Security
Teams apps: regaining control over what users install
Org-wide app settings, permission policies versus app centric management, third-party apps and Graph permissions, and custom app uploads: how to govern Teams apps.
SecurityAuthentication coercion and NTLM relay: understanding the risk and reducing it
Why forcing a server to authenticate and then relaying that authentication still works, and the mitigations that matter: EPA, hardening AD CS, LDAP channel binding, RPC filters.
SecurityBYOD without enrolment: protecting data with Intune app protection policies
Controlling Microsoft 365 access from personal smartphones without enrolling them: data transfer restrictions, Conditional Access requiring app protection, and selective wipe.
SecuritySecrets, certificates and federated credentials: credential hygiene for Entra ID apps
Client secrets, certificates or federated credentials: which to choose, how to manage expiry and owners, and why credential additions on service principals must be monitored.
SecuritySafe Attachments and Safe Links in Defender for Office 365: what really weakens protection
Preset or custom policies, dynamic delivery, exclusions and "do not rewrite" lists, Teams and Office coverage: the points to check in Safe Attachments and Safe Links.
SecurityAnonymous LDAP and "Pre-Windows 2000 Compatible Access": closing unauthenticated reads
dSHeuristics, members of the "Pre-Windows 2000 Compatible Access" group, null sessions: how a directory can still be read without any account at all, and how to close it.
SecurityPurview Message Encryption: choosing the right protection and avoiding the pitfalls
Encrypt-Only or Do Not Forward, templates, the external recipient experience and mail flow rules to apply encryption: what you need to know before rolling it out widely.
SecurityExchange Online mail flow rules: a blind spot worth auditing
Hidden BCC copies, redirects, spam filtering bypasses and domain allow-lists: how mail flow rules turn into a risk and how to review them methodically.
SecurityAiTM phishing: when MFA is no longer enough to protect sessions
Adversary-in-the-middle phishing kits steal session cookies after MFA. Detection signals, incident response and the real fix: phishing-resistant MFA.
SecurityApplication consent: closing the door on illicit consent grant attacks
Restricting user consent, setting up the admin consent workflow and reviewing the permissions already granted to applications in your tenant.
SecurityEntra ID emergency access accounts: set them up without creating a back door
Two accounts, phishing-resistant authentication, controlled exclusions and an alert on every sign-in: how to make emergency access safe.
SecurityEntra PIM: replacing standing admin roles with just-in-time activation
How Privileged Identity Management replaces standing administrator roles with just-in-time activation that is justified, approved, time-limited and audited.
SecurityDefender for Office 365 anti-phishing policies: going beyond the defaults
User and domain impersonation protection, mailbox intelligence, spoof intelligence, safety tips and preset security policies: the settings that really matter.
SecuritySPF, DKIM and DMARC for Microsoft 365: the complete setup, domain by domain
SPF record, enabling DKIM selectors, moving DMARC step by step to p=reject and protecting parked domains: a practical method for Microsoft 365 tenants.
SecurityWindows LAPS: migrating from legacy LAPS and locking down who can read passwords
Built into Windows since April 2023, Windows LAPS replaces legacy Microsoft LAPS with encryption, DSRM backup, Entra ID support and post-authentication actions.
SecurityInbox rules and forwarding in Exchange Online: the favourite persistence of payment fraud
Rules that hide replies, external forwarding, OAuth apps: how attackers persist in a compromised mailbox, and how to detect them.
SecurityKerberoasting: protecting service accounts before their passwords are cracked offline
Any domain user can request a ticket for a service account with an SPN and try to crack its password offline. Here is how to shut that attack path down.
SecurityWorkload identities: the accounts nobody watches
Service principals, secrets, application permissions: why non-human identities have become a major Entra ID attack surface.
SecurityAS-REP roasting: hunting down accounts without Kerberos preauthentication
One ticked box, "Do not require Kerberos preauthentication", is enough to expose a password to offline cracking. Here is how to find and fix it.
SecurityEntra Password Protection: banned lists, smart lockout and on-premises AD
Global and custom banned password lists, smart lockout and domain controller agents: how to stop weak passwords in the cloud and in on-premises Active Directory.
SecurityAdminSDHolder and SDProp: understanding, auditing and cleaning up protected accounts
AdminSDHolder protects privileged AD accounts, but it can also become a persistence mechanism. How to audit its ACL and clean up orphaned adminCount values.
SecurityToken theft: what MFA no longer covers, and how to shrink the window
AiTM proxies and cookie theft bypass classic MFA. Phishing-resistant MFA, compliant devices, token protection and CAE shrink the exploitation window.
SecurityEntra ID Protection: making sign-in risk and user risk work for you
Sign-in risk, user risk, detections, risk-based Conditional Access and remediation: how to get real value from Entra ID Protection without drowning in false positives.
SecurityLDAP signing and channel binding: closing the door on relay attacks against your DCs
Without LDAP signing and channel binding, a relayed authentication can modify your directory. Event 2889, DC settings and a rollout plan that avoids breakage.
