Search for Microsoft security blog posts written and shared by the community. Discover insights on Azure, Defender, Entra, Intune, Sentinel, and more.
Discover the latest insights, best practices, and security research related to Microsoft Azure cloud platform.
In this blog post, I’ll cover one of the more overlooked aspects of deploying Azure Arc-enabled SCVMM, which is hardeningContinue Reading
Read Article →Today I want to share something I’ve been working on for a while now - a Progressive Web App (PWA) version of my PowerShell-based tool, PIMActivati...
Read Article →In this blog post, you will learn why the ResourceMoveValidationFailed error occurs when attempting to move an Azure Arc-enabled SCVMMContinue Reading
Read Article →Let’s start with the following Security quote:Hackers don’t break in, they log inhighlighting that most breaches use valid credentials, stolen via ...
Read Article →In my series “Detect threats using *GraphActivityLogs” I covered a lot of the basics on how to use different methods to detect certain ...
Read Article →What’s up, everyone! You might have heard about a recent cyber incident where the attackers were reportedly successful in wiping a lot of man...
Read Article →Paul, Ian, and I just finished publishing the second edition of MDE In Depth, so to coincide, I’ve refreshed the comparison of MDE features a...
Read Article →Microsoft Entra Global Secure Access (GSA) enables secure access to Microsoft 365 services, internet resources, and private applications through a ...
Read Article →On 7 April 2026, Anthropic announced Claude Mythos Preview, a frontier model that can find and exploit software vulnerabilities [0-days] at a level...
Read Article →What’s up, everyone! You might have heard about a recent cyber incident where the attackers were reportedly successful in wiping a lot of man...
Read Article →What’s up, everyone! You might have heard about a recent cyber incident where the attackers were reportedly successful in wiping a lot of man...
Read Article →Agent Identity Blueprint | CredentialAn Agent Identity Blueprint uses client credentials to request access tokens via the T1/T2 authentication flow...
Read Article →Supported Agent Identity Blueprint Builder PlatformsAutonomous agents such as those built on Microsoft Foundry, Microsoft Agent 365, or Microsoft S...
Read Article →In this blog post, I tackle one of the often overlooked aspects of AVD on Azure Local, which is securityContinue Reading
Read Article →Last Updated on April 13, 2026 by Michael Morten Sonne Introduction The community is key – and I… The post HVTools – first Community re...
Read Article →Customers with Microsoft 365 E5 and E7 receive 400 Security Compute Units (SCUs) per month for every 1,000 paid user licenses, up to a maximum of 1...
Read Article →Emergencies happen every day. Most of the time, they happen to someone else. Until the day they happen to you - then what? We all know things can g...
Read Article →Microsoft Entra Backup and Recovery is a new backup and recovery capability for directory objects that is natively integrated into Microsoft Entra....
Read Article →If you don’t know who that is, you might already have a security risk⚠️Disclaimer the scope of this blog post are Microsoft Copilot Studio agents, ...
Read Article →My potentially 'realistic-ish' take on privileged access in Entra ID, Azure and Microsoft 365. Not perfect, not nothing, maybe just good enough to ...
Read Article →For ‘lazy’ people: TLDR at the end of this blog :-)My previous blog described the four-object model* of the Entra agent identity platform.Microsoft...
Read Article →Microsoft Entra Tenant Governance brings the GDAP delegation model to internal multitenant organizations — but is it the right choice over B2B? Thi...
Read Article →Intro During my latest engagements with different customers I frequently received the question why you still have to configure Azure permissions if...
Read Article →Have you ever felt that the native reporting options in the Microsoft Cloud are lacking? Well, you’re not alone - let’s talk about it. Visibility i...
Read Article →In my previous blog I explain different security misconfigurations in Microsoft Copilot Studio agents including⚠️risk and ✅mitigations.This blog co...
Read Article →While May 1st marks the GA of the Microsoft 365 E7 license, which includes the Agent 365 license (advanced Entra, Defender and Purview features for...
Read Article →In my blog post contribution for this year’s Azure Spring Clean, we’ll explore how to design and implement a taggingContinue Reading
Read Article →Last Updated on March 10, 2026 by Michael Morten Sonne I’m excited to announce HVTools – a powerful, free Windows… The ...
Read Article →Connecting external users to internal resources has traditionally been implemented using VPN. While this approach provides network connectivity, it...
Read Article →Security Dashboard for AIThe new Microsoft Security Dashboard for AI (Preview) provides an end-to-end inventory and security risk overview of the e...
Read Article →In this blog post, you will learn how to view your Azure Advisor Potential savings in EUR instead of USDContinue Reading
Read Article →Last Updated on February 15, 2026 by Michael Morten Sonne Introduction This blog post is related to a… The post Microsoft Artifact Signing Re...
Read Article →Until now, access to internal resources through Microsoft Entra Private Access was limited to managed devices that were either Microsoft Entra join...
Read Article →Intelligent Local Access (ILA) addresses a core limitation of Microsoft Entra Global Secure Access: ensuring that local network traffic is handled ...
Read Article →This post introduces the MicrosoftCloudWorkloadActivity KQL function and shows how to hunt token-based activity of workload identities across Micro...
Read Article →Last Updated on January 29, 2026 by Michael Morten Sonne Introduction I just want to share some news… The post Visual Studio Enterprise Partn...
Read Article →Cicada 3301 is one of the internet’s most mysterious puzzles. It appeared as a series of complex, global puzzle challenges posted anonymously onlin...
Read Article →Agent Identity Security controls …From a Security perspective it is recommended to provide Security Controls for AI Agents as if they where humans ...
Read Article →Disclaimer: all Agent Identity Security products are in Preview (subject to minor changes and in it’s early stage of development)In the previous bl...
Read Article →Linked Identities in Microsoft Defender unlock new opportunities for visibility and management of multiple accounts, including scenarios with separ...
Read Article →An article from 2018 uses the AzureAD and Exchange PowerShell modules to synchronize membership between a security and a Microsoft 365 group. The i...
Read Article →This blog series aims to demystify Microsoft Entra Agent Identity Security.An agent is an application that attempts to achieve a goal by understand...
Read Article →Check out this article via web browser: Access Azure Virtual Desktop and Windows 365 Cloud PC from non-managed devices Many organizations use Azure...
Read Article →In Microsoft Entra ID, user and guest access evolves incrementally over time, for example as a result of role changes, project assignments or tempo...
Read Article →In this blog post, you will learn how to use Azure Arc in combination with Azure Storage Mover to migrateContinue Reading
Read Article →In this blog post, you’ll learn how to create or update an Azure Arc AWS multicloud connector to enable S3Continue Reading
Read Article →What started as a single blog in 2023 is now becoming a yearly tradition. Each year, the KQL community expands with new repositories and queries. T...
Read Article →DarkLighthouse is a PowerShell module for discovering Azure Lighthouse delegations. Great for security assessments and understanding your multi-ten...
Read Article →In my Festive Tech Calendar contribution this year, I’ll show you how to manage AWS Virtual Machine instances with AzureContinue Reading
Read Article →In this blog post, you’ll learn how to use an Azure PowerShell script to list and export available Azure VMContinue Reading
Read Article →Last Updated on December 16, 2025 by Michael Morten Sonne Introduction I’m happy to announce the release of… The post SignToolGUI 2.1.0.0 Rel...
Read Article →Thanks to Soft Delete, a deleted policy in Microsoft Entra Conditional Access remains available for up to 30 days and can be fully restored during ...
Read Article →Last Updated on December 10, 2025 by Michael Morten Sonne Introduction Big news is on the horizon for… The post Global Secure Access – Guest ...
Read Article →Today I want to walk through how to configure Azure App Service Authentication when your App Service sits behind Azure Front Door and is accessed t...
Read Article →Ignite has brought us a lot of news about products improvement and I was happy to see how much there is incoming to Microsofts Security portfolio. ...
Read Article →Ignite has brought us a lot of news about product improvements and I was happy to see how much there is incoming to Microsoft’s Security portfolio....
Read Article →Ignite has brought us a lot of news about products improvement and I was happy to see how much there is incoming to Microsofts Security portfolio. ...
Read Article →When we talk about Microsoft 365 security, we are talking about two things: The latter can be used to achieve the former, as well as other (non-Mic...
Read Article →Last Updated on November 25, 2025 by Michael Morten Sonne Introduction As organizations increasingly adopt hybrid work models,… The post Glob...
Read Article →Learn how to detect when a Global Admin silently elevates their access across all Azure subscriptions using Entra ID, Log Analytics, Azure Monitor,...
