
Read Article →The Ballad of Buster Exit Code’s
In one of my earlier blogs, I discussed the IME installation flow and the global retry schedule. I showed you how the retry schedule looks at the E...
Read Article →A Babysitter’s Troubleshooting Guide to breaking Autopilot
This blog will be about the 0x800705b4 (Time-Out) error I got during the Autopilot “Preparing your device for mobile management” step. Please note ...
Read Article →Defender for servers: Defender for Endpoint onboarding behind the scenes
You can find my previous blog posts on my medium site. Defender for servers mde onboarding behind the scenes: https://medium.com/@vertho/defender-f...
Read Article →Microsoft Defender for Endpoint series – Configure Defender for Endpoint – Part2
It is time for part 2 of the ultimate Microsoft Defender for Endpoint (MDE) series. After part 1 we are now going to deep-dive more into the initia...
Read Article →Retry Win32 App Lola Retry
When a Win32app fails to install, figuring out the root cause can be frustrating. We often need to trigger the installation repeatedly to get to th...
Read Article →How to set up Evilginx to phish Office 365 credentials
Check out this article via web browser: How to set up Evilginx to phish Office 365 credentials Update: Evilginx 3 is here! This post is based on Ev...
Read Article →The TenantID from Toronto
After reading a question on Reddit about how Intune knows which device belongs to which organization, I decided to write a dedicated blog post abou...
Read Article →OOBEAADV10: Return of the 502 Autopilot Error
After all of the Autopilot issues and AAD sign-in errors in March 2022, I need to explain this OOBEAADV10 error a little bit better. 1. Introductio...
Read Article →Fantastic Apps: The Secrets of Updating Them
This blog will be about version 3 of the sort of update tool I have been creating or many I am creating. This Update tool will make sure that some ...
Read Article →How to deal with orphaned objects in Azure AD (Connect)
Check out this article via web browser: How to deal with orphaned objects in Azure AD (Connect) We have done hybrid identity for a couple of years ...
Read Article →The Incredibly Strange Device Who Stopped Syncing and Became Certificate Zombies!!?
This blog will NOT be about the new Autopatch function! Of course not! This blog will be about multiple weird Intune Device sync errors I was asked...
Read Article →Block internet macros in Office, and don’t wait for Microsoft
Microsoft announced earlier this year that it would block VBA macros on downloaded documents by default for all customers. Last week Microsoft anno...
Read Article →Microsoft Defender for Endpoint series – What is Defender for Endpoint? – Part1
It is time for the first part of the ultimate Microsoft Defender for Endpoint (MDE) series. After the announcement and the great response, it is ti...
Read Article →Night of the Autopilot of the Dawn of the Temporary Access Pass of the MFA of the Return of the RebootRequired of the WUFB of the Attack of the Evil, Mutant, Hellbound, Flesh-Eating SSO Zombified Living Conditional Access, Part 2: In Azure 2-D
After a nice talk with Yannick Van Landeghem, who made me aware of a “possible” security gap when using a Temporary Access Pass (TAP), I decided to...
Read Article →Use a FIDO2 security key as Azure MFA verification method
Check out this article via web browser: Use a FIDO2 security key as Azure MFA verification method This news seems to be kept under the radar a litt...
Read Article →Office CSP: DNS and the Journey to Autopilot
In this blog, I’ll discuss the unexpected challenges I encountered during an Autopilot deployment, specifically the 0x000008CA error. This er...
Read Article →Get alerts on Azure resource assignments made outside PIM
Check out this article via web browser: Get alerts on Azure resource assignments made outside PIM Microsoft released a new public preview where adm...
Read Article →Troubleshooting Intune MDM Device enrollment errors.
Troubleshooting Windows Device Enrollment errors can be a pain! In this post, we will guide you through resolving issues that may arise when enroll...
Read Article →How to upgrade from MMA-based Defender for Endpoint to MDE unified solution in Defender for Cloud?
The new Defender for Endpoint unified agent is generally available for some time (since April 11th, 2022. The new unified Microsoft Defender for En...
Read Article →Retirement of superseded Microsoft Entra Connect Connect Sync versions
Last Updated on January 4, 2024 by Michael Morten Sonne Intoduction As part of its ongoing enhancements and… The post Retirement of supersede...
Read Article →Microsoft Defender for Business – How to use it, and what are the differences with P2?
Microsoft Defender for Business (MDB) is the new Defender product scoped for small businesses. Defender for Business is a new endpoint security sol...
Read Article →The Adventures Of the Broken Store Apps Across The 8th S-1-15-2-1
This blog will be, again about some nasty Store Apps issues!. In the conclusion of my last blog, I mentioned the fact that I was looking into some ...
Read Article →Detecting the DFSCoerce attack
Today the threat researcher Filip Dragovic released a new PoC: DFSCoerce for us all to play with. I tested the PoC against a Microsoft Defender for...
Read Article →Microsoft Defender for Endpoint can now isolates hacked, unmanaged Windows devices
Last Updated on December 17, 2023 by Michael Morten Sonne Microsoft has announced a new feature for Microsoft… The post Microsoft Defender fo...
Read Article →Microsoft: Windows update to permanently disable Internet Explorer
Last Updated on January 6, 2024 by Michael Morten Sonne Internet Explorer is dead Microsoft confirmed today that… The post Microsoft: Windows...
Read Article →The Microsoft Store Apps and the City of a Thousand missing Frameworks
This blog will be about some weird issues with some Microsoft Store apps, such as when the device was wiped before being handed over to a new colle...
Read Article →The Microsoft Store for Business: The Curse of the retirement
This blog will be about me trying to explain why in my opinion it isn’t a big issue that the Microsoft Store for Business (MSfB) will be reti...
Read Article →LOB Apps & Win32 Apps: The Intune Lightning Thief
This blog will show you how to get back your LOB (MSI) apps from Intune. Last week I noticed a question popping up on Reddit asking for the same th...
Read Article →How to manage M365 portal directly from Microsoft Teams?
Last Updated on April 13, 2025 by Michael Morten Sonne Microsoft Teams is packed with a lot… The post How to manage M365 portal directly from...
Read Article →Bill & Ted Face the NCE
This blog will show you an issue in which your lovely Windows Enterprise subscription license could be downgraded to Pro out of the blue. I decided...
Read Article →Protocol Nightmare on Elmstreet: The Dream CVE-2022-30190
This blog will be about how I am protecting my Windows 10 Pro devices to ensure they aren’t vulnerable to the nasty CVE-2022-30190 bug, also known ...
Read Article →Use automation/playbooks in Microsoft Sentinel during incident update activity using update triggers
Automation is critical for modern SOC environments to handle the volume of upcoming threats and manage day-to-day tasks. Ideally most of the featur...
Read Article →Dynamic Administrative Units using on-prem Organizational Units
Check out this article via web browser: Dynamic Administrative Units using on-prem Organizational Units Gone are the days that I could start a work...
Read Article →0x80073cfb: The Company Portal Awakens
This blog will show you what could be causing the Enrollment status page to fail with a 0x80073cfb error when enrolling a Windows 11 Insider Previe...
Read Article →Get started with Azure AD B2B direct connect
Check out this article via web browser: Get started with Azure AD B2B direct connect We all love seamless collaboration, right? Well, here’s ...
Read Article →Night at the Windows Store API Service: Secret of the Subscription Activation
This blog will show you what else could break when there are Authentication Issues at Microsoft. It was definitely something I wasn’t expecti...
Read Article →Intune - Edge in iOS Kiosk Mode
Note This article was last updated on 01/26/2025 for readability and changes to URLs.
Read Article →Managing Microsoft Defender for Endpoint with the new Security Management feature in MEM/Intune
Currently in general availability is the new Security Settings Management in Microsoft Defender for Endpoint. Security Management for Microsoft Def...
Read Article →KB – Reset cross-tenant access policies back to the system default.
Check out this article via web browser: KB – Reset cross-tenant access policies back to the system default. This is a knowledgebase item. Hop...
Read Article →Azure AD - Integrating Azure AD logs with Azure Monitor
Note This article was last updated on 01/26/2025 for readability and updated URLs
Read Article →The 100-Year-Old Quick Assist tool Who Climbed Out the Window and Disappeared
This week (16-05-2022 / 19-05-2022), was a week with many Autopilot issues. Some were caused by the broken latest Office 365 build, and some were c...
Read Article →Microsoft Defender for Endpoint Troubleshooting mode – how to use it?
Microsoft announced recently the new troubleshooting mode functionality for Defender for Endpoint. With the new troubleshooting mode, it is possibl...
Read Article →Speaking about Mobile Application Management at the Techorama Belgium 2022 event
On Wednesday, May 25, 2022, I will be speaking together with Peter Daalmans at the Techorama Belgium event. Techorama 2022 will be an in-person con...
Read Article →ESP: Cultural Learnings of Online Microsoft Store Apps for Make Benefit Glorious Nation of Autopilot
This blog will be about some possible time-out issues you could encounter during the Account ESP phase when using Autopilot and requiring Online Mi...
Read Article →Defender AV - Improving Windows Defender Update Efficacy
Note This article was last updated on 01/26/2025 for readability and updated URLs. Unfortunately, images were not able to be restored from a previo...
Read Article →Multi-stage approval for privileged roles using Azure AD Identity Governance
Check out this article via web browser: Multi-stage approval for privileged roles using Azure AD Identity Governance Privileged Identity Management...
Read Article →MyStaff - Simplified Administrative Password Reset
Note This article was last updated on 01/26/2025 for readability and updated URLs. Unfortunately, images were not able to be restored from a previo...
Read Article →OSINT - Using Shodan.io to protect your school district
Note This article was last updated on 01/26/2025 for readability and updated URLs. Unfortunately, images were not able to be restored from a previo...
Read Article →The 41-Year-Old Hardware Hash Who Knocked Up Autopilot and Felt Superbad About It
In this blog, I will be talking about a sudden “HardwareMismatchDetected” I got when I was trying to enroll my Windows 10/11 device with Autopilot ...
Read Article →Microsoft Defender for Endpoint – The ultimate blog series for Windows (Intro) – P0
Microsoft Defender for Endpoint is an endpoint security platform designed to help customers prevent, detect, investigate, and respond to advanced t...
Read Article →Defender for Endpoint - Removable Storage Access Control
Note This article was last updated on 01/26/2025 for readability and new images due to UI changes made in Intune. I tried to keep the original styl...
Read Article →Speaking about implementing Microsoft Endpoint Manager for Operations and Mobile Application Management at the Microsoft 365 Virtual Marathon 2022 event
On Friday, May 6th 2022, I will be speaking at the Microsoft 365 Virtual Marathon 2022 event. Microsoft 365 Virtual Marathon is a free, online, 60-...
Read Article →Detect and block Credential Dumps with Defender for Endpoint & Attack Surface Reduction
Credential dumping or password dump is a technique used by cybercriminals to gain access to a network. They will enter the workstation through phis...
Read Article →KB – mobile phone number not in sync Azure AD Connect
Check out this article via web browser: KB – mobile phone number not in sync Azure AD Connect This is a knowledgebase item. Hope it helps you...
Read Article →MFA prompt spamming/ MFA fatigue – What can you do to prevent/ detect attacks?
MFA prompt spamming/ MFA fatigue is a quite new term and seeing more after the LAPSUS$ attack. Currently there are many MFA options including SMS, ...
Read Article →Don’t Be a Menace to Autopilot While configuring Your WUfB in the Hood
This blog will discuss why your device could get an expected reboot during Windows Autopilot and also shows you how to fix it!
Read Article →Use Microsoft Defender for Identity Response Actions for on-premises AD accounts
Microsoft announced recently the public availability of the native response actions in Defender for Identity. Security teams can now directly impac...
Read Article →Download Intune PowerShell scripts with Graph Explorer
Check out this article via web browser: Download Intune PowerShell scripts with Graph Explorer This quick post will show an easy method to fetch yo...
