The blog
Entra ID
Managed identities: the Graph and Azure privileges nobody looks at
Managed identities remove secrets, not privileges. How to inventory their Microsoft Graph and Azure permissions, spot escalation paths and apply least privilege.
Entra IDToken protection in Conditional Access: what it really covers
Token protection binds sessions to the device that obtained them. Its real scope, supported clients and platforms, and a careful rollout in report-only mode.
Entra IDPHS, PTA or federation: choosing hybrid authentication and moving off AD FS
Password hash sync, pass-through authentication or federation: strengths and risks of each, then a gradual migration off AD FS using staged rollout.
Entra IDUser consent to applications: closing the door on consent phishing
Restricting user consent, relying on verified publishers and low-impact permissions, and setting up the admin consent workflow.
Entra IDSecrets and certificates on app registrations: credential hygiene that holds up
Client secrets versus certificates, lifetimes, long-lived secrets, app registration owners and orphaned apps: what needs to be under control.
Entra IDHigh-risk Microsoft Graph permissions: why some applications are Tier 0
RoleManagement.ReadWrite.Directory, AppRoleAssignment.ReadWrite.All, Application.ReadWrite.All, Mail.ReadWrite: these application permissions amount to Global Administrator-level control.
Entra IDManaged identities or service principals with secrets: choosing and auditing
When to use a managed identity rather than a service principal with a secret, the difference between system-assigned and user-assigned identities, and how to audit their Azure and Graph rights.
Entra IDWorkload identity federation: removing secrets from pipelines without opening a gap
GitHub Actions, Azure DevOps and Kubernetes can authenticate to Entra ID without a secret using OIDC. The critical point: how tightly the subject claim is scoped.
Entra IDEntra ID default user settings: what every user can do without a role
Registering apps, creating groups or tenants, reading the directory, reaching the admin center: a review of default permissions and the settings worth hardening.
Entra IDExternal collaboration settings: keeping guests in check in Entra ID
Guest access restrictions, invitation rights, domain allow and deny lists and email one-time passcode: the external collaboration settings worth reviewing.
Entra IDInactive and never-redeemed guests: detect, disable, delete
Using signInActivity and invitation state to find dormant guest accounts, then putting a regular, automated clean-up process in place.
Entra IDEntra certificate-based authentication: bindings, affinity and deployment pitfalls
PKI trust, username bindings, high versus low affinity and revocation: what makes certificate-based authentication genuinely phishing-resistant, or not.
Entra IDAuthentication strengths in Conditional Access: requiring the right MFA in the right place
Built-in and custom strengths, phishing-resistant MFA for administrators, guests and cross-tenant access: how to use authentication strengths without locking yourself out.
Entra IDSign-in frequency and persistent sessions: getting Conditional Access session controls right
Sign-in frequency, persistent browser sessions and the "Every time" option: how to use Conditional Access session controls to reduce risk without wearing users out.
Entra IDTesting Conditional Access without locking yourself out: report-only mode and the What If tool
Report-only mode, the What If tool, the insights and reporting workbook and staged rollout: a method for enabling Conditional Access policies without blocking the organisation.
Entra IDJoining devices to Entra ID: who can join, and who becomes local administrator?
Entra ID device settings are rarely reviewed: join permissions, per-user quota, local administrators, Windows LAPS and access to BitLocker keys.
Entra IDPHS, PTA or federation: choosing your hybrid authentication method
Password hash synchronization, pass-through authentication or federation: the three methods compared from the angle of security, resilience and leaked credentials detection.
Entra IDLeaving AD FS: moving to cloud authentication without disrupting users
Relying party inventory, staged rollout, migration of applications and claims rules, then full decommissioning: the steps of a controlled exit from AD FS.
Entra IDSeamless SSO: protecting the AZUREADSSOACC account and rolling over its key
Seamless SSO relies on a computer account whose Kerberos key is shared with Entra ID. Why that account is sensitive, how to roll over its key and when to turn the feature off.
Entra IDEntra Cloud Sync or Entra Connect Sync: choosing your synchronisation engine
Architecture, features, the security footprint of the agents and the migration approach: the criteria for choosing between Microsoft Entra Cloud Sync and Microsoft Entra Connect Sync.
Entra IDSoft match and hard match: when synchronisation can take over a cloud account
The matching mechanisms between Active Directory and Entra ID accounts make migrations easier, but they can let an on-premises attacker take over a cloud account. How they work and how to lock them down.
