Archive
Token replay attacks grew over 111% year over year and walk straight past MFA. Device compliance, strict location enforcement, token binding, and risk-based blocking form the foundation.
Turn Microsoft 365 offboarding into a workflow HR triggers from a form: sessions revoked, sign-in blocked, mailbox converted and shared, license reclaimed, groups cleaned, ticket filed.
Copilot Wave 2 ships Pages, Python in Excel, and SharePoint agents; Microsoft starts enforcing MFA for admin portals on October 15, 2024; Teams and Intune stack up quality-of-life updates.
A HaloPSA self-service form, one webhook, and a Power Automate flow per tenant turn user onboarding into a hands-off process. Here is the full build, including the ROI math.
Microsoft Forms plus Power Automate can create the user, license them, set their manager, mirror group access, and send the welcome email. No third-party tools, one tenant at a time.
Most MSPs stall on security because they assess ad hoc and remediate reactively. A repeatable loop of assess, prioritize, implement, and monitor fixes both, and it maps cleanly to the CIS Controls.
Copilot picks up enterprise data protection and usage APIs, Autopatch and WUfB-DS merge into one service, Entra ships AiTM detection and FIDO2 provisioning, and Teams adds CAPTCHA for anonymous joins.
Mailbox full tickets do not need an Exchange Online Plan 2 upsell. Online archiving plus auto-expanding archive grows a mailbox to 1.5TB on licensing many tenants already own.
CIPP and Microsoft 365 Lighthouse both beat Partner Center for multi-tenant management. Here is the full comparison across twelve categories, with a downloadable matrix and a clear verdict.
Geo-blocking Conditional Access creates a ticket every time a user travels. This Forms plus Power Automate build grants time-boxed access to approved countries, then revokes it automatically.
Rotation, JIT elevation, audit logging, and a plan for the two moments admin rights actually get used. The full governance picture for local admin accounts, first party and third party.
July 2024 ships the new Microsoft Entra Suite, auto-enables Microsoft-managed MFA Conditional Access policies, archives unlicensed OneDrive accounts after 90 days, and adds dynamic watermarking and scheduled Copilot prompts.
Out of the box, SharePoint generates Anyone links with edit rights. Here is the staged path to safer sharing defaults, with the exact guest and Gmail user flows that generate tickets.
Two accounts, a 32-character split password, FIDO2 keys, one Conditional Access exclusion, and an alert on every sign-in. The full checklist for Microsoft 365 emergency access accounts.
Three overlapping enforcement systems and no central report make MFA coverage in Microsoft 365 genuinely hard to prove. Here is what insurers will eventually demand and how to produce it.
June 2024 brings token protection and the Entra PowerShell module to preview, hardware-backed device attestation and Config Refresh in Intune, expanded Copilot prerequisites, and a batch of Teams and Outlook updates.
Compromise is the opening move; persistence is the game. The MFA methods, device joins, app consents, and inbox rules attackers plant in Microsoft 365, with the CIS-mapped settings that block each.
Passkeys stop phishing, not stolen sessions. A real $530K wire fraud shows how pass-the-cookie walks past FIDO2, and the layered Microsoft 365 controls that actually close the gap.