Read Article →Forgive Us Our BitLocker suspension
When deleting the Intune object, I noticed that Bitlocker had somehow been suspended. With Bitlocker suspended, the Protection was off. If the Bitl...
Read Article →Mamma Mia! Here we Wipe Again!
This blog will show you the “other paths” available to ensure that your device is wiped before it is trashed or sent back to the supplier. 1. Intro...
Read Article →Wrath of the 0x81036501 MDM Error
This blog will be about the error 0x81036501 we got during the MDM enrollment while enrolling a device with Autopilot white-glove AKA Pre-Provision...
Read Article →Updated March 2022: Ultimate Comparison of Defender for Endpoint Features by Operating System
It’s been about 5 months since I last updated my comparison of Defender for Endpoint features by OS. This is a “matrix” of the to...
Read Article →Honest Win32App Thief
This blog will show you an alternative method to download your Win32Apps sources from Intune WITHOUT having the Encryption key information. Besides...
Read Article →What happens without RDP protection after 24+ hours in Microsoft Sentinel & Microsoft security products
For many years, abuse of Remote Desktop Protection (RDP) has been the most common root cause of all ransomware events. At the moment one of the mos...
Read Article →10 tips to secure your identities in Microsoft 365
Check out this article via web browser: 10 tips to secure your identities in Microsoft 365 I was recently invited by the Dutch Virtual Desktop User...
Read Article →2022-03 Update: The Search for Sp… Uhh Shift+F10
This blog will discuss Microsoft's “their” solution to remove the lingering Windows.old folder after a remote wipe. I noticed that when using Micro...
Read Article →Office Templates, The Rise of Gru
This time, I’m writing a simple and short blog about what options you have when you want to deploy your Office templates to your users. Again...
Read Article →Get started with multi-stage access reviews in Azure AD
Check out this article via web browser: Get started with multi-stage access reviews in Azure AD Access reviews, part of the Azure AD Identity Gover...
Read Article →The Intune Remote”Wipe” fix!
I guess you have all been reading my blog series. Magical Mi…Ehh Wipe Series – Call4Cloud. It will show you some weird issues with the ...
Read Article →I’ll Always Know What You Did Last Wipe
In this blog, I will try to explain the Technical flow behind the Push Button Reset. I was intrigued to do so after writing my blog about the linge...
Read Article →Protecting Microsoft Teams with Microsoft Sentinel
Microsoft Teams and other online collaboration tools increases massively in the last 2-3 years. Working from home became the new normal in most of ...
Read Article →Silence of the Microsoft Teams Notifications
This blog will be about some issues I encountered with Microsoft Teams notifications on especially IOS devices. I am writing this blog to make sure...
Read Article →Apple Business Manager device import options for later use within Microsoft Endpoint Manager
This blogpost is a continuation of two earlier blogposts about integrating Apple Business Manager with Azure Active Directory and Apple Business Ma...
Read Article →Collect Security Events in Microsoft Sentinel with the new AMA agent and DCR
The Microsoft Sentinel Data Connector that utilizes the modern agent (AMA) for collecting Windows Security Events is for a couple of months general...
Read Article →KB – SelfServicePasswordReset write-back problem – error hr=80230818
Check out this article via web browser: KB – SelfServicePasswordReset write-back problem – error hr=80230818 This is a knowledgebase it...
Read Article →ADMX ingestion for Centero Agent and Carillon Client using Intune
Check out this article via web browser: ADMX ingestion for Centero Agent and Carillon Client using Intune This article is about the ADMX templates ...
Read Article →The Dark and the Windows “Remote/Local” Wipe
This blog will be about my experience performing a remote wipe of Windows 10 and 11 devices in Intune. I noticed some weird and awful behavior when...
Read Article →Connecting Microsoft Endpoint Manager to Apple Business Manager
This article will continue where we finished in the article I wrote about setting up Apple Business Manager for use with Azure Active Directory. In...
Read Article →Autopilot: Across the TimeOut-Verse
This blog will discuss the 0x800705b4 error that “could” occur during the “Preparing your device for mobile management” ESP Autopilot phase. ...
Read Article →Access reviews for Azure AD directory roles
Check out this article via web browser: Access reviews for Azure AD directory roles This blog post is for all those organizations out there with st...
Read Article →Azure AD Connect: Escape to Proxy Addresses
This blog will be about some stuff you need to beware of when you are setting up Azure AD Connect. It’s a topic I haven’t written a lot about but [...
Read Article →Setting up Apple Business Manager for use with Azure Active Directory
Apple Business Manager is a service provided by Apple which helps to deploy Apple devices and apps in your organization. By leveraging Apple Busine...
Read Article →Protect against AzureAD OAuth Consent phishing attempts (Illicit consent attack)
In the last couple of months, there is a large increase visible in consent phishing emails (illicit consent attacks). Microsoft threat analysts are...
Read Article →Escape from Windows Pro/Business
This blog will explain why an existing Windows Business device isn’t automatically upgraded to Windows Enterprise after assigning the MS365 E5 lice...
Read Article →Pause Update Rings: No Way Home
This blog will show you how to handle the issue where your device stops receiving updates due to the “Windows Updates Paused” setting, ...
Read Article →Proactive Remediatons: The Hidden World
Introduction: Understanding and Utilizing Proactive Remediations in Intune Proactive remediations are a powerful feature in Microsoft Intune that e...
Read Article →Monitor Microsoft Sentinel Data Connectors using Health Monitoring and Logic App
Microsoft announced a new public preview which contains the new Microsoft Sentinel Health Monitoring feature. Microsoft Sentinel now provides the&#...
Read Article →Updating Apps: A New Era
Updating Applications can be a real headache, especially when certain apps require administrative permissions that standard users don’t have. This ...
Read Article →How I Fell in Love with App Updates
Today, I was called in to devise a solution to allow some DDS-CAD users (NO LOCAL ADMINS!) to install the necessary DDS-CAD updates themselves. Of ...
Read Article →Deploy OOB Update with PowerShell
This blog will be about Patch Tuesday and how to deal with those optional OOB (out-of-band) updates when you configure some nice Windows Update for...
Read Article →Tag domain controllers automatically in Defender for Endpoint using KQL, Logic App, and API
The use of device tags within Microsoft Defender for Endpoint (MDE) is important for environments. Device tags can be used to give more control ove...
Read Article →Microsoft 365 self-service using Power Apps
Check out this article via web browser: Microsoft 365 self-service using Power Apps This article was originally posted on the Microsoft 365 PnP Blo...
Read Article →Onboard Microsoft Defender for Endpoint using Azure Arc for non-Azure devices
Microsoft Defender for Endpoint deployment is possible based on multiple deployment mechanisms. Microsoft Defender for Cloud (previous Azure Defend...
Read Article →Act on group membership changes in Azure Active Directory
Check out this article via web browser: Act on group membership changes in Azure Active Directory Did you ever want to act on a change in group mem...
Read Article →Deploying Defender for Endpoint on iOS with zero-touch onboarding
Defender for Endpoint is available for multiple platforms. For mobile platforms Defender for Endpoint is supported for iOS en Android. In this blog...
Read Article →Speaking about Conditional Access at the M365 Chicago Virtual Event on January 14th, 2022
On Friday, January 14, 2022 I will be speaking at the M365 Chicago Virtual event. You can attend the event for free, by signing up via the Eventbri...
Read Article →Exploring Microsoft 365’s NOBELIUM Defence Capabilities
I recently read through an excellent article by Mandiant, which recently split with FireEye, on their findings and analysis of the continued action...
Read Article →Log4j and CVE-2021-44228: Use Microsoft Defender for Endpoint for software/ threat investigation
One of the most important and trending topics in the last couple of days is related to Log4j, log4shell, and the attached CVE 2021-44228. A zero-da...
Read Article →Speaking at the December 2021 – MC2MC Evening event about Designing and building Microsoft Endpoint Manager for Operations
On Thursday, December 16, the Microsoft Cloud and Client Management Community (MC2MC) is organizing its December Evening event. The MC2MC team cons...
Read Article →Onboard FIDO2 keys using Temporary Access Pass in Azure AD
Check out this article via web browser: Onboard FIDO2 keys using Temporary Access Pass in Azure AD One of the requirements to use FIDO2 security ke...
Read Article →Use Registration campaign to promote Microsoft Authenticator App
Check out this article via web browser: Use Registration campaign to promote Microsoft Authenticator App With all the new improvements to the Micro...
Read Article →Gradual rollout options for upgrading to Windows 11 are now available in Microsoft Endpoint Manager
Microsoft has made available service release 2111 for Microsoft Endpoint Manager, this release contains a lot of updates which are described on the...
Read Article →Identity Protection Risk Analysis workbook: Get more Azure AD Identity Protection insights
During Ignite ’21 Microsoft announced multiple new functionalities, renames, and new products. In the upcoming weeks, more blogs are coming w...
Read Article →Microsoft Endpoint Manager and the issue of the tattooing Block write access to removable data-drives not protected by BitLocker setting
Today I experienced an issue which I want to share on my blog, it is related to a setting related to BitLocker which gets tattooed meaning that it ...
Read Article →Microsoft Sentinel content hub: Using solutions and start with the Training Lab content
Microsoft Sentinel is in the last months improved with a huge amount of new interesting features. One of the announced features is the content hub....
Read Article →Conditional Access announcements from Ignite November 2021 reviewed
During the Microsoft Ignite conference in November 2021 Microsoft made several announcements related to Azure AD conditional access. You can read t...
Read Article →The day I bought my WinRAR license
Check out this article via web browser: The day I bought my WinRAR license This post is about WinRAR. We all know WinRAR for it’s never expir...
Read Article →My appearance in the Cloud Conversations podcast #32
On Saturday, October 30th I was a guest in the Cloud Conversations podcast which is hosted by Kat Greenan, Peter Rising and Ru Cambell. The Cloud C...
Read Article →Speaking at the HTMD Conference 2021 about Designing and building Microsoft Endpoint Manager for Operations
On Saturday, November 20, the How to Manage Devices Community Group India, which is led by Microsoft MVP enterprise mobility Anoop C Nair organizes...
Read Article →Manage Device control with Microsoft Defender for Endpoint and Endpoint Manager
Microsoft Defender for Endpoint contains multiple protections layers like EDR, ASR, Network Protection, and many more. Protecting against unwanted ...
Read Article →Azure AD Conditional Access sign-in troubleshooting tip: Flag sign-in errors for review
If you have Conditional Access configured and active within your Azure AD environment, there might be some scenario’s where users are not abl...
Read Article →Continuous Access Evaluation configuration is now part of Conditional Access
While browsing through the options in my Conditional Access policies I noticed a new session related to Continuous Access Evaluation (CAE). Time fo...
Read Article →Announcing #WPNinjasNL Meetup #1, Thursday November 4th – Microsoft Ignite edition
For next week, Thursday November 4th, we are proud to announce that we are hosting our first on-premised event again. The event will be held in the...
Read Article →Speaking at the AppManagEvent 2021 about Designing and building Microsoft Endpoint Manager for Operations
On Friday, November 12th Professional Development Services is organizing its annual event AppManagEvent again. This in-person full day event which ...
Read Article →Enable Location Information and Code Match for Azure MFA
Check out this article via web browser: Enable Location Information and Code Match for Azure MFA Update 26-11-2021 As this feature is now in public...
Read Article →Create Role Assignable Groups based on existing groups
Check out this article via web browser: Create Role Assignable Groups based on existing groups Today’s post is about Role Assignable Groups. ...
Read Article →Enabling and configuring Web content filtering in Microsoft Defender for Endpoint (MDE)
Web content filtering is part of the Microsoft Defender for Endpoint solution. One of the previous blogs explained the feature during the preview r...
Read Article →10 productivity tips for M365 administrators
Check out this article via web browser: 10 productivity tips for M365 administrators I have worked with Microsoft 365 over the past few years, and ...
