Notes from the engagement floor.
Field notes, checklists and control matrices on Microsoft 365 security, Copilot readiness, AI governance and regulated-FinTech compliance — from the engineers doing the work. Free, no form, no gate.
Note
Expiring app credentials: the outage nobody plans for
Every backup job, HR sync and mail connector that talks to Microsoft 365 without a human authenticates with a client secret or certificate carrying an expiry date. What that ceiling is, where the date lives, and the narrow warning Microsoft gives first.
Read it →Guide
The questions a board asks about AI, and how to answer with evidence
Boards and insurers are adding a line for AI risk to the agenda. Six questions a director actually asks, what Microsoft 365 can already prove, what only a vendor's own terms can answer, and what a written policy needs to cover.
Read it →Checklist
Legacy authentication: the quiet back door in older tenants
Legacy authentication cannot ask for a second factor, so any account reachable through it is protected by its password alone. Here is what Microsoft has already blocked in Exchange Online, what is not blocked yet, and how to check your own tenant today.
Read it →Note
Why tenant-wide admin consent deserves a change ticket
One click of tenant-wide admin consent can let every user in a Microsoft 365 tenant sign in to an outside app, with no expiry on the grant and, by default, no second reviewer. What it grants, how it ends, and how to review it before it becomes a habit.
Read it →Guide
Why 'not licensed' beats an empty chart
A blank chart in a Microsoft 365 dashboard can mean four different things: not licensed, not granted, an expired credential, or genuinely nothing. Most tools show the same blank for all four, and Microsoft's own APIs rarely tell them apart.
Read it →Note
What Microsoft Secure Score measures, and what it doesn't
Microsoft Secure Score is the most-quoted number in small business security, and one of the least understood. How points are earned, why the number can drop without an attack, and what Microsoft itself says the score does not measure.
Read it →Checklist
What happens to a leaver's access on day 31
Blocking sign-in, wiping a phone and deleting an account run on three different clocks, not one. A source-quoted walk-through of what a departing employee's Microsoft 365 access actually keeps, until when, and how to confirm it is gone.
Read it →Matrix
Shadow AI is two problems: the apps you approved and the sites they visit
Do we have shadow AI is really two separate questions, each with its own sensor: identity records showing what received an OAuth grant, and network or endpoint signals showing what got visited. Neither lens sees what the other one sees.
Read it →Note
MFA enabled and MFA registered are different numbers
An insurer's form asks whether MFA is enforced for all users. Microsoft 365 actually keeps several different numbers behind that one word, and they do not move together. Here is what each one measures, and which one an attacker has to beat.
Read it →Guide
What the first thirty minutes of Microsoft 365 monitoring actually look like
The real objection to Microsoft 365 monitoring is not price, it is time. A minute-by-minute walk through a read-only onboarding against Microsoft's own admin-consent rules, including which role actually has to click, and it is narrower than most admins assume.
Read it →Matrix
Compliant, certified, and able to prove it are three different things
Compliant, certified, and having evidence get used as though they mean the same thing, though a security questionnaire rarely says which it wants. What ISO certification, a SOC 2 report, and HIPAA's own rules require, and what only dated evidence proves.
Read it →Note
Your admin count is wrong, and here is why
An auditor and an IT lead can both correctly count a different number of Global Administrators in the same Microsoft 365 tenant. The difference is active versus eligible role assignments, and which one your screen or API call happens to return.
Read it →Guide
What an AI tool can actually read once you click Accept
A consent screen is the only contract most businesses sign with an AI vendor, and almost nobody reads it end to end. This explains who is granting access, what words like Mail.Read and Files.Read.All mean, and whether access outlasts the login.
Read it →Note
The three places Microsoft 365 spend leaks
Microsoft 365 spend leaks through leavers who were blocked but never unlicensed, mailboxes kept on a paid seat, and accounts nobody signs into. Why reclaiming a seat saves nothing until renewal, and how to time it so it does.
Read it →Matrix
Buy a tool, or have someone watch it for you
Three ways to watch a Microsoft 365 tenant: what you already pay for, software you run, or someone watching for you. What separates them is not features but who is accountable for looking — and what they can change while looking.