Read Article →Last Updated on November 14, 2025 by Michael Morten Sonne Introduction Many organizations are tightening there security for… The post The Hid...
Read Article →Microsoft is redefining Windows 11 compliance with Microsoft Azure Attestation (MAA). They are doing so with some new evaluation settings, such as ...
Read Article →What’s up, everyone! In the upcoming mini-series I’d like to take you back to a presentation I delivered with Niklas Tinner at the Work...
Read Article →In many Microsoft Entra ID environments, the quality of user attributes remains an often underestimated factor in security and governance. WatchTra...
Read Article →This blog explains how Azure Bastion enables secure access to virtual machines without exposing public endpoints, leveraging hub-spoke architecture...
Read Article →Long time no see. I’ve been quite busy and it’s been hard to find time to explore new things. This time, my curiosity got the best of me as my coll...
Read Article →Long time no see. I’ve been quite busy and it’s been hard to find time to explore new things. This time, my curiosity got the best of me as my coll...
Read Article →We’ve covered what Authentication Contexts are, why they matter, and how they help us strengthen access and data security in Microsoft 365. Now it’...
Read Article →What’s up, everyone! Let’s assume that you are using Azure Virtual Desktop, a great solution to provide virtual desktops to your end us...
Read Article →In-depth exploration of why certain apps do not appear in the Conditional Access app picker in Microsoft Entra ID, the impact of public vs. confide...
Read Article →Learn how to connect to Microsoft Teams across tenants using a multi-tenant enterprise application and managed identities in Azure. The post How to...
Read Article →Seamless Single Sign-On (Seamless SSO) is an optional feature in Microsoft Entra Connect that enables domain-joined Windows devices on the internal...
Read Article →The November 2025 update for the Automating Microsoft 365 with PowerShell eBook is available online. Subscribers can download the new PDF and EPUB ...
Read Article →If you can't use managed identities, credential resources are a way to manage username and password credentials for Azure Automation runbooks. The ...
Read Article →Recently I posted a blog about Entra ID Application Registration secret management, in which I explained how to rotate Application Registration sec...
Read Article →Introduction When connecting Microsoft Sentinel to Defender XDR, there are a couple of changes happening in tables which you should be aware of. Ev...
Read Article →Microsoft Copilot Studio is a graphical, low-code/no‑code (LCNC) platform to build AI agents to support human tasks.Microsoft Copilot Studio — AI A...
Read Article →Application Registrations are an amazing feature within Entra ID, allowing you to deploy a non-personal identity for a wide array of different use-...
Read Article →What’s up, everyone! Did you know that Microsoft released External Identity in public preview for Azure Virtual Desktop and Windows 365? I...
Read Article →Azure Back to School s a fantastic community initiative founded by Dwayne Natwick and Derek Smith. As in previous years,Continue Reading
Read Article →This article describes the prerequisites and how to run cmdlets from the Teams PowerShell module in Azure Automation runbooks. We also consider whe...
Read Article →Starting with version 2.4.129.0, Microsoft Entra Connect Sync introduces a new admin audit logging feature that is enabled by default. This capabil...
Read Article →Registration of security information such as the Microsoft Authenticator app, FIDO2 security keys or OATH tokens is a critical component of modern ...
Read Article →A custom runtime environment is a way of defining a specific job execution environment for Azure Automation runbooks, including Microsoft Graph Pow...
Read Article →A brief history Seamless Single Sign On was first introduced in late 2016 and provided a way for users to authenticate to Entra ID (Azure AD at the...
Read Article →Last Updated on August 18, 2025 by Michael Morten Sonne Introduction Managing permissions for Managed Identities in Azure/Entra… The post Ent...
Read Article →Microsoft Sentinel’s data lake story is quietly powerful: you get fast, 90-day Analytics (Shortterm) for hunting and detections, plus scalable, ......
Read Article →In this blog post, you’ll learn how to use a dedicated Management Group to store any decommissioned Azure subscriptions inContinue Reading
Read Article →Discover how Microsoft Conditional Access protects your Microsoft 365, Entra, and Azure environments. Learn the essentials, explore real-world use ...
Read Article →The Connect-IPPSSession cmdlet is needed to connect to the Security and Compliance endpoint to update a Microsoft 365 retention policy. Unhappily, ...
Read Article →It may be tempting to click “Enable Macros” when you open a spreadsheet, but macros are executable programs. Without a ... Read more
Read Article →With the introduction of Application Based Authentication (ABA), Microsoft introduces modern authentication mechanisms to Microsoft Entra Connect. ...
Read Article →Getting annoyed or impatient when activating eligible roles in PIM — especially multiple roles at once? You’re not alone. Today, I’m...
Read Article →In this blog post, I’ll walk you through troubleshooting connectivity issues with the Azure Connected Machine agent and highlight someContinue Reading
Read Article →Learn how to update your Conditional Access policies to protect your environment in preparation for updates to the Azure DevOps service. The post I...
Read Article →Answering some common questions people might have - Data lake is here, rejoice. It also brings up a bunch of questions, like do I still need Micros...
Read Article →This blog post will show you how to use an Azure PowerShell script to register all required Azure Update ManagerContinue Reading
Read Article →Logic Apps allow organizations to easily automate processes, in the last blog the APIs to run KQL are discussed. This blog builds upon the knowledg...
Read Article →The time has come to write a blog about Entra ID Governance. There are a lot of cool functionalities that can help managing users and their permiss...
Read Article →What’s up, everyone! Welcome to my mini-series about Liquidware ProfileUnity and FlexApp. In this post we will take a look on how to package applic...
Read Article →Sometimes tenants need to copy group membership from one user to another. Often PowerShell is used, but with the demise of the Azure AD module you ...
Read Article →Workload identities in Microsoft Entra are non-human identities assigned to a software workload (e.g. application, service or script) to authentica...
Read Article →Introduction Microsoft announced on the 1st of July 2025 that the Microsoft Sentinel Azure Portal UI will be deprecated at the 1st of July 2026, an...
Read Article →In this blog post, I’ll walk you through removing the Azure Arc Connected Machine agent from a Windows machine and cleaning up all related folders,...
Read Article →Recent problems with Microsoft 365 PowerShell modules afflicted the ability of Azure Automation runbooks to execute cmdlets Microsoft Graph PowerSh...
Read Article →Last Updated on June 21, 2025 by Michael Morten Sonne Introduction I’m thrilled to announce the latest release… The post Introducing Az...
Read Article →On June 16, Microsoft announced European sovereign solutions, including a new offering called Microsoft 365 Local that has nothing to do with Micro...
Read Article →In this blog post, you’ll learn how to resolve the error that occurs when updating or creating dynamic scopes forContinue Reading
Read Article →In today’s blog, we’re diving into the world of hunting through APIs. In the blog, the advantages, limitations, and scopes of the Graph...
Read Article →What’s up, everyone! This week I will be taking a look at Console Connect. This feature is actually a collaboration between Nerdio and Zoho a...
Read Article →In this blog post, you’ll learn how to use an Azure PowerShell script to automatically register all the necessary AzureContinue Reading
Read Article →The prospect of agents running amok in Microsoft 365 tenants lessened a tad with the introduction of Entra Agent ID. Tenants will be able to manage...
Read Article →Managing external users is one of the most tedious—but also critical—challenges in a Microsoft Business Premium environment. With...
Read Article →I have been playing around with integrating AI into my favorite scripting tool: Powershell. This blog serves as a quick-guide ... Read more
Read Article →Last Updated on May 23, 2025 by Michael Morten Sonne Introduction Managing Azure Arc Connected Machine Agents just… The post Azure Arc – Intr...
Read Article →In this blog post, you’ll learn how to keep the Azure Connected Machine agent up-to-date on Azure Arc-enabled Windows servers,Continue Reading
Read Article →Last Updated on May 4, 2025 by Michael Morten Sonne Introduction 🧑💻 I’m excited to share that I’m… The post Time for a new lab envirom...
Read Article →Hi there! Welcome (back) to my blog series about building a connector using Microsoft’s Sentinel Codeless Connector Platform (CCP). In the previous...
Read Article →Managing new guest accounts can be a daunting task—especially when you’re dealing with high turnover, distributed teams, or unknown user...
Read Article →What’s up, everyone! Welcome to my mini-series about Liquidware ProfileUnity and FlexApp. Previously I have explored how to setup ProfileUnity and ...