Read Article →Announcing #WPNinjasNL Tuesdays Webinar #32, Tuesday October 26, featuring Isidora Katanic, Holly Lehman and Nicole Enders #WomenInTech
For next week, Tuesday, October 26 we are proud to announce that we have a special edition of our #WPNinjasNL Tuesdays Webinar. This time, Isidora ...
Read Article →Updated October 2021: Availability of Defender for Endpoint Features by Operating System
In July, I released v1 of The Big Comparison of Defender for Endpoint Features by Operating System (or, what I think is much catchier, TBCMDEFOS). ...
Read Article →October 2021 update of the conditional access demystified whitepaper and workflow cheat sheet
I’m proud to announce the October 2021 update of my Conditional Access demystified whitepaper. With this release, we have reached the fourth ...
Read Article →Install the new unified Microsoft Defender for Endpoint agent on Server 2012R2 and 2016
Since April 11th, 2022, the new unified Microsoft Defender for Endpoint solution is generally available for Server 2016 and Server 2016. The unifie...
Read Article →Speaking about Conditional Access at the Centric Craft webinar on Wednesday October 13, 2021
On Wednesday October 13, I will be speaking at the free online webinar hosted by Centric Craft. Craft is a community initiative from the company Ce...
Read Article →Control Azure AD Conditional Access policy behavior during an Azure AD outage
In December last year, Microsoft announced that per April 1, 2021 they updated their service level agreement(SLA) for Azure AD user authentication ...
Read Article →Customize the MFA registration policy in Azure AD Identity Protection
Check out this article via web browser: Customize the MFA registration policy in Azure AD Identity Protection Disclaimer: this is a proof of concep...
Read Article →Warn/monitor users for Shadow IT usage with Microsoft Cloud App Security
Cloud App Discovery is one of the most interesting functions available in Microsoft Cloud App Security. This blogpost is about the new MCAS monitor...
Read Article →With Windows Update for Business configured, will my devices automagically start updating to Windows 11?
Tomorrow, on October 5th Microsoft will make Windows 11 Generally Available. Many of my customers already asked if this will have any impact on the...
Read Article →KB – Add account operation is blocked by policy on the device
Check out this article via web browser: KB – Add account operation is blocked by policy on the device This is a knowledgebase item. Hope it h...
Read Article →Using Mozilla Firefox as a browser when using Azure AD Conditional Access on your Modern Workplace
Starting with Firefox version 91, Mozilla is now supporting Single sign-on support (SSO) and device-based Conditional Access as announced by Micros...
Read Article →Role Assignable Groups and Privileged Identity Management.
Check out this article via web browser: Role Assignable Groups and Privileged Identity Management. I have used this feature from the very beginning...
Read Article →Stream Azure AD Identity Protection events to Microsoft Sentinel/ Log Analytics
Microsoft recently added a new function that gives the option for stream events from Azure AD Identity Protection into Microsoft Sentinel. In this ...
Read Article →Preventing account breaches leveraging SIM swapping techniques by nudging your users to start using the Microsoft authenticator app
The last couple of years, Microsoft has been pushing the usage of Multi Factor Authentication for logins to their Cloud Services. MFA, which requir...
Read Article →Cloud App Discovery with MCAS & MDE for Shadow IT monitoring and integration with Azure Sentinel
Cloud discovery is one of the most interesting functions available with the Cloud App Discovery product. With Cloud Discovery, organizations will g...
Read Article →OneDrive client sign-in issues due to Conditional Access policies in Azure AD tenant where you are a guest user
Today I experienced an interesting issue, for which I thought it was interesting sharing how I figured out what was going on. The issue/challenge T...
Read Article →This might be the FIDO2 key for you! Authentrend ATKey.Pro
Check out this article via web browser: This might be the FIDO2 key for you! Authentrend ATKey.Pro In the past few years, I tried different types o...
Read Article →Protecting against Lateral Movement with Defender for Identity and monitor with Azure Sentinel
Lateral movement refers to the techniques that a cyber attacker uses, after gaining initial access, to move deeper into a network in search of sens...
Read Article →How to build a PowerApp – Temporary Access Pass Manager – Part 1
Check out this article via web browser: How to build a PowerApp – Temporary Access Pass Manager – Part 1 Part 1 – Introduction an...
Read Article →How to build a PowerApp – Temporary Access Pass Manager – Part 2
Check out this article via web browser: How to build a PowerApp – Temporary Access Pass Manager – Part 2 Part 2: App registration and G...
Read Article →How to build a PowerApp – Temporary Access Pass Manager – Part 3
Check out this article via web browser: How to build a PowerApp – Temporary Access Pass Manager – Part 3 Part 3: Graph API and Graph Explorer...
Read Article →How to build a PowerApp – Temporary Access Pass Manager – Part 4
Check out this article via web browser: How to build a PowerApp – Temporary Access Pass Manager – Part 4 Part 4: Build a custom connector bas...
Read Article →How to build a PowerApp – Temporary Access Pass Manager – Part 5
Check out this article via web browser: How to build a PowerApp – Temporary Access Pass Manager – Part 5 Part 5: Create an app in PowerApps u...
Read Article →Searching and finding data
Welcome to the fifth blog post in the series becoming a Kusto Knight. While the previous blog post was about time in Kusto, this blog post will be ...
Read Article →(Bonus) How to build a PowerApp – Temporary Access Pass Manager – Part 6
Check out this article via web browser: (Bonus) How to build a PowerApp – Temporary Access Pass Manager – Part 6 (Bonus) Part 6: Integr...
Read Article →Protecting against password spray attacks with Azure Sentinel and Azure AD
A Password Spraying Attack is a type of brute force attack where a malicious actor attempts the same password on many accounts before moving on to ...
Read Article →Hunting for unsigned drivers, like Printer Nightmare
It has been busy times, and I have not written much lately. So, I have had some time to think about new detections. And while there are enough blog...
Read Article →Security Hygiene, Azure Security Center, and Secure Score
The basics Let’s start this article with some basic cybersecurity terminology. Security hygiene, or cyber hygiene, is a general term used to ...
Read Article →Use Sysmon for monitoring servers with Microsoft Sentinel
System Monitor (Sysmon) is one of the most common add-ons for Windows logging. With Sysmon, you can detect malicious activity by tracking code beha...
Read Article →Speaking at the Workplace Ninja Virtual Edition 2021 about Designing and building Microsoft Endpoint Manager for Operations
From Tuesday August 31 till Thursday September 2, the 2nd edition of the Workplace Ninja Virtual Edition will take place. The event will be hosted ...
Read Article →Using Defender for Endpoint Live response API with Sentinel Playbooks/ Automation
Live response is a function from Defender for Endpoint and is available for Windows 10 and Server 1803/1903. Live response gives security operation...
Read Article →Azure AD Identity Protection: User Risk and Sign-in Risk protection with automation
Azure AD Identity Protection is one of the security tools available in the Microsoft E5 license. With Azure AD Identity Protection it is possible t...
Read Article →The Big Comparison of Defender for Endpoint Features by Operating System
Microsoft Defender for Endpoint (MDE) is a massive platform. It’s not a single product, and it’s more than just a service. It’s a...
Read Article →Using the Azure Sentinel Windows Security Events Connector for getting custom events
Microsoft announced on 14th June 2021 a new version of the Windows Security Events data connector. The new feature reached currently the public pre...
Read Article →Announcing #WPNinjasNL Tuesdays Webinar #28, Tuesday July 6, featuring Jeremy Moskowitz
Our # WPNinjasNL “Live – Ask us Anything” session planned for Tuesday June 29 has been rescheduled to Monday July 5th, you can st...
Read Article →Getting everyone enrolled for Azure MFA and SSPR. How hard can it be?
Check out this article via web browser: Getting everyone enrolled for Azure MFA and SSPR. How hard can it be? I’ve done quite some Azure MFA ...
Read Article →My session about Conditional Access at the Microsoft 365 Security & Compliance User Group on June 30, 2021
On Wednesday June 30, I spoke at the monthly user group meeting of the Microsoft 365 Security & Compliance user group. The Microsoft 365 Securi...
Read Article →PrintNightmare – Use Microsoft Defender/ Sentinel toolings to get insights
Technical details and a proof-of-concept (PoC) exploit have been accidentally leaked for a currently unpatched vulnerability in Windows that makes ...
Read Article →Reauthorise Windows Server DHCP with One Line of PowerShell
This will be a brief blog, as I am certainly not a DHCP expert or day-to-day administrator. I do, however, run a DHCP server on Windows Server 2019...
Read Article →A first look at Azure AD Conditional Access authentication context
During Microsoft Ignite in March this year, Microsoft announced several new upcoming functionalities for Azure Active Directory. One of the announc...
Read Article →Monitor RDP Brute Force Attack with Azure Sentinel & Azure Security Center
Since the last years, there is a large increase in cybercriminals attempting to run attacks by exploiting the login credentials. With the current w...
Read Article →Announcing #WPNinjasNL Tuesdays Webinar #27 (Tomorrow), Tuesday June 22, featuring Peter Daalmans
For Tuesday, June 22 (yes, thats Tomorrow) we are proud to announce that our very own Peter Daalmans, Microsoft MVP Enterprise Mobility will host a...
Read Article →Review service principals with Azure AD Access Reviews and monitor with Azure Sentinel
A new feature in public preview is the Azure AD access review functionality. With the new AzureAD access reviews function it is possible to review ...
Read Article →Change billing model for Azure AD guest users
Check out this article via web browser: Change billing model for Azure AD guest users Back in 2020, Microsoft announced a change in the pricing mod...
Read Article →Power Automate: not your daddy’s RSS reader
Check out this article via web browser: Power Automate: not your daddy’s RSS reader Here’s a quick tip for all you eager learners out t...
Read Article →Deploying Office 365 with Intune as a Win32 App (and Why You’d Want To)
Office 365, or Microsoft 365 Apps for Enterprise, or whatever it’s called this month, can be deployed by Intune to Windows 10 devices using a...
Read Article →Monitor Azure AD break-glass accounts with Microsoft Sentinel
Conditional Access configuration for AzureAD accounts is important. With Conditional Access you can protect easy accounts, block outdated protocols...
Read Article →Three Cool Things To Do With Azure Information Protection
In my last blog, I wrote about three considerations for your Azure Information Protection deployments and commented on often overlooked potential d...
Read Article →Speaking about Conditional Access at the Microsoft 365 Security & Compliance User Group on June 30, 2021
On Wednesday June 30, I will be speaking at the monthly user group meeting of the Microsoft 365 Security & Compliance user group. The Microsoft...
Read Article →Export Microsoft 365 Defender security events with the streaming API
By default Microsoft Defender for Endpoint stores Endpoint events in Defender for Endpoint for the configured retention period; Max: 180 days. ...
Read Article →Announcing #WPNinjasNL Tuesdays Webinar #26, Tuesday June 8th, featuring Thorsten Pickhan and Michael Plettner
For next week, Tuesday, June 8th we are proud to announce that Thorsten Pickhan, Senior Microsoft UC Consultant and Michael Plettner, Microsoft MVP...
Read Article →Received the Microsoft Most Valuable Professional (MVP) award in Enterprise Mobility
On Thursday June 1st 2021, I received an email from Microsoft telling me that I received the Microsoft Most Valuable Professional (MVP) award. My a...
Read Article →Enroll Android smartphones into Microsoft Defender for Endpoint for blocking FluBot
The Flubot-malware is currently active in the news. The malware with the name FluBot will be sent to mobile endpoints with a text message or WhatsA...
Read Article →Endpoint Manager filters: Use filtering for assigning policies, profiles and apps to specific devices
Microsoft recently announced a new existing feature in Microsoft Endpoint Manager with the name: “filters”. With the new feature, it is...
