Baselines, Conditional Access, MFA and Defender: the Microsoft 365 settings that keep a tenant out of trouble, and how to roll them out whether you manage one tenant or fifty.
Microsoft is finally addressing one of the biggest limitations of Security Defaults in Microsoft 365: the all-or-nothing configuration. For years, Security Defaults has provided businesses with a free baseline of identity security protections, including MFA and blocking legacy authentication. The problem? There was almost no flexibility. Now Microsoft is introducing individually managed Security Defaults protections, […]
Earlier this year, attackers got into a client environment using the credentials of a former MSP employee. That person had left, but their partner account in the client tenant was still enabled and still privileged. The attackers used it to move through the environment, and it ended in a data breach and ransomware. Dormant accounts […]
Microsoft is officially moving customers away from SMS and voice authentication in Microsoft Entra ID. For MSPs, this is more than another Microsoft change notification. It affects how users authenticate, how they recover their accounts, and how you should plan migrations across every customer tenant you manage. Beginning September 1, 2026, Microsoft will start automatically […]
On March 11th, 2026, employees at Stryker began their day to blank screens. Within three hours, roughly 80,000 devices had been wiped across the company’s 61-country footprint. Not encrypted. Not ransomed. Erased. No malware was involved. An Iran-linked hacktivist group compromised an admin account and used Microsoft’s own Intune remote wipe capability to erase the […]
Microsoft quietly dropped Entra Backup and Recovery into Public Preview in March 2026. Before this feature, Entra ID had no native rollback capability for most object types. A deleted security group was gone permanently, no recycle bin, no soft-delete window. A misconfigured Conditional Access policy meant a manual rebuild. A corrupted service principal meant starting […]
Most MSPs don’t discover security gaps because they were looking for them. They find them mid-ticket, during a breach, or when a client calls with a problem that shouldn’t exist. A Conditional Access policy that was never deployed. Legacy authentication still wide open. Something that should have been caught six months ago. I built CloudCapsule […]
Here’s something that bothers me about the MSP industry: we hand technicians the keys to dozens, sometimes hundreds, of Microsoft 365 tenants, and then we expect them to just figure out security on the job. No structured training. No safe place to practice. Just production environments and the hope that nothing goes wrong. If you’re […]
Guest users are one of the most powerful collaboration features in Microsoft 365. They allow organizations to work with vendors, consultants, customers, and partners without creating full internal accounts. But if you ask most administrators how guest users get created in their tenant, the answer is usually simple. Someone sends an invite. That answer is […]
Cyber Essentials is supposed to make your business safer but for many organizations, it ends up feeling expensive, overwhelming, and confusing. You start Googling Cyber Essentials tools and Cyber Essentials requirements, and suddenly you’re facing: A stack of quotes from new vendors Tools you’ve never heard of Technical controls that feel impossible to map The […]
Imagine this scenario. Your CFO signs into Microsoft 365 from Denver.Two minutes later, there is another successful login. This time it is from Eastern Europe. No VPN.No approved travel.No reasonable explanation. That is impossible travel and it almost always means the account is compromised. What makes this more concerning is not just the attack itself. […]
If you’re an MSP, you’ve probably seen it: the business wants frictionless collaboration with vendors, contractors, and partner companies. They’re sharing files in SharePoint, chatting in Teams, moving fast… and the security model quietly drifts into “wide open.” This post walks through a real-world-style scenario (Tech Corp) and the exact Microsoft 365 controls that can […]
In today’s attack landscape, not all MFA methods should be treated equal. Across Microsoft 365 tenants, one of the fastest-growing attack techniques I’m seeing today is Adversary-in-the-Middle (AiTM) phishing — often paired with token theft. In this post, I’ll walk through: How an AiTM attack actually works Why traditional MFA fails in these scenarios And […]
Harden it once, then know it stays that way.
CloudCapsule scans 300+ Microsoft 365 security controls in about a minute, shows what to fix first, fixes findings at scale, and flags drift the day a setting changes.
No credit card required. Results in < 2 minutes.