Read Article →V2.26 and V2.26.1 of the Microsoft Graph PowerShell SDK were low-quality, buggy disasters. Microsoft aims to fix the problem in the next version to...
Read Article →Intro While reviewing Defender for Servers and AMA agent implementations across various customers, I noticed that not all of them are following bes...
Read Article →Last Updated on March 25, 2025 by Michael Morten Sonne Intoduction 🥳 Exciting News! Trusted Signing has launched… The post Microsoft Azure – ...
Read Article →Intro Microsoft recently announced that OAuth applications are now integrated into the attack path experience within Exposure Management. This...
Read Article →Hey there, glad to see you’re still with me on this journey! If this is your starting point, you might want to considered reading the previous part...
Read Article →Artificial intelligence (AI) tools and Large Language Models (LLM) behind those tools have become a talking point and for some, the new Google sear...
Read Article →Artificial intelligence (AI) tools and Large Language Models (LLM) behind those tools have become a talking point and for some, the new Google sear...
Read Article →Artificial intelligence (AI) tools and Large Language Models (LLM) behind those tools have become a talking point and for some, the new Google sear...
Read Article →Hey there, welcome back! In this blog series I’ll show you how you can make your own Sentinel Codeless Connector Platform (CCP) connector. If you h...
Read Article →Have you seen Azure environments with resources that have public access allowed or just some limitations to the IP addresses in place? Well, I have...
Read Article →Have you seen Azure environments with resources that have public access allowed or just some limitations to the IP addresses in place? Well, I have...
Read Article →Have you seen Azure environments with resources that have public access allowed or just some limitations to the IP addresses in place? Well, I have...
Read Article →In Part 02 , we explored authentication , the process of verifying user identities—ensuring users are who they claim to be. Today we’ll...
Read Article →As cloud computing becomes more integrated into our daily operations, the importance of securing identities in Azure can’t be overstated. Gone are ...
Read Article →Hey there! In this blog series I’ll be going to walk you through a step by step guide on how to build your own Codeless Connector Platform (CCP) da...
Read Article →Copyright © 2025 Microsoft Security - All Rights Reserved.
Read Article →Last Updated on March 17, 2025 by Michael Morten Sonne Introduction I’m thrilled to announce the latest release… The post Signtool GUI ...
Read Article →Outlook Newsletters are intended for internal communications, at least for the preview. It's possible to take the HTML for a newsletter and send it...
Read Article →The developers rushed out Version 2.26.1 of the Microsoft Graph PowerShell SDK to fix some obvious issues. Alas, problems persist in PowerShell SDK...
Read Article →In my last post I covered how to monitor the GOD Mode in Azure (Coined by the great John Savill ). While visibility and monitoring are...
Read Article →A look into how we can utilize Maester to secure our Azure Tenant with a sprinkle of AI on top - Welcome back! This time, I’m writing a contributio...
Read Article →A bunch of problems with V2.26 of the Microsoft Graph PowerShell SDK V2.26 make the software unusable. Not only did Microsoft do a horrible job of ...
Read Article →What’s up, everyone! Welcome to my second post in the mini-series about Liquidware ProfileUnity and FlexApp. In the first post we explored the worl...
Read Article →Intro Lately, I’ve been exploring Microsoft Exposure Management, particularly the data available in the Enterprise Exposure Graph. One intere...
Read Article →Elevating access to manage Azure subscriptions is a valuable tool for administrators, particularly when dealing with unknown or orphaned...
Read Article →Since August 2024 there has been a sophisticated phishing campaign actively leveraging the device code authorization flow. Currently, there is a wi...
Read Article →SharePoint Online is basically a big Azure SQL application. Custom columns for sites and libraries enhance metadata and are even better if they're ...
Read Article →In this primer, we cover how to create and execute Azure Automation Exchange Online runbooks (scripts) using cmdlets from the Exchange Online manag...
Read Article →Last Updated on February 6, 2025 by Michael Morten Sonne Introduction I’m beyond excited to announce that the… The post 🚀 Managed Ident...
Read Article →What’s up, everyone! Welcome to my first post in the mini-series about Liquidware ProfileUnity and FlexApp. In this post I will explore the w...
Read Article →Last Updated on January 31, 2025 by Michael Morten Sonne Introduction During my time in IT, I’ve occasionally… The post Microsoft Azure – Ele...
Read Article →What’s up, everyone! Are you using Nerdio Manager to manage your AVD environment or Intune? If so, you probably want to think of ways to make...
Read Article →This article covers how to use HVE with Azure Automation to send email. HVE is Exchange Online's High Volume Email solution for internal communicat...
Read Article →This article describes how to use Azure Automation for audit searches. The runbook runs an audit search to find events for specific operations, ref...
Read Article →Today kicks off a comprehensive blog series where I’ll delve into the security features of the Business Premium license SKU, offering...
Read Article →This solution provides automation that ensures all available auditable events are enabled for all users in a tenant. By default, not all events are...
Read Article →Last Updated on January 24, 2025 by Michael Morten Sonne Introduction I´m thrilled to announce the release of… The post Managed Identity Perm...
Read Article →After creating a runbook to process Microsoft 365 data, registering the runbook with an automation schedule means that the runbook will execute on ...
Read Article →The second part of the Azure Automation runbook primer brings us to output, specifically how to create items generated by a runbook in a SharePoint...
Read Article →A reader asked why it seems so difficult to use Azure Automation runbooks to process Microsoft 365 data. In fact, it's not so hard, and here's a pr...
Read Article →Managing emails for unlicensed admin accounts? Juggling a shared mailbox flooded with notifications from services and clients? Today’s...
Read Article →After many twists and turns since August 2021, the MSOnline module retirement will happen in April 2025. The AzureAD module will then retire in the...
Read Article →What’s up, everyone! Join me in this weeks post where I dive into the different networking options that Windows 365 has to offer. Currently W...
Read Article →Introduction During my time as SOC Engineer, I do a lot of third-party data source ingestion projects for clients into their Microsoft Sentinel ins...
Read Article →As the season for audits approaches (though, let’s be honest, auditing should be an all-year-round endeavor), I’m excited to share a...
Read Article →What started as a single blog is now becoming a yearly trend. More and more KQL related repositories are created, not only with a focus on security...
Read Article →Learn how to use Managed Identities for multi-tenant app authentication when using Microsoft Graph PowerShell in Azure Automation. The post How to ...
Read Article →At MC2MC Live: Forward to the past I was able to give a session on how to manage Azure Bicep templates at scale and automatically. Very happy to ha...
Read Article →Over the past couple of weeks I’ve been working in close collaboration with the Netskope team to build and design a new Sentinel data connector for...
Read Article →From global tensions on nation-state level to cybercriminals and script-kiddies, cybersecurity for OT (Operational Technology) becomes more and mor...
Read Article →What’s up, everyone! Since we have arrived in the age of AI, it was only a matter of time before I would write a post about Copilots or anoth...
Read Article →The unified audit log is a centralized repository for M365 user and admin activities. The activities originate from different applications, such as...
Read Article →What’s up, everyone! This one is for my Nerdio friends! Nerdio is, amongst other things, well known for their amazing auto-scale feature. Thi...
Read Article →Introduction In the past couple of weeks, I worked on a project where I needed to provide access to a securely private integrated Azure Storage Acc...
Read Article →Last Updated on November 2, 2024 by Michael Morten Sonne Introduction I’m thrilled to announce the latest release… The post Managed Ide...
Read Article →Last Updated on January 21, 2025 by Michael Morten Sonne Introduction I’m thrilled to announce the latest release… The post Introducing...
Read Article →IntroductionMicrosoft Sentinel offers a lot of features, one being the ability to manage your analytic rules (detection rules) as infrastructure as...
Read Article →Explore advanced design patterns for implementing Conditional Access policies in Microsoft Entra ID as part of a Zero Trust security strategy. Cove...
Read Article →Last Updated on October 25, 2024 by Michael Morten Sonne Introduction Introducing a new PowerShell tool for Managing… The post Managed Identi...
Read Article →Best practices for securing workload identities including service principals and managed identities in Microsoft Entra ID. Discusses credential man...
Read Article →A recent question asked how to force users to reauthenticate at 7AM every Monday. The solution seems to revoke access for user accounts. This artic...
Read Article →Deep dive into Microsoft Entra Privileged Identity Management (PIM) covering just-in-time access, approval workflows, access reviews, and integrati...
Read Article →Detailed analysis of Azure Role-Based Access Control (RBAC) security considerations, including custom role design, least privilege principles, scop...
