This article provides steps to apply the principles of Zero Trust security to prepare your environment for Microsoft 365.

Since the general availability of Microsoft Defender Experts for XDR, Their extended managed detection and response (MXDR) service, in June 2023, Microsoft his Defender Experts team has been busy providing around the clock service to our customers and soliciting their feedback on how thet can make their service better. As the cyberthreat landscape continues to […]

Deception is a new feature in Microsoft Defender for Endpoint. This blog provides a high level overview of the new feature. Deception deploys virtual decoys (local accounts/Alias and advices/Host name) on the assigned Microsoft Defender for Endpoint devices.

In today’s rapidly evolving digital world, the art of eDiscovery is undergoing a transformative shift. As organizations increasingly rely on sophisticated platforms for their daily operations, the challenge of managing, locating, and analyzing data intensifies. The emergence of modern communication tools and complex data storage locations necessitates eDiscovery tools to be more agile, comprehensive, and […]

The AIP Scanner has been around for some time and I do notice an upbeat in the use of the platform. Organizations I speak with want to have a clearer understanding of the data they are planning to migrate to the Microsoft cloud. In addition to more common parameters like the date of last modification […]

The primary goal of FalconHound is to enrich BloodHound data in near-realtime based on various events and updates sourced from your environment.

Join Microsoft Wednesday, December 6th for a virtual day of demos and technical deep dives. And bring your questions for everyone’s favorite – Ask Microsoft Anything (AMA). Microsoft is excited for you to join them in the AI era of security. Their goal is to connect you to your security peers and equip you with […]

Markus has recently came across a request from a customer to block specific applications on their Windows clients. More specifically, the requirements were as follows: We want to be able to block Java being installed on Windows clients We also want to block Java being used (if it’s already installed) We need to be able […]

Entra ID’s P2 license (previously Azure AD Premium P2) unlocks the Privileged Identity Management (PIM). PIM is part of broader identity governance features, and is most known for enabling just-in-time admin rights. For example, you are eligible to become an administrator for a maximum of X hours, at which point the permissions expire and you […]

Daniel has added a new tool called ‘New-DCEntraIDAppPermissionsReport’ to DCToolbox that gets all EntraID (AzureAD) Enterprise Apps with assigned application API permissions in the local tenant. The purpose of the tool is to identify vulnerabilities in enterprise apps and app registrations.

Microsoft Entra Private Access gives the Entra admins the ability to manage the access to the fully qualified domain names and IP addresses considered private or internal. Private Access provides two ways to configure the private resources that Entra admins want to tunnel with the Edge of Microsoft Entra. First option is to use Quick […]

Cyber criminals are continuously evolving their tactics, and as trends shift, it’s critical that defenders have solutions that are adapting alongside new cyberattack patterns and security risks. As cloud adoption continues to soar, Microsoft’s security researchers are seeing an increasing trend of attackers crossing the lines from end-user assets into cloud workloads. In just one […]

Microsoft Defender for Identity is an essential part of a modern security practice, helping your organization protect against, and respond to, identity-based threats. In this blog we will show you the simple steps for deploying Microsoft Defender for Identity within your environment.

With an estimated 80% of these threats being common across most organizations, today’s SOCs are able to confidently rely on automation to cover this large percentage of threat signals. But, while it is true that automation can greatly improve the efficiency and effectiveness of security teams, it will never be able to cover all detection […]

We‘ve repeatedly emphasized the importance of multifactor authentication (MFA) and emphasized that not all MFA is equal – the Authenticator is much more secure than phone authentication (so hang up!). Through the implementation of number matching, we’ve successfully thwarted criminals engaging in MFA fatigue attacks.

Microsoft Defender for Endpoint is an enterprise endpoint security platform designed to help enterprise networks prevent, detect, investigate, and respond to advanced threats. Defender for Endpoint for Windows Subsystem for Linux 2 (WSL) enables Defender for Endpoint to provide more visibility into all running WSL containers, by plugging into the isolated subsystem.

Today, we are thrilled to announce that we are unleashing the power of threat intelligence to all Microsoft Defender XDR tenants. Starting at Microsoft Ignite, all Defender XDR users will see Microsoft Defender Threat Intelligence (MDTI) in the threat intelligence blade of Defender XDR. This free experience, which is a limited version of MDTI, enables […]