Entra IDMFA fatigue: number matching, additional context and what comes next
Push notification bombing is still an effective technique against traditional MFA. What number matching and additional context change, how to make use of user reports, and why phishing-resistant methods should be the goal.
Entra IDTemporary Access Pass: a valuable tool that needs strict controls
The Temporary Access Pass makes passwordless onboarding and account recovery easier. One-time or multi-use, lifetime, roles allowed to issue it: the settings that stop it from becoming a back door.
Entra IDEntra smart lockout: tuning it properly against password spraying
Threshold, duration, familiar locations and interaction with Active Directory lockout: how to tune Entra ID smart lockout without locking out your own users.
Entra IDTenant restrictions v2: stopping data from leaking to other tenants
How tenant restrictions v2 prevent your users from signing in to third-party tenants from your devices and network, and how they fit with cross-tenant access settings.
Entra IDCustom Entra ID roles: least privilege when built-in roles are too broad
When to create a custom role in Entra ID, how to pick its permissions, scope it to an administrative unit or an application, and which pitfalls to avoid.
Entra IDCloud-only admin accounts: keeping Entra ID administration separate from on-premises AD
Why privileged Entra ID roles should never be granted to synchronised accounts, and how to design dedicated, mailbox-free and strongly protected admin accounts.
Entra IDFive useful KQL queries on Entra ID sign-in and audit logs
Legacy authentication, MFA failures, password spraying, application consents and role changes: simple KQL queries for Log Analytics and Microsoft Sentinel.
Entra IDAuditing the OAuth permissions already granted in Entra ID
Delegated permissions, organisation-wide consents, application permissions: how to inventory what third-party applications have already been granted and clean up without breaking production.
Entra IDEnterprise applications: why you should turn on "Assignment required"
By default, any user in the tenant can get a token for most enterprise applications. How the "Assignment required" option and Conditional Access actually restrict access.
Entra IDSecurity defaults: what they protect, and when to move to Conditional Access
What Entra ID security defaults enforce, where they fall short, and how to replace them with Conditional Access policies without opening a window of exposure.
Entra IDAzure access elevation: when a Global Administrator takes over every subscription
The "Access management for Azure resources" option lets a Global Administrator grant themselves User Access Administrator at the Azure root scope. Risk, monitoring and control.
Entra IDFederated domains: a quiet backdoor in Entra ID
Adding a federated domain, changing federation settings, slipping in an extra signing certificate: how attackers use them to persist in a tenant, and how to detect it.
Active Directory
Service accounts: moving to gMSA and dMSA without opening new gaps
Automatically managed passwords, retrieval rights, limits, migration steps, and caution around Windows Server 2025 dMSAs following the "BadSuccessor" research.
Active DirectoryActive Directory delegations: finding and cleaning up excessive rights on OUs and objects
GenericAll, WriteDacl, delegated password resets: how ACLs accumulated on OUs create attack paths, and how to analyse and then clean them up.
Active DirectoryMachineAccountQuota: why any user can still add ten computers to your domain
The default ms-DS-MachineAccountQuota lets any account create computer accounts. Why this makes many attacks easier, and how to delegate domain join properly instead.
Active DirectoryThe first 48 hours of an Active Directory compromise: contain, preserve, take back control
Containment, preserving evidence, resetting privileged accounts, the double krbtgt reset and its timing, the rebuild decision and communication: a framework for the first hours.
Active DirectoryAD-integrated DNS: securing zones, dynamic updates and the DnsAdmins group
Dynamic updates, record creation by any authenticated user, WPAD, wildcard records and the DnsAdmins group: the blind spots of Active Directory-integrated DNS.
Active DirectoryGroup Managed Service Accounts (gMSA): putting an end to static service passwords
gMSAs replace fixed-password service accounts with long, automatically rotated secrets. The key is still controlling who is allowed to retrieve them.
Active DirectoryMachineAccountQuota: why any user can join machines to your domain, and how to stop it
By default, every authenticated user can create up to ten computer accounts. A legacy setting that enables several attack paths and is simple to fix.
Active DirectoryThe Protected Users group: strong protections for privileged accounts, deployed with care
No NTLM, no delegation, no RC4, short-lived TGTs: Protected Users hardens sensitive accounts with no extra tooling. How to use it and the pitfalls to avoid.
Active DirectoryAuthentication policies and silos: restricting where Tier 0 accounts can sign in
Authentication silos let the domain controller refuse a Kerberos ticket to a privileged account signing in from an unauthorised machine.