Read Article →This is an update to a previous article I wrote on hardening Azure Active Directory. The idea of this update is to provide a table of default setti...
Read Article →What’s up, everyone! Nerdio has released Nerdio Manager for Enterprise 6.4 and it’s packed with lots of great features! In this post I&...
Read Article →At a recent community event, I presented a deep dive into various authentication flows in Entra Id, showcasing how to retrieve an ARC server from a...
Read Article →Last Updated on June 21, 2025 by Michael Morten Sonne Introduction I’m thrilled to announce the latest release… The post Introducing Az...
Read Article →Recently, I was challenged to build a scalable, cloud native solution that should be used for monitoring of critical Windows ... Read more
Read Article →Today, we use logging for many purposes including security hunting with SIEM (Sentinel), troubleshooting, performance telemetry, compliance reporti...
Read Article →As I have outlined in the series of blogs, Azure Logging is based on Data Collection Rules (DCRs) and Azure ... Read more
Read Article →Previously the File Integrity Monitoring (FIM) feature in Defender for Server P2 was based on the MMA and/or Azure Monitor Agent. Since the MMA age...
Read Article →There are many different ways of getting your security data into Microsoft Sentinel: You can use agent based software, play around with Diagnostic ...
Read Article →Struggling to get internet access from a newly deployed VM in Azure on a new subnet, then check if VM ... Read more
Read Article →You may have noticed that Microsoft will enforce MFA requirement per October 15, 2024 for Azure/Entra/Intune. If this is new ... Read more
Read Article →Microsoft's project to impose a mandatory MFA requirement for access to Azure management tools and sites will start enforcement on or after October...
Read Article →Check out this article via web browser: All you need to know about the mandatory multifactor authentication for Azure and other administration port...
Read Article →HVE and ECS are two competing Microsoft Cloud Email Services. At least, they seem to compete. In reality, HVE and ECS serve different target audien...
Read Article →Copyright © 2025 Microsoft Security - All Rights Reserved.
Read Article →Last Updated on September 24, 2024 by Michael Morten Sonne Introduction I’m thrilled to announce the latest release… The post Introduci...
Read Article →In this article, I would like to point out options to identify, monitor and avoid persistent access on Managed Identities privileges by adding fede...
Read Article →What’s up, everyone! This week I’ve had a lot of fun with nothing less then a thin client running Windows 11 IoT Enterprise LTSC from m...
Read Article →From X/Twitter. Thx to @r3srch3r for summarization. Physical machine physical server VM on Hyper-V VM on AWS VM on Azure ... Read more
Read Article →Disclaimer there is no change for existing Microsoft Defender for IoT (Azure) deployments.OT (Operational Technology) is (often old) technology (ha...
Read Article →Last Updated on January 21, 2025 by Michael Morten Sonne Introduction If you’re encountering this error message in… The post Azure Arc ...
Read Article →Microsoft says they will remove the Remove-SPOExternalUser cmdlet starting July 29. They recommend using Remove-AzureADUser as a replacement. It's ...
Read Article →Last Updated on July 10, 2024 by Michael Morten Sonne Intoduction I’m thrilled to announce the latest release… The post Introducing Azu...
Read Article →Around 5 years ago, Microsoft announced the general availability of Azure Sentinel. This post aims to assess how far we along we have come - the go...
Read Article →Learn how to assess how the impact of MFA enforcement on Azure service will impact your users. The post How to assess the impact of MFA enforcement...
Read Article →If you need to get an Azure Monitor alert using Azure Resource Graph data, this can easily be accomplished using ... Read more
Read Article →On May 14, Microsoft announced that they will require Azure MFA for connections to services starting in July 2024. No details about the implementat...
Read Article →Last Updated on May 2, 2024 by Michael Morten Sonne Intoduction Resetting Microsoft Defender for Cloud Configuration Are… The post Defender f...
Read Article →The Microsoft FY24 Q3 results didn't contain any new user numbers for Office 365 or Teams. However, we did learn that Copilot and Azure are popular...
Read Article →How to add a managed identity to Azure DevOps and get access tokens for Azure Devops - This one is very short and sweet - how to authenticate to Az...
Read Article →Everything you need to know to download Azure DevOps repositories using a Managed Identity and REST API - In this post, we will go over how to down...
Read Article →Last Updated on July 10, 2024 by Michael Morten Sonne Intoduction I’m thrilled to announce the latest release… The post Introducing Azu...
Read Article →Configure an automation Microsoft 365 Security Poster Monitoring solution using the Maester tool using Azure Automation. The post Automated Microso...
Read Article →A recent note from Microsoft advised that if your tenant uses classic Azure administrative role, you need to switch to Azure RBAC roles by 31 Augus...
Read Article →Critical features will break or stop working, if you delete too much in Legacy solutions like SecurityInsights, SQLAdvancedThreatProtection or SQLV...
Read Article →Last Updated on March 23, 2024 by Michael Morten Sonne Intoduction Are you tired of spending valuable time… The post Azure – Automating Manag...
Read Article →What’s up, everyone! You probably know that it’s possible to disable clipboard redirection when connecting to a Cloud PC. When configur...
Read Article →Microsoft 365 Backup costs are charged on a PAYG basis against an Azure subscription. You pay a flat fee of $0.15 per month per gigabyte of protect...
Read Article →Did you ever run into an issue in which the user was still in the local administrator group after the device was enrolled with Windows Autopilot (a...
Read Article →Device Code Flow is a great feature. You are signed in on a machine that does not have any UI but need to connect to an Azure or Microsoft 365 reso...
Read Article →Today (Tuesday February 27th) I have the pleasure to speak at the February 2024 Azure APE Meetup organized by the Azure Platform Engineering (APE) ...
Read Article →Finally, it’s time for a refresh. It’s been a while! Due to personal circumstances, I haven’t been able to keep the U...
Read Article →Explore storing Microsoft Entra logs via Azure Monitor, Storage Accounts, and Event Hubs, each offering unique benefits for IT security.
Read Article →Learn how to Connect to Microsoft Graph PowerShell using certificate based authentication in Microsoft Entra. The post Connect to Microsoft Graph P...
Read Article →BOOK ANNOUNCEMENT! ??? We are beyond excited to announce our first book; Securing Cloud PCs and Azure Virtual Desktop! This book aims to assist any...
Read Article →In the recent parts of the blog post series, we have gone through the various capabilities to detect threats and fine-tune incident enrichment of W...
Read Article →Introduction Adversaries are more and more interested in the data and infrastructure that lives in Cloud environments like Azure and Microsoft 365 ...
Read Article →Collecting details of all workload identities in Microsoft Entra ID allows to build correlation and provide enrichment data for Security Operation ...
Read Article →On July 11th, Microsoft announced that Azure AD would be renamed to Microsoft Entra ID. Microsoft also announced two new security offerings called ...
Read Article →Attack techniques has shown that service principals will be used for initial and persistent access to create a backdoor in Microsoft Entra ID. This...
Read Article →Entra ID’s P2 license (previously Azure AD Premium P2) unlocks the Privileged Identity Management (PIM). PIM is part of broader identity gove...
Read Article →Learn how to protect your Microsoft 365 Break Glass accounts and never get locked out of your organisations tenant with Azure Automation. The post ...
Read Article →Error Connect-AzAccount : Method not found: ‘System.Threading.Tasks.Task`1 Azure.Identity.InteractiveBrowserCredential.AuthenticateAsync(Azur...
Read Article →IntroductionHello there, welcome back to part 4 of my Sentinel & SOAR series! If you’re new to this series you might want to check out any earl...
Read Article →This blog will be about my first and second encounters with Microsoft Azure Attestation(MAA) and how this new kind of attestation will be dropped d...
Read Article →Last year Microsoft announced a new feature called; Automatic attack disruption which uses correlated insights from the Microsoft 365 ecosystem and...
Read Article →What’s up, everyone! In my previous post I had some fun with scaling plans in Azure Virtual Desktop. Using scaling plans admins can configure...
Read Article →Workload identities should be covered by lifecycle management and processes to avoid identity risks such as over-privileged permissions but also in...
Read Article →What’s up, everyone! This week I had a look at scaling plans for Azure Virtual Desktop. Until recently we only had the ability to use Autosca...
Read Article →Cause Old version of Az.Accounts v2.9.1 was being installed on the computer as part of Az.Portal installation, even though newer ... Read more
Read Article →This blog will give you insight on how to setup collection of DNS Events from Windows devices using Azure Monitor ... Read more
Read Article →Learn how to turn off directory synchronisation (Azure AD Connect) using Microsoft Graph PowerShell to disable on-premise synchronisation. The post...