SecurityNamed locations and country blocking: useful, but never enough
What geographic blocking in Conditional Access really protects against, its limits with VPNs, proxies and IPv6, and why location must never be a substitute for MFA.
SecurityTeams external access: when open federation becomes a phishing channel
External access versus guest access, open federation, unmanaged Teams accounts and anonymous meeting join: the Teams settings to review to reduce phishing risk.
SecurityAD CS: reading ESC1 to ESC8 without being a PKI expert
Over-permissive certificate templates, rights on the PKI, NTLM web enrollment: the ESC scenarios explained simply, and how to fix them.
SecuritySharePoint and OneDrive on unmanaged devices: restrict without stopping work
Limited web-only access, sync restricted to managed PCs, app-enforced restrictions and idle session sign-out: how to control SharePoint and OneDrive on unmanaged devices.
SecuritySMB signing and SMBv1 removal: two jobs you should not put off
Relay to SMB and SMBv1 remain common attack vectors. Require signing, audit then remove SMBv1, and plan for the performance impact before you enforce.
SecurityGroups and privilege escalation: when a group owner becomes an administrator
Role-assignable groups, group owners, Azure permissions and Conditional Access exclusions: how an ordinary group can open a path to a privileged role.
SecurityGPO security: edit rights, delegation and passwords left behind in SYSVOL
Who can edit the GPOs linked to your domain root or domain controllers, and what is still lying in SYSVOL? A practical review of permissions and forgotten secrets.
SecurityKerberos delegation: three mechanisms, three ways to lose the domain
Unconstrained, constrained with protocol transition, RBCD: how a useful authentication mechanism becomes a path to domain admin.
SecurityExchange Online: SMTP AUTH, POP and IMAP, the legacy protocols still left open
Basic authentication has largely gone from Exchange Online, yet SMTP AUTH, POP and IMAP often remain enabled by default. How to close them without breaking your printers.
SecurityEntra ID dynamic groups: when a poorly chosen attribute opens the door
Dynamic membership rules rely on attributes that others may be able to influence. Guests, HR synchronisation, devices: the risks involved and how to write safer rules.
SecurityDCSync: who really holds replication rights on your domain?
Replicating Directory Changes rights let anyone pull every password hash from the domain. Who should hold them, how to spot unexpected holders and detect DCSync.
SecurityMailbox delegation: FullAccess and SendAs, the silent accumulation of access
FullAccess, SendAs, SendOnBehalf and folder permissions: how mailbox delegations pile up over the years in Exchange Online, and how to review them with PowerShell.
SecurityDevice code phishing: understanding the attack and blocking the flow safely
How the device code flow is abused to steal tokens despite MFA, and how to block it with the Conditional Access authentication flows condition after identifying legitimate uses.
SecurityYour Entra Connect server is a domain controller in disguise
Replication rights, PTA agents, the AZUREADSSOACC account: why the hybrid sync server must be protected like a domain controller.
SecurityPrint Spooler on domain controllers: closing a door nobody uses
Why the Print Spooler has no place on a domain controller, and which complementary protections neutralize forced-authentication attacks.
SecurityPower Automate: when a three-click flow exfiltrates your data
Connectors to personal services, a default environment open to everyone and Power Platform DLP policies: how to govern Power Automate without stifling innovation.
SecurityMicrosoft 365 Copilot: the oversharing your permissions were hiding until now
Copilot only surfaces what users can already open, but it makes oversharing visible. Broad links, "Everyone except external users": what to fix before you roll it out.
SecuritySelf-service password reset: convenient for users, and potentially for attackers too
Allowed methods, number of factors, security questions, the admin policy and writeback: how to secure SSPR so it does not become an account takeover route.
SecurityForgotten privileged groups: Operators, DnsAdmins and other quiet paths to domain admin
Account Operators, Server Operators, Backup Operators, DnsAdmins and more: built-in groups with near Domain Admin power that should usually stay empty.
SecurityShared mailboxes: why you should block sign-in on their user accounts
Every shared mailbox is backed by an Entra ID user account with a password. Left enabled, it becomes a quiet entry point that attackers love to find.
SecurityCross-tenant access settings: controlling who comes in, who goes out, and to which tenants
Default and per-organisation settings, MFA trust, B2B direct connect and tenant restrictions v2: taking back control of external collaboration in Entra ID.
SecurityDomain and forest trusts: SID filtering, selective authentication and forgotten links
Trust direction and transitivity, SID filtering, SID history, selective authentication and links to former partners: how to audit the boundaries of your Active Directory.
SecurityExchange, SharePoint, Teams: who really holds admin rights in your tenant?
Entra ID directory roles only tell part of the story. Exchange Online, SharePoint and Teams each have their own delegation models that deserve a review.
SecurityPassword policies in AD: default policy, fine-grained PSOs and length over complexity
Default domain policy, fine-grained policies for admins and service accounts, length, lockout and reversible encryption: building a consistent Active Directory password policy.
SecurityToo many Global Administrators: finally applying least privilege in Entra ID
Why Global Administrators multiply, what Microsoft recommends, and how to map each everyday task to the least-privileged built-in Entra ID role.