Read it →Checklist
What to check before an MCP server reads your Microsoft 365 tenant
An MCP server asking to read your Microsoft 365 tenant passes three gates — Microsoft consent, vendor entitlement, and the protocol audience check. Most buyers check one. The seven questions to ask, and what the answers should sound like.
Read it →Note
Six consoles, and nobody with an hour a day to check them
Microsoft 365 security is spread across six admin portals, and in one of them the record of who signed in survives seven days. Why nobody checks all six, what that quietly costs, and what a single read-only view changes.
Read it →Matrix
Microsoft Sentinel data tiers: what they cost, and what they cost you
The widely quoted Sentinel per-GB price is gone, two Microsoft pages publish different commitment ladders, and some rates cannot be found at all. What each tier costs, and which one silently turns your alerting off.
Read it →Guide
What an AI agent actually costs: seats, credits and consumption units
Microsoft prices AI in three incompatible units, and nothing is priced per agent. What a Copilot seat really zero-rates, which spend draws down your Azure commitment, and the three enforcement thresholds nobody shows you together.
Read it →Matrix
Claude in Microsoft Foundry: hosted on Azure, governed by Anthropic
Claude went GA in Microsoft Foundry hosted on Azure. That moves the silicon, not the accountability. Which four models are actually Azure-hosted, why there is no EU data zone, and where prompts go across Foundry, Copilot, Copilot Studio and GitHub.
Read it →Guide
Intune device compliance policy: the control that never blocks anything
An Intune device compliance policy evaluates a device and reports a boolean. It blocks nothing by itself. What enrolment establishes, what profiles write, which layer really denies access, and the tenant default that marks unmanaged devices compliant.
Read it →Checklist
NYDFS 23 NYCRR 500 on Microsoft 365: what the controls actually map to
Every phase of the amended NYDFS cybersecurity regulation is now in force. What Microsoft actually attests to, which Part 500 controls your licence tier can evidence, why your audit horizon is shorter than you think, and the two 72-hour clocks.
Read it →Guide
Microsoft Copilot security: what actually happens to your business data
Where a Copilot prompt goes, what is kept and for how long, what Microsoft commits to contractually, and which certifications actually name Microsoft 365 Copilot in scope — including the model-hosting change in July 2026 that most security reviews have not caught up with.
Read it →Guide
Microsoft Copilot governance: identity, data, security and compliance
Microsoft Copilot governance in practice: the two frameworks Microsoft publishes and the gap between them, which administrative roles actually hold authority, a control mapping to the NIST AI Risk Management Framework, and when to bring in help.
Read it →Checklist
A Microsoft Copilot readiness assessment you can run yourself
A Copilot readiness assessment asks three things: can Copilot run, can it see what it should, and can it not see what it should not. The first-party reports that answer each one, the exact SharePoint reports and cmdlets, and the requirement-versus-recommendation distinction most checklists get wrong.
Read it →Guide
Microsoft 365 Copilot implementation: what has to be true before you buy
A Microsoft 365 Copilot implementation is a permissions project with a licence attached. What Copilot actually inherits, which prerequisites stall pilots in week one, where the official guidance assumes an enterprise a 300-seat business does not have, and what the independent evidence says about outcomes.
Read it →Guide
Making a mailbox migration boring
Migration is one of the few operations where the failure mode is not downtime but loss. How EMaigrator removes the dangerous options from the tool — streaming pass-through, an idempotency ledger, and per-account rate coordination.
Read it →Guide
Every deploy is a commit
Three cloud consoles, three mental models, and no shared record of who changed what. How Mirsat makes the audit trail a by-product of the operation rather than a discipline someone has to maintain.
Read it →Guide
Microsoft 365 Copilot deployment: the four control planes of a secure rollout
A secure Microsoft 365 Copilot deployment is four control planes, and one of them did not exist a year ago. What Purview DLP for Copilot actually blocks, why encryption rights stop agents reading files, how agent identity changed the boundary, and where your data goes when the region is busy.
Read it →
Tell us what'skeeping you upat night.
Most engagements start with a Cloud Health Check — one week, full audit, top-10 findings, 90-day roadmap. Many turn into a longer engagement; either way, you walk away with a prioritized plan you own.