Microsoft 365 security,
decoded for MSPs

ScubaGear 2.0: What Changed and How It Checks Microsoft 365

CISA released ScubaGear 2.0 on October 28, 2026. See what changed, how the SCuBA baseline works, and how MSPs check every tenant against it.

MFA Didn't Stop the SkyKick Attackers. Your App Controls Can.

Security Defaults Is No Longer All or Nothing: What the New Preview Means for MSPs

The Accounts Nobody Uses Are the Ones Attackers Want: Cleaning Up Dormant Identities in Entra ID

M365 Roundup, September 2026: Copilot Spending Gets Guardrails and Four Deadlines Land Before Year End

September 2026 in Microsoft 365: MemberOf dynamic rules end November 3, Copilot Business defaults to usage-based billing, Teams blurs external QR codes, and Copilot Cost Management expands.

Copilot Grants No New Access. It Just Makes Years of SharePoint Sprawl Searchable.

M365 Roundup, August 2026: Sharing Links Stop Granting Access by Default

Microsoft Retires SMS and Voice MFA on February 1, 2027. The Part That Breaks First Is Account Recovery.

Inactive SharePoint Sites Keep Their Permissions. Retire Them on a Policy, Not a Hunch.

Abandoned SharePoint sites keep their storage, their sharing links, and their place in Copilot answers. Here is the policy-driven way to inventory, certify, and retire them.

Microsoft Frontier Puts Prerelease Copilot in Your Tenant. Scope It to a Pilot Group First.

M365 Roundup, July 2026: Microsoft Puts an Expiry Date on SMS Authentication

When Someone Quits, Does Their Claude Account Leave With Them?

During an Insider Threat, Copilot Follows the Rules. Your Response Plan Is What Breaks.

In a live insider-threat tabletop, Copilot never broke a rule. It surfaced years of overshared data in minutes using access the employee already had. Here is what to prepare.