Active DirectoryDangerous ACLs in Active Directory: forgotten delegations that lead to Domain Admins
GenericAll, WriteDACL, WriteOwner, password reset: some permissions on sensitive objects are as good as membership of privileged groups.
Active DirectoryShadow credentials: understanding and controlling the msDS-KeyCredentialLink attribute
Designed for Windows Hello for Business, the msDS-KeyCredentialLink attribute lets whoever can write it authenticate as the account. Who holds that right in your domain?
Active DirectorySecrets in SYSVOL: cpassword, scripts and clear-text passwords readable by everyone
More than ten years after MS14-025, we still find Group Policy Preferences passwords and clear-text credentials in SYSVOL. How to find and remove them.
Active DirectoryProtecting LSASS: LSA protection and Credential Guard, what they block and what they don't
In-memory credential theft remains central to Active Directory compromises. Two protections built into Windows make it much harder, provided they are deployed correctly.
Active DirectoryStopping privileged accounts from signing in to lower tiers with user rights assignment
"Deny log on" user rights applied through Group Policy make the tier model real: a domain administrator must never leave credentials on a user workstation.
Active DirectoryPrivileged Access Workstations (PAW): administering Active Directory from a clean source
Administering the domain from the machine you also use for email exposes your most sensitive accounts to the first successful phishing. Principles and architecture of a privileged access workstation.
Active DirectoryForest and domain functional levels: what each level actually brings to security
Protected Users, authentication policies, LAPS encryption, the Windows Server 2025 level: the protections tied to functional levels, and how to raise them safely.
Active DirectoryDomain controllers on unsupported Windows Server versions: getting out of the dead end cleanly
An unpatched domain controller exposes the whole forest. Inventory, in-place upgrade versus new DC, demotion and metadata cleanup.
Active DirectoryRead-only domain controllers: getting the Password Replication Policy right
An RODC is only as safe as its Password Replication Policy. Allowed and denied groups, dedicated krbtgt accounts, delegated administrators and branch office risks.
Active DirectoryAD-integrated DNS: secure updates, record creation rights and booby-trapped records
Dynamic updates, Authenticated Users rights, wildcard and WPAD records, the DnsAdmins group, scavenging: the DNS settings that matter for AD security.
Active DirectoryLLMNR, NBT-NS and mDNS: shutting down the fallback name resolution that leaks your NTLM hashes
When DNS fails, Windows asks the local network and trusts the first answer. Understanding poisoning, disabling these protocols via GPO and DHCP, and anticipating what might break.
Active DirectoryDHCPv6 spoofing and WPAD: when a network "without IPv6" becomes a way in
Windows prefers IPv6 even where nobody deployed it. How a rogue DHCPv6 server hijacks DNS and WPAD to feed NTLM relay, and the right countermeasures.
Active DirectoryKerberos encryption: moving off RC4 to AES without breaking services
RC4 makes Kerberoasting easier and Microsoft is preparing its retirement. msDS-SupportedEncryptionTypes, accounts without AES keys, ticket logs: a method to migrate safely.
Active DirectoryRisky userAccountControl flags: finding and fixing them before an attacker does
Password not required, reversible encryption, DES, unconstrained delegation: these quiet bits weaken your accounts. How to find them and remove them properly.
Active DirectorySIDHistory: the migration legacy that can hide privileges
Essential during a migration, SIDHistory becomes a risk if it lingers. Legitimate use, abuse for persistence, auditing, cleanup and SID filtering on trusts.
Active DirectoryActive Directory Recycle Bin: enabling it, restoring objects and knowing its limits
An accidentally deleted OU should never require restoring a domain controller. Enabling, lifetimes, restoring objects and memberships, and what only a backup still covers.
Active DirectoryMicrosoft Defender for Identity: what the sensors really detect, and what they do not replace
Sensors on domain controllers, AD FS, AD CS and Entra Connect, detections, posture assessments and tuning: how to get value from Defender for Identity without expecting miracles.
Active DirectoryNetwork isolation of domain controllers: no Internet, controlled flows and an active firewall
A domain controller does not browse the Internet, accepts administration only from dedicated workstations and filters its traffic: the network rules that protect the heart of the directory.
Active DirectoryTime synchronization in Active Directory: the PDC emulator, Kerberos and virtualization pitfalls
A skewed clock breaks Kerberos, corrupts logs and weakens certificates. How to build a reliable time hierarchy, from the PDC emulator down to virtualized domain controllers.
Active DirectoryPasswords in Active Directory attributes: the Description field anyone can read
Description, info, comment, userPassword: passwords sit in attributes any authenticated user can read. How to find them, remove them and keep them from coming back.
