Looks like Christmas is coming early this year 🤷‍♂️

New post: focusing on the key biggest Microsoft 365 security considerations. READ: campbell.scot/micros... When we talk about Microsoft 365 security, we are talking about two things: (a) securing Microsoft 365 the platform, (b) using Microsoft 365 security tooling.

@cloudflare.social is so broken now that even their status page is broken 🧐 #cloudflaredown

New video: 5 common Entra ID guests mistakes (Entra B2B) • excessive directory visibility • ignored cross-tenant defaults • untrusted MFA & device states • open SharePoint sharing • no guest lifecycle There's tons more! But here's a starter WATCH: youtu.be/AXuj-U9p3jU

After yesterday's interesting #Copilot+#OneDrive event I took a much deeper look at the 'Add shortcut to OneDrive' #SharePoint feature. Microsoft have declared this as the direction of travel. At first it looked great. Until I dug deeper. What I found is pretty horrifying. Blog inbound...

Chaos is exactly where our work begins. Our job is to bring clarity, calm, and momentum—fast. Watch the video from my colleague Adrian Hill on our Microsoft Security blog. www.microsoft.com/en-us/securi...

Did you know Entra ID Protection never automatically clears Medium or High risk? We either need to use Risk Based Conditional Access policies to remediate or an admin needs to manually remediate User risk = password reset Sign-in risk = require MFA learn.microsoft.com/...

Microsoft introduced new Sentinel commitment tier for SMBs. The 50 GB commitment tier is available in public preview, with promotional pricing starting October 1, 2025, until March 31, 2026. Customers who sign up during this period will lock in promotional pricing until March 31, 2027.

A 3 picture story of why you should default quarantine password protected files and enforce SmartScreen without allowing user bypass...

Seriously, Apple? That plastic-like white back on your silver flagship iPhone looks awful. This might be the ugliest iPhone ever, and I’m seriously thinking about returning it purely because of the design.

IMHO - Worry less about how long tokens are valid for, worry more about protecting the tokens, both on the client and during authentication Obviously we need phishing resistant auth, but also focus on client hardening (app control, EDR, etc.) and VPN/ZTNA with enforced CAE

Wow, I totally missed this change! Apparently since July, we've been able to use Asset rules management to use device details, like name, domain, OS, and other tags, to dynamically apply MDE-Management for MDE attach 😎 learn.microsoft.com/...

I love passkeys in Microsoft Authenticator, but rolling them out with Compliance and/or App Protection Policies has not been as easy as it should be... But I have good news - we can create a better experience without introducing significant gaps :)

𝗛𝗼𝘄 𝘁𝗼 𝗮𝘂𝘁𝗼𝗺𝗮𝘁𝗶𝗰𝗮𝗹𝗹𝘆 𝘂𝗽𝗱𝗮𝘁𝗲 𝗮𝗽𝗽𝗹𝗶𝗰𝗮𝘁𝗶𝗼𝗻𝘀 𝗼𝗻 𝗰𝗼𝗺𝗽𝘂𝘁𝗲𝗿𝘀 𝗶𝗻 𝗠𝗶𝗰𝗿𝗼𝘀𝗼𝗳𝘁 𝗜𝗻𝘁𝘂𝗻𝗲 Microsoft Intune does not have any built-in options for updating installed applications on Windows computers.

Microsoft has been ranked #1 in the worldwide modern endpoint security market share for the third year in a row (IDC, 2024).

The financially motivated threat actor Storm-0501 has continuously evolved to achieve sharpened focus on cloud-based TTPs as their primary objective shifted from deploying on-premises endpoint ransomware to using cloud-based ransomware tactics. msft.it/63326sZC6E

For incident response to be successful, the proper tools and logging systems should be in place—but that is usually easier said than done.

Convenient reminder to stop what you’re doing and enforce browser extension allow listing.

We’re excited to announce the general availability of Windows Backup for Organizations!

Seamless SSO is a legacy setting only for very old and unsupported systems. If you have it turned on, go and turn it off. If you must keep it on, ať least rotate the kerberos deception key every month.

Get the latest Windows quality updates during the out-of-box experience (OOBE) by default. This much awaited improvement is coming to your eligible Microsoft Entra joined or Microsoft Entra hybrid joined devices running Windows 11, version 22H2 and later.

As enterprise defenses continue to mature, threat actors are shifting toward quieter, more efficient techniques. Attackers are increasingly using native tools and stealthy methods to operate under the radar.

One thing I always recommend when it comes to designing conditional acesss policies. Never use a block policy when the same outcome can be achieved with a grant policy. This blog post by Rakhesh is a good walthrough why... 👇

I like my Lenovo hardware, and I want to keep it up to date with the latest drivers, firmware, and other software updates. In this small blog post, I will show you how you can do that using the LSUClient module from Jantari. powershellisfun.com/2025/08/22/u... #PowerShell #Lenovo #Update

Token Protection in Microsoft Entra Conditional Access for Windows is now GA! 🎉 #EntraID #Token learn.microsoft.com/en-us/entra/...

