Microsoft is finally addressing one of the biggest limitations of Security Defaults in Microsoft 365: the all-or-nothing configuration. For years, Security Defaults has provided businesses with a free baseline of identity security protections, including MFA and blocking legacy authentication. The problem? There was almost no flexibility. Now Microsoft is introducing individually managed Security Defaults protections, […]
Earlier this year, attackers got into a client environment using the credentials of a former MSP employee. That person had left, but their partner account in the client tenant was still enabled and still privileged. The attackers used it to move through the environment, and it ended in a data breach and ransomware. Dormant accounts […]
Microsoft is officially moving customers away from SMS and voice authentication in Microsoft Entra ID. For MSPs, this is more than another Microsoft change notification. It affects how users authenticate, how they recover their accounts, and how you should plan migrations across every customer tenant you manage. Beginning September 1, 2026, Microsoft will start automatically […]
Microsoft quietly dropped Entra Backup and Recovery into Public Preview in March 2026. Before this feature, Entra ID had no native rollback capability for most object types. A deleted security group was gone permanently, no recycle bin, no soft-delete window. A misconfigured Conditional Access policy meant a manual rebuild. A corrupted service principal meant starting […]
Guest users are one of the most powerful collaboration features in Microsoft 365. They allow organizations to work with vendors, consultants, customers, and partners without creating full internal accounts. But if you ask most administrators how guest users get created in their tenant, the answer is usually simple. Someone sends an invite. That answer is […]
Imagine this scenario. Your CFO signs into Microsoft 365 from Denver.Two minutes later, there is another successful login. This time it is from Eastern Europe. No VPN.No approved travel.No reasonable explanation. That is impossible travel and it almost always means the account is compromised. What makes this more concerning is not just the attack itself. […]
In today’s attack landscape, not all MFA methods should be treated equal. Across Microsoft 365 tenants, one of the fastest-growing attack techniques I’m seeing today is Adversary-in-the-Middle (AiTM) phishing — often paired with token theft. In this post, I’ll walk through: How an AiTM attack actually works Why traditional MFA fails in these scenarios And […]
Microsoft Entra has a wealth of security features that often fly under the radar—yet they can make a significant difference in protecting your environment. The best part? Many of these settings are already included in base licenses like Microsoft 365 Business Premium. Let’s walk through five lesser-known Entra settings that you can enable today to […]
Image Generated by Copilot 🙂 I get a lot of questions around best practices for break glass accounts in Microsoft 365 so wanted to document them in this article. To avoid locking yourself out of your Microsoft account, its advised (from Microsoft) to create 2 break glass accounts, one of which is excluded from all […]
For most of us out there, conditional access is something we still either struggle with or have extreme inconsistencies when it comes to implementing policies across our customer environments. I would say that most environments still have some pretty significant security holes given misconfiguration of policies or a lack of understanding in the scope of […]
