MFA proves who is signing in. It says nothing about the device they are using. A stolen password plus a phished MFA prompt on an attacker's laptop still looks like a valid sign-in. Requiring device compliance in
Not every phishing attack wants your password. OAuth consent phishing in Microsoft 365 tricks a user into clicking Accept on a genuine Microsoft sign-in prompt that grants a malicious app access to their mail, files or calendar.
Windows Firewall is one of those controls everyone assumes is on and nobody looks at. In the tenants I review, the most common situation is a firewall that is technically enabled but riddled with local allow rules
Illustrative scenario: the organization below is a fictional composite. It reflects problems and fixes we commonly see in Microsoft 365, Intune, Purview and Azure environments. Names and figures are examples, not a specific client. This business email
Phishing drills have a reputation problem. Done badly, they feel like a trap: staff get caught, get embarrassed, and learn to resent IT. Done well, they are one of the most useful security habits a business can
Almost every tenant I review has Intune compliance policies. Far fewer have compliance policies that actually mean anything. A policy that only checks "is this Windows" will mark every device green, and the moment you link it
When a user says "I can't sign in" or an alert says "suspicious sign-in", the answer is almost always in the Entra sign-in logs. The problem is that the logs are dense, full of codes and tabs,
If your Microsoft 365 plan includes Defender for Office 365, you already have Safe Links and Safe Attachments. The question is which version of them is protecting your staff. Most tenants run on the Built-in protection that
Standing admin rights are a gift to attackers. An account that is Global Administrator around the clock is just as powerful at 3 a.m. on a Sunday as it is during a planned change. Privileged Identity Management,
The worst Conditional Access incident is not an attacker getting in. It is every administrator getting locked out because one policy was saved with the wrong setting. A properly built Conditional Access break glass account, plus a