Active DirectoryDesigning OUs for delegated administration without creating attack paths
Separate tiers, delegate to groups rather than people, control inheritance and document everything: the principles of an OU structure that supports security instead of undermining it.
Active DirectorySchema Admins and Enterprise Admins: groups that should stay empty
The two most powerful groups in the forest only need members a few hours a year. Temporary membership, hardening the built-in Administrator account and monitoring changes.
Active DirectoryDomain password policy: favour length, rethink lockout
Length over complexity, passphrases, lockout threshold versus password spraying and fine-grained policies: bringing the domain policy in line with current guidance.
Active DirectoryPre-Windows 2000 Compatible Access and anonymous access: closing directory enumeration
A legacy group, a dSHeuristics setting and a few security options can be enough to open the directory to anonymous queries. How to check and harden without breaking applications.
Active DirectoryWDigest, LM hashes and NTLMv1: removing the legacy settings that expose credentials
Clear-text passwords in memory, stored LM hashes, NTLMv1 authentication still accepted: three legacy issues still found in audits, and the Group Policy settings that fix them.
Active DirectoryAuthentication coercion and NTLM relay: understanding PetitPotam and its relatives to defend against them
PetitPotam, DFSCoerce, the printer bug: forcing a domain controller to authenticate, then relaying that authentication. The concept, and the measures that break the chain.
Methodology
Deploying Windows Hello for Business: choosing the right trust model and planning recovery
Cloud Kerberos trust, key trust or certificate trust, PIN policy and reset: the choices that determine a successful Windows Hello for Business rollout.
MethodologyDevice settings in Entra ID: joining, local administrators, LAPS and clean-up
Who can join or register devices, who becomes local administrator, how to enable cloud Windows LAPS and how to clean up stale devices without nasty surprises.
MethodologyOrganising alert and incident triage in Defender XDR
Incident correlation, severity, automated investigation, alert tuning and clear roles: a method to make sure the Defender XDR incident queue is actually worked through.
MethodologyRaising domain and forest functional levels: method and security benefits
Prerequisites, retiring old domain controllers, migrating from FRS to DFSR and what each level brings up to Windows Server 2025: a method for raising functional levels safely.
MethodologyAfter the audit: prioritising remediation and measuring progress
Quick wins or structural work, risk-based ordering, owners, metrics and follow-up audit: how to turn an audit report into real improvements.
MethodologyMicrosoft Secure Score: a useful roadmap, a misleading target
How Secure Score is calculated, why a high score can hide real weaknesses, how to handle third-party mitigations and how to use it as a roadmap rather than a goal.
MethodologyPreparing for a Microsoft security audit: scope, access, documents and stakeholders
A well-prepared audit goes further in the same time. Scope, read-only accounts, documents to gather, people to involve and what the deliverable contains: the checklist before starting.
MethodologyCertificate-based authentication in Entra ID: bindings, affinity and revocation
Native certificate-based authentication in Entra ID lets you use smart cards and certificates without AD FS. Use cases, binding rules, affinity, revocation lists and protection level.
MethodologyThe Active Directory Recycle Bin: enabling it, object lifetime and limits versus a real backup
Enabling the Recycle Bin, understanding deleted object lifetime, restoring an object and its memberships, and knowing its limits compared to an authoritative restore or a backup.
MethodologyMicrosoft 365 groups and Teams: governing creation, naming and lifecycle
Who can create groups and teams, naming policy, expiration policy, ownerless groups and per-group guest settings: the levers to prevent uncontrolled sprawl.
MethodologyBuilding a Conditional Access baseline by persona
Admins, users, guests, service accounts: structure Conditional Access by persona for a baseline that is readable, testable and lockout-free.
MethodologyThe authentication methods policy: migrate, clean up and enforce the right methods
Moving from legacy per-user MFA and SSPR settings to the unified authentication methods policy, retiring SMS and voice, and steering users towards stronger methods.
MethodologyRolling out FIDO2 passkeys in Entra ID: approach, pitfalls and recovery planning
Device-bound or synced passkeys, Authenticator, AAGUID restrictions, pilot phase, Temporary Access Pass and recovery: a practical method for a controlled rollout.
MethodologyReducing NTLM in Active Directory: a realistic six-step roadmap
NTLM is still everywhere and fuels relay attacks. Auditing, NTLMv1 removal and gradual restrictions: a method to shrink its use without breaking production.