Read Article →What’s up, everyone! Last week I’ve noticed that watermarking went into general availability and that gave me the idea to dedicate a po...
Read Article →Workload identities will be used by applications, services or cloud resources for authentication and accessing other services and resources. Especi...
Read Article →After upgrading Microsoft Graph, I noticed an issue when trying to run cmdlet Get-MgGroup or Get-MgUser. I could connect to ... Read more
Read Article →This blog will show you how you can automate an overview using Kusto queries against Azure Resource Graph (ARG) to ... Read more
Read Article →This time, a simple blog about a BitLocker escrow error (0x80072f8f )that started happening (all of a sudden) on multiple devices when you were try...
Read Article →What’s up, everyone! If you are using Azure Virtual Desktop then you probably have a ritual in place that helps you update and manage your im...
Read Article →Last Updated on September 24, 2024 by Michael Morten Sonne This may be split up in 2 parts..… The post How is it now you get a refund for Mic...
Read Article →What’s up, everyone! In this post I’ll checkout the possibility to move a Cloud PC to a different Azure region. This feature has been i...
Read Article →Learn how to monitor for application admin permission consents in Azure AD using PowerShell and Azure Automation. The post How to Monitor for Appli...
Read Article →Defender for Storage is the Azure-native layer of security intelligence that detects potentially harmful attempts to access or malicious activity. ...
Read Article →Last Updated on June 2, 2025 by Michael Morten Sonne Intoduction Frist – sorry for the size og… The post Azure AD – Why use Cloud-Only ...
Read Article →Last Updated on June 25, 2023 by Michael Morten Sonne How secure your Azure Management Portal?. By default,… The post Secure your Azure Manag...
Read Article →What’s up, everyone! Last week I wrote an introduction into Unified Application Management which has been introduced in Nerdio Manager for En...
Read Article →Check out this article via web browser: Company branding and custom CSS in Azure Active Directory Company branding in Azure AD is a nice feature th...
Read Article →In the today’s digital age and use all over the world, maintaining the security of an organization has… The post Azure AD Application Activit...
Read Article →Using Azure Automation Accounts to send scheduled emails, ditch those scheduled tasks and insecure scripts!
Read Article →Last Updated on March 14, 2024 by Michael Morten Sonne Customer Lockbox is a security feature in Microsoft… The post What is Customer lockbox...
Read Article →What’s up, everyone! Nerdio Manager for Enterprise v5 was a big release with great new features which shows that Nerdio Manager can do a lot ...
Read Article →Check out my latest 2 videos, which will cover both migration scenarios using my AzLogDcrIngestPS PS-module: Side-by-Side Migration (new table, ......
Read Article →Restricted Management Administrative Unit (RMAU) allows to protect objects from modification by Azure AD role members on directory-level scope. Man...
Read Article →Check out this article via web browser: Step-up authentication with Defender for Cloud Apps and Authentication Context In this post, I will show yo...
Read Article →Intro Up until now, onboarding non-Azure servers to Defender for Servers required Azure Arc as a mandatory pre-requisite. With this new release, Mi...
Read Article →Previously, onboarding hybrid servers to Defender for Servers with MDE required Azure Arc as a pre-requisite for the deployment. Since the standalo...
Read Article →What’s up, everyone! Nerdio released some great new feature with the release of Nerdio Manager for Enterprise v5.0! One of those featur...
Read Article →Check out this article via web browser: Send an email on a new Azure MFA method registration I’ve done quite some Azure MFA projects over tim...
Read Article →Check out this article via web browser: Microsoft icons That’s the post for today. Just a bunch of sources with icons from Microsoft 365, Azu...
Read Article →Last Updated on June 19, 2023 by Michael Morten Sonne Intoduction What is Azure DevOps Azure DevOps is… The post Azure DevOps – Use Azure Key...
Read Article →Last Updated on June 19, 2023 by Michael Morten Sonne Intoduction Seperate accounts in Azure AD for Administrative… The post Azure AD Admin a...
Read Article →Last Updated on February 18, 2024 by Michael Morten Sonne Introduction This tool offers a user-friendly interface and… The post Azure DevOps ...
Read Article →What’s up, everyone! I’ve written a post on how to create a custom image for Azure Virtual Desktop in the past but I never went into an...
Read Article →Intro This blog will be about an issue I bumped into when deploying one of the enhanced protection features in defender for cloud. The enhanced fea...
Read Article →Check out this article via web browser: Report Suspicious Activity & Fraud Alert for Azure MFA A new feature popped up in Azure AD. Well, not ...
Read Article →Note This article was last updated on 01/30/2025 for readability and updated URLs. We no longer need to manually load modules as shown, and this ar...
Read Article →Last Updated on July 9, 2023 by Michael Morten Sonne Secure your Azure environment with the power of… The post Securing your Azure/Microsoft ...
Read Article →Why is this needed? Admins who are using Azure AD Connect are currently receiving email notifications when there… The post Configure Azure AD...
Read Article →If you are sending data using HTTP Data Collector API (REST) today, you should continue reading, as this API will ... Read more
Read Article →If you are sending data using HTTP Data Collector API (REST) today, you should continue reading, as this API will ... Read more
Read Article →Deploy Microsoft Teams to Azure Virtual Desktop using Intune.
Read Article →If you are sending data using HTTP Data Collector API (REST) today, you should continue reading, as this API will ... Read more
Read Article →Are you in control? – or are some of your core infrastructure processes like patching, antivirus, bitlocker enablement driftin...
Read Article →This blog will give you insight on how to setup collection of syslogs (CEF) using Linux forwader server using Azure ... Read more
Read Article →This blog will give you insight on how to setup collection of IIS logs from Windows devices using Azure Monitor ... Read more
Read Article →This blog will give you insight on how to setup collection of Performance and ServiceMap information from Linux and Windows ... Read more
Read Article →This blog will give you insight on how to setup collection of Security Events (eventlog) from Windows devices using Azure ... Read more
Read Article →This blog will give you insight on how to setup collection of syslogs using Linux forwader server using Azure Monitor ... Read more
Read Article →This blog will give you insight on how to setup collection of System & Application Events (eventlog) from Windows devices ... Read more
Read Article →This blog will give you insight on how to setup collection of text logs from Linux and Windows devices using ... Read more
Read Article →This blog will demonstrate how you can do workspace transformation to support legacy data transformation where data is being uploaded ... Read more
Read Article →I am really passioned about the logging capabilities in M365 Defender and Azure with the power to bring data back from cli...
Read Article →This section will show you the steps for setting up data transformations – and how you can do the transformation ... Read more
Read Article →Azure Data Collection Endpoint (DCE) provide a connection for certain data sources of Azure Monitor. This article gives you an ... Read more
Read Article →Azure includes lots of great technologies, which can be used for logging purpose. Currently, Microsoft is transitioning from v1-method (MMA) ... Re...
Read Article →This blog will take you “under the hood” of extensions, Azure Monitor Agent (AMA) and Azure Data Collection Rules for ... Read more
Read Article →Note This article was last updated on 01/30/2025 for readability and updated URLs
Read Article →Note This article was last updated on 01/30/2025 for readability and updated URLs
Read Article →Intro This post is inspired on different setups I saw while working with my clients. More and more clients are leveraging the Azure Monitoring Agen...
Read Article →What’s up, everyone! In my last blog I wrote about the ability to create your own restore points. But did you know you can also copy that res...
Read Article →Check out this article via web browser: Authenticator Lite – Approve Azure MFA prompts with the Outlook app Microsoft released a new feature ...
Read Article →Note This article was last updated on 01/30/2025 for readability and updated URLs
Read Article →What’s up, everyone! Chances are that you are already familiar with Nerdio’s Cost Estimator which is a great tool to plan for an AVD de...
Read Article →Check out this article via web browser: System-preferred multifactor authentication in Azure AD. Don’t settle for less. A new feature has pop...
Read Article →Microsoft has extended the capabilities of Azure AD authentication context to Azure AD Privileged Identity Management (PIM). By doing this we can t...
Read Article →Check out this article via web browser: Duplicate Azure Active Directory Conditional Access policies In this post, we look at managing Conditional ...
Read Article →Microsoft Defender for Endpoint (MDE) is a massive stack of endpoint protection and endpoint detection and response (EDR) capabilities. It integrat...
