Imagine this scenario. Your CFO signs into Microsoft 365 from Denver.Two minutes later, there is another successful login. This time it is from Eastern Europe. No VPN.No approved travel.No reasonable explanation. That is impossible travel and it almost always means the account is compromised. What makes this more concerning is not just the attack itself. […]
For most of us out there, conditional access is something we still either struggle with or have extreme inconsistencies when it comes to implementing policies across our customer environments. I would say that most environments still have some pretty significant security holes given misconfiguration of policies or a lack of understanding in the scope of […]
Microsoft is currently in preview with a new session attribute in Conditional Access policies that Requires token protection for sign-ins. Full Details: Microsoft Entra Conditional Access token protection explained – Microsoft Entra ID | Microsoft Learn Microsoft recently changed the licensing requirement to make this available in Entra ID P1 licensing. With that said, there are […]
In today’s digital age, cyberattacks are constantly evolving, and one of the fastest-growing threats in the Microsoft 365 ecosystem is token theft, also known as token replay attacks. This attack method has surged over 111% year-over-year, and today I’m going to walk you through what token theft is, how it works, why it’s a threat […]
If you’re an MSP, you’ve probably seen it: the business wants frictionless collaboration with vendors, contractors, and partner companies. They’re sharing files in SharePoint, chatting in Teams, moving fast… and the security model quietly drifts into “wide open.” This post walks through a real-world-style scenario (Tech Corp) and the exact Microsoft 365 controls that can […]
Microsoft is finally addressing one of the biggest limitations of Security Defaults in Microsoft 365: the all-or-nothing configuration. For years, Security Defaults has provided businesses with a free baseline of identity security protections, including MFA and blocking legacy authentication. The problem? There was almost no flexibility. Now Microsoft is introducing individually managed Security Defaults protections, […]
In today’s attack landscape, not all MFA methods should be treated equal. Across Microsoft 365 tenants, one of the fastest-growing attack techniques I’m seeing today is Adversary-in-the-Middle (AiTM) phishing — often paired with token theft. In this post, I’ll walk through: How an AiTM attack actually works Why traditional MFA fails in these scenarios And […]
Microsoft Entra has a wealth of security features that often fly under the radar—yet they can make a significant difference in protecting your environment. The best part? Many of these settings are already included in base licenses like Microsoft 365 Business Premium. Let’s walk through five lesser-known Entra settings that you can enable today to […]
If you want to provide secure access to your corporate data on personal smart phones without enrolling that device under full IT management, stay tuned because in this article, I am going to show you the exact policies you need to configure to protect your organization. Access on the Go When we think about users […]
Many MSPs have been using a third-party tool like JAMF or Addigy to manage macOS devices in customer environments because of the limitations of Intune. Over the years, Microsoft has been adding a good amount of management functionality specifically for macOS devices. One of the latest releases is giving you the ability to manage the […]
Uploading 52% Purpose The purpose of this article is to explain Security Defaults and end of life for baseline policies. I give you recommended actions to take to replace these policies and how to manage security defaults for you customers in the future. Full Video Walk-through For those of you who need more of a visual. Highlights/Considerations Enforced February 29th, […]
In a previous post, I walked you through an incident response playbook for Token Theft via AiTM. This playbook can be leveraged for BEC incidents as well. Today’s deep dive is going to look at proactive protections you can put into place to PREVENT these attacks altogether. We will be focusing on Conditional Access Policies […]
Microsoft quietly dropped Entra Backup and Recovery into Public Preview in March 2026. Before this feature, Entra ID had no native rollback capability for most object types. A deleted security group was gone permanently, no recycle bin, no soft-delete window. A misconfigured Conditional Access policy meant a manual rebuild. A corrupted service principal meant starting […]
Most MSPs don’t discover security gaps because they were looking for them. They find them mid-ticket, during a breach, or when a client calls with a problem that shouldn’t exist. A Conditional Access policy that was never deployed. Legacy authentication still wide open. Something that should have been caught six months ago. I built CloudCapsule […]
Privileged accounts are the #1 target for attackers. One compromised Global Administrator can mean full control of mail, SharePoint, Teams, Defender…everything. The fallout is real: downtime, legal exposure, regulatory headaches, and direct financial loss. A pattern I see often: IT teams feel safe because they’ve rolled out MFA and Conditional Access for users… while the […]
Many of us have set up a geo-blocking conditional access policy to prevent sign ins from unapproved countries. If you haven’t already, look to implement this as it gives you great protection against potentially malicious sign ins. This policy inevitably creates a support burden when users are traveling to a country that is not approved […]
MFA settings in Azure AD have evolved so much over the past few years and I believe that will continue at an even greater pace with the introduction of Microsoft Entra. I believe if you are a progressive MSP, you have moved your customers to licensing that supports Conditional Access over the legacy “per user” […]
Uploading 52% Download Guide The purpose of this guide is to lay out the steps for implementing Intune. This guide is assuming you have the M365 Business License. It can apply to EMS licenses but some features will not be covered such as Conditional Access and Windows Autopilot. After you complete this guide you will […]