MethodologyThe Active Directory tiering model, applied for real
Tier 0, admin workstations, separate accounts, logon restrictions: implementing Active Directory tiering in a realistic way.
MethodologyEntra ID administrative units: delegate by entity or country without tenant-wide roles
How administrative units let you hand over management of an entity's users, groups and devices without granting roles that apply across the entire tenant.
MethodologyRotating the krbtgt password: why twice, and how to do it without breaking anything
The krbtgt password signs every Kerberos ticket in the domain. A two-step rotation method, the waiting periods to respect, RODC accounts and a sensible frequency.
MethodologyIntune compliance: the often-neglected foundation of "require compliant device"
A Conditional Access policy requiring a compliant device is only as strong as the Intune compliance policies behind it. What to check, and the traps that create false confidence.
MethodologyActive Directory backup: preparing a forest recovery before you need one
System state backups, offline copies, tombstone lifetime, DSRM passwords and an isolated recovery test: the foundations of a credible Active Directory recovery plan.
MethodologyEntra ID access packages: ending "please add me to the group" requests by email
Catalogs, policies, approvals, expiry and connected organisations: how entitlement management replaces ad-hoc access requests with a governed process.
Security
Teams apps: regaining control over what users install
Org-wide app settings, permission policies versus app centric management, third-party apps and Graph permissions, and custom app uploads: how to govern Teams apps.
SecurityAuthentication coercion and NTLM relay: understanding the risk and reducing it
Why forcing a server to authenticate and then relaying that authentication still works, and the mitigations that matter: EPA, hardening AD CS, LDAP channel binding, RPC filters.
SecurityBYOD without enrolment: protecting data with Intune app protection policies
Controlling Microsoft 365 access from personal smartphones without enrolling them: data transfer restrictions, Conditional Access requiring app protection, and selective wipe.
SecuritySecrets, certificates and federated credentials: credential hygiene for Entra ID apps
Client secrets, certificates or federated credentials: which to choose, how to manage expiry and owners, and why credential additions on service principals must be monitored.
SecuritySafe Attachments and Safe Links in Defender for Office 365: what really weakens protection
Preset or custom policies, dynamic delivery, exclusions and "do not rewrite" lists, Teams and Office coverage: the points to check in Safe Attachments and Safe Links.
SecurityAnonymous LDAP and "Pre-Windows 2000 Compatible Access": closing unauthenticated reads
dSHeuristics, members of the "Pre-Windows 2000 Compatible Access" group, null sessions: how a directory can still be read without any account at all, and how to close it.
SecurityPurview Message Encryption: choosing the right protection and avoiding the pitfalls
Encrypt-Only or Do Not Forward, templates, the external recipient experience and mail flow rules to apply encryption: what you need to know before rolling it out widely.
SecurityExchange Online mail flow rules: a blind spot worth auditing
Hidden BCC copies, redirects, spam filtering bypasses and domain allow-lists: how mail flow rules turn into a risk and how to review them methodically.
SecurityAiTM phishing: when MFA is no longer enough to protect sessions
Adversary-in-the-middle phishing kits steal session cookies after MFA. Detection signals, incident response and the real fix: phishing-resistant MFA.
SecurityApplication consent: closing the door on illicit consent grant attacks
Restricting user consent, setting up the admin consent workflow and reviewing the permissions already granted to applications in your tenant.
SecurityEntra ID emergency access accounts: set them up without creating a back door
Two accounts, phishing-resistant authentication, controlled exclusions and an alert on every sign-in: how to make emergency access safe.
SecurityEntra PIM: replacing standing admin roles with just-in-time activation
How Privileged Identity Management replaces standing administrator roles with just-in-time activation that is justified, approved, time-limited and audited.
SecurityDefender for Office 365 anti-phishing policies: going beyond the defaults
User and domain impersonation protection, mailbox intelligence, spoof intelligence, safety tips and preset security policies: the settings that really matter.
SecuritySPF, DKIM and DMARC for Microsoft 365: the complete setup, domain by domain
SPF record, enabling DKIM selectors, moving DMARC step by step to p=reject and protecting parked domains: a practical method for Microsoft 365 tenants.
SecurityWindows LAPS: migrating from legacy LAPS and locking down who can read passwords
Built into Windows since April 2023, Windows LAPS replaces legacy Microsoft LAPS with encryption, DSRM backup, Entra ID support and post-authentication actions.
SecurityInbox rules and forwarding in Exchange Online: the favourite persistence of payment fraud
Rules that hide replies, external forwarding, OAuth apps: how attackers persist in a compromised mailbox, and how to detect them.
