sbd.org.uk
All topics

Microsoft 365

Tenant architecture, Entra ID, conditional access, licensing, and governance.

17 articles

Conditional Access: When 'All Users' Stops Meaning All Users
·10 min read·Identity controls that move under you

Conditional Access: When 'All Users' Stops Meaning All Users

A Conditional Access policy can stay identical while what it covers or can ask for changes. Four documented cases, and the dated record that catches them.

microsoft-365entra-idconditional-accesssecurityzero-trustgovernance
What an Unchanged Policy Export Does Not Prove
·9 min read·Identity controls that move under you

What an Unchanged Policy Export Does Not Prove

A Purview or Entra policy export can stay identical while Microsoft changes what it covers. Four cases, and what to record to prove behaviour.

microsoft-365purviewentra-idcompliancedrift-detectionconditional-access
The Global Admin You Did Not Hire
·12 min read·Identity controls that move under you

The Global Admin You Did Not Hire

A ConnectWise app added itself to Global Administrator. Why a people-first review misses vendor service principals and Entra agent identities too.

microsoft-365entra-idsecurityidentityzero-trustpowershellgraph-api
Enrolment Is the New Perimeter
·9 min read·Identity controls that move under you

Enrolment Is the New Perimeter

Attackers win the account when a credential is registered, and Microsoft's enrolment schedule gives them the pretext. Gate it before 1 February 2027.

microsoft-365entra-idsecuritypasskeysauthenticationzero-trustconditional-access
Session, Not Sign-In: What MFA Leaves Unchecked
·12 min read·Identity controls that move under you

Session, Not Sign-In: What MFA Leaves Unchecked

MFA and Conditional Access decide at sign-in; the token lives for hours or days. What CAE, token protection and revocation cover, and what they miss.

microsoft-365entra-idsecurityconditional-accesszero-trustauthentication
Entra Connect Sync: Why Auto-Upgraded Servers Fail in April
·16 min read

Entra Connect Sync: Why Auto-Upgraded Servers Fail in April

Entra Connect Sync fails on 7 April 2027 unless it runs 2.6.84.0 or later with application-based authentication. Auto-upgrade does not set it.

microsoft-365entra-idsecurityconditional-accesspowershellgraph-apitenant-healthhybrid-identity
Entra Passkey Migration: The Default Problem
·16 min read

Entra Passkey Migration: The Default Problem

On 1 September 2026 Entra put SMS and voice users into a passkey profile with attestation off. What it costs you, and the runbook change it forces.

microsoft-365entra-idsecuritypasskeysauthenticationzero-trustconditional-access
Entra ID Directory Enumeration: The Attack Map
·38 min read

Entra ID Directory Enumeration: The Attack Map

A default member in Entra ID can enumerate the whole directory: every user, group, service principal and role assignment. The controls that narrow it.

microsoft-365entra-idsecuritygraph-apipowershellzero-trustconditional-access
M365 Add-On Costs: Evaluation Framework
·16 min read

M365 Add-On Costs: Evaluation Framework

Control M365 add-on costs: a five-question framework for Intune Suite, Entra ID Governance, Copilot, and Purview, plus a PowerShell audit script.

microsoft-365licensingcost-optimisationintuneentra-idcopilotpurviewgovernancedefenderteams-premiumpowershellgraph-api
M365 Solution Architect: What the Role Does
·13 min read

M365 Solution Architect: What the Role Does

What an M365 Solution Architect actually does: standards ownership, security architecture, licensing strategy, and delivery oversight. Beyond diagrams.

microsoft-365architecturegovernanceentra-idintuneautomationsecuritylicensing
Intune Security Baselines vs CIS Benchmarks
·19 min read

Intune Security Baselines vs CIS Benchmarks

Compare Intune security baselines against CIS benchmarks with a PowerShell export-and-diff workflow: ASR deployment and deviation tracking included.

microsoft-365intunesecurityendpoint-managementpowershellgraph-apiwindows-security
Microsoft 365 E3 vs E5: Decision Framework
·15 min read

Microsoft 365 E3 vs E5: Decision Framework

M365 E3 vs E5 decision framework for architects: TCO breakpoints, cost comparison scripts, and the rule for when E5 actually beats E3 plus add-ons.

microsoft-365licensingcost-optimizationpowershellgraph-apientra-idsecuritygovernance
M365 Tenant Health: Why It's Probably a Mess
·11 min read

M365 Tenant Health: Why It's Probably a Mess

Microsoft 365 tenant health audit checklist: detect orphaned groups, expired app secrets, CA policy sprawl, and SharePoint chaos with Graph API scripts.

microsoft-365entra-idgovernancepowershellgraph-apiautomationtenant-healthconditional-access
Conditional Access Policies That Actually Work
·15 min read

Conditional Access Policies That Actually Work

A baseline Conditional Access policy set built from 20 deployments: common mistakes, circular dependencies, and the patterns that survive production.

microsoft-365conditional-accessentra-idsecurity
Microsoft Graph API: Endpoints for Architects
·9 min read

Microsoft Graph API: Endpoints for Architects

Production-ready PowerShell scripts for M365 tenant assessment via Graph API: discovery, identity auditing, security posture, governance, licensing.

microsoft-365graph-apipowershellarchitectureentra-idsecurityautomation
The M365 Licensing Audit Nobody Wants to Do
·14 min read

The M365 Licensing Audit Nobody Wants to Do

Automated M365 licensing audit using Graph API and PowerShell: find unused Copilot seats and reclaim licences from disabled accounts still on E5.

microsoft-365graph-apipowershellazurelicensingautomationcost-optimization
Global Secure Access: Microsoft's SSE Play
·10 min read

Global Secure Access: Microsoft's SSE Play

A practical look at Microsoft's Global Secure Access SSE solution: what it does, how it works, and where it fits in a zero-trust architecture.

securityentra-idzero-trustnetworkingidentity

Get the next one by email

Long, specific write-ups on M365 architecture and security, worked out against real tenants rather than summarised from documentation. Sent rarely, and only when it is worth your time.