Baselines, Conditional Access, MFA and Defender: the Microsoft 365 settings that keep a tenant out of trouble, and how to roll them out whether you manage one tenant or fifty.
Microsoft is rolling out Hero Links in SharePoint and OneDrive: one primary sharing link per file or folder, with permissions you can change after it's sent. Here's what's new and what admins need to check.
Microsoft just introduced Conditional Access Policy Plans, a new feature in Microsoft Entra, now in preview, that changes how we organize and manage Conditional Access policies.
Passkey registration failing in Microsoft 365? Here are six common problems, from missing registration options to Conditional Access loops and lost phones, and how to troubleshoot and fix each one.
The ConnectWise Cloud Backup (formerly SkyKick) incident showed how a compromised vendor app can reach Microsoft 365 tenants without passwords or MFA. Here are 4 steps to lock down third-party applications.
Microsoft is finally addressing one of the biggest limitations of Security Defaults in Microsoft 365: the all-or-nothing configuration. For years, Security Defaults has provided businesses with a free baseline of identity security protections, including MFA and blocking legacy authentication. The problem? There was almost no flexibility. Now Microsoft is introducing individually managed Security Defaults protections, […]
Earlier this year, attackers got into a client environment using the credentials of a former MSP employee. That person had left, but their partner account in the client tenant was still enabled and still privileged. The attackers used it to move through the environment, and it ended in a data breach and ransomware. Dormant accounts […]
Microsoft is officially moving customers away from SMS and voice authentication in Microsoft Entra ID. For MSPs, this is more than another Microsoft change notification. It affects how users authenticate, how they recover their accounts, and how you should plan migrations across every customer tenant you manage. Beginning September 1, 2026, Microsoft will start automatically […]
On March 11th, 2026, employees at Stryker began their day to blank screens. Within three hours, roughly 80,000 devices had been wiped across the company’s 61-country footprint. Not encrypted. Not ransomed. Erased. No malware was involved. An Iran-linked hacktivist group compromised an admin account and used Microsoft’s own Intune remote wipe capability to erase the […]
Microsoft quietly dropped Entra Backup and Recovery into Public Preview in March 2026. Before this feature, Entra ID had no native rollback capability for most object types. A deleted security group was gone permanently, no recycle bin, no soft-delete window. A misconfigured Conditional Access policy meant a manual rebuild. A corrupted service principal meant starting […]
Most MSPs don’t discover security gaps because they were looking for them. They find them mid-ticket, during a breach, or when a client calls with a problem that shouldn’t exist. A Conditional Access policy that was never deployed. Legacy authentication still wide open. Something that should have been caught six months ago. I built CloudCapsule […]
Here’s something that bothers me about the MSP industry: we hand technicians the keys to dozens, sometimes hundreds, of Microsoft 365 tenants, and then we expect them to just figure out security on the job. No structured training. No safe place to practice. Just production environments and the hope that nothing goes wrong. If you’re […]
Guest users are one of the most powerful collaboration features in Microsoft 365. They allow organizations to work with vendors, consultants, customers, and partners without creating full internal accounts. But if you ask most administrators how guest users get created in their tenant, the answer is usually simple. Someone sends an invite. That answer is […]
Harden it once, then know it stays that way.
CloudCapsule scans 300+ Microsoft 365 security controls in about a minute, shows what to fix first, fixes findings at scale, and flags drift the day a setting changes.
No credit card required. Results in about a minute.
