Microsoft Defender

Defender for Endpoint P1 vs P2: what Plan 2 adds and when it pays

Conditional Access App Control not working: where it breaks

The Entra policy is on, the session policy says Block download, and the file still downloads. Where Conditional Access App Control breaks, and the check for each layer.

Defender for Endpoint onboarding not working: where it stops

Intune says the EDR policy succeeded and the device is missing from Defender. The four layers onboarding breaks in, with the error codes and event IDs for each.

Attack surface reduction rules not applying: what to check

Controlled Configuration for Defender: deciding which channel actually owns your antivirus settings

New in preview: Intune-delivered Defender settings can now override Group Policy, Configuration Manager and local scripts. Useful, and not something to switch on tenant-wide.

Contain Phishing with Defender for Office 365 Safe Links and Payload Detonation

In an era where sophisticated cyber threats loom at every digital corner, organisations must fortify their email security frameworks. Central to this effort is...

Microsoft 365 Advanced Hunting: a working KQL primer

Microsoft 365 provides unparalleled tools for strengthening your digital ecosystem, among which Advanced Hunting plays a pivotal role. Uncovering the treasures...

Mail bombing: what Defender for Office 365 actually stops

# Proactive Protection: Harnessing Microsoft Defender for Office 365 Against Mail Bombing Threats