Read Article →Our session about Modern Authentication at the May 2021 meetup of the Microsoft Cloud and Client Management Community #MC2MC
Yesterday, on Thursday May 27, Erik Loef and I delivered a session at the May virtual event of the Microsoft Cloud and Client Management Community....
Read Article →A first look at using Filters for devices as conditions in Azure AD Conditional Access policies
Earlier this month I wrote an article about using filtering in assignments for apps, compliance policies and configuration profiles in Microsoft En...
Read Article →MDM policy processing on Windows 10 with Microsoft Endpoint Manager, a closer look
The goal of this blogpost is to explain more about what happens between the moment that a configurations setting in Microsoft Endpoint Manager (MEM...
Read Article →Announcing #WPNinjasNL Tuesdays Webinar #25, Tuesday May 25, featuring Jan Bakker
For next week, Tuesday, May 25 we are proud to announce that Jan Bakker, Microsoft 365 Consultant and Microsoft Enterprise Mobility MVP will be hos...
Read Article →Integrate Azure Sentinel with Microsoft Teams for seamlessly collaboration
Working from home became the new normal in most of the work environments. With the increase of working from home also the security impact changed. ...
Read Article →Announcing #WPNinjasNL “Live – Ask us Anything” #5, on Tuesday May 18, 2021 (Tomorrow) about Endpoint Analytics
On Tuesday, May 18 we are proud to announce our fifth “Live – Ask us Anything” session, hosted by Ronny de Jong and Frans O...
Read Article →Three Considerations for Azure Information Protection Deployments
Azure Information Protection (AIP) – more accurately exposed to Microsoft 365 now as sensitivity labels – is close to the top of my fav...
Read Article →A first look at expediting Windows 10 Quality Updates when using Windows Update for Business and Microsoft Endpoint Manager
During Microsoft Ignite, Microsoft announced the option to bypass pre-configured Windows Update for Business policies to immediately deploy a secur...
Read Article →A first look at filtering when assigning apps, compliance policies and configuration profiles in Microsoft Endpoint Manager
Microsoft is currently in the process of rolling out a preview of filtering for apps, policies and profiles in Microsoft Endpoint Manager. With thi...
Read Article →Use Azure Security Center workbooks for detailed information/ dashboards
Azure Security Center included integration with Azure Workbooks. With the new Workbooks feature is it possible to build custom reports. From Azure ...
Read Article →Speaking about Modern Authentication at the May 2021 meetup of the Microsoft Cloud and Client Management Community #MC2MC
On Thursday May 27, Erik Loef and I will speak at the May virtual event of the Microsoft Cloud and Client Management Community. The Microsoft Cloud...
Read Article →Announcing #WPNinjasNL Tuesdays Webinar #24, Tuesday May 11, featuring Nico Zieck
For next week, Tuesday, May 11 we are proud to announce that Nico Zieck, Director Technology & Solutions at Liquit B.V. will be hosting a sessi...
Read Article →Automatically Hide IP Addresses When Recording Demos or Screen Sharing
The Azure Mask browser extension is a really great tool when either recording on-screen demos or sharing your screen. Available for Edge/Chrome and...
Read Article →Defender for Endpoint Device Discovery: Discover the unmanaged part of the corporate network
Unmanaged devices are most of the time a weak point in the corporate network/ environment. With the current situation more and more BYOD devices ar...
Read Article →Customizing the Microsoft Endpoint Manager company portal and my experiences doing so.
The Microsoft Company Portal app is a cross platform app available in the app stores of Apple, Android and Microsoft. The app, depending on the ins...
Read Article →Time is of the essence
Welcome to the fourth blog post in the series becoming a Kusto Knight. While the previous blog post was about data types in Kusto, this blog post w...
Read Article →Troubleshooting Hybrid Azure AD Intune Automatic Enrollment
As I have blogged about a lot, there are a bunch of hoops to be jumped through and prerequisites to be met for a successful hybrid Azure AD join an...
Read Article →Announcing #WPNinjasNL “Live – Ask us Anything” #4, on Tuesday April 20 about Expediting Windows 10 Quality Updates
On Tuesday, April 20 we are proud to announce our fourth “Live – Ask us Anything” session, hosted by Ronny de Jong and Fran...
Read Article →Using Conditional Access to provide more granularity when registering or joining devices
This month Microsoft released a new “User Action” for Conditional Access in public preview. The new user action called “Register ...
Read Article →Revoke Access to Office Files with Sensitivity Labels and Azure Information Protection
Most of us have had that “oh <blank>” moment where we have given someone access to someone only to immediately or later need to...
Read Article →Designing and configuring compliance policies for your Windows Modern Workplace using Microsoft Endpoint Manager
Measuring your managed systems against a baseline has been around for a while, in Microsoft Endpoint Configuration Manager(MECM)/ConfigMgr we can a...
Read Article →Announcing #WPNinjasNL Tuesdays Webinar #23, Tuesday April 13, featuring Greg Ramsey
For next week, Tuesday, April 13 we are proud to announce that Greg Ramsey, Enterprise Mobility MVP and Enterprise Tools Strategist at Dell, Inc. w...
Read Article →Require MFA for Azure AD domain join and Device Registration
Check out this article via web browser: Require MFA for Azure AD domain join and Device Registration Today we take a look at a new feature in Azure...
Read Article →Conditional Access: Skip MFA for Company Devices on the Company Network
A common Conditional Access policy is to add trusted locations as an exception to multi-factor authorisation requirements. The logic goes, if you a...
Read Article →Configuring Windows Update for Business settings for your Microsoft Endpoint Manager managed Modern Workplace
Keeping Microsoft windows devices up-to-date has been a challenge I have been dealing with for a long time now. Within Microsoft Endpoint Configura...
Read Article →Defender for Endpoint on Linux onboarding and behavior monitoring detection
Het bericht Defender for Endpoint on Linux onboarding and behavior monitoring detection verscheen eerst op Jeffrey Appel - Microsoft Security blog.
Read Article →Announcing #WPNinjasNL Tuesdays Webinar #22, Tuesday March 30, featuring Dirk-jan Mollema, security researcher at Fox-IT
For next week, Tuesday, March 30 we are proud to announce that Dirk-jan Mollema, one of the core researchers of Active Directory and Azure AD at Fo...
Read Article →Announcing #WPNinjasNL “Live – Ask us Anything” #3, on Tuesday March 23 about Microsoft Ignite
Starting in January 2021, the Workplace Ninja User Group Netherlands has started a new initiative, the “Live – Asks us Anything” ...
Read Article →Update BitLocker Unique Identifiers with Intune
BitLocker unique identifiers are values used to identify the ownership of an encrypted volume. The device that performs the encryption holds the un...
Read Article →Azure Active Directory Connect – Cloud Sync
Check out this article via web browser: Azure Active Directory Connect – Cloud Sync When organizations want to extend Active Directory to Azu...
Read Article →My presentations at the Workplace Ninja User Group Switzerland 2103 virtual meetup
On Friday, the 19th of March, I spoke at the 2103 virtual meetup of the Workplace Ninja User Group Switzerland. During this event which lasts a who...
Read Article →Have you already started your journey towards Passwordless authentication on your Modern Workplace?
One of the main Identity related topics during Microsoft Ignite March 2021 edition was passwordless. Microsoft announced at the event that password...
Read Article →Block Legacy Authentication now, and don’t wait for Microsoft
Legacy authentication is the most compromising sign-in. Microsoft is going to disable basic/ legacy authentication. It is recommended to impl...
Read Article →Microsoft Defender Antivirus – Schedule & Install Updates via Network Shares
Although not common, there are scenarios out where you will have LAN-only devices onboarded in Microsoft Defender for Endpoint (MDE), or at least u...
Read Article →Enable external sender identification in Exchange Online
Microsoft has rolled out a new feature in Exchange Online called External Sender Identification. It allows for tags to be added to email messages c...
Read Article →Create Powershell Session is failed using OAuth when using the Exchange Online V2 PowerShell module
Update: Since September 2022, the v3.0 PowerShell module of Exchange Online is available, which when used solves this issue as well. You can update...
Read Article →A first look at the Microsoft 365 Apps admin center
The Microsoft 365 Apps admin center, available via https://config.office.com provides a portal where admins can manage Microsoft 365 Apps for Enter...
Read Article →Announcing #WPNinjasNL Tuesdays Webinar #21, Tuesday March 16, featuring Patrick van den Born and Rick Stijnman
For next week, Tuesday, March 16 we are proud to announce that Patrick van den Born and Rick Stijnman will be hosting a session about: Deploying Wi...
Read Article →Track the registration and usage of all authentications methods with AzureAD
As part of the new Passwordless GA announcement, Microsoft created a new activity blade in AzureAD. With the new Authentications methods Activity b...
Read Article →Microsoft Defender Network Protection – Not Enabling via Intune – Troubleshooting & Fix
When configuring Defender for Endpoint (MDE) customer recently, I ran into a problem when trying to enable network protection. Network protection i...
Read Article →Review guest access across Microsoft 365 groups (teams)
Check out this article via web browser: Review guest access across Microsoft 365 groups (teams) In a previous blog post I wrote about Azure AD Acce...
Read Article →Modern Workplace Management key takeaways from the Microsoft Ignite March 2021 announcements
This week, during the virtual Ignite event Microsoft made several announcements related to the Modern Workplace. The event started yesterday (March...
Read Article →Detect critical 0-day exploits with Defender for Endpoint
Microsoft has detected multiple 0-days exploits being used to attack on-premises versions of Microsoft Exchange Servers. Microsoft releases today m...
Read Article →Get insights into device restart frequency with Endpoint Analytics
A well-running workplace environment is critical to have a great endpoint user-experience. With a not stable configuration/ device the productivity...
Read Article →Speaking at the Workplace Ninja User Group Switzerland 2103 virtual meetup on March 19, about Modern Authentication and Designing & Building MEM for Operations
On Friday, the 19th of March, I will speak at the 2103 virtual meetup of the Workplace Ninja User Group Switzerland. During this event which lasts ...
Read Article →Microsoft Information Protection Sensitivity Labels – Custom User Permissions and Do Not Forward
With Microsoft Information Protection, you can apply sensitivity labels to files, emails, and containers such as SharePoint Libraries. These labels...
Read Article →Announcing #WPNinjasNL Tuesdays Webinar #20, Tuesday March 2nd, featuring Thomas Maurer
For next week, Tuesday, February 16 we are proud to announce that Thomas Maurer, Senior Cloud Advocate at Microsoft will be hosting a session about...
Read Article →Azure Active Directory Temporary Access Pass
Check out this article via web browser: Azure Active Directory Temporary Access Pass This blog post is all about the new Temporary Access Pass in A...
Read Article →A first look at the settings catalog in Microsoft Endpoint Manager
With the 2101 Service Release of Microsoft Intune, released this week (February 1, 2021) Microsoft released a lot of new features. One of those fea...
Read Article →Microsoft Defender for Endpoint – Offline Onboarding for Windows 10 via a Proxy
Getting your devices into Defender for Endpoint is referred to as onboarding and can be done in lots of different ways, depending on the scenario. ...
Read Article →My presentation about Conditional Access at the Workplace Ninja User Group Netherlands
Yesterday, on Thursday February 16, I presented at the 19th Workplace Ninja User Group Netherlands Tuesdays Webinar. My session, titled “Azur...
Read Article →February 2021 update of the Azure AD Conditional Access demystified whitepaper and workflow cheat sheet.
I’m proud to announce the February 2021 update of my Conditional Access demystified whitepaper. With this release, we have reached the third ...
Read Article →Go fully passwordless with the new Azure AD Temporary Access Pass feature
The new Azure AD Temporary Access Pass preview feature is available in the tenant. With the new preview feature, it is possible to configure ...
Read Article →Privileged Identity Management Discovery and insights
Check out this article via web browser: Privileged Identity Management Discovery and insights Privileged Identity Management (PIM) in Azure Active ...