Read Article →Note This article was last updated on 01/30/2025 for readability and updated URLs
Read Article →The Importance Of Identity In Microsoft Certifications As I’ve taken Microsoft certification exams, or the exam renewals, I’ve noticed that Azure A...
Read Article →Don't Let DNS Be Your Azure AD Recovery Downfall In September of 2022, Joey Verlinden (@jvldn1) published an excellent article on his experience wi...
Read Article →This blog covers 2 topics : (1) how you can automate clean-up of any orphaned security principal role assignments – ... Read more
Read Article →Cross tenant sync is a feature I've been waiting to see for a while and with the announcement of cross tenant access settings, I knew it...
Read Article →Background Recently, I was asked to build a simple reporting-script, which integrates data from Microsoft Defender for Cloud and Azure ... Read more
Read Article →What’s up, everyone! Last week I wrote a post on how to set up a Kiosk based on Windows 10. You can login using your Azure AD credentials and...
Read Article →Azure AD 101: Azure Subscription Relationship Whether you are dipping your toe or diving headfirst into Azure, one of the points of confusion is th...
Read Article →Note This article was last updated on 01/27/2025 for readability and updated URLs, and the content itself will be updated in the near future :)
Read Article →Introduction Hosting a blog these days can easily be done without having to cost anything. There are a lot of solutions in the likes of Medium, Wee...
Read Article →What’s up, everyone! Last year I wrote a post on how to use Intune to set up a kiosk mode on Windows 10 or Windows 11 machines. I thoug...
Read Article →What’s up, everyone! Usually when I write on my blog I stick to the technology and try to keep my own opinion out of the article, but I think IR...
Read Article →What’s up, everyone! This post is for Nerdio friends! I love the scripted actions feature that Nerdio Manager has. And the legends of Nerdio ...
Read Article →This blog is about keeping long-term Sentinel logs, giving you insight to the options today – with great opportunities to ... Read more
Read Article →Do you want to automate alert rules including creating new alert rules and update existing – with checks every x ... Read more
Read Article →What’s up, everyone! So, did you hear about Rimo3 yet? Lately I’ve been hearing a lot about about Rimo3, especially since they have tea...
Read Article →This is a real-life example of how I helped reduce the log-cost by 43% for LogAnalytics & Sentinel combined for ... Read more
Read Article →Have you ever had a need to collect vital configuration status (inventory) from thousands of servers – with a defined ... Read more
Read Article →Microsoft’s Defender Vulnerability Management is a built-in module in Microsoft Defender for Endpoint that can: If you’ve enabled ...
Read Article →Recently I was asked to provide a solution to detect file deletions on a file server in a sensitive folder ... Read more
Read Article →One of the cool features in Azure LogAnalytics is the capability to do data-transformation before the data enters your LogAnalytics ... Read more
Read Article →Check out this article via web browser: Break glass accounts and Azure AD Security Defaults Security Defaults is the best thing since sliced bread....
Read Article →What’s up, everyone! Did you know that using the Cloud PC just became more easy? Microsoft just announced a couple of early Christmas gifts a...
Read Article →Conditional Access and Entitlement Management plays an essential role to apply Zero Trust principles of “Verify explicitly“ and “Use least-privileg...
Read Article →SpAML: Spoofing Users In Azure AD With SAML Claims Transformations For those that believe SAML is dead, they should take a look at the Azure AD App...
Read Article →In the last couple of months, Microsoft released new functionality for Azure AD Conditional Access. All of this functionality is still in public pr...
Read Article →In the last couple of months, Microsoft released new functionality for Azure AD Conditional Access. All of this functionality is still in public pr...
Read Article →In the last couple of months, Microsoft released new functionality for Azure AD Conditional Access. All of this functionality is still in public pr...
Read Article →Microsoft has been released a feature to automate on- and off-boarding tasks for Azure AD accounts. Lifecycle workflows offers built-in workflow te...
Read Article →Check out this article via web browser: Synchronize attributes for Lifecycle workflows – Azure AD Connect Sync Azure AD Lifecycle Workflows c...
Read Article →What’s up, everyone! In this post I’ll take a look at MultiMedia Redirection, or MMR from now on. This feature is still in preview and ...
Read Article →CISA SCuBA: Diving Into The Azure AD Baseline CISA recently released baseline guidance for cloud application security, dubbed SCuBA, or Secure Clou...
Read Article →VM Contributor To Domain Admin In 60 Seconds When Microsoft revamped the privileged access model in the late fall of 2020, it was received with mix...
Read Article →Check out this article via web browser: How to keep track of changes on Microsoft Docs & Learn? When working with cloud services like Microsof...
Read Article →This article will go into detail on how to configure Azure MFA for access to on-premises VPN and RD Gateway.
Read Article →What’s up, everyone! Usually when I write on my blog I stick to the technology and try to keep my own opinion out of the article, but I think IR...
Read Article →Azure AD: New Controls For Authentication Strength Microsoft has released a much asked for setting, which also aligns to the Whitehouse memorandum,...
Read Article →Microsoft Defender for Identity MDI (previously called Azure Advanced Threat Protection or Azure ATP) is a Microsoft security solution that capture...
Read Article →It is time for part 3D of the ultimate Microsoft Defender for Endpoint (MDE) series. After Part 3C (Onboard Defender for Endpoint using Azure Arc) ...
Read Article →Hackers are more frequently using social engineering attacks to gain access to corporate credentials and breach large networks. With the rise of mo...
Read Article →Check out this article via web browser: Take control of your guests with the External Identities Policy Today we take a look at the brand new Exter...
Read Article →It is time for part 3C of the ultimate Microsoft Defender for Endpoint (MDE) series. After Part 3B (Onboard Defender for Endpoint using Defender fo...
Read Article →Choosing a FIDO2 Security Key As I’ve been keeping up with my FIDO2 Security Key roundup, which you can find here, Azure AD: FIDO2 Security Key Rou...
Read Article →Identity attacks are currently changing and focussing on new techniques. In the past years, many organizations protected accounts with MFA/ FIDO2 a...
Read Article →This is the updated “matrix” of OS supported for the almost 80 features, services, and important components that make up Microsoft Defe...
Read Article →What’s up, everyone! So, did you hear about Rimo3 yet? Lately I’ve been hearing a lot about about Rimo3, especially since they have tea...
Read Article →What’s up, everyone! Windows user profiles are important to the user experience. It holds all of the bits and settings together that our user...
Read Article →Defender for Cloud was since the release based on the Microsoft Monitoring Agent (MMA). Since august 2022 it is possible to auto-deploy the Azure M...
Read Article →What’s up, everyone! In this post I’ll take a look at password-less authentication. We can optimize the user experience and increase se...
Read Article →In the last couple of weeks, many researchers warns of a new large-scale phishing campaign that is using the adversary-in-the-middle (AiTM) techniq...
Read Article →Check out this article via web browser: How to deal with orphaned objects in Azure AD (Connect) We have done hybrid identity for a couple of years ...
Read Article →After a nice talk with Yannick Van Landeghem, who made me aware of a “possible” security gap when using a Temporary Access Pass (TAP), I decided to...
Read Article →Check out this article via web browser: Use a FIDO2 security key as Azure MFA verification method This news seems to be kept under the radar a litt...
Read Article →Check out this article via web browser: Get alerts on Azure resource assignments made outside PIM Microsoft released a new public preview where adm...
Read Article →What’s up everyone! In the first post we talked about Windows 365 and how it compliments the existing modern endpoints (Microsoft 365 and Azu...
Read Article →Check out this article via web browser: Get started with Azure AD B2B direct connect We all love seamless collaboration, right? Well, here’s ...
Read Article →Note This article was last updated on 01/26/2025 for readability and updated URLs
Read Article →What’s up, everyone! This post is part of a series I’ve been wanting to do for a long time now. It is about Azure Virtual Desktop / Win...
Read Article →What’s up, everyone! This post is part of a series I’ve been wanting to do for a long time now. It is about Azure Virtual Desktop / Win...
Read Article →Check out this article via web browser: Multi-stage approval for privileged roles using Azure AD Identity Governance Privileged Identity Management...
Read Article →Check out this article via web browser: KB – mobile phone number not in sync Azure AD Connect This is a knowledgebase item. Hope it helps you...
Read Article →What’s up, everyone! This post is part of a series I’ve been wanting to do for a long time now. It is about Azure Virtual Desktop / Win...
Read Article →MFA prompt spamming/ MFA fatigue is a quite new term and seeing more after the LAPSUS$ attack. Currently there are many MFA options including SMS, ...