New video: Why your Defender update settings are risky - update types: engines, platforms, intelligence - what is Microsoft’s 'Safe Deployment Practices' (SDP)? - update rings in Defender (not just Windows) - balancing rollout risk vs. protection WATCH: youtu.be/trQv__-Z9-8

Microsoft has announced the public preview of the Phishing Triage Agent in Microsoft Defender!

On 9/15, Microsoft starts enforcing mandatory MFA for Azure CLI, Azure PowerShell, Azure mobile app, and your IAC tools (non-Service Principal based) I created a CA template you can import (report-only) to audit these apps (add your IAC ones): github.com/nathanmcn...

Folks, working on two Defender books out this year and want to feature the best community tips. Defender for Endpoint In Depth 2nd Ed (w/ @Threatzman) Mastering Defender XDR 2nd Ed (w/ @Headburgh) So, drop your great MDE, MDO, MDI, MDA, and XDR tips here. Best get featured.

Make sure you are actively blocking weaker authentication options.

Cloud Forensics Tip: In the Azure era, preparing for the worst means enabling forensic readiness now—not after a breach strikes.

Check Nathan's options for break-glass account exclusions in conditional access policies.

Defender AV Platform v4.18.25070.5 ◽Enhanced Passive Mode Scanning Behavior ◽Improved Tamper Protection Handling ◽Digital Signature Verification Performance Boost ◽Refined ASR Rule Exclusion Processing #MDAV #MDE #ASR

Microsoft announced today that systems running Home and Pro editions of Windows 11 23H2 will stop receiving updates in three months.

👋 Check out this new Microsoft Entra blog post 👇 Now Generally Available: Platform SSO for macOS with Microsoft Entra ID techcommunity.microsoft.com/t5/microsoft...

Heads-up. If you have #Office365 E5 or #Microsoft365 licenses and use Microsoft Defender for Office 365, shared mailboxes must be licensed, and all user mailboxes need MDO licenses. The service description is clear, but who reads these things? office365itpros.com/2025/08/11/m...

Defender defaults are not secure enough. Make it as hard as possible for the bad guys!

This is amazing! We can now query Graph Sign-in logs for events based on the audience :D Sometimes we need to know all tokens that can be used with an app, like Exchange Online, even if that wasn't the target resource Undocumented so far, but it appears to take OData queries 😎

While I'm on the topic of CIS Benchmarks... If you follow this one for Edge, you won't be able to use device compliance in your Conditional Access policies :-/

Don’t blindly follow benchmarks. They’re a great starting point — but not the finish line. Always make sure you understand what you’re configuring and why it matters in your specific environment.

The latest version of Microsoft Entra Connect brings an important update — application-based authentication is now generally available (no longer in preview). Even better, it’s now the default option for all new Entra Connect installations. A great step forward in securing hybrid identity!

In today’s hybrid‑cloud era, identity-based cyberattacks are no longer a question of if but when—Microsoft reports over 7,000 password attacks per second in 2024 and a 146% jump in AiTM phishing incidents.

Here are the ways you can interact with Microsoft at #BHUSA 2025: On the main stage, Microsoft Threat Intelligence experts share behind-the-scenes insights in “Unmasking Cyber Villains: How Microsoft Stays Ahead of the World's Most Dangerous Hackers”: msft.it/63322syXVM

Conditional access policies are key when it comes to identity protection.

Reminder when deploying Defender for Endpoint for macOS You *could* do this the hard way: learn.microsoft.com/... Or you can do it the easy way: github.com/microsoft... You really just need 4 policies: 1) Permissions (combined) 2) Onboarding 3) AV policy 4) App installation

📢 Breaking changes: Guest billing for Entra ID Governance I haven't seen any announcements on this and guidance is extremely lacking, so Joe Stocker gave me time to create a script to help everyone assess costs early :) I would love your feedback! github.com/nathanmcnult...

Microsoft Sentinel Data Lake – Public Preview Microsoft just announced Sentinel Data Lake, designed to unify all your security data, cut SIEM storage costs by 85%, and power advanced AI like Security Copilot.

Octo Tempest (aka Scattered Spider) has shifted focus in July 2025 — now targeting the aviation sector, following prior campaigns against retail, food, hospitality, and insurance industries April–July 2025.

🚨 Security Alert: Synology Active Backup for Microsoft 365 Vulnerability 🚨 Modzero discovered a critical vulnerability in Synology’s "Active Backup for Microsoft 365" (ABM) that exposed sensitive cloud data.