Read Article →My presentation about Conditional Access at the Nordic Virtual Summit 2021
Today, on Thursday February 11, I presented for at the second day of the Nordic Virtual Summit 2021 event. The event was very well organized by sev...
Read Article →Use Intune to Manage Microsoft Defender for Endpoint Tags and Device Groups
In Microsoft Defender for Endpoint (MDE), tags can be attached to a device for reporting, filtering, and as a dynamic attribute for membership of a...
Read Article →First look at Access Reviews for guests in all Teams and Microsoft 365 Groups
In January, Microsoft announced that they released a public preview allowing entitled customers to create Azure AD access reviews for guest users a...
Read Article →Number matching with Microsoft Authenticator App in Azure MFA
Check out this article via web browser: Number matching with Microsoft Authenticator App in Azure MFA Number matching and passwordless phone sign-i...
Read Article →One year anniversary JanBakker.tech
Check out this article via web browser: One year anniversary JanBakker.tech This month, janbakker.tech becomes one year old. On February 16th 2020,...
Read Article →Speaking at Global Automation Bootcamp 2021
Check out this article via web browser: Speaking at Global Automation Bootcamp 2021 I’m very excited to announce my session for the Global Au...
Read Article →Turn Existing Azure AD Devices into Windows Autopilot Devices
To provision Windows 10 PCs using Autopilot and Intune, they must first be registered as Windows Autopilot devices in the Device Directory Service,...
Read Article →Demystifying Windows 10 in cloud configuration
On February 2, 2021 Microsoft announced “Windows 10 in cloud configuration”, when reading the title I was immediately interested to fin...
Read Article →Updating your Security baselines in Microsoft Endpoint Manager to a newer version
With the 2101 Service Release of Microsoft Intune, released this week (February 1, 2021) Microsoft released a lot of new features (more on that in ...
Read Article →Which data types do we have
Welcome to the third blog post in the series becoming a Kusto Knight. While the previous blog post was about where we store data in Kusto, this blo...
Read Article →Kusto Gym
Welcome to the Kusto Gym, On your road to become a Kusto Knight, there are some exercises to put the theory into action. Where do we store the data...
Read Article →Speaking at the Workplace Ninja User Group Netherlands meetup webinar on February 16, about Conditional Access
On Tuesday the 16th of February, I will speak at the webinar of the Workplace Ninja User Group Netherlands. This session, which is updated monthly ...
Read Article →Where do we store the data in Kusto
Welcome to the second blog post in the series becoming a Kusto Knight. While the previous blog post was more about what Kusto Query Language is, an...
Read Article →Understanding Application Guard for Office, Now Generally Available
Application Guard first appeared in Windows 10 1709 (“Fall Creators Update”) to isolate Edge browser activity within a Hyper V containe...
Read Article →Speaking at the Nordic Virtual Summit 2021 about Conditional Access
On Wednesday 10 and Thursday 11 February, several communities (A joint venture by #SGUCSE #SCUGDK #SCUGFI #MMUGNO and #MSEndpointMgr) in the Nordic...
Read Article →Announcing #WPNinjasNL Tuesdays Webinar #2, Tuesday February 2nd featuring Kenny Buntinx & Merlijn Van Waeyenberghe
For Tuesday, February 2nd we are proud to announce that community friend Kenny Buntinx & Merlijn Van Waeyenberghe are hosting a session about: ...
Read Article →Browser restrictions and configuration when using Conditional Access on your modern workplace
This article is about a subject I covered before in my blogpost titled: “Understanding and governing reauthentication settings in Azure Activ...
Read Article →Enabling Self Service Password Reset (SSPR) for your Modern Workplace users
On modern workplaces we use authentication techniques provided by Windows Hello for Business, like biometric and PIN. Due to this, user don’t...
Read Article →Understanding Modern vs. Legacy Authentication in Microsoft 365
Since October 2019, Microsoft has enabled Security Defaults by default in new Microsoft 365 tenants. Security Defaults are a group of best-practice...
Read Article →Announcing #WPNinjasNL “Live – Ask us Anything” #1, on Tuesday January 26 about Security Awareness
Starting in January 2021, the Workplace Ninja User Group Netherlands has started a new initiative, the “Live – Asks us Anything” ...
Read Article →My presentation about Conditional Access at the Workplace Ninja User Group München
Yesterday, on Thursday January 21, I presented for the Workplace Ninja User Group München about one of my favorite topics “Conditional Access...
Read Article →Announcing #WPNinjasNL Tuesdays Webinar #1, January 19, 2021 featuring Adnan Hendricks
For Today, January 19th we are proud to announce that our own Adnan Hendricks, Microsoft Azure MVP will host a session about: Azure AD Identity Pro...
Read Article →Enable automatic Access Reviews for Guest users in Teams and Microsoft 365 Groups
Azure AD access reviews feature is now in public preview for the Teams and Microsoft 365 Groups. In this blog post an overview of the new public pr...
Read Article →Self Service in Microsoft 365
Check out this article via web browser: Self Service in Microsoft 365 One of the great things about Azure Active Directory is the capability of sel...
Read Article →Store BitLocker Recovery Keys in Azure AD for Devices Already Encrypted
As you move from on-premises or third-party infrastructure to Microsoft 365 and Azure AD, you will want to keep those BitLocker recovery keys safe....
Read Article →Enrich Microsoft 365 profile card with extensions and custom attributes
Check out this article via web browser: Enrich Microsoft 365 profile card with extensions and custom attributes Microsoft 365 is equipped with a ve...
Read Article →Your road to become a Kusto Knight starts here
Welcome to the first blog post in the series becoming a Kusto Knight. Besides blogging about the latest and greatest detections I also want to help...
Read Article →Speaking about Conditional Access at the Workplace Ninja Usergroup München on Thursday January 21st 2021
On Thursday, January 21st 2021 I’m honored to announce that I will be speaking at the Workplace Ninja Usergroup München meetup. The Workplace...
Read Article →Rebranding the Windows Management User Group Netherlands to Workplace Ninja User Group Netherlands
In February 2013 Bob Cornelissen, Marnix Wolf, Peter Daalmans and myself founded the Windows Management User Group Netherlands (WMUG_NL) foundation...
Read Article →Azure Active Directory Identity Governance – Azure AD Entitlement Management
Check out this article via web browser: Azure Active Directory Identity Governance – Azure AD Entitlement Management In this series, we take a look...
Read Article →Use Microsoft technology for the detection and prevention of the SolarWinds chain attack
SolarWinds has revealed how monitoring products it released earlier this year may have been tampered with in a supply chain attack. In this blog po...
Read Article →Azure Active Directory Identity Governance – Privileged Identity Management
Check out this article via web browser: Azure Active Directory Identity Governance – Privileged Identity Management In this series, we take a look ...
Read Article →Deploy and configure Microsoft Defender for Endpoint on iOS devices
Het bericht Deploy and configure Microsoft Defender for Endpoint on iOS devices verscheen eerst op Jeffrey Appel - Microsoft Security blog.
Read Article →Defining more granularity for your Conditional Access App Enforced Restrictions using Sensitivity Labels
In June this year I wrote an article about: Limit Access to Outlook Web Access, SharePoint Online and OneDrive using Conditional Access App Enforce...
Read Article →Designing and building your Microsoft Endpoint Manager/Intune environment for Operations
In my work as a modern workplace consultant, I see a lot of Microsoft Endpoint Manager/Intune environments. Many of these environments have been bu...
Read Article →Announcing #WMUG_NL Tuesdays Webinar 15 on December 1st, 2020 featuring Alex Verboon
For Tuesday, December 1 we are proud to announce that Alex Verboon, Cyber Security Consultant at baseVISION in Switzerland will host a session abou...
Read Article →Azure Active Directory Identity Governance – Access Reviews
Check out this article via web browser: Azure Active Directory Identity Governance – Access Reviews In this series, we take a look at Azure A...
Read Article →Conditional Access demystified: My recommended default set of policies
In August last year, I published eight articles in a series on Conditional Access, and later once finished I decided to bundle those articles in a ...
Read Article →Endpoint Data Loss Prevention (DLP): Protect cloud uploads and printing
Managing the risks around data has become increasingly complex for organizations. At the current stage more and more employees are working from hom...
Read Article →Get all Conditional Access Query’s with a single click using Graph API
Conditional Access is one of the available tools used by Azure Active Directory to bring different signals together. Based on different signals it ...
Read Article →Announcing #WMUG_NL Tuesdays Webinar 14 on November 10, 2020 featuring Ronni Pedersen
For Tuesday, November 10 we are proud to announce that Ronni Pedersen, Cloud Architect at APENTO will host a session about: “How to get succe...
Read Article →Protect files on download using Cloud App Security and Azure Information Protection
Check out this article via web browser: Protect files on download using Cloud App Security and Azure Information Protection If you have read my blo...
Read Article →The 10 Technical IT Books of Most Influence on Me
In the name of transparency, or maybe stating the bleeding obvious, I confess I am that guy who can happily read an IT reference book or something ...
Read Article →PowerShell: Run Cmdlet If Another Was Successful (And Keep Trying Until It Is)
Today I’m sharing a useful bit of PowerShell I gracelessly punt from script to script whenever I need to make sure a prerequisite it met befo...
Read Article →Fast response with Azure AD Continuous Access Evaluation (CAE) and Conditional Access
Continuous Access Evaluation (CAE) for AzureAD is one of the latest functions and is available in public preview. With this new technique, it is po...
Read Article →Understanding and governing reauthentication settings in Azure Active Directory
Governing when users receive authentication prompts when authenticating to Azure Active Directory (Azure AD) is depending on more than one setting,...
Read Article →Announcing #WMUG_NL Tuesdays Webinar 13 on October 27th featuring Erik Loef and Kenneth van Surksum
For Tuesday, October 27th we are proud to announce that Erik Loef, CTO and Microsoft MVP at Proxsys, and Kenneth van Surksum, Modern Workplace cons...
Read Article →Microsoft Defender for Office 365: Check protection policies with Configuration Analyzer
Microsoft Defender for Office 365 is one of the three types of Advanced Threat Protection that Microsoft offers. With Microsoft Defender for Office...
Read Article →License on-demand with Power Automate and Azure AD
Check out this article via web browser: License on-demand with Power Automate and Azure AD Most organizations are using group-based licensing in Az...
Read Article →Block low reputation apps or newly detected cloud apps with Microsoft Defender for Endpoint, MCAS and Endpoint Manager
One of the benefits of Microsoft 365/ Microsoft Endpoint is the interaction across all the different products. With the connection between multiple...
Read Article →Mobile Application Management for Mobile Devices with Microsoft Endpoint Manager/Intune deep dive
With Microsoft Intune, there is a lot of focus on the Mobile Device Management (MDM) aspects of the product. This is logical because from a managem...
Read Article →Azure AD Continuous access evaluation (CAE), a first look
In April 2020 Alex Weinert, Director of Identity Security at Microsoft announced that Microsoft was working on moving towards real time policy and ...
Read Article →Announcing #WMUG_NL Tuesdays Webinar 12 featuring Thijs Lecomte
Due to the COVID-19 crisis, we (the Windows Management User Group Netherlands) were forced to move our activities to virtual events, which we call ...
Read Article →Collect Microsoft Teams activity in Azure Sentinel and start hunting
Azure Sentinel is a cloud-native security information and event management platform. (SIEM). Sentinel uses AI to analyze large volumes of data. Azu...
Read Article →Enabling Plus Addressing in Office 365 Exchange Online
In December 2019 Microsoft included support for Plus Addressing in their roadmap (ID 59441) for Office 365. In the meantime this feature is release...
Read Article →Food for thought – Bring Your Own Disaster.
Check out this article via web browser: Food for thought – Bring Your Own Disaster. Today a slightly different blog post. It’s a common...
