#Modern Workplace

Historically, safeguarding proprietary information mandated total control over the physical hardware. However, with the shift toward SaaS-based apps and the rise of remote work, the paradigm has moved toward securing the data itself rather than the device. Staff and external partners are no longer restricted to corporate-owned and managed Windows devices, thanks to the robust controls available within Microsoft 365. Organizations can now focus on a versatile strategy that closes visibility gaps without overstepping onto personal or third-party hardware. Microsoft is bolstering the defensive features within   Edge for Business, Entra, Intune, and Purview . Recent enhancements to profile handling and authentication now enable firms to insulate browser-centric tasks on PCs governed by other entities. These advancements synchronize Purview’s real-time data oversight with Intune’s structured deployment frameworks, allowing administrators to deploy a unified security blanket rather ...

                                      While utilizing Preset Security Policies in Microsoft Defender for Office 365, that focuses on a "set-and-forget" security posture, organizations can leverage automation in Attack Simulation Training (AST) to further strengthen the security directly through the end users (aka human firewall) by carrying out recurring, randomized testing. In other words, Preset Security Policies help in handling technical blocks (Safe Links, Safe Attachments) while Simulation Automations target the human element. I tested the Automation feature back in December 2025, but never got to blogging about it, and so decided to put a quick read together. Automation in Attack Simulation Training is a closed-loop system which allows organizations to - - Send simulated phishing emails - Observe user behavior - Automatically train users who fail - Repeat at a defined frequency - Track ...

While attempting to upgrade my Surface device to 25H2 in my tenant, I constantly encountered issues. The error in the default Windows Update report was not really helpful. The error just indicated that the installation was being cancelled by the user and that it needed attention. Which is quite bizarre, because I had the device kept switched on and connected to the internet for a long period of time so the error didn't make sense to me. I started investigating this and realized that I needed more information to get to the bottom of the error. That is when I realized that I hadn't configured the collection of the Windows diagnostic or telemetry data correctly. While this is not a necessity, nonetheless highly recommended. Here is why.. Windows telemetry helps in improving security and compatibility, identifying and troubleshooting issues, monitoring device performance and reliability through collection of specific data points. These are classified across - Service-based data fro...

Every now and then, I get asked by customers for ways of offboarding devices from Defender for Endpoint for various reasons. Most of the time it involves troubleshooting of some sort which requires going off MDE altogether. While I normally recommend to use put the device in troubleshooting mode, sometimes, it is just not the way to go. And therefore, one finds themselves offboarding the devices.  Until now, I had been using the OMA-URI way of offboarding a device in Intune, but recently I stumbled upon another way which I had no idea it ever existed. Did you know that you can use EDR to offboard a device? Surprise, surprise. I always used EDR under endpoint security in Intune, to use the blob connector to onboard a device. However, the same EDR profile also allows offboarding devices using value from the WindowsDefenderATP offboarding package. Here is how you can go about - 1. Head over to the Microsoft Defender admin portal. 2. Navigate to Settings > Endpoints > Offboardin...