sbd.org.uk
All topics

Security

Zero trust architecture, conditional access, security baselines, and identity.

16 articles

Conditional Access: When 'All Users' Stops Meaning All Users
·10 min read·Identity controls that move under you

Conditional Access: When 'All Users' Stops Meaning All Users

A Conditional Access policy can stay identical while what it covers or can ask for changes. Four documented cases, and the dated record that catches them.

microsoft-365entra-idconditional-accesssecurityzero-trustgovernance
What an Unchanged Policy Export Does Not Prove
·9 min read·Identity controls that move under you

What an Unchanged Policy Export Does Not Prove

A Purview or Entra policy export can stay identical while Microsoft changes what it covers. Four cases, and what to record to prove behaviour.

microsoft-365purviewentra-idcompliancedrift-detectionconditional-access
The Global Admin You Did Not Hire
·12 min read·Identity controls that move under you

The Global Admin You Did Not Hire

A ConnectWise app added itself to Global Administrator. Why a people-first review misses vendor service principals and Entra agent identities too.

microsoft-365entra-idsecurityidentityzero-trustpowershellgraph-api
Enrolment Is the New Perimeter
·9 min read·Identity controls that move under you

Enrolment Is the New Perimeter

Attackers win the account when a credential is registered, and Microsoft's enrolment schedule gives them the pretext. Gate it before 1 February 2027.

microsoft-365entra-idsecuritypasskeysauthenticationzero-trustconditional-access
Session, Not Sign-In: What MFA Leaves Unchecked
·12 min read·Identity controls that move under you

Session, Not Sign-In: What MFA Leaves Unchecked

MFA and Conditional Access decide at sign-in; the token lives for hours or days. What CAE, token protection and revocation cover, and what they miss.

microsoft-365entra-idsecurityconditional-accesszero-trustauthentication
Entra Connect Sync: Why Auto-Upgraded Servers Fail in April
·16 min read

Entra Connect Sync: Why Auto-Upgraded Servers Fail in April

Entra Connect Sync fails on 7 April 2027 unless it runs 2.6.84.0 or later with application-based authentication. Auto-upgrade does not set it.

microsoft-365entra-idsecurityconditional-accesspowershellgraph-apitenant-healthhybrid-identity
Entra Passkey Migration: The Default Problem
·16 min read

Entra Passkey Migration: The Default Problem

On 1 September 2026 Entra put SMS and voice users into a passkey profile with attestation off. What it costs you, and the runbook change it forces.

microsoft-365entra-idsecuritypasskeysauthenticationzero-trustconditional-access
Entra ID Directory Enumeration: The Attack Map
·38 min read

Entra ID Directory Enumeration: The Attack Map

A default member in Entra ID can enumerate the whole directory: every user, group, service principal and role assignment. The controls that narrow it.

microsoft-365entra-idsecuritygraph-apipowershellzero-trustconditional-access
M365 Solution Architect: What the Role Does
·13 min read

M365 Solution Architect: What the Role Does

What an M365 Solution Architect actually does: standards ownership, security architecture, licensing strategy, and delivery oversight. Beyond diagrams.

microsoft-365architecturegovernanceentra-idintuneautomationsecuritylicensing
Intune Security Baselines vs CIS Benchmarks
·19 min read

Intune Security Baselines vs CIS Benchmarks

Compare Intune security baselines against CIS benchmarks with a PowerShell export-and-diff workflow: ASR deployment and deviation tracking included.

microsoft-365intunesecurityendpoint-managementpowershellgraph-apiwindows-security
Microsoft 365 E3 vs E5: Decision Framework
·15 min read

Microsoft 365 E3 vs E5: Decision Framework

M365 E3 vs E5 decision framework for architects: TCO breakpoints, cost comparison scripts, and the rule for when E5 actually beats E3 plus add-ons.

microsoft-365licensingcost-optimizationpowershellgraph-apientra-idsecuritygovernance
M365 Tenant Health: Why It's Probably a Mess
·11 min read

M365 Tenant Health: Why It's Probably a Mess

Microsoft 365 tenant health audit checklist: detect orphaned groups, expired app secrets, CA policy sprawl, and SharePoint chaos with Graph API scripts.

microsoft-365entra-idgovernancepowershellgraph-apiautomationtenant-healthconditional-access
Conditional Access Policies That Actually Work
·15 min read

Conditional Access Policies That Actually Work

A baseline Conditional Access policy set built from 20 deployments: common mistakes, circular dependencies, and the patterns that survive production.

microsoft-365conditional-accessentra-idsecurity
Microsoft Graph API: Endpoints for Architects
·9 min read

Microsoft Graph API: Endpoints for Architects

Production-ready PowerShell scripts for M365 tenant assessment via Graph API: discovery, identity auditing, security posture, governance, licensing.

microsoft-365graph-apipowershellarchitectureentra-idsecurityautomation
Windows Estate Standardisation: The Foundation
·8 min read·Windows Endpoint Management

Windows Estate Standardisation: The Foundation

How to build a repeatable, auditable Windows estate using Intune, Autopilot, and GitOps: the foundation for Zero Trust and Copilot-ready endpoints.

windowsintunegitopszero-trust
Global Secure Access: Microsoft's SSE Play
·10 min read

Global Secure Access: Microsoft's SSE Play

A practical look at Microsoft's Global Secure Access SSE solution: what it does, how it works, and where it fits in a zero-trust architecture.

securityentra-idzero-trustnetworkingidentity

Get the next one by email

Long, specific write-ups on M365 architecture and security, worked out against real tenants rather than summarised from documentation. Sent rarely, and only when it is worth your time.