SecurityKerberoasting: protecting service accounts before their passwords are cracked offline
Any domain user can request a ticket for a service account with an SPN and try to crack its password offline. Here is how to shut that attack path down.
SecurityWorkload identities: the accounts nobody watches
Service principals, secrets, application permissions: why non-human identities have become a major Entra ID attack surface.
SecurityAS-REP roasting: hunting down accounts without Kerberos preauthentication
One ticked box, "Do not require Kerberos preauthentication", is enough to expose a password to offline cracking. Here is how to find and fix it.
SecurityEntra Password Protection: banned lists, smart lockout and on-premises AD
Global and custom banned password lists, smart lockout and domain controller agents: how to stop weak passwords in the cloud and in on-premises Active Directory.
SecurityAdminSDHolder and SDProp: understanding, auditing and cleaning up protected accounts
AdminSDHolder protects privileged AD accounts, but it can also become a persistence mechanism. How to audit its ACL and clean up orphaned adminCount values.
SecurityToken theft: what MFA no longer covers, and how to shrink the window
AiTM proxies and cookie theft bypass classic MFA. Phishing-resistant MFA, compliant devices, token protection and CAE shrink the exploitation window.
SecurityEntra ID Protection: making sign-in risk and user risk work for you
Sign-in risk, user risk, detections, risk-based Conditional Access and remediation: how to get real value from Entra ID Protection without drowning in false positives.
SecurityLDAP signing and channel binding: closing the door on relay attacks against your DCs
Without LDAP signing and channel binding, a relayed authentication can modify your directory. Event 2889, DC settings and a rollout plan that avoids breakage.
SecurityNamed locations and country blocking: useful, but never enough
What geographic blocking in Conditional Access really protects against, its limits with VPNs, proxies and IPv6, and why location must never be a substitute for MFA.
SecurityTeams external access: when open federation becomes a phishing channel
External access versus guest access, open federation, unmanaged Teams accounts and anonymous meeting join: the Teams settings to review to reduce phishing risk.
SecurityAD CS: reading ESC1 to ESC8 without being a PKI expert
Over-permissive certificate templates, rights on the PKI, NTLM web enrollment: the ESC scenarios explained simply, and how to fix them.
SecuritySharePoint and OneDrive on unmanaged devices: restrict without stopping work
Limited web-only access, sync restricted to managed PCs, app-enforced restrictions and idle session sign-out: how to control SharePoint and OneDrive on unmanaged devices.
SecuritySMB signing and SMBv1 removal: two jobs you should not put off
Relay to SMB and SMBv1 remain common attack vectors. Require signing, audit then remove SMBv1, and plan for the performance impact before you enforce.
SecurityGroups and privilege escalation: when a group owner becomes an administrator
Role-assignable groups, group owners, Azure permissions and Conditional Access exclusions: how an ordinary group can open a path to a privileged role.
SecurityGPO security: edit rights, delegation and passwords left behind in SYSVOL
Who can edit the GPOs linked to your domain root or domain controllers, and what is still lying in SYSVOL? A practical review of permissions and forgotten secrets.
SecurityKerberos delegation: three mechanisms, three ways to lose the domain
Unconstrained, constrained with protocol transition, RBCD: how a useful authentication mechanism becomes a path to domain admin.
SecurityExchange Online: SMTP AUTH, POP and IMAP, the legacy protocols still left open
Basic authentication has largely gone from Exchange Online, yet SMTP AUTH, POP and IMAP often remain enabled by default. How to close them without breaking your printers.
SecurityEntra ID dynamic groups: when a poorly chosen attribute opens the door
Dynamic membership rules rely on attributes that others may be able to influence. Guests, HR synchronisation, devices: the risks involved and how to write safer rules.
SecurityDCSync: who really holds replication rights on your domain?
Replicating Directory Changes rights let anyone pull every password hash from the domain. Who should hold them, how to spot unexpected holders and detect DCSync.
SecurityMailbox delegation: FullAccess and SendAs, the silent accumulation of access
FullAccess, SendAs, SendOnBehalf and folder permissions: how mailbox delegations pile up over the years in Exchange Online, and how to review them with PowerShell.
SecurityDevice code phishing: understanding the attack and blocking the flow safely
How the device code flow is abused to steal tokens despite MFA, and how to block it with the Conditional Access authentication flows condition after identifying legitimate uses.
SecurityYour Entra Connect server is a domain controller in disguise
Replication rights, PTA agents, the AZUREADSSOACC account: why the hybrid sync server must be protected like a domain controller.
