Security

Start here

• The most expensive mistakes in tech history, and the lesson each one teaches
  A missing symbol that destroyed a rocket. A typo that took down a chunk of the internet.
• The power cut that saved Maersk, and what NotPetya teaches about Active Directory recovery
  How NotPetya wiped Maersk's network and one offline domain controller in Ghana saved it, plus five Active Directory recovery lessons. Includes the video.
• Azure Arc for servers: the complete setup guide
  How to set up Azure Arc for servers end to end: how the agent works, network and firewall needs, every onboarding method, and fixes for common errors.

Coming up

• 10 Nov 2026 Windows 11 23H2 Enterprise and Education end of servicing
• December 2026 Application Guard for Office removed from Microsoft 365 Apps
• 12 Jan 2027 Windows Server 2016 end of extended support
• 12 Jan 2027 Windows 10 Enterprise LTSC 2021 support ends
• 1 Feb 2027 Microsoft-provided SMS and voice MFA retired
• 1 Feb 2027 MDE and XDR Advanced Hunting APIs retired
• 2 Feb 2027 Entra Connect 2.5.190.0 reaches end of support
• 7 Apr 2027 Entra Connect Sync must use app-based auth

Learning paths

• Identity secops

Reference and tools

• App permission risk checker
• Attack path explorer
• Windows event IDs explained

All Security posts (33)

• Entra ID and Active Directory backup and recovery: the complete guide 5 Nov 2026
• The power cut that saved Maersk, and what NotPetya teaches about Active Directory recovery 4 Nov 2026
• The most expensive mistakes in tech history, and the lesson each one teaches 1 Nov 2026
• The $6.3 billion Binance hack may have started with one engineer's laptop: what happened, and what every IT team should take from it 30 Oct 2026
• The week in review: Secure Boot, PHP2Shell, Exchange and everything else that happened 24 Oct 2026
• Five things breaking this week: PHP attacks, Exchange, Always On VPN, Smart App Control and NTLMv1 22 Oct 2026
• The PHP flaw that took websites offline worldwide: what AI found, and what to do in Azure today 21 Oct 2026
• Azure Arc for servers: the complete setup guide 17 Oct 2026
• Every Entra default user permission, what it does, and how to check yours in one command 16 Oct 2026
• MC1506733: every user can create agent blueprints in Entra from November unless you turn it off 14 Oct 2026
• What's actually inside an Azure region? From the planet to one server, then we break it 13 Oct 2026
• Microsoft's deadline week: four products retire tomorrow, and Secure Boot's last 2011 certificate expires next Monday 12 Oct 2026
• Windows Server 2012 and 2012 R2: the last security update ships tomorrow 12 Oct 2026
• Governing AI agent identities in Entra: sponsors, access packages and expiry 11 Oct 2026
• Domainless SAML federation: let partners sign in with their own IdP, whatever their email domain 10 Oct 2026
• SOC Identity Responder: contain a compromised account without handing out admin roles 9 Oct 2026
• Lock down app consent without blocking your users 23 Sept 2026
• Unattended Graph PowerShell scripts with certificate authentication 16 Sept 2026
• Microsoft is retiring its own SMS and voice MFA. Here's your plan. 4 Sept 2026
• Private endpoints and DNS: why your private endpoint isn't being used 19 Aug 2026
• Key Vault: move from access policies to Azure RBAC 12 Aug 2026
• Intune in July: macOS custom compliance and Defender settings that finally win 5 Aug 2026
• Windows LAPS with Intune: unique local admin passwords in minutes 29 Jul 2026
• Microsoft Authenticator now blocks jailbroken and rooted devices 22 Jul 2026
• Entra Agent ID: giving AI agents real identities 6 May 2026
• Configurable token lifetimes are GA: when to shorten them (and when not to) 29 Apr 2026
• Six KQL queries for Entra sign-in logs every admin should keep 11 Mar 2026
• External MFA is GA: third-party MFA without giving up Conditional Access 25 Feb 2026
• Deploy from GitHub Actions to Azure without storing a single secret 21 Jan 2026
• Managed identities vs service principals: which should your workload use? 7 Jan 2026
• Turning on Defender CSPM across a landing zone 3 Dec 2025
• Break-glass accounts done right 12 Nov 2025
• Temporary Access Pass: onboarding users without a password 15 Oct 2025