Identity, Governance & Security Writing
Practical thinking on Microsoft Entra ID, M365 Governance, and Conditional Access. No fluff, no vendor spin.
Passkey Migration: A Practical Rollout Plan
A practical plan for migrating Microsoft Entra ID users to passkeys, from profile design and pilot waves to Conditional Access and account recovery.
Identity
5 articlesMicrosoft Entra ID, authentication, identity architecture, and threat detection. The fundamentals that everything else builds on.
Identity Is Everything
Defense in depth, Zero Trust, RBAC, and ITDR explained through everyday life. Why signal correlation matters.
Authentication Methods: The Spectrum
From SMS OTP to phishing-resistant MFA — understanding the full range and when each matters.
Passkeys: Security Only Works If People Use It
The strongest authentication method doesn't matter if adoption fails. What makes passkeys stick.
Who Did You Let Into Your House?
Guest accounts, external identities, and the access you forgot you gave.
Groups: The Connective Tissue
Every MFA policy, CA exclusion, app assignment, and privileged role is enforced through group membership. Get groups wrong and everything else fails quietly.
Conditional Access
9 articlesConditional Access policy design, exclusions, service principal gaps, and the real-world decisions behind every rule.
Policy Plans Are the Fix Conditional Access Needs
A plan holds the targeting and the break glass exclusion once. I pushed plans to their limits in my own tenant, and the numbers should shape how you name things.
Policy Plans Change How You Organize Conditional Access
Entra's new policy plans (preview) let you define targeting and exclusions once and layer scenario rules underneath, plus the Security Defaults update, Message Center and Roadmap items moving this October.
Why Your Encrypted Emails Won't Open and How to Fix It
Sensitivity labels encrypt email, but Conditional Access can block the decryption service. Here's why it happens and how to fix it with a targeted exclusion.
10 CA Mistakes That Are Probably in Your Tenant Right Now
Not theory. These are the gaps that show up in real tenants — the ones that look configured but aren’t doing what the admin thought.
Baseline Scopes: Microsoft Closed the Side Door
A Conditional Access gap that sat open for years, the research that exposed it, and the new enforcement setting that closes it.
CA Policy Analyzer: July 2026 Update
Community-contributed fixes, new audit rules, and expanded coverage for real-world policy gaps — what shipped in the July 2026 release.
CA Policy Analyzer Update
What changed in the latest CA Policy Analyzer update and how to use it to validate exclusions, gaps, and policy coverage faster.
Conditional Access: The Safety Net
Why Azure is the foundation of every CA stack. Build the safety net first. Then build the stack on top of it.
MFA for All… But Not the Same
One foundational policy. Four excluded service principals. And the production scars that explain every decision.
Governance
5 articlesM365 governance, group lifecycle, ownership models, and the cleanup work that never makes it onto roadmaps — until something breaks.
Groups Are the Connective Tissue — and Nobody Owns the Scissors
A governance lens on groups: dynamic rules, naming policy, expiry, and why ungoverned groups become risk vectors.
The Governance Gap
Settings are the starting point. What separates a configured tenant from a controlled one is operationalisation.
The Cleanup Campaign That Never Ends
Lifecycle management isn't a one-time project. It's a countermeasure against the entropy of a living tenant.
Clean the House Before the Guests Arrive
Before Copilot goes live, you need to know what it will find. A practical audit framework for AI readiness governance.
The Ownership Operating Model
Governance doesn't fail because of technology. It fails because nobody owns anything. Building an operating model that sticks.
Entra
7 articlesDeep dives on Microsoft Entra groups, OAuth2, delegated and app permissions, and practical identity platform architecture.
Passkey Migration: A Practical Rollout Plan
A practical plan for migrating Microsoft Entra ID users to passkeys, from profile design and pilot waves to Conditional Access and account recovery.
App Registrations and Enterprise Apps: What the Entra Object Model Actually Looks Like
A ConnectWise (formerly SkyKick) vendor credential compromise hit customer tenants across the MSP space in October 2026, and it will not be the last. How App Registrations, Enterprise Apps, and OAuth 2.0 actually work in Entra ID, and the application management policies that would have stopped it.
SMS and Voice Retirement, Part 2
Four weeks after September 1: the Global Admin date change to ignore, the all-types passkey profile, registration campaigns that wouldn't stay disabled, and what Soprano and Telesign charge for SMS in Entra ID.
SMS and Voice Retirement, Part 1
Microsoft is not removing SMS and Voice from Entra ID. It is ending Microsoft-provided telephony. What changed on September 1, what happens February 1, 2027, and how MSPs find and move their SMS and Voice users.
NHI? Never Heard of Him — The Service Principal Sitting in Your Tenant
Every tenant has them. Most orgs can't see them. Some hold more privilege than any human admin, with none of the controls you've actually built.
Mastering Groups: The Deep Dive
The complete reference to Microsoft 365 group types, creation controls, lifecycle governance, and the directory settings that underpin every workload.
AUs vs RMAUs: What's That?
A practical deep dive on Administrative Units and role-assignable variants in Microsoft Entra — where each fits, where each breaks down, and how to use them safely in production.
Azure
1 articleAzure infrastructure, governance guardrails, and the policy-as-code controls that keep MSP and enterprise environments from drifting.
Book Reviews
2 articlesEarly review copies of identity and security books, checked chapter by chapter against what Microsoft Learn actually says today.
Agents Inherit Every Identity Mistake You Already Made
A review of Securing Enterprise AI Agents by Thomas De Vos: why every identity and data governance problem MSPs already have just got faster.
Identity Is Everything, and This Book Spends 18 Chapters Proving It
A review of Mastering Microsoft Entra ID by Pramiti Bhatnagar, mapped chapter by chapter to Entra licensing tiers, with the one number that has changed since publication.
Never miss a new article.
Subscribe via RSS or follow the full archive of 40 published articles on Medium.