SecurityPrint Spooler on domain controllers: closing a door nobody uses
Why the Print Spooler has no place on a domain controller, and which complementary protections neutralize forced-authentication attacks.
SecurityPower Automate: when a three-click flow exfiltrates your data
Connectors to personal services, a default environment open to everyone and Power Platform DLP policies: how to govern Power Automate without stifling innovation.
SecurityMicrosoft 365 Copilot: the oversharing your permissions were hiding until now
Copilot only surfaces what users can already open, but it makes oversharing visible. Broad links, "Everyone except external users": what to fix before you roll it out.
SecuritySelf-service password reset: convenient for users, and potentially for attackers too
Allowed methods, number of factors, security questions, the admin policy and writeback: how to secure SSPR so it does not become an account takeover route.
SecurityForgotten privileged groups: Operators, DnsAdmins and other quiet paths to domain admin
Account Operators, Server Operators, Backup Operators, DnsAdmins and more: built-in groups with near Domain Admin power that should usually stay empty.
SecurityShared mailboxes: why you should block sign-in on their user accounts
Every shared mailbox is backed by an Entra ID user account with a password. Left enabled, it becomes a quiet entry point that attackers love to find.
SecurityCross-tenant access settings: controlling who comes in, who goes out, and to which tenants
Default and per-organisation settings, MFA trust, B2B direct connect and tenant restrictions v2: taking back control of external collaboration in Entra ID.
SecurityDomain and forest trusts: SID filtering, selective authentication and forgotten links
Trust direction and transitivity, SID filtering, SID history, selective authentication and links to former partners: how to audit the boundaries of your Active Directory.
SecurityExchange, SharePoint, Teams: who really holds admin rights in your tenant?
Entra ID directory roles only tell part of the story. Exchange Online, SharePoint and Teams each have their own delegation models that deserve a review.
SecurityPassword policies in AD: default policy, fine-grained PSOs and length over complexity
Default domain policy, fine-grained policies for admins and service accounts, length, lockout and reversible encryption: building a consistent Active Directory password policy.
SecurityToo many Global Administrators: finally applying least privilege in Entra ID
Why Global Administrators multiply, what Microsoft recommends, and how to map each everyday task to the least-privileged built-in Entra ID role.
Compliance
Obsolete systems in Active Directory: inventory, isolate and keep an exceptions register
Spotting end-of-support operating systems from the operatingSystem attribute, gauging the risk they pose to the domain, isolating them and documenting every exception.
ComplianceGDPR and Microsoft 365: the practical checkpoints
Data processing terms, EU Data Boundary, data subject requests, retention, access logging and transfers: what to check in a Microsoft 365 tenant.
ComplianceInsider Risk Management in Purview: use cases, pseudonymisation and the French framework
Departing employees, data leaks, pseudonymisation, works council consultation and impact assessment: how to start with Insider Risk Management in a useful and defensible way.
ComplianceGuest accounts: lifecycle, inactive guests and access reviews
Guests pile up and never leave. Invitation settings, directory access restrictions, finding inactive guests and access reviews to keep their lifecycle under control.
ComplianceISO 27001:2022: the Annex A controls that rely on Microsoft 365, and the evidence auditors expect
Access control, authentication, logging, data leakage: which Annex A controls rely on Microsoft 365 and which evidence to prepare for the certification auditor.
ComplianceeDiscovery in Purview: controlling an investigation tool as powerful as an administrator
eDiscovery roles, cases, holds, separation of duties and auditing the searches themselves: how to use eDiscovery for internal investigations without creating a new risk.
ComplianceNIS2 and identity: turning the directive's requirements into Entra ID and Microsoft 365 controls
MFA, privileged access, logging, incident handling: what NIS2 expects regarding identity, and how to demonstrate it in practice in a Microsoft environment.
ComplianceOrphaned and inactive SharePoint sites: regaining control of the data lifecycle
Why sites with no owner and no activity are a risk, how to find them, and how to organise ownership, archiving and deletion without losing data that still matters.
CompliancePower Platform governance: environments, DLP policies and maker inventory
A default environment open to everyone, unrestricted connectors, orphaned flows: how to regain control over Power Apps, Power Automate and Copilot Studio.
ComplianceThe Microsoft 365 unified audit log: verify it, search it, keep it
Enablement, licence-based retention, searching in Purview and PowerShell, the MailItemsAccessed event and export: making real use of the unified audit log.