Read Article →Microsoft Endpoint Data Loss Prevention: Blokkeren van USB bestandstransfers
Databeveiliging en classificatie is belangrijk. Een datalek via een verkeerde aanzender of toegang tot externe databronnen is snel gemaakt, waardoo...
Read Article →Announcing #WMUG_NL Tuesdays Webinar 11 featuring Tim Hermie & Jasper Bernaers on Tuesday September 29th
Due to the COVID-19 crisis, we (the Windows Management User Group Netherlands) were forced to move our activities to virtual events, which we call ...
Read Article →Block outdated operating systems with Cloud App Security
Check out this article via web browser: Block outdated operating systems with Cloud App Security It is not unlikely that some of your users still u...
Read Article →Announcing #WMUG_NL Tuesdays Webinar 10 featuring Ronny de Jong on Tuesday September 15th
Due to the COVID-19 crisis, we (the Windows Management User Group Netherlands) were forced to move our activities to virtual events, which we call ...
Read Article →Inzicht in Brute-force & Password spray attack via Azure Sentinel
Azure Sentinel is een cloud-native Security Information Event Management-oplossing, ook wel bekend als een SIEM-oplossing. Azure Sentinel is cloud-...
Read Article →Azure MFA authentication method analysis. Share the results with Power Automate!
Check out this article via web browser: Azure MFA authentication method analysis. Share the results with Power Automate! You might have seen the sa...
Read Article →The Difference Between Cloud App Security Discovery (CAD), Office 365 Cloud App Security (OCAS), and Microsoft Cloud App Security (MCAS)
Microsoft Cloud App Security (MCAS), Redmond’s cloud app security broker (CASB) offering, is a powerful tool for investigating and pro-active...
Read Article →Microsoft Secure Score Series – 15 – Do not expire passwords
Check out this article via web browser: Microsoft Secure Score Series – 15 – Do not expire passwords Research has found that when periodic password...
Read Article →Control access from unmanaged devices with Cloud App Security
Check out this article via web browser: Control access from unmanaged devices with Cloud App Security When COVID-19 hit the world, most people had ...
Read Article →Are you already synchronizing your Message Center messages to Planner? Here is why you should
Microsoft 365 changes regularly, changes are implemented almost on a daily basis and as an Admin responsible for the service you must be aware of w...
Read Article →How to prevent your users from downloading and installing Office via the Office portals
If your goal is to restrict the usage of Office applications on non-managed devices and only allow Web access in limited mode (as explained in my a...
Read Article →Microsoft is making changes related to automatic email forwarding for ATP customers, here is what you need to know
In February this year I blogged about Stopping automatic email forwarding in your Exchange Online environment in a controlled way providing a struc...
Read Article →Assigning groups to Azure AD roles and Privileged access groups, a first look!
On August 13th 2020, Alex Simons (Microsoft Identity PM) announced that assigning groups to Azure AD roles in now in public preview. This feature i...
Read Article →Use Microsoft Graph Security for end-user notifications
Check out this article via web browser: Use Microsoft Graph Security for end-user notifications In this short blog post, I want to show how you can...
Read Article →Inzage in malware via Cloud App Security en acties via de Microsoft threat intelligence engine
Microsoft Cloud App Security is geplaatst als Cloud App Security broker in het landschap van Microsoft en heeft meerdere mogelijkheden welke aanslu...
Read Article →Self Service Purchasing for Power Platform, Visio and Project, should you keep it enabled or disable the functionality?
In October 2019, Microsoft announced that it would enable end users to buy and manage their own licenses within their corporate account. At that ti...
Read Article →Getting Started with Azure AD Identity Governance – Part 3: Privileged Identity Management (PIM)
This blog is the last in a small series on Azure AD Premium P2’s Identity Governance toolkit. Part 1: Entitlement Management Part 2: Access R...
Read Article →Office 365 Templated policies and Preset security policies in Exchange Online Protection and Office 365 ATP
In my deep dive article on Office 365 Advanced Threat Protection (ATP) I mentioned that Microsoft provides best practices as described in the follo...
Read Article →Bulk dismiss risky users with Power Automate or Logic Apps
Check out this article via web browser: Bulk dismiss risky users with Power Automate or Logic Apps Update 08-10-2020: Microsoft released an officia...
Read Article →Getting Started with Azure AD Identity Governance – Part 2: Access Reviews
This blog is the second in a small series on Azure AD Premium P2’s Identity Governance toolkit. Part 1: Entitlement Management Part 2: Access...
Read Article →Prepopulate phone methods for MFA and SSPR using Graph API
Check out this article via web browser: Prepopulate phone methods for MFA and SSPR using Graph API Part 1 – Graph API What is the number one ...
Read Article →Prepopulate phone methods using a Custom Connector in Power Automate
Check out this article via web browser: Prepopulate phone methods using a Custom Connector in Power Automate Part 2 – Automation In the previ...
Read Article →Getting Started with Azure AD Identity Governance – Part 1: Entitlement Management
This blog is the first in a small series on Azure AD Premium P2’s Identity Governance toolkit. Part 1: Entitlement Management (this post) Par...
Read Article →Close the gap. Azure AD Identity Protection & Conditional Access.
Check out this article via web browser: Close the gap. Azure AD Identity Protection & Conditional Access. This blog is about Azure AD Identity...
Read Article →Downloads blokkeren via Conditional Access App Control vanuit Microsoft Endpoint Manager
Microsoft Cloud App Security is een behoorlijk uitgebreid product met verschillende mogelijkheden en toepassingen. In een eerder blog was al te lez...
Read Article →Apps vanuit Cloud App Security blokkeren via Microsoft Defender ATP + Microsoft Endpoint Manager
Microsoft Defender ATP is de Advanced Threat Protection dienst van Microsoft. Bij Microsoft gaan de ontwikkelingen snel, waarmee er steeds meer fun...
Read Article →Microsoft Defender ATP web content filtering; Zo werkt deze functionaliteit
Microsoft Defender ATP is al een tijd als preview te vinden in Microsoft Defender ATP – sinds 6 juli is hierop een wijziging geweest vanuit M...
Read Article →Edge Chromium; zo configureer je de tracking prevention functionaliteit vanuit Microsoft Endpoint Manager
De nieuwe Microsoft Edge webbrowser is gebaseerd op Chromium en geeft verschillende voordelen welke voor de beheerders interessant zijn. Door de on...
Read Article →Microsoft Defender for Endpoint Web Content Filtering – Migrate Rules from Existing Security Software
In my last blog, I wrote about web content filtering in MDATP and how it now allows you to block website categories on the client across all apps. ...
Read Article →Use Power Automate as your Conditional Access Police Department
Check out this article via web browser: Use Power Automate as your Conditional Access Police Department Last week, I was working on a new blog for ...
Read Article →Microsoft Secure Score Series – 14 – Designate more than one global admin
Check out this article via web browser: Microsoft Secure Score Series – 14 – Designate more than one global admin Designate more than one global ad...
Read Article →Microsoft Secure Score Series – 13 – Set automated notifications for new and trending cloud applications in your organization
Check out this article via web browser: Microsoft Secure Score Series – 13 – Set automated notifications for new and trending cloud applications in...
Read Article →Announcing #WMUG_NL Tuesdays Webinar 9 featuring Derk van der Woude on Tuesday July 7th
Due to the COVID-19 crisis, we (the Windows Management User Group Netherlands) were forced to move our activities to virtual events, which we call ...
Read Article →Monitor Teams activiteiten via Microsoft Cloud App Security Activity templates
Sinds de coronasituatie is Teams in een versnelling gekomen bij de meeste organisaties. In de meeste gevallen een versnelde uitrol, waardoor er nie...
Read Article →Microsoft Defender for Endpoint Web Content Filtering – Administration, Limitations, and User Experience
Historically, one of the big features missing “out of the box” with MDATP was web content filtering. Customers typically look at MDATP ...
Read Article →Use Power Automate or Logic Apps to keep an eye on your licenses
Check out this article via web browser: Use Power Automate or Logic Apps to keep an eye on your licenses I guess we’ve all been there; you ra...
Read Article →Limit Access to Outlook Web Access, SharePoint Online and OneDrive using Conditional Access App Enforced Restrictions
One of the scenario’s we can build with Conditional Access, is the scenario where we restrict access inside the web application itself. By do...
Read Article →Microsoft Defender ATP voor Android: Zo werkt de configuratie en gebruikerservaring tijdens de public preview
Microsoft heeft sinds deze week Microsoft Defender Advanced Threat Protection voor mobiele devices in public preview fase uitgebracht. Met deze rel...
Read Article →Completed the Azure Solution Architect Expert Certification
After earning my Microsoft 365 Certified Enterprise Administrator Expert certification in May, I decided to continue my certification journey and e...
Read Article →Announcing #WMUG_NL Tuesdays Webinar 8 featuring Tim De Keukelaere on Tuesday June 30th
Due to the COVID-19 crisis, we (the Windows Management User Group Netherlands) were forced to move our activities to virtual events, which we call ...
Read Article →A first look at Administrative Units and My Staff in Azure Active Directory
Check out this article via web browser: A first look at Administrative Units and My Staff in Azure Active Directory Recently, Microsoft introduced ...
Read Article →Automatisch contacten synchroniseren vanaf Microsoft Outlook naar native contact app via Microsoft Endpoint Manager
Met de komst van multifactor en moderne authenticatie stappen steeds meer bedrijven over op de Outlook app voor de mobiele devices. Dit heeft voora...
Read Article →Microsoft Secure Score Series – 12 – Turn on customer lockbox feature
Check out this article via web browser: Microsoft Secure Score Series – 12 – Turn on customer lockbox feature Turning on the customer lockbox featu...
Read Article →Android Enterprise via Microsoft Endpoint Manager als vervanger van Android device administrator
Met de aflopende support van Android device administrator is het van groot belang om te zoeken naar een passend alternatief. Vanuit Microsoft Endpo...
Read Article →Microsoft Secure Score Series – 11 – Turn on user risk policy
Check out this article via web browser: Microsoft Secure Score Series – 11 – Turn on user risk policy With the user risk policy turned on, Azure AD...
Read Article →Controle op Azure AD machtigingen met de Admin consent workflow; zo werkt het
Tegenwoordig worden steeds meer applicaties via de cloud aangesloten en geconfigureerd. Als we naar Microsoft kijken, is het mogelijk om vele appli...
Read Article →Sign In to Azure AD Using Google with Azure AD External Identities
External Identities is a new public preview feature of Azure AD which allows external users to authenticate with a non-Microsoft account such as th...
Read Article →Edge Chromium; zo configureer je beheerde favorieten via Microsoft Endpoint Manager
Edge Chromium is de nieuwe versie van Edge welke is gebaseerd op de opensource Chromium. Vanuit Microsoft Endpoint Manager is het mogelijk om deze ...
Read Article →Microsoft Secure Score Series – 10 – Discover trends in shadow IT application usage
Check out this article via web browser: Microsoft Secure Score Series – 10 – Discover trends in shadow IT application usage Add a data source in au...
Read Article →Announcing #WMUG_NL Tuesdays Webinar 7 featuring Jörgen Nilsson
Due to the COVID-19 crisis, we (the Windows Management User Group Netherlands) were forced to move our activities to virtual events, which we call ...
Read Article →Set additional clocks to Windows 10 using Intune
Check out this article via web browser: Set additional clocks to Windows 10 using Intune When you work for an international company, or you have to...
Read Article →The Differences Between (and History of) the Microsoft 365 Security Centre, Compliance Centre, and Security & Compliance
There are currently three separate admin consoles in Microsoft 365 for administrators to view or configure security and compliance policies, alerts...
Read Article →Microsoft Secure Score Series – 09 – Do not allow users to grant consent to unmanaged applications
Check out this article via web browser: Microsoft Secure Score Series – 09 – Do not allow users to grant consent to unmanaged applications Tighten ...
