Topic
Rotation, JIT elevation, audit logging, and a plan for the two moments admin rights actually get used. The full governance picture for local admin accounts, first party and third party.
Out of the box, SharePoint generates Anyone links with edit rights. Here is the staged path to safer sharing defaults, with the exact guest and Gmail user flows that generate tickets.
Two accounts, a 32-character split password, FIDO2 keys, one Conditional Access exclusion, and an alert on every sign-in. The full checklist for Microsoft 365 emergency access accounts.
Compromise is the opening move; persistence is the game. The MFA methods, device joins, app consents, and inbox rules attackers plant in Microsoft 365, with the CIS-mapped settings that block each.
Microsoft Teams holds chats, meetings, and files for the whole company. These eight CIS-mapped settings control who gets in, what apps run, and where data can leak.
CISA's SCuBA project gives you a checklist. A real hardening program needs CIS mapping, licensing notes, setup steps, user-impact warnings, and scripts for every control across all six M365 workloads.
A device lifecycle walkthrough of 16 Intune security controls: enrollment restrictions, compliance enforcement, encryption, patching, app protection, and offboarding, with licensing and setup steps.
CISA's SCuBA project pairs a free M365 security baseline with ScubaGear, a PowerShell tool that grades your tenant against it. Setup steps, licensing gotchas, and a CIS Controls mapping.
As of November 2022, Intune can schedule macOS updates, defer releases, and enforce minimum OS versions. Here is how to configure update policies, deferrals, and compliance for your Macs.
September 2022 for MSPs: Exchange Online basic auth shutoff begins October 1, the GDAP bulk migration tool runs until October 31, and Teams ships eight features from Cameo to 7x7 galleries.
Intune tags every enrolled device corporate or personal automatically, and that tag decides whether it lands under MDM or MAM. Here is exactly how the classification is made.
Intune's default auto-enrollment puts every device under full MDM, including the cell phones your users never wanted managed. Here is how to scope MDM and MAM the right way.