Read Article →What’s up, everyone! This post is part of a series I’ve been wanting to do for a long time now. It is about Azure Virtual Desktop / Win...
Read Article →What’s up, everyone! In this post I will talk about the Azure AD Application Proxy. Simply put, the Azure AD Application Proxy is a great way...
Read Article →For many years, abuse of Remote Desktop Protection (RDP) has been the most common root cause of all ransomware events. At the moment one of the mos...
Read Article →Check out this article via web browser: Get started with multi-stage access reviews in Azure AD Access reviews, part of the Azure AD Identity Gover...
Read Article →What’s up, everyone! This post is part of a series I’ve been wanting to do for a long time now. It is about Azure Virtual Desktop...
Read Article →This blogpost is a continuation of two earlier blogposts about integrating Apple Business Manager with Azure Active Directory and Apple Business Ma...
Read Article →What’s up, everyone! This post is part of a series I’ve been wanting to do for a long time now. It is about Azure Virtual Desktop...
Read Article →This article will continue where we finished in the article I wrote about setting up Apple Business Manager for use with Azure Active Directory. In...
Read Article →Check out this article via web browser: Access reviews for Azure AD directory roles This blog post is for all those organizations out there with st...
Read Article →This blog will be about some stuff you need to beware of when you are setting up Azure AD Connect. It’s a topic I haven’t written a lot about but [...
Read Article →Apple Business Manager is a service provided by Apple which helps to deploy Apple devices and apps in your organization. By leveraging Apple Busine...
Read Article →Here are some troubleshooting steps that might help when implementing Azure MFA with an existing RDS infrastructure. Typo’s There are many st...
Read Article →What’s up, everyone! Here’s an updated guide on how to implement Azure MFA on an existing RDS infrastructure. This version has some gre...
Read Article →In the last couple of months, there is a large increase visible in consent phishing emails (illicit consent attacks). Microsoft threat analysts are...
Read Article →Microsoft Defender for Endpoint deployment is possible based on multiple deployment mechanisms. Microsoft Defender for Cloud (previous Azure Defend...
Read Article →Check out this article via web browser: Act on group membership changes in Azure Active Directory Did you ever want to act on a change in group mem...
Read Article →Check out this article via web browser: Onboard FIDO2 keys using Temporary Access Pass in Azure AD One of the requirements to use FIDO2 security ke...
Read Article →During Ignite ’21 Microsoft announced multiple new functionalities, renames, and new products. In the upcoming weeks, more blogs are coming w...
Read Article →During the Microsoft Ignite conference in November 2021 Microsoft made several announcements related to Azure AD conditional access. You can read t...
Read Article →If you have Conditional Access configured and active within your Azure AD environment, there might be some scenario’s where users are not abl...
Read Article →Check out this article via web browser: Enable Location Information and Code Match for Azure MFA Update 26-11-2021 As this feature is now in public...
Read Article →In December last year, Microsoft announced that per April 1, 2021 they updated their service level agreement(SLA) for Azure AD user authentication ...
Read Article →Check out this article via web browser: Customize the MFA registration policy in Azure AD Identity Protection Disclaimer: this is a proof of concep...
Read Article →Starting with Firefox version 91, Mozilla is now supporting Single sign-on support (SSO) and device-based Conditional Access as announced by Micros...
Read Article →Microsoft recently added a new function that gives the option for stream events from Azure AD Identity Protection into Microsoft Sentinel. In this ...
Read Article →Cloud discovery is one of the most interesting functions available with the Cloud App Discovery product. With Cloud Discovery, organizations will g...
Read Article →Today I experienced an interesting issue, for which I thought it was interesting sharing how I figured out what was going on. The issue/challenge T...
Read Article →Lateral movement refers to the techniques that a cyber attacker uses, after gaining initial access, to move deeper into a network in search of sens...
Read Article →A Password Spraying Attack is a type of brute force attack where a malicious actor attempts the same password on many accounts before moving on to ...
Read Article →The basics Let’s start this article with some basic cybersecurity terminology. Security hygiene, or cyber hygiene, is a general term used to ...
Read Article →Azure AD Identity Protection is one of the security tools available in the Microsoft E5 license. With Azure AD Identity Protection it is possible t...
Read Article →Microsoft announced on 14th June 2021 a new version of the Windows Security Events data connector. The new feature reached currently the public pre...
Read Article →Check out this article via web browser: Getting everyone enrolled for Azure MFA and SSPR. How hard can it be? I’ve done quite some Azure MFA ...
Read Article →During Microsoft Ignite in March this year, Microsoft announced several new upcoming functionalities for Azure Active Directory. One of the announc...
Read Article →Since the last years, there is a large increase in cybercriminals attempting to run attacks by exploiting the login credentials. With the current w...
Read Article →A new feature in public preview is the Azure AD access review functionality. With the new AzureAD access reviews function it is possible to review ...
Read Article →Check out this article via web browser: Change billing model for Azure AD guest users Back in 2020, Microsoft announced a change in the pricing mod...
Read Article →Conditional Access configuration for AzureAD accounts is important. With Conditional Access you can protect easy accounts, block outdated protocols...
Read Article →In my last blog, I wrote about three considerations for your Azure Information Protection deployments and commented on often overlooked potential d...
Read Article →Earlier this month I wrote an article about using filtering in assignments for apps, compliance policies and configuration profiles in Microsoft En...
Read Article →For next week, Tuesday, May 25 we are proud to announce that Jan Bakker, Microsoft 365 Consultant and Microsoft Enterprise Mobility MVP will be hos...
Read Article →Working from home became the new normal in most of the work environments. With the increase of working from home also the security impact changed. ...
Read Article →Azure Information Protection (AIP) – more accurately exposed to Microsoft 365 now as sensitivity labels – is close to the top of my fav...
Read Article →Azure Security Center included integration with Azure Workbooks. With the new Workbooks feature is it possible to build custom reports. From Azure ...
Read Article →The Azure Mask browser extension is a really great tool when either recording on-screen demos or sharing your screen. Available for Edge/Chrome and...
Read Article →As I have blogged about a lot, there are a bunch of hoops to be jumped through and prerequisites to be met for a successful hybrid Azure AD join an...
Read Article →Most of us have had that “oh <blank>” moment where we have given someone access to someone only to immediately or later need to...
Read Article →Check out this article via web browser: Require MFA for Azure AD domain join and Device Registration Today we take a look at a new feature in Azure...
Read Article →For next week, Tuesday, March 30 we are proud to announce that Dirk-jan Mollema, one of the core researchers of Active Directory and Azure AD at Fo...
Read Article →Check out this article via web browser: Azure Active Directory Connect – Cloud Sync When organizations want to extend Active Directory to Azu...
Read Article →For next week, Tuesday, March 16 we are proud to announce that Patrick van den Born and Rick Stijnman will be hosting a session about: Deploying Wi...
Read Article →As part of the new Passwordless GA announcement, Microsoft created a new activity blade in AzureAD. With the new Authentications methods Activity b...
Read Article →Check out this article via web browser: Review guest access across Microsoft 365 groups (teams) In a previous blog post I wrote about Azure AD Acce...
Read Article →With Microsoft Information Protection, you can apply sensitivity labels to files, emails, and containers such as SharePoint Libraries. These labels...
Read Article →For next week, Tuesday, February 16 we are proud to announce that Thomas Maurer, Senior Cloud Advocate at Microsoft will be hosting a session about...
Read Article →Check out this article via web browser: Azure Active Directory Temporary Access Pass This blog post is all about the new Temporary Access Pass in A...
Read Article →Yesterday, on Thursday February 16, I presented at the 19th Workplace Ninja User Group Netherlands Tuesdays Webinar. My session, titled “Azur...
Read Article →I’m proud to announce the February 2021 update of my Conditional Access demystified whitepaper. With this release, we have reached the third ...
Read Article →The new Azure AD Temporary Access Pass preview feature is available in the tenant. With the new preview feature, it is possible to configure ...
Read Article →Check out this article via web browser: Privileged Identity Management Discovery and insights Privileged Identity Management (PIM) in Azure Active ...
Read Article →In January, Microsoft announced that they released a public preview allowing entitled customers to create Azure AD access reviews for guest users a...
Read Article →Check out this article via web browser: Number matching with Microsoft Authenticator App in Azure MFA Number matching and passwordless phone sign-i...
Read Article →To provision Windows 10 PCs using Autopilot and Intune, they must first be registered as Windows Autopilot devices in the Device Directory Service,...
Read Article →Welcome to the Kusto Gym, On your road to become a Kusto Knight, there are some exercises to put the theory into action. Where do we store the data...