Read Article →Announcing #WMUG_NL Tuesdays Webinar 6 featuring Bob Cornelissen
Due to the COVID-19 crisis, we (the Windows Management User Group Netherlands) were forced to move our activities to virtual events, which we call ...
Read Article →Legacy Authentication; Zo blokkeer je Legacy Authentication voordat Microsoft het voor je doet
Microsoft heeft laten weten dat het Legacy Authentication protocol in de 2e helft van 2021 geblokkeerd zal worden. Om de security te verbeteren is ...
Read Article →Hybrid Azure AD Join + Intune Enrollment – Prerequisites Checklist and Process Flow
I’m a simple person, and sometimes it just helps to have a checklist to refer to when you’re troubleshooting rather than navigating the...
Read Article →May 2020 update of the Conditional Access Demystified Whitepaper, Workflow cheat sheet, Implementation workflow and Documentation spreadsheet
In August last year, I published eight articles in a series on Conditional Access, and later when finished I decided to bundle those articles in a ...
Read Article →Install Windows Package Manager (winget) using Intune
Check out this article via web browser: Install Windows Package Manager (winget) using Intune Microsoft released a preview of the Windows Package M...
Read Article →Announcing #WMUG_NL Tuesdays Webinar 5 featuring Alexander Benoit
Due to the COVID-19 crisis, we (the Windows Management User Group Netherlands) were forced to move our activities to virtual events, which we call ...
Read Article →Some welcome additions to the Admin consent workflow in Azure AD
Update October 7 2020: This functionality is now GA, see Publisher verification and app consent policies are now generally available In February th...
Read Article →Sure, keep me signed in! And don’t prompt for MFA!
Check out this article via web browser: Sure, keep me signed in! And don’t prompt for MFA! Today a short blog about MFA prompts, session life...
Read Article →Microsoft 365 Updates from Build 2020
Build 2020 had some nice bits of M365 related news. Microsoft deserves commendation for sticking to the schedule and pulling this off (remotely) du...
Read Article →5 Manieren om Azure Active Directory accounts veiliger te maken
De cloud is trending en steeds meer applicaties en diensten zijn afhankelijk van de cloud. Een cloud omgeving geeft vele voordelen maar geeft ook e...
Read Article →Aanmelden zonder wachtwoord via Phone sign-in: Zo gebruik je het!
Een wachtwoord is als je er over nadenkt best lastig, en je vergeet hem vast wel eens. Ook heeft een gebruiker tegenwoordig meerdere accounts – en ...
Read Article →Android Enterprise fully managed beschikbaar in Microsoft Intune voor zakelijke omgevingen
Microsoft heeft vandaag laten weten dat de Intune support voor “Android Enterprise fully managed devices” nu volledig beschikbaar is. Hiermee is he...
Read Article →Azure Active Directory Password Protection; hoe werkt deze extra beveiliging?
Azure AD Password Protection is een functionaliteit welke de mogelijkheid geeft om het wachtwoordbeleid te versterken op basis van informatie welke...
Read Article →Azure AD aanmelden via een FIDO2 Security Key; zo werkt het!
Een wachtwoord is als je er over nadenkt best lastig, en je vergeet hem vast wel eens. Ook heeft een gebruiker tegenwoordig meerdere accounts – en ...
Read Article →Azure AD Sign-In Risk Policy: Zo werkt deze functionaliteit
De Azure AD beveiligen is tegenwoordig van groot belang. Vanuit de Microsoft Secure Score krijg je een aantal adviezen op basis van de kennis bij M...
Read Article →Azure Sentinel: Wat kan je met de nieuwe security oplossing van Microsoft?
Azure Sentinel is een van de nieuwste security producten van Microsoft. Maar wat is nu precies het doel van Azure Sentinel binnen de Microsoft omge...
Read Article →Completed the Microsoft 365 Certified Enterprise Administrator Expert Certification
Yesterday I completed the last exam in order to earn the Microsoft 365 Certified Enterprise Administrator Expert certification. Microsoft 365 Enter...
Read Article →Intune 2005: Aanpassen van Self service acties in Company Portal
Een verzoek hoog op de wensenlijst van vele beheerders. De mogelijkheid om de self-service acties te wijzigen in de Company Portal. In de praktijk ...
Read Article →Password-less werken: Is het de toekomst via Yubikey, Windows Hello en Authenticator?
Wachtwoorden zijn momenteel nog de meest gebruikte mogelijkheid voor het inloggen. Een groot deel van de online accounts bevat vooralsnog een wacht...
Read Article →Veilig werken met Teams en Office365, dit zijn quick wins vanuit Office365 en AzureAD
Teams is enorm populair, en is wereldwijd in een behoorlijke versnelling gekomen vanwege het vele thuiswerken. Microsoft Teams is een online samenw...
Read Article →Windows 10 co-management: Flexibel naar de cloud
Steeds meer bedrijven maken de overstap richting de cloud. Uiteraard zijn de cloud functionaliteiten enorm, toch zijn bedrijven terughoudend vanweg...
Read Article →Register Domain-Joined Computers as Devices – The Redundant and Broken Hybrid Azure AD Join GPO
The group policy object Register domain-joined computers as devices, or Automatically workplace join client computers in older templates, was previ...
Read Article →Going passwordless with the FEITIAN Fingerprint card
Check out this article via web browser: Going passwordless with the FEITIAN Fingerprint card A quick word upfront. I'm not a salesperson. I'm inter...
Read Article →Connect a Work or School Account – MDM vs. MAM in Self Enrolment
A Windows 10 user can self-enrol in MDM or MAM from Settings > Accounts > Access work or school > Connect. What happens next depends on...
Read Article →Windows Information Protection (WIP) App Protection Policies: Protected and Exempt; Denied and Allowed – What Do They Mean?
One of things that strikes me as vague in Windows Information Protection (WIP) policies in Intune is configuring targeted apps: what’s the ex...
Read Article →Announcing #WMUG_NL Tuesdays Webinar 4 featuring Wim Matthyssen
Due to the COVID-19 crisis, we (the Windows Management User Group Netherlands) were forced to move our activities to virtual events, which we call ...
Read Article →Use Graph API data in Power BI using Logic Apps
Check out this article via web browser: Use Graph API data in Power BI using Logic Apps Some things in the modern connected world seem so common th...
Read Article →Announcing #WMUG_NL Tuesdays Webinar 3 featuring Mirko Colemberg
Due to the COVID-19 crisis, we (the Windows Management User Group Netherlands) were forced to move our activities to virtual events, which we call ...
Read Article →Speaking at Workplace Ninja Virtual Edition 2020
I’m very proud to announce that I will be speaking at the Workplace Ninja Virtual Edition 2020 event. The Workplace Ninja Virtual Edition 202...
Read Article →What admins should know about the combined registration portal for Azure MFA and Self Service Password Reset
Check out this article via web browser: What admins should know about the combined registration portal for Azure MFA and Self Service Password Rese...
Read Article →Microsoft Secure Score Series – 08 – Use Cloud App Security to detect anomalous behavior
Check out this article via web browser: Microsoft Secure Score Series – 08 – Use Cloud App Security to detect anomalous behavior Cloud App Security...
Read Article →Announcing #WMUG_NL Tuesdays Webinar 2 featuring Michael van Horenbeeck
Due to the COVID-19 crisis, we (the Windows Management User Group Netherlands) were forced to move our activities to virtual events. We started thi...
Read Article →Office 365 Advanced Threat Protection (ATP) deep dive
Around 5 years ago (April 2015) Microsoft announced Exchange Online Advanced Threat Protection (ATP), which was renamed to Office 365 Advanced Thre...
Read Article →How to keep an eye on your Teams with Log Analytics and Azure Monitor?
Check out this article via web browser: How to keep an eye on your Teams with Log Analytics and Azure Monitor? In my previous blog post, I wrote ab...
Read Article →Activity policy templates for Teams in Microsoft Cloud App Security
Check out this article via web browser: Activity policy templates for Teams in Microsoft Cloud App Security The usage of Teams is massively increas...
Read Article →Announcing the #WMUG_NL Tuesday Webinars
Due to the current COVID-19 crisis, we were forced to postpone our in- person meetings for our Windows Management User Group Netherlands community....
Read Article →Manage Teams custom backgrounds using Intune
Check out this article via web browser: Manage Teams custom backgrounds using Intune Update! I got some feedback on this blog. Seems that if your u...
Read Article →Microsoft Secure Score Series – 07 – Turn on sign-in risk policy
Check out this article via web browser: Microsoft Secure Score Series – 07 – Turn on sign-in risk policy Turning on the sign-in risk policy ensures...
Read Article →Microsoft Secure Score Series – 06 – Enable policy to block legacy authentication
Check out this article via web browser: Microsoft Secure Score Series – 06 – Enable policy to block legacy authentication Today, most compromising ...
Read Article →Azure AD Identity Protection deep dive
One of the advantages of Microsoft having many customers using its services is that Microsoft can leverage data from those customers and apply some...
Read Article →Use Power Automate for your custom “dynamic” groups
Check out this article via web browser: Use Power Automate for your custom “dynamic” groups Azure AD Dynamic Groups Dynamic groups in A...
Read Article →Microsoft Secure Score Series – 05 – Enable self-service password reset
Check out this article via web browser: Microsoft Secure Score Series – 05 – Enable self-service password reset With self-service password reset in...
Read Article →Microsoft Secure Score Series – 04 – Ensure all users can complete multi-factor authentication for secure access
Check out this article via web browser: Microsoft Secure Score Series – 04 – Ensure all users can complete multi-factor authentication for secure a...
Read Article →Lessons learned while implementing Azure AD Privileged Identity Management (PIM)
Lessons learned while implementing Azure AD Privileged Identity Management (PIM) The post Lessons learned while implementing Azure AD Privileged Id...
Read Article →Microsoft Secure Score Series – 03 – Enable Password Hash Sync if hybrid
Check out this article via web browser: Microsoft Secure Score Series – 03 – Enable Password Hash Sync if hybrid Password hash synchronization is o...
Read Article →How to publish on-premises applications and protect them with MFA
Check out this article via web browser: How to publish on-premises applications and protect them with MFA Using Azure Application Proxy you can pub...
Read Article →Microsoft Secure Score Series – 02 – Require MFA for administrative roles
Check out this article via web browser: Microsoft Secure Score Series – 02 – Require MFA for administrative roles Require MFA for administrative ro...
Read Article →Announcing WMUG_NL Saturday, on March 28 2020
On Saturday March 28th, 2020 the Windows Management User Group Netherlands (WMUG_NL) will organize a full Saturday with Workshops. Together with Pe...
Read Article →Speaking at RDW Techday on April 1st 2020
On Wednesday April 1st, I have the opportunity to present at the RDW Techday. RDW Techday is a community event organized by the RDW, the goal is to...
Read Article →Microsoft Secure Score Series – 01 – What is Microsoft Secure Score?
Check out this article via web browser: Microsoft Secure Score Series – 01 – What is Microsoft Secure Score? What is Microsoft Secure S...
Read Article →License requirements for administering Microsoft 365 services
Microsoft licensing is tough and vague but something we must deal with while implementing our solutions. I’m also aware that some of the feat...
Read Article →Microsoft is going to disable basic/legacy authentication for Exchange Online. What does that actually mean and does that impact me?
Update: On September 23, 2021, the Exchange Team announced that effective October 1st, 2022 basic authentication, regardless of usage will be perma...
Read Article →Azure AD tenant branding; size does matter!
Check out this article via web browser: Azure AD tenant branding; size does matter! Earlier today, I read this article from Alex Simons about the c...
Read Article →A guide to implementing Applocker on your Modern Workplace
At our last Windows Management User Group Netherlands meeting, we had the honor to have Sami Laiho, one of the world’s leading professionals in the...
Read Article →Get started with web content filtering in MDATP
Check out this article via web browser: Get started with web content filtering in MDATP Update 7-7-2020: Microsoft anounced that you no longer need...
