M365 Roundup
M365 Roundup, July 2025: Token Protection Comes to P1
Token protection reaches Entra ID P1, Defender gains mail-bombing detection, the Conditional Access Optimization Agent hits GA, and Intune ships LAPS for macOS.
Nick Ross
Topic
Conditional Access
Identity & Access
Microsoft Flagged the Breach. Nobody Was Listening: Wiring Risky Users Into Your Alert Flow
Entra flags risky users by default, but nobody gets told and nothing happens without P2. How to route risk detections to your PSA and the one policy that prevents most compromises.
Nick Ross
Identity & Access
Half of MSPs Saw Token Theft Last Year. Five Controls Break the Attack at Every Stage
Token theft via AiTM phishing hit 51% of webinar respondents in the past year. Five layered controls, from Defender tuning to attack disruption, break the kill chain at each stage.
Nick Ross
Identity & Access
Six Conditional Access Defenses Against Token Theft, and What Each One Misses
Six Conditional Access policies can stop token theft before it starts. Each blocks a different part of the attack, and each has a gap. Here is the full comparison with exact settings.
Nick Ross
Identity & Access
Entra Token Protection Does Less Than You Think. Here Is the Test Evidence.
Entra's token protection session control sounds like the end of token replay. In testing, stolen tokens still replay in the browser. Here is exactly what the preview covers, as of May 2025.
Nick Ross
M365 Roundup
M365 Roundup, March 2025: Exchange Starts Counting Your Outbound Email
Exchange Online enforces tenant-wide outbound email limits, E5 Security arrives as a Business Premium add-on, and the Report Message add-in enters maintenance mode.
Nick Ross
M365 RoundupIdentity & Access
M365 Roundup, February 2025: Microsoft Writes Your Conditional Access Now
Microsoft-managed Conditional Access policies start auto-enforcing after 45 days, Skype interop in Teams dies May 1, and Hotpatch hits preview. The February 2025 changes, sorted by deadline.
Nick Ross
Device & Endpoint Security
Secure Company Data on Phones You Will Never Enroll
Users refuse enrollment, admins refuse open access. Intune app protection policies plus one Conditional Access rule protect Microsoft 365 data on personal phones without managing the device.
Nick Ross
Email & Collaboration SecurityIdentity & Access
Guests Can Read, Not Take: Browser-Only Access for External Users in Microsoft 365
External collaborators do not need download rights to do their job. Two settings force guests into authenticated, browser-only access and block local downloads in SharePoint and OneDrive.
Nick Ross
Identity & AccessDevice & Endpoint Security
Attackers Register Their Own Devices to Stay In. Close That Door in Entra
Entra lets any user register any device by default, and attackers use that to persist after a compromise. Three policies, from MFA on registration to TAP gating, shut the door.
Nick Ross
Identity & AccessDevice & Endpoint Security
Any Device, Any Network, Anywhere: The Microsoft 365 Default You Should Turn Off First
Microsoft 365 lets users sign in from any device in the world by default. Here are the two Conditional Access policies, exact settings included, that restrict access to devices you manage.
Nick Ross
Device & Endpoint SecurityIdentity & Access
The Client Will Not Give Up Personal Devices. Contain Them Instead
When customers demand BYOD access to Microsoft 365, contain it: web-only access, download blocks, session limits, TAP-gated enrollment, and MAM, with a dynamic group to segment personal devices.
Nick Ross