Blog & Guides
Practical cybersecurity articles, step-by-step guides, and quick-reference cheat sheets — from Active Directory hardening to Microsoft 365 and zero trust. Written by someone who's done the work. No hype, no fluff.
10 results for “entra id” · Clear
Passkeys by Default and the Retirement of Microsoft SMS and Voice MFA: The Entra Migration Playbook
Microsoft Entra ID is making passkeys the default sign-in experience and retiring Microsoft-provided SMS and voice authentication. Two dates matter: on 1 September 2026 passkeys are auto-enabled for every user still on SMS or voice and a Microsoft-managed registration campaign starts nudging them; on 1 February 2027 Microsoft-provided SMS and voice telecom delivery is retired, and after that any user whose only MFA method is SMS or voice hits a blocking passkey-registration prompt with no opt-out. This playbook covers who is in scope, how to find your exposed users, how to move them to passkeys, when a customer-managed telecom provider is worth it, the temporary Graph opt-out and its limits, and how it all ties into your Conditional Access baseline. Dates and behaviours validated against Microsoft Learn, August 2026.
The Microsoft 365 2026 Deprecation Deadline Tracker
Every material Microsoft 365, Exchange Online and Entra ID deprecation landing in 2026 — EWS, SMTP AUTH basic auth, Identity Protection risk policies, Azure ACS and more — in date order, with what breaks and the one fix that keeps you ahead of each deadline.
Anatomy of a Device Code Phishing Email: A Real Investigation
A phishing email with no malware, no cloned login page and a clean URL reputation would still have handed an attacker a fully authenticated Microsoft 365 session — without ever seeing the password, and without the victim's MFA slowing them down. This is a captured, screen-by-screen walkthrough of a device code phishing email (the Cloudflare hold-to-continue gate, the copied Microsoft device code, the genuine sign-in page) plus the detection, hardening, and full mitigating and compensating controls to stop it.
Conditional Access Baseline Policies Every Microsoft 365 Tenant Needs in 2026
Every Microsoft 365 tenant should run a baseline of roughly eight to ten Conditional Access policies — block legacy authentication, require MFA for all users, phishing-resistant MFA for admins, compliant or managed devices, block device code flow, sign-in and user-risk policies, session controls, guest MFA, and a break-glass exclusion group — deployed in report-only first, piloted with a ring group, then enforced. This guide gives the named set, the safe rollout order, the P1/P2 licensing reality, the enforcement changes that landed in June and July 2026, and the production gotchas that lock teams out of their own tenant.
How to Configure Microsoft Entra PIM for Just-in-Time Admin Access
Microsoft Entra Privileged Identity Management (PIM) removes standing admin rights by making a role eligible instead of permanently active: the admin activates it just-in-time, for a time-boxed window, subject to MFA, justification and optional approval. This step-by-step guide covers licensing (Entra ID P2 or Entra ID Governance), prerequisites and break-glass accounts, assigning eligible roles, configuring activation settings, the end-user activation experience, validation, and Access Reviews — plus the production gotchas that lock teams out of their own tenant.
Which Microsoft 365 Plan Do I Actually Need for My Business? Basic vs Standard vs Premium in 2026
Microsoft 365 Business Basic covers email, Teams and web apps; Business Standard adds the desktop Office suite; Business Premium adds the security and device-management layer most small businesses are missing — Entra ID P1, Intune, Defender for Business and Defender for Office 365. With the July 2026 price increase now in effect and new capabilities rolling into every tier, here is what each plan actually includes, what it costs, and a decision framework for picking the right one — including when to skip the Business plans entirely and go enterprise.
Ghost Phishing: How the EvilTokens Campaign Hides in the Browser to Hijack Microsoft 365 Accounts
A new "ghost phishing" wave from the EvilTokens kit is slipping past email security by keeping its payload AES-encrypted until it renders in the victim's browser, then using Microsoft device-code phishing to take over Microsoft 365 accounts without ever stealing a password. This guide breaks down how the technique works, why traditional URL and email controls miss it, who is being hit, and the concrete detection and hardening steps to defend your tenant.
Building a Microsoft 365 Incident Response Console in PowerShell
Why Microsoft 365 incident response is spread across three PowerShell surfaces and several portals, and how a single-file WPF console consolidates the first-hour actions — email purge via Purview, account containment via Graph/Entra, and BEC investigation — into one window. Includes the platform changes that broke a lot of scripts in 2025 and the open-source tool on GitHub.
Okta to Entra ID Migration: A Phased Plan That Won't Lock Out Your Users
Migrate from Okta to Microsoft Entra ID in phases, not a big-bang cutover: sync identities, switch from Okta federation to managed authentication, move apps and provisioning one at a time with reverse federation as a safety net, then rebuild policies in Conditional Access before decommissioning Okta.