Blog Posts
Some time ago, I had a conversation with my girlfriend (also a Microsoft Consultant) about how to manage secure access for external admins. Probably not your average dinner talk at home. She explained that new customers would create an admin account for her, but she often couldn't sign
Blog Posts
This post is the second part of my favorite conditional access policies to implement. If you haven't read part one yet, you can find it here. In this post, I'm providing a high-level overview of five more conditional access policies to further harden your security
Blog Posts
A bit of light reading today, but still an important topic worth discussing: Conditional Access! If you're not very experienced with implementing these policies, this post might help set you up in the right direction. Conditional access policies are powerful tools for hardening your security posture with, and
Blog Posts
Microsoft Defender for Endpoint (MDE) is part of the Microsoft Defender platform, and is designed to protect devices and endpoints from various cyber threats. To implement this product successfully, the first step is ensuring efficient onboarding of new devices. So, I always ask myself, "Which MDE onboarding method suits
Blog Posts
Update: Microsoft has moved this feature from Public Preview to General Availability. I'll update this post once new features or changes are introduced. Recently, on July 7th, 2023, Microsoft announced the long-awaited Mobile Application Management (MAM) for Windows. Now that it has entered Public Preview, it allows
Blog Posts
In two previous blog posts, I wrote about enforcing limited web-only access on unmanaged devices using Conditional Access policies or Sensitivity Labels. However, in this blog post, I will talk about a third method that achieves a similar web experience for unmanaged devices by utilizing session policies in Microsoft
Quick Guides
Enabling Single Sign-On (SSO) for third-party browsers like Google Chrome and Firefox offers several benefits. Firstly, users won't have to repeatedly authenticate when working from different browsers. However from a security perspective, when SSO is enabled, Microsoft Intune is able to assess the device's
Quick Guides
In this quick and easy guide, I show you how to configure LAPS (Local Administrator Password Solution) with Microsoft Intune. LAPS is a solution which secures the local administrator account on your devices by enforcing password requirements, backing up local admin accounts, and scheduling password rotations. Prerequisites * Platform requirements: Windows
Blog Posts
For years, Microsoft has offered built-in attack simulation training through Microsoft Defender for Office 365. However, I have rarely encountered anyone who is actively using the product. But why is that, you may wonder? There could be several reasons, but the most significant one is likely that the solution
Blog Posts
Today, I'm following up on a recent blog post where I talked about how to manage Conditional Access exclusions with PIM. For a similar purpose we are going to utilize the Access Reviews feature, which is part of the Identity Governance solution available in Microsoft Entra. Access Reviews
Blog Posts
Sometimes in our dreams we envision a world without exclusions for Conditional Access policies, only to wake up and realize that this is not yet a reality. Since exclusions can significantly expand the attack surface it's important to manage them effectively. So how can we deal with those
Blog Posts
Update: Microsoft recently brought the authentication context feature into general availability, but this came with an extra licensing requirement for protecting SharePoint sites and OneDrive; the new SharePoint advanced management license is required going forward. Read more about the license here. The Authentication Contexts feature has been in preview for