A client's Conditional Access policy looked correct while sign-ins quietly bypassed MFA. The cause: a Named Location built from a CIDR list gone stale, entries inaccurate, missing, or pointing at ranges no longer controlled. This walks security architects and engineers through six ways Named Locations fail silently, what each costs in dwell time and false confidence, and the PowerShell and KQL checks to audit yours before an incident finds the gap.

Conditional Access evaluates a sign-in once, then stops evaluating it. A 2025 phishing campaign confirmed a 50%+ success rate against Microsoft 365 accounts that already had MFA enabled, by capturing session tokens right after MFA succeeded. Part 3 of The Security Bridge series covers the fix: authentication strength, Token Protection, and what to validate this week. For security architects, engineers, and CISOs who assume MFA enrollment closes the risk on its own.

Most Microsoft 365 environments treat the sign-in event as the finish line for identity security. Part 1 of The Security Bridge series breaks down where the real exposure lives after a successful login: standing privilege, unmanaged token handling, and over-permissioned app access. Includes 3 examples from real client engagements and a validation checklist for security architects, engineers, and CISOs.

MFA is on, Security Defaults are on, the audit passed, and the tenant still has an identity-shaped gap. This walks security admins and architects through the five Entra ID settings most often left at an insecure default, plus the break-glass account people get wrong in both directions. For each one: the attack it enables, the business cost when it stays open, and the exact admin-center fix. Written for the engineer configuring it and the CISO funding it.

Identity attacks don't start with malware — they start with a perfectly valid sign-in. Microsoft Defender for Identity is the monitoring and early-warning system for your organization's "control room." This article breaks down the business case: what you're buying, how it reduces identity exposure, why earlier detection compresses cost, and how identity signals correlate into unified incidents for faster response. Includes an ROI model, executive and engineer checklists, and

I've never investigated a breach where Conditional Access failed — only where expectations did. Most CA breakdowns aren't technical. They're architectural: wrong exclusions, forgotten accounts, policies that evaluate risk but never enforce it. This article covers the four most common failure patterns — and the three-phase approach to fix them.