If you’ve ever had to deploy a new Microsoft Defender for Identity (MDI) Sensor on a Domain Controller, you’ll know that one of the required components is the Access Key that is used during installation. The Access Key is effectively a one-time password for use when deploying the sensor, after which communication is performed usingā¦ Read More »
Well, this is definitely going to be one of my shortest posts š. Q. How do you remove an App Connector in Microsoft Defender for Cloud Apps? A. You can’t. The only options you have are to edit the settings, edit the instance name, or disable the connector. If you no longer need the Appā¦ Read More »
I recently had to help out a customer with a situation where someone in first level support accidentally deleted an Entra ID security group. That person (let’s call him Eric) was trying to to remove a user from the group using the Entra Portal but ended up deleting the group instead. It transpired that insteadā¦ Read More »
I’ve been doing a bit of work recently with URL/Domain Indicators in “block execution” mode and thought it might be usefult to share my experience here. I found a website that isn’t blocked in Chrome and I suspect that my experience may not be unique. This article briefly covers how to use Indicators to blockā¦ Read More »
I came across something quite surprising (to me at least) the other day, so I thought I would share it here in case others come across the same behaviour. What I found is that that the Entra ID audit log doesn’t always show an entry for removal of a member from a group. Specifically, ifā¦ Read More »
When something runs in Audit mode, you generally expect it not to block anything, right? I recently found an anomaly with Microsoft Defender Application Control runing in Audit mode causing .hta files not to open. An HTML Application (HTA) is a Microsoft Windows program whose source code consists of HTML, Dynamic HTML, and one orā¦ Read More »
SharePoint Online offers a nifty security feature known as “app-enforced restrictions”. In this article, I will briefly describe the feature and show you how to enable it. I will also point out why there is a need to be aware of what is happening in the background in case turning it on causes issues forā¦ Read More »
If you’ve ever needed to do some troubleshooting with Exchange Online (EXO) message delivery, you’ll know how useful the Extended Report capability can be. One thing I noticed recently is that while the Summary Report is typically available within a few minutes of the message being handled by EXO, it can take considerably longer forā¦ Read More »
You may have heard recently that Microsoft has rebranded their Advanced Threat Protection (ATP) offerings. I’m putting this up here because I keep forgetting their new names. This is what they look like: Microsoft 365 Defender (previously Microsoft Threat Protection)Microsoft Defender for Endpoint (previously Microsoft Defender Advanced Threat Protection)Microsoft Defender for Office 365 (previously Officeā¦ Read More »
With about six weeks to go until Microsoft starts to deprecate versions of Azure AD Connect released more than 18 months ago, it’s a good time to check which version you’re running. The version release history site for AAD Connect is displaying the statement below. It’s not immediately clear what the word “deprecation” actually impliesā¦ Read More »