Archive
External collaborators do not need download rights to do their job. Two settings force guests into authenticated, browser-only access and block local downloads in SharePoint and OneDrive.
Entra lets any user register any device by default, and attackers use that to persist after a compromise. Three policies, from MFA on registration to TAP gating, shut the door.
Microsoft 365 lets users sign in from any device in the world by default. Here are the two Conditional Access policies, exact settings included, that restrict access to devices you manage.
When customers demand BYOD access to Microsoft 365, contain it: web-only access, download blocks, session limits, TAP-gated enrollment, and MAM, with a dynamic group to segment personal devices.
Copilot agents reach general availability, Teams adds impersonation warnings for external chat, a new calendar lands in January, and Office 2016/2019 get one year of support left.
Microsoft 365 email is not phishing-resistant by default. SPF/DKIM/DMARC, a tuned anti-phishing policy, Safe Links and Attachments, external sender tags, and keyword mail flow rules close the gap.
Token replay attacks grew over 111% year over year and walk straight past MFA. Device compliance, strict location enforcement, token binding, and risk-based blocking form the foundation.
Turn Microsoft 365 offboarding into a workflow HR triggers from a form: sessions revoked, sign-in blocked, mailbox converted and shared, license reclaimed, groups cleaned, ticket filed.
Copilot Wave 2 ships Pages, Python in Excel, and SharePoint agents; Microsoft starts enforcing MFA for admin portals on October 15, 2024; Teams and Intune stack up quality-of-life updates.
A HaloPSA self-service form, one webhook, and a Power Automate flow per tenant turn user onboarding into a hands-off process. Here is the full build, including the ROI math.
Microsoft Forms plus Power Automate can create the user, license them, set their manager, mirror group access, and send the welcome email. No third-party tools, one tenant at a time.
Most MSPs stall on security because they assess ad hoc and remediate reactively. A repeatable loop of assess, prioritize, implement, and monitor fixes both, and it maps cleanly to the CIS Controls.
Copilot picks up enterprise data protection and usage APIs, Autopatch and WUfB-DS merge into one service, Entra ships AiTM detection and FIDO2 provisioning, and Teams adds CAPTCHA for anonymous joins.
Mailbox full tickets do not need an Exchange Online Plan 2 upsell. Online archiving plus auto-expanding archive grows a mailbox to 1.5TB on licensing many tenants already own.
CIPP and Microsoft 365 Lighthouse both beat Partner Center for multi-tenant management. Here is the full comparison across twelve categories, with a downloadable matrix and a clear verdict.
Geo-blocking Conditional Access creates a ticket every time a user travels. This Forms plus Power Automate build grants time-boxed access to approved countries, then revokes it automatically.
Rotation, JIT elevation, audit logging, and a plan for the two moments admin rights actually get used. The full governance picture for local admin accounts, first party and third party.
July 2024 ships the new Microsoft Entra Suite, auto-enables Microsoft-managed MFA Conditional Access policies, archives unlicensed OneDrive accounts after 90 days, and adds dynamic watermarking and scheduled Copilot prompts.