ComplianceMicrosoft Purview DLP: getting started without drowning your team in alerts
Sensitive information types, policy locations, simulation mode and policy tips: the fundamentals for rolling out Microsoft Purview DLP gradually and under control.
ComplianceSensitivity labels: a rollout that protects data without paralysing users
A short taxonomy, encryption and its side effects, default and automatic labelling, container labels and user training: the keys to a successful Microsoft 365 rollout.
ComplianceEntra ID logs: why 30 days of retention is not enough to investigate an incident
Default retention, diagnostic settings, non-interactive and service principal sign-ins: which Entra ID logs to export before you actually need them.
ComplianceGuests and external sharing in Microsoft 365: regain control without blocking collaboration
Invitation settings, SharePoint sharing, anonymous links, access reviews: control external access in Microsoft 365 and prove it.
ComplianceRetention and litigation hold in Microsoft 365: it is not a backup
Retain or delete, retention labels or policies, the Preservation Hold library and eDiscovery holds: understanding Microsoft 365 retention without mistaking it for backup.
ComplianceAccess reviews for privileged roles: from box-ticking to audit-ready evidence
Scheduling, choosing reviewers, auto-applying results and the evidence auditors expect: how to run access reviews in Entra ID that actually reduce risk.
ComplianceStale accounts in Active Directory: identifying them reliably and cleaning them up
Dormant user and computer accounts: reading lastLogonTimestamp correctly, disabling before deleting, handling service accounts and keeping evidence for audits.
ComplianceActive Directory auditing: advanced audit policy and the events worth watching
Configuring advanced audit policy on domain controllers, choosing the key events, sizing logs and forwarding them to a SIEM: the foundation of Active Directory detection.
ComplianceJoiners, movers, leavers: bringing the Entra ID account lifecycle under control
Stale accounts, disabled but licensed users, orphaned guests and lifecycle workflows: how to evidence a leaver process that satisfies ISO 27001 and NIS2.
ComplianceDORA and Microsoft 365: what evidence can you produce on your cloud environment?
Applicable since 17 January 2025, DORA requires financial entities to demonstrate control of ICT risk. Microsoft 365 and Entra ID sit right at the centre of it.
Architecture
Reaching internal apps without a VPN: application proxy, Private Access and a migration plan
Replacing the VPN with per-application access: Entra application proxy, Global Secure Access and Private Access, Conditional Access integration and a gradual migration plan.
ArchitectureDesigning your log architecture: which sources to send to Sentinel, for how long and at what cost
Entra ID, Microsoft 365, Active Directory, Defender: which sources to collect in a SIEM such as Sentinel, how to tier retention and keep costs under control by starting from detections.
ArchitectureExchange hybrid today: what the on-premises server still does and how to do without it
Recipient management, SMTP relay, hybrid server security and AD permissions: what the last on-premises Exchange server really does, and the path to removing it.
ArchitectureConsolidating Active Directory forests and domains: approaches, SID history risks and trust clean-up
Why legacy multi-domain designs persist, how to migrate towards a simpler forest, and how to stop SID history and trusts from becoming attack paths.
ArchitectureZero Trust for Microsoft 365: a pragmatic reference architecture and the order in which to build it
Identities, devices, apps, data, network and telemetry: a concrete Zero Trust architecture for Microsoft 365, stripped of marketing talk, with a realistic build order.
ArchitecturePrivileged access workstations: designing PAWs that genuinely respect the clean source principle
Admin tiers, the clean source principle, jump servers versus PAWs, cloud-managed workstations: how to design the devices from which your critical systems are administered.
ArchitectureDesigning a two-tier AD CS PKI: offline root, Tier 0 issuing CAs and controlled templates
Offline root, issuing CAs treated as Tier 0, template hygiene, CRL and AIA publishing, HSM use: the architectural choices behind a sound Active Directory PKI.
ArchitectureHybrid identity: choosing between Entra Connect Sync and Cloud Sync, and scoping what gets synchronised
Connect Sync or Cloud Sync, supported topologies, a staging server for resilience, OU filtering and source of authority: the design choices behind a sound hybrid identity.
ArchitectureBacking up Microsoft 365: retention is not backup, and restores must be tested
Shared responsibility, the limits of retention, Microsoft 365 Backup or a third-party tool, ransomware and mass deletion scenarios: how to design a backup that actually restores.
ArchitectureOne or several Microsoft 365 tenants: the criteria that should drive the decision
Mergers, subsidiaries, sovereignty, admin isolation: when a single tenant makes sense, when several should be kept, and what each choice really costs to run.