We've had several near-breaches involving an EvilToken-style attack. A compromised account sends convincing messages to everyone in the victim's address book, often linking to a legitimate-looking SharePoint site.…
We're redesigning our new-hire onboarding process so users register both Windows Hello for Business and a passkey through Microsoft Authenticator as early and smoothly as possible. Our current…
We're redesigning our new-hire onboarding flow so users register both Windows Hello for Business and a passkey through Microsoft Authenticator as early and smoothly as possible. Our current…
I'm removing the Global Administrator role from my everyday account and creating a separate account for administrative use. I'd like to protect it as strongly as possible, so…
I'm moving the Global Administrator role off my everyday user account and creating a separate account for administrative work. I'd like to secure it as tightly as possible…
We're a two-person IT team supporting about 225 users on Microsoft 365 Business Premium. Our Windows workstations are Entra joined and managed with Intune. We're moving administrative roles…
We're a two-person IT team managing about 225 users on Microsoft 365 Business Premium. Our Windows workstations are Entra joined and managed through Intune. We're moving administrative roles…
I'm a one-person IT team in a manufacturing environment, and I'm trying to improve our Microsoft 365 and Entra ID security practices. One goal is to create a…
Microsoft is phasing out SMS and voice-based MFA in favor of passkeys and other phishing-resistant authentication methods. All of my users currently use Microsoft Authenticator push notifications with…
We're migrating Entra ID users to phishing-resistant authentication and moving some sites toward passkeys or other access-key methods. For compliance purposes, will auditors recognize a TPM-bound key combined…
Microsoft is retiring SMS authentication, so I'm reviewing our environment and finding users who still rely on it. I've been with the organization for a little over a…
Microsoft is retiring SMS authentication, so I'm reviewing our environment and still have some users relying on SMS. We have a hybrid setup with Active Directory-only joined devices…
I work for an MSP supporting a college that is dealing with recurring Microsoft 365 account compromises. The usual pattern is that a student clicks a link in…
I work for an MSP supporting a college that is dealing with recurring Microsoft 365 account compromises. The usual pattern is that a student receives a phishing email,…
I've spent the last few years rolling out the usual security basics across our organization: MFA everywhere, password managers, secure email gateways, regular phishing training, and the other…
I'm a public-sector network administrator dealing with a recurring phishing problem. Some employees continue to provide their passwords and MFA information, after which their accounts are compromised and…
I'm a public-sector network administrator dealing with repeated phishing incidents. Employees are surrendering passwords and two-factor authentication codes, after which attackers take over their accounts and use them…
I'm trying to understand how MFA protects against a phishing scenario where an attacker sends a malicious link leading to a fake Microsoft 365 login page. The victim…
I'm modernizing authentication because SMS-based MFA is being phased out. Windows passkeys work well for our regular users, especially when they don't have company apps or Microsoft Authenticator…