#Modern Workplace

Source: Microsoft If you work across different Microsoft 365 environments, you have probably noticed that the Microsoft Defender portal can be a bit of a moving target. One day you are working in an enterprise environment (with Defender for Endpoint Plan 2) and you know exactly where everything is. The next day, you log into an SMB client's tenant running Microsoft 365 Business Premium (Defender for Business) and things look a lot different.  A classic example of this is Device Groups . If you search online or read standard enterprise documentation, you will be told to go to Settings > Endpoints > Permissions > Device groups . But if you try that in a Defender for Business or a Business Premium tenant, you will get a frustrating surprise. The menu isn't there, and clicking the hyperlink under a supported feature like AIR, just brings you back to the homepage. So what is really going on? Is this by design or a bug? Let’s explore.. Where are the Device Groups The disapp...

Microsoft Entra makes passwordless registration easier, but what does this mean for Zero Trust? Let's discuss.. Microsoft recently  published  a message in the message center that covers details on Windows Hello for Business and macOS Platform SSO supporting standalone MFA factors. It is well established that Passwordless authentication is becoming the default approach for modern identity security. Windows Hello for Business (WHfB), passkeys, FIDO2 and macOS Platform SSO (PSSO) all provide stronger authentication while reducing our dependency on passwords. And with this new change, Microsoft has now made passwordless registration in Entra ID easier, including bringing register security information further into the conditional access model. However, this does raise an interesting question: If passwordless authentication is strong enough to authenticate the user, do we still need MFA? In my personal opinion, it is still necessary, but not necessarily in the way we traditionally ...

Credits: Google Microsoft’s shift to the modern Google Android Management API (AMAPI) brings a highly anticipated, low-friction onboarding experience to Android Enterprise Personally-Owned Work Profiles: Web-Based Enrollment. This mirrors the web-first workflow we’ve seen on iOS for a while, completely removing the traditional requirement for end-users to pre-download the heavy Intune Company Portal application from the public Play Store. However, moving to a modern, browser-driven enrollment framework completely changes how security tokens are passed under the hood. So if you are planning to deploy Android Web-Based Enrolment while maintaining a strict Zero-Trust tenant, you will almost certainly run into infinite authentication loops, hidden app blocks, and broken single sign-on (SSO). In this blog post, I’ll break down the architectural reality of Android container sandboxing, uncover the hidden identity dependencies, and detail the exact Conditional Access exclusions you need to m...

Historically, safeguarding proprietary information mandated total control over the physical hardware. However, with the shift toward SaaS-based apps and the rise of remote work, the paradigm has moved toward securing the data itself rather than the device. Staff and external partners are no longer restricted to corporate-owned and managed Windows devices, thanks to the robust controls available within Microsoft 365. Organizations can now focus on a versatile strategy that closes visibility gaps without overstepping onto personal or third-party hardware. Microsoft is bolstering the defensive features within   Edge for Business, Entra, Intune, and Purview . Recent enhancements to profile handling and authentication now enable firms to insulate browser-centric tasks on PCs governed by other entities. These advancements synchronize Purview’s real-time data oversight with Intune’s structured deployment frameworks, allowing administrators to deploy a unified security blanket rather ...