MFA protects authentication. These five checks examine what follows: continued access, temporary privilege, session revocation, workload identities and emergency recovery.
Article collection
Microsoft security and governance
Security architecture, operations and governance guidance across Microsoft identity, Defender, Sentinel and Purview.
Published guidance
AADSTS50011 is an exact-string comparison failure. Capture the redirect URI sent by the application, identify the correct registration and avoid wildcard-style fixes.
The domain controller records which computer submitted the bad credentials. Follow Event 4740, then inspect services, tasks, mapped resources and cached credentials on that source.
Error 53003 only says Conditional Access blocked the request. The fix comes from correlating the exact sign-in event, policy result, device state and resource dependency.
Inactive, impaired communications and no sensor data are different states. Start with device identity and local evidence before repeatedly onboarding the endpoint.
Microsoft Entra ID now blocks risky hard-match operations that could let an on-premises Active Directory object take control of a privileged cloud account. Prepare migrations by proving identity, source anchor and role state before synchronization.
A practical implementation sequence that connects Microsoft Entra, Intune, Defender, Purview and Sentinel around one attack path and a measurable control loop.
A successful PIM request proves that an assignment was created. It does not prove the target service has refreshed its authorization cache or that the activation scope is correct.
A missing policy tip can be client configuration, policy scope, sensitive-information matching, threshold or service evaluation. Test one controlled message and follow the evidence.
An enabled connector is only the control plane. Prove heartbeat, DCR association, source selection, agent configuration and table ingestion in that order.
A rule can run successfully and still produce no alert. Reconstruct its lookback, threshold, grouping and ingestion delay before rewriting the KQL.
Microsoft Sentinel now separates fast operational analytics from lower-cost long-term security retention. The difficult decision is not enabling the lake; it is deciding which telemetry must remain available for immediate detection.
Azure Lighthouse lets one SOC operate across separate Microsoft Sentinel tenants while customer data, billing and ownership remain in each tenant. The design succeeds or fails on delegated scope, identity and role engineering.
The October 2026 Windows update can automatically replace insecure AD FS DKM container permissions. Audit the events, preserve the current descriptor, remediate deliberately and validate the farm.
A KQL query becomes a reliable SOC detection only after its data, timing, entities, grouping, false positives and operational health have been tested.
Passkeys resist phishing, but attackers are targeting registration, recovery and active sessions. Detect the identity changes and cloud collection that follow.
A practical Microsoft guide to discovering MCP servers, controlling their identities and tools, monitoring activity and testing containment.
Tiering fails as a diagram and succeeds as an enforcement mechanism. This is the dependency order that decides which one you end up with.
ASR rules block the behaviours malware relies on — and some of the behaviours a twenty-year-old line-of-business application relies on. Audit mode is the entire deployment strategy.
Auto-enrolment fails silently until certificates expire and authentication breaks. A read-only script that finds the certificates about to lapse, tests the certification authorities and reports who actually holds enrol rights.
A policy set that works in a demo tenant and locks out a real organisation is the normal outcome. Report-only mode, exclusion design and a deliberate rollout order prevent it.
Two products that overlap enough to confuse the boundary. Defender XDR covers the Microsoft estate; Sentinel is for everything else and for correlation across it.
Delegated and application permissions are not two settings on the same dial. One is bounded by the signed-in user and one is not, and the difference decides your exposure.
An agent acting on a user's behalf inherits that user's access, including everything they could reach but never did. The oversharing problem stops being theoretical.
Three delegation models, one of which should not exist in your directory any more. The differences decide who can impersonate whom, and who gets to configure it.
An Owner who cannot read a secret, a firewall that looks open, and a private endpoint resolving to the wrong address all produce the same status code. A script that separates them.
Enforcing LDAP signing and channel binding is a five-minute change that breaks printers, scanners and appliances nobody documented. A script that finds them first, from the domain controllers' own evidence.
Audits, incidents and reviews all ask the same questions about a tenant. Collecting the answers the same way every time turns an ad-hoc scramble into a comparable record.
Classification tells you where sensitive data is. It does not reduce who can reach it. Deploying labels over broken permissions produces an accurate map of a problem you still have.
NTLM is deprecated, NTLMv1 is already removed from the newest Windows releases, and nobody has an inventory. A read-only script that collects what is actually authenticating with NTLM, from the machines that know.
Two distinct protections with overlapping names, both now on by default in recent Windows. Knowing which one blocks which attack tells you what remains exposed.
A read-only assessment that collects privileged membership, delegation, stale accounts and password policy exposure — and changes nothing, deliberately.
The defaults optimise for collaboration, which is the right default for Microsoft and the wrong one for most organisations. Six settings change the exposure considerably.
Ingestion is charged by volume and most of what Windows logs has no investigative value. A small, deliberate set of events answers the questions an incident actually asks.
A shared local administrator password across an estate is one compromised machine away from being every machine's password. Windows LAPS is built in, and the deployment is four steps.
A practical guide to governing AI agents with Entra Agent ID, Conditional Access, Defender and Purview, including PowerShell, Graph requests and validation.