Read Article →This article is about a subject I covered before in my blogpost titled: “Understanding and governing reauthentication settings in Azure Activ...
Read Article →For Today, January 19th we are proud to announce that our own Adnan Hendricks, Microsoft Azure MVP will host a session about: Azure AD Identity Pro...
Read Article →Azure AD access reviews feature is now in public preview for the Teams and Microsoft 365 Groups. In this blog post an overview of the new public pr...
Read Article →Check out this article via web browser: Self Service in Microsoft 365 One of the great things about Azure Active Directory is the capability of sel...
Read Article →As you move from on-premises or third-party infrastructure to Microsoft 365 and Azure AD, you will want to keep those BitLocker recovery keys safe....
Read Article →Check out this article via web browser: Azure Active Directory Identity Governance – Azure AD Entitlement Management In this series, we take a look...
Read Article →Check out this article via web browser: Azure Active Directory Identity Governance – Privileged Identity Management In this series, we take a look ...
Read Article →Check out this article via web browser: Azure Active Directory Identity Governance – Access Reviews In this series, we take a look at Azure A...
Read Article →Conditional Access is one of the available tools used by Azure Active Directory to bring different signals together. Based on different signals it ...
Read Article →Check out this article via web browser: Protect files on download using Cloud App Security and Azure Information Protection If you have read my blo...
Read Article →Continuous Access Evaluation (CAE) for AzureAD is one of the latest functions and is available in public preview. With this new technique, it is po...
Read Article →Governing when users receive authentication prompts when authenticating to Azure Active Directory (Azure AD) is depending on more than one setting,...
Read Article →Check out this article via web browser: License on-demand with Power Automate and Azure AD Most organizations are using group-based licensing in Az...
Read Article →In April 2020 Alex Weinert, Director of Identity Security at Microsoft announced that Microsoft was working on moving towards real time policy and ...
Read Article →Azure Sentinel is a cloud-native security information and event management platform. (SIEM). Sentinel uses AI to analyze large volumes of data. Azu...
Read Article →Azure Sentinel is een cloud-native Security Information Event Management-oplossing, ook wel bekend als een SIEM-oplossing. Azure Sentinel is cloud-...
Read Article →Check out this article via web browser: Azure MFA authentication method analysis. Share the results with Power Automate! You might have seen the sa...
Read Article →Check out this article via web browser: Microsoft Secure Score Series – 15 – Do not expire passwords Research has found that when periodic password...
Read Article →On August 13th 2020, Alex Simons (Microsoft Identity PM) announced that assigning groups to Azure AD roles in now in public preview. This feature i...
Read Article →Check out this article via web browser: Use Microsoft Graph Security for end-user notifications In this short blog post, I want to show how you can...
Read Article →This blog is the last in a small series on Azure AD Premium P2’s Identity Governance toolkit. Part 1: Entitlement Management Part 2: Access R...
Read Article →Check out this article via web browser: Bulk dismiss risky users with Power Automate or Logic Apps Update 08-10-2020: Microsoft released an officia...
Read Article →This blog is the second in a small series on Azure AD Premium P2’s Identity Governance toolkit. Part 1: Entitlement Management Part 2: Access...
Read Article →This blog is the first in a small series on Azure AD Premium P2’s Identity Governance toolkit. Part 1: Entitlement Management (this post) Par...
Read Article →Check out this article via web browser: Close the gap. Azure AD Identity Protection & Conditional Access. This blog is about Azure AD Identity...
Read Article →Check out this article via web browser: Use Power Automate or Logic Apps to keep an eye on your licenses I guess we’ve all been there; you ra...
Read Article →After earning my Microsoft 365 Certified Enterprise Administrator Expert certification in May, I decided to continue my certification journey and e...
Read Article →Check out this article via web browser: A first look at Administrative Units and My Staff in Azure Active Directory Recently, Microsoft introduced ...
Read Article →Check out this article via web browser: Microsoft Secure Score Series – 11 – Turn on user risk policy With the user risk policy turned on, Azure AD...
Read Article →Tegenwoordig worden steeds meer applicaties via de cloud aangesloten en geconfigureerd. Als we naar Microsoft kijken, is het mogelijk om vele appli...
Read Article →External Identities is a new public preview feature of Azure AD which allows external users to authenticate with a non-Microsoft account such as th...
Read Article →I’m a simple person, and sometimes it just helps to have a checklist to refer to when you’re troubleshooting rather than navigating the...
Read Article →Update October 7 2020: This functionality is now GA, see Publisher verification and app consent policies are now generally available In February th...
Read Article →De cloud is trending en steeds meer applicaties en diensten zijn afhankelijk van de cloud. Een cloud omgeving geeft vele voordelen maar geeft ook e...
Read Article →Azure AD Password Protection is een functionaliteit welke de mogelijkheid geeft om het wachtwoordbeleid te versterken op basis van informatie welke...
Read Article →Een wachtwoord is als je er over nadenkt best lastig, en je vergeet hem vast wel eens. Ook heeft een gebruiker tegenwoordig meerdere accounts – en ...
Read Article →De Azure AD beveiligen is tegenwoordig van groot belang. Vanuit de Microsoft Secure Score krijg je een aantal adviezen op basis van de kennis bij M...
Read Article →Azure Sentinel is een van de nieuwste security producten van Microsoft. Maar wat is nu precies het doel van Azure Sentinel binnen de Microsoft omge...
Read Article →Teams is enorm populair, en is wereldwijd in een behoorlijke versnelling gekomen vanwege het vele thuiswerken. Microsoft Teams is een online samenw...
Read Article →The group policy object Register domain-joined computers as devices, or Automatically workplace join client computers in older templates, was previ...
Read Article →A Windows 10 user can self-enrol in MDM or MAM from Settings > Accounts > Access work or school > Connect. What happens next depends on...
Read Article →Check out this article via web browser: What admins should know about the combined registration portal for Azure MFA and Self Service Password Rese...
Read Article →Check out this article via web browser: How to keep an eye on your Teams with Log Analytics and Azure Monitor? In my previous blog post, I wrote ab...
Read Article →Check out this article via web browser: Microsoft Secure Score Series – 07 – Turn on sign-in risk policy Turning on the sign-in risk policy ensures...
Read Article →One of the advantages of Microsoft having many customers using its services is that Microsoft can leverage data from those customers and apply some...
Read Article →Check out this article via web browser: Use Power Automate for your custom “dynamic” groups Azure AD Dynamic Groups Dynamic groups in A...
Read Article →Check out this article via web browser: Microsoft Secure Score Series – 05 – Enable self-service password reset With self-service password reset in...
Read Article →Lessons learned while implementing Azure AD Privileged Identity Management (PIM) The post Lessons learned while implementing Azure AD Privileged Id...
Read Article →Check out this article via web browser: Microsoft Secure Score Series – 03 – Enable Password Hash Sync if hybrid Password hash synchronization is o...
Read Article →Check out this article via web browser: How to publish on-premises applications and protect them with MFA Using Azure Application Proxy you can pub...
Read Article →Check out this article via web browser: Azure AD tenant branding; size does matter! Earlier today, I read this article from Alex Simons about the c...
Read Article →Check out this article via web browser: Require trusted location for MFA and SSPR registration This article shows how you can block MFA and SSPR re...
Read Article →Check out this article via web browser: Secure your Azure Management portal Today a quick tip to secure your Azure Management Portal. By default, t...
Read Article →By default, on Windows 10 devices which are Azure AD joined, the user performing the join is added to the Local Administrator group. Besides the us...
Read Article →As you may know, it’s possible for your users to sign-in to SaaS based applications using their Azure AD account. By doing this, a Single Sig...
Read Article →Unified labels refer to a movement whereby Azure Information Protection (AIP) labels are now being replaced by sensitivity labels. Sensitivity labe...
Read Article →Last week, Microsoft announced that the Azure AD conditional access baseline policies will not make it out of their current preview status. The fun...
Read Article →When you create an Intune tenant within your environment, you execute the creation with an account which is Global Administrator within Azure Activ...
Read Article →During its annual Microsoft Ignite 2019 conference this week, Microsoft announced a new feature for Conditional Access called Report-Only mode in p...
Read Article →In Q1 2017 Microsoft released the Pass Through Authentication (PTA) functionality as part of Azure AD connect. With the release of Azure Active Dir...
Read Article →While teaching the 20533C course to students I provide them with more information about the topics covered in the training. Perhaps they can help y...
Read Article →