Topic
The March 2026 Stryker breach wiped 80,000 devices through one compromised admin and Intune's own remote wipe. Multi Admin Approval, PIM, and break glass governance close that hole.
Entra Backup and Recovery, in public preview since March 2026, gives Entra ID a five-day, tamper-proof rollback for groups, Conditional Access policies, and apps. The steps and the limits.
Blue Team Labs is a free training platform where MSP techs investigate realistic Microsoft 365 incidents using simulated sign-in logs, audit logs, and email headers. No videos, no quizzes.
The Microsoft 365 E5 Security add-on brings five standalone security products to Business Premium for $12 per user. Six business scenarios show where the value lands.
Entra flags risky users by default, but nobody gets told and nothing happens without P2. How to route risk detections to your PSA and the one policy that prevents most compromises.
Token theft via AiTM phishing hit 51% of webinar respondents in the past year. Five layered controls, from Defender tuning to attack disruption, break the kill chain at each stage.
A stolen session token becomes a BEC campaign fast. This runbook walks the full cleanup, confirm, scope, evict, recover, with the exact portals, KQL queries, and PowerShell for each step.
Entra keeps sign-in logs for 30 days at most, 7 on the free tier. Here is how to stream them into a Log Analytics Workspace and keep up to two years of evidence, usually for pocket change.
PIM extends just-in-time access to groups with Conditional Access enforcement, Graph activity logging enters preview, Windows Server 2012 R2 hits end of support, and Teams stacks up eight features.
Azure AD P2 auto-remediates risky users; P1 only detects them. This Power Automate flow sweeps every customer tenant for risk detections and opens a PSA ticket the moment a new one lands.
An Azure Logic App can pull Microsoft Graph security alerts on a timer and post them to a Teams channel with no scripting. Here is the build, the cost, and where it falls short.
Register a Graph Security app, drop a webhook into Teams, and schedule a PowerShell script to post every M365 and Azure security alert across your tenants at zero running cost.
