Methodology
Deploying Windows Hello for Business: choosing the right trust model and planning recovery
Cloud Kerberos trust, key trust or certificate trust, PIN policy and reset: the choices that determine a successful Windows Hello for Business rollout.
MethodologyDevice settings in Entra ID: joining, local administrators, LAPS and clean-up
Who can join or register devices, who becomes local administrator, how to enable cloud Windows LAPS and how to clean up stale devices without nasty surprises.
MethodologyOrganising alert and incident triage in Defender XDR
Incident correlation, severity, automated investigation, alert tuning and clear roles: a method to make sure the Defender XDR incident queue is actually worked through.
MethodologyRaising domain and forest functional levels: method and security benefits
Prerequisites, retiring old domain controllers, migrating from FRS to DFSR and what each level brings up to Windows Server 2025: a method for raising functional levels safely.
MethodologyAfter the audit: prioritising remediation and measuring progress
Quick wins or structural work, risk-based ordering, owners, metrics and follow-up audit: how to turn an audit report into real improvements.
MethodologyMicrosoft Secure Score: a useful roadmap, a misleading target
How Secure Score is calculated, why a high score can hide real weaknesses, how to handle third-party mitigations and how to use it as a roadmap rather than a goal.
MethodologyPreparing for a Microsoft security audit: scope, access, documents and stakeholders
A well-prepared audit goes further in the same time. Scope, read-only accounts, documents to gather, people to involve and what the deliverable contains: the checklist before starting.
MethodologyCertificate-based authentication in Entra ID: bindings, affinity and revocation
Native certificate-based authentication in Entra ID lets you use smart cards and certificates without AD FS. Use cases, binding rules, affinity, revocation lists and protection level.
MethodologyThe Active Directory Recycle Bin: enabling it, object lifetime and limits versus a real backup
Enabling the Recycle Bin, understanding deleted object lifetime, restoring an object and its memberships, and knowing its limits compared to an authoritative restore or a backup.
MethodologyMicrosoft 365 groups and Teams: governing creation, naming and lifecycle
Who can create groups and teams, naming policy, expiration policy, ownerless groups and per-group guest settings: the levers to prevent uncontrolled sprawl.
MethodologyBuilding a Conditional Access baseline by persona
Admins, users, guests, service accounts: structure Conditional Access by persona for a baseline that is readable, testable and lockout-free.
MethodologyThe authentication methods policy: migrate, clean up and enforce the right methods
Moving from legacy per-user MFA and SSPR settings to the unified authentication methods policy, retiring SMS and voice, and steering users towards stronger methods.
MethodologyRolling out FIDO2 passkeys in Entra ID: approach, pitfalls and recovery planning
Device-bound or synced passkeys, Authenticator, AAGUID restrictions, pilot phase, Temporary Access Pass and recovery: a practical method for a controlled rollout.
MethodologyReducing NTLM in Active Directory: a realistic six-step roadmap
NTLM is still everywhere and fuels relay attacks. Auditing, NTLMv1 removal and gradual restrictions: a method to shrink its use without breaking production.
MethodologyThe Active Directory tiering model, applied for real
Tier 0, admin workstations, separate accounts, logon restrictions: implementing Active Directory tiering in a realistic way.
MethodologyEntra ID administrative units: delegate by entity or country without tenant-wide roles
How administrative units let you hand over management of an entity's users, groups and devices without granting roles that apply across the entire tenant.
MethodologyRotating the krbtgt password: why twice, and how to do it without breaking anything
The krbtgt password signs every Kerberos ticket in the domain. A two-step rotation method, the waiting periods to respect, RODC accounts and a sensible frequency.
MethodologyIntune compliance: the often-neglected foundation of "require compliant device"
A Conditional Access policy requiring a compliant device is only as strong as the Intune compliance policies behind it. What to check, and the traps that create false confidence.
MethodologyActive Directory backup: preparing a forest recovery before you need one
System state backups, offline copies, tombstone lifetime, DSRM passwords and an isolated recovery test: the foundations of a credible Active Directory recovery plan.
MethodologyEntra ID access packages: ending "please add me to the group" requests by email
Catalogs, policies, approvals, expiry and connected organisations: how entitlement management replaces ad-hoc access requests with a governed process.