Microsoft 365 security

Which Microsoft 365 security settings can’t be read through Graph API?

I've spent the past year building automated Microsoft 365 posture assessments, and the biggest challenge has been identifying security settings that cannot be read programmatically. These are the…

Which Microsoft 365 security settings still can’t be checked through APIs?

I've spent the past year building automated Microsoft 365 posture assessments, and the biggest challenge has been identifying controls that cannot be read programmatically. Here are the gaps…

How are you defending against EvilToken-style device code phishing?

We've had several near-breaches involving an EvilToken-style attack. A compromised account sends convincing messages to everyone in the victim's address book, often linking to a legitimate-looking SharePoint site.…

Where should I begin implementing Zero Trust in a small Microsoft 365 tenant?

I'm planning a Zero Trust security architecture for a relatively simple Microsoft 365 environment. We have a small number of internal users on managed devices, plus guest users…

What’s the safest low-cost way to manage YubiKeys for a small staff?

We're a small public library with about 20 employees and are finally implementing MFA for Microsoft 365 and a few vendor accounts. We plan to use YubiKeys for…

How can we reduce recurring Microsoft 365 compromises in a large BYOD student environment?

I work for an MSP supporting a college that is dealing with recurring Microsoft 365 account compromises. The usual pattern is that a student receives a phishing email,…