Read Article →Require trusted location for MFA and SSPR registration
Check out this article via web browser: Require trusted location for MFA and SSPR registration This article shows how you can block MFA and SSPR re...
Read Article →Windows Update for Business. “Just” a free cloud service.
Check out this article via web browser: Windows Update for Business. “Just” a free cloud service. Since the introduction of the “...
Read Article →Stopping automatic email forwarding in your Exchange Online environment in a controlled way
Working as a modern workplace consultant also means that sometimes you have to go deep into Exchange Online options in order to make sure that (sen...
Read Article →Secure your Azure Management portal
Check out this article via web browser: Secure your Azure Management portal Today a quick tip to secure your Azure Management Portal. By default, t...
Read Article →Challenges while managing administrative privileges on your Azure AD joined Windows 10 devices
By default, on Windows 10 devices which are Azure AD joined, the user performing the join is added to the Local Administrator group. Besides the us...
Read Article →Did you already modify your Azure AD consent defaults settings? Here is why you should
As you may know, it’s possible for your users to sign-in to SaaS based applications using their Azure AD account. By doing this, a Single Sig...
Read Article →Using Intune to Deploy the Azure Information Protection (AIP) Unified Labeling Client (Win32 MSI)
Unified labels refer to a movement whereby Azure Information Protection (AIP) labels are now being replaced by sensitivity labels. Sensitivity labe...
Read Article →Blocking access to Cloud apps by integrating Microsoft Cloud App Security with Microsoft Defender Advanced Threat Protection
Microsoft has quietly introduced the option to automatically block connections to unsanctioned cloud apps from the Microsoft Cloud App Security (MC...
Read Article →Microsoft deprecates Conditional Access baseline policies in favour of Security Defaults, here is what you need to know and do
Last week, Microsoft announced that the Azure AD conditional access baseline policies will not make it out of their current preview status. The fun...
Read Article →Deploy Microsoft Store Apps using Intune with Configuration Manager (SCCM) Co-Management (Fix ‘Not Applicable’ Status)
Intune provides an interface to easily deploy apps from the Microsoft Store to your registered users and devices, but even if you have SCCM (Config...
Read Article →Prerequisites and Planning for Centrally Deploying Office 365 Outlook Add-Ins
Deploying Outlook add-ins (“apps”) for your O365 tenant is an intuitive experience via AppSource. As a Global Administrator, click GET ...
Read Article →Implementing RBAC and Scoping in Microsoft Intune
When you create an Intune tenant within your environment, you execute the creation with an account which is Global Administrator within Azure Activ...
Read Article →Did you already enable DKIM and DMARC for your Office 365 domains?
When you host your email on the Exchange Online (EXO) platform part of Office365 you can implement several security measures to make sure that emai...
Read Article →Intune: Choosing whether to assign to User or Device Groups
One of the disadvantages of being an experienced consultant in IT is the fact that once in a while you need to re-learn. With re-learn I mean that ...
Read Article →Report-only mode, and some more handy reporting functionality for Conditional Access and Azure AD
During its annual Microsoft Ignite 2019 conference this week, Microsoft announced a new feature for Conditional Access called Report-Only mode in p...
Read Article →What are Guided Scenarios in Microsoft 365 Device Management/Intune?
While browsing the new Microsoft 365 Device Management portal I noticed the following option: “Guided scenarios (preview)”. From the Wh...
Read Article →iOS restore behaviour when re-enrolling devices with backup data into Intune
While implementing Intune at my customers I rarely encounter green field implementations where computers and mobile devices are newly delivered and...
Read Article →Extending Conditional Access to Microsoft Cloud App Security using Conditional Access App Control
In my blog article series on Conditional Access Demystied I mentioned that Conditional Access can be used to route sessions toward Microsoft Cloud ...
Read Article →What are Intune Policy Sets?
Starting with the Intune release from October 14th 2019, Microsoft made available a new functionality called “Policy Sets”. ...
Read Article →Litetouch deployment failed, Return Code = -2147467259 0x80004005 when installing Surface Pro 6 devices using MDT
TL;DR; – When reinstalling Windows on a Surface Pro 6 and it fails, make sure that you “temporarely” disable the ” Enable b...
Read Article →Manage MyAnalytics Weekly Insight Digest Emails and App Availability
Made available to more than just E5 licencees earlier this year, MyAnalytics will, by default, send users weekly emails regarding their work patter...
Read Article →Ask yourself if you still really need ADFS
In Q1 2017 Microsoft released the Pass Through Authentication (PTA) functionality as part of Azure AD connect. With the release of Azure Active Dir...
Read Article →Conditional Access demystified, part 8: Resources and further references
Now available: May 2020 update of the Conditional Access Demystified Whitepaper, Workflow cheat sheet, Implementation workflow and Documentation sp...
Read Article →Conditional Access demystified, part 6: Troubleshooting Conditional Access
Now available: May 2020 update of the Conditional Access Demystified Whitepaper, Workflow cheat sheet, Implementation workflow and Documentation sp...
Read Article →Conditional Access demystified, part 7: Modifying Conditional Access to suit your special needs
Now available: May 2020 update of the Conditional Access Demystified Whitepaper, Workflow cheat sheet, Implementation workflow and Documentation sp...
Read Article →Conditional Access demystified, part 4: Designing a Conditional Access strategy
Now available: May 2020 update of the Conditional Access Demystified Whitepaper, Workflow cheat sheet, Implementation workflow and Documentation sp...
Read Article →Conditional Access demystified, part 5: Implementing Conditional Access
Now available: May 2020 update of the Conditional Access Demystified Whitepaper, Workflow cheat sheet, Implementation workflow and Documentation sp...
Read Article →Conditional Access demystified, part 2: What is Conditional Access?
Now available: May 2020 update of the Conditional Access Demystified Whitepaper, Workflow cheat sheet, Implementation workflow and Documentation sp...
Read Article →Conditional Access demystified, part 3: How does Conditional Access work?
Now available: May 2020 update of the Conditional Access Demystified Whitepaper, Workflow cheat sheet, Implementation workflow and Documentation sp...
Read Article →Conditional Access demystified, part 1: Introduction
Now available: May 2020 update of the Conditional Access Demystified Whitepaper, Workflow cheat sheet, Implementation workflow and Documentation sp...
Read Article →Course: 20533C – Implementing Microsoft Azure Infrastructure Solutions–Study reference
While teaching the 20533C course to students I provide them with more information about the topics covered in the training. Perhaps they can help y...
Read Article →The new Self Service Portal for System Center 2012 R2 Service Manager and my experiences installing and using it so far – UPDATED
Update (December 11th 2015): Today Microsoft released a hotfix for the Self Service Portal, the hotfix (KB3124091) can be downloaded from Microsoft...
Read Article →Distributing content to Distribution points and Distribution point groups in ConfigMgr 2012
With the release of System Center 2012 Configuration Manager, Microsoft introduced the distribution point groups functionality. Distribution point ...
Read Article →Installing the Service Manager Self Service Portal (SSP) on Windows Server 2012 R2
When Microsoft released System Center 2012 R2 Service Manager in October 2013, I was quite suprised that the server the webparts for the Self Servi...
Read Article →SCSM 2012: Failed to execute Submit Operation, event id 26319
At a customer of mine a issue with Incident Requests in System Center 2012 R2 Service Manager was reported. Some users reported that they received ...
Read Article →Service Manager Related Links
The post Service Manager Related Links appeared first on Modern Workplace Blog.
Read Article →Next WMUG NL meeting announced with Kent Agerlund and Brian Mason
Last week we announced our next Windows Management User Group Netherlands meeting. On May the 22nd we have invited Enterprise Client Management MVP...
Read Article →Next WMUG NL Webinar announced with Johan Arwidmark
Last week we announced our next Windows Management User Group Netherlands Webinar. On May the 6th we have invited Enterprise Client Management MVPs...
Read Article →Implementing RBAC in System Center 2012 R2 Service Manager
This blogpost will detail my experiences and insights gained from implementing Role Based Access Control (RBAC) in a System Center 2012 R2 Service ...
Read Article →WMUG NL Meeting on subject Monitoring on the 12th of February
On Wednesday evening the 12th of February the Windows Management User Group Netherlands is organizing a new event. This time the subject throughout...
Read Article →Event: Dutch VMware User Group conference on March 6th
On the 6th of March, the Dutch VMware User Group, which is a subsidairy of the global VMware User Group organizes a conference in the Netherlands. ...
Read Article →Configuring Group Policies for your ConfigMgr Servers
Disclaimer: Please test and validate this in your test environment, don’t take the information i provide for granted. This article describes ...
Read Article →Some things to consider before installing the ConfigMgr database on a SQL cluster
Note: I’ve already posted this article a while ago, but since my ex-employer decided to whipe the whole website without asking me if I would ...
Read Article →System Center 2012 R2 Configuration Manager prerequisite overview on Windows Server 2012 R2
Before you can start installing System Center 2012 R2 Configuration Manager in your environment you have to install the servers with an OS and conf...
Read Article →The self signed certificate could not be created successfully error in the Create Site System Server Wizard
Today, a customer contacted me with a very strange issue while installing a new Site System Server in his System Center 2012 R2 Configuration Manag...
Read Article →Windows Management User Group Netherlands: Meeting on the 17th of September
On Tuesday evening the 17th of September the Windows Management User Group Netherlands organizes its 3rd meeting. The announcement, which is in Dut...
Read Article →How to create ConfigMgr 2012 boot images from scratch
Today, after installing a fresh System Center 2012 Configuration Manager Service Pack 1 environment, we experienced that the Boot images for both 3...
Read Article →Introducing the Windows Management User Group Netherlands (WMUG NL)
Text below is in Dutch, together with Bob Cornelissen, Marnix Wolf and Peter Daalmans we created a new User Group called the Windows Management Use...
Read Article →Role Based Access Control in ConfigMgr 2012: Part 1 – Introduction
One of the reasons to install multiple primary sites in a System Center Configuration Manager 2007 hierarchy often was due to the fact that Adminis...
Read Article →Role Based Access Control in ConfigMgr 2012: Part 2 Scenario
In the previous post I introduced Role Based Access Control in ConfigMgr 2012 as the new way to delegate administrative access to a ConfigMgr hiera...
Read Article →Role Based Access Control in ConfigMgr 2012: Part 3 Mapping OpCo roles to ConfigMgr roles
In the first part of this series I outlined what Microsoft changed in ConfigMgr 2012 in order to introduce Role Based Access Control. In the second...
Read Article →Role Based Access Control in ConfigMgr 2012: Part 4 Outcome
In the first part of this series I outlined what Microsoft changed in ConfigMgr 2012 in order to introduce Role Based Access Control. In the second...
Read Article →Techdays NL 2013: ConfigMgr 2012: Notes from the field
During Techdays, the annual event organized by Microsoft in the Netherlands, i had the honor of presenting a session together with Peter Daalmans, ...
Read Article →Beware when installing ConfigMgr SP1 when still using vSphere 4 or running other platforms not supporting Windows 8 – UPDATED
Update: Microsoft has released CU2 for Configuration Manager 2012 Service Pack 1, allowing you to use Boot images based on Windows 7 from the WAIK ...
Read Article →Best practices for Implementing drivers in ConfigMgr
One of the most time consuming tasks when working with OS Deployment in ConfigMgr is implementing the drivers needed to support different hardware ...
Read Article →How to add Branding to your OS Deployment in ConfigMgr 2012 – Part 3: Create Compliance Baseline
In part 1, I showed you how to enable the Branding to Reg steps, and where you could find the information in the registry. Part 2 showed you how yo...
Read Article →How to add Branding to your OS Deployment in ConfigMgr 2012 – Part 2: Modify OSDBranding
In part 1 of this series, I showed you how to enable the Branding to Reg steps, so that during a Task Sequence some information about the Task Sequ...
Read Article →