All Posts

A Conditional Access policy that required an app protection policy nobody deployed in Intune blocked mobile users on day one. For security architects and CISOs: a 7-layer dependency model for Microsoft 365 tenant security, Cloud Harbor Consulting's 5-step build sequence for Entra ID, Intune, Conditional Access, Purview, and Defender XDR, and the verification step that closes gaps like this before they ship.

Most security teams can describe what's configured, not whether they're better off than 6 months ago. Part 5 closes The Security Bridge series with a 4-dimension scorecard, prevention, detection, governance, ownership, that turns identity security into one maturity number leadership can track and fund. Includes a real budget conversation that stalled without one, and a checklist to build your own this week. For architects, engineers, and CISOs who need identity security to co

A client's Conditional Access policy looked correct while sign-ins quietly bypassed MFA. The cause: a Named Location built from a CIDR list gone stale, entries inaccurate, missing, or pointing at ranges no longer controlled. This walks security architects and engineers through six ways Named Locations fail silently, what each costs in dwell time and false confidence, and the PowerShell and KQL checks to audit yours before an incident finds the gap.

Microsoft scored 100% on the 2024 MITRE detection evaluations, then withdrew from the 2025 edition. A license, a deployed sensor, and a strong test score describe capability, not whether your tenant will alert when it matters. Part 4 of The Security Bridge series covers Coverage and maturity scoring, the sensor health issues that quietly limit visibility, and how to validate detection instead of assuming it. For security architects, engineers, and CISOs who treat deployment a

A single unflagged service account and an unaudited AD trust relationship turned into a $1M, multi-forest incident. This piece is for security architects and engineers running hybrid Active Directory: how lateral movement actually happens, how Microsoft Defender for Identity detects it now that the old path map is gone, and the validation checklist to run before it happens to you.

Conditional Access evaluates a sign-in once, then stops evaluating it. A 2025 phishing campaign confirmed a 50%+ success rate against Microsoft 365 accounts that already had MFA enabled, by capturing session tokens right after MFA succeeded. Part 3 of The Security Bridge series covers the fix: authentication strength, Token Protection, and what to validate this week. For security architects, engineers, and CISOs who assume MFA enrollment closes the risk on its own.

Machine identities outnumber humans 109 to 1 in the average Microsoft 365 tenant, and most are ungoverned. Part 2 of The Security Bridge series breaks down why service principal ownership, not directory roles alone, is the real takeover path: how a stolen credential inherits every permission an app holds, and why 99% of tenants already have at least one privileged service principal exposed. Includes 3 real examples and a validation checklist for security architects, engineers

Most Microsoft Defender for Cloud Apps deployments turn on Cloud Discovery and stop there. This piece walks security architects and engineers through the four MDCA policy layers that actually enforce governance, the build order that avoids alert fatigue, and the file-policy retirement (January 6, 2027) that changes where new governance work belongs. Includes the client trap that turns Cloud Discovery data into noise, and the CFO-ready business case for fixing it.

Most Microsoft 365 environments treat the sign-in event as the finish line for identity security. Part 1 of The Security Bridge series breaks down where the real exposure lives after a successful login: standing privilege, unmanaged token handling, and over-permissioned app access. Includes 3 examples from real client engagements and a validation checklist for security architects, engineers, and CISOs.

MFA is on, Security Defaults are on, the audit passed, and the tenant still has an identity-shaped gap. This walks security admins and architects through the five Entra ID settings most often left at an insecure default, plus the break-glass account people get wrong in both directions. For each one: the attack it enables, the business cost when it stays open, and the exact admin-center fix. Written for the engineer configuring it and the CISO funding it.

Publishing a Copilot Studio agent creates an Entra identity in the same minute. As of March 18, 2026, every Copilot Studio agent in a default-on tenant gets a Microsoft Entra Agent ID: a service principal with the 'Agent' subtype, governable through the same Entra admin center and Microsoft 365 admin center your IAM team already operates. A walkthrough of what the Agent ID is, how Agent 365 governs it, the connected dual-agent pattern from a defensive SecOps PoC, and a 7-step

When someone leaves, can you prove every one of their accounts is actually closed? Most teams can't, because offboarding runs on manual steps across Active Directory, Entra ID, and SaaS apps. This deep-dive shows security architects and the leaders who fund them how to build lifecycle workflows in Microsoft Entra ID Governance: the joiner-mover-leaver architecture, the deployment order that works, and the ROI case for automating it.

Onboarding a device to Microsoft Defender for Endpoint turns on the sensor that sends telemetry. It does not turn on the controls that stop an attack. A device can report "healthy" while nothing blocks files on disk. For the engineers who run MDE rollouts and the leaders who fund them: the five gaps that leave a finished onboarding exposed, and the post-onboarding checklist that closes them.

Most security teams ship two versions of every report. The 40 page export the platform makes easy. The 1 page version someone sat down and designed for a specific reader and a specific decision. This piece walks through a 4 question rubric for separating reports that drive decisions from reports that exist because they always have. Includes an audience cadence matrix, outcome metrics by audience, and a kill list of the reports that almost always fail the test.

Publishing a Copilot Studio agent creates an Entra identity in the same minute. As of March 18, 2026, every Copilot Studio agent in a default-on tenant gets a Microsoft Entra Agent ID: a service principal with the 'Agent' subtype, governable through the same Entra admin center and Microsoft 365 admin center your IAM team already operates. A walkthrough of what the Agent ID is, how Agent 365 governs it, the connected dual-agent pattern from a defensive SecOps PoC, and a 7-step

Three things get called "service account" in Microsoft Entra ID. Most incidents involve only one of them. This article gives security architects and CISOs a framework for picking the right control: PIM-eligible roles for human admins, managed identities and service principals for workloads. Two diagnostic questions, four patterns, and a 5-step checklist for converting a tenant from standing privilege to a controlled model.

Email is still the top entry point for ransomware, BEC, and credential theft. Architects choosing between Exchange Online Protection, Defender for Office 365 Plan 1, and Plan 2 have to answer one question: which tier, at what licensing cost, gets the organization to a defensible posture. This article covers what each tier does, the cost-of-breach math, and the 5 questions that decide Plan 1 versus Plan 2.

App owners can't always answer who has access to their app right now. Mid-market enterprises run about 200 SaaS apps; large enterprises closer to 350. Account Discovery (preview) in Microsoft Entra ID Governance reads each connected app and classifies every account as Local, Unassigned, or Assigned. This post covers the business case, the three categories, and a three-phase rollout worked through SAP.

Zero Trust isn’t a product—it’s a decision framework. This post explains how Microsoft 365 enforces consistent access decisions across identity, endpoints, apps, data, and unified security operations to reduce cost, risk, and improve compliance defensibility.

Identity attacks don't start with malware — they start with a perfectly valid sign-in. Microsoft Defender for Identity is the monitoring and early-warning system for your organization's "control room." This article breaks down the business case: what you're buying, how it reduces identity exposure, why earlier detection compresses cost, and how identity signals correlate into unified incidents for faster response. Includes an ROI model, executive and engineer checklists, and