Security: Zero Trust for Microsoft 365, Intune and Azure

• Identity & accessConditional Access as code · phishing-resistant MFA · no standing admin rightsProtected

  Sound familiar?

  Global Admins without MFA, 47 unnamed Conditional Access policies and a break-glass account nobody knows the password of. I bring identity back to a clear set: phishing-resistant MFA, Conditional Access as code with a reason per policy, PIM for admin roles and zero standing privileges.

  What you get

  Access you can explain to the auditor and to the user.

  Entra IDConditional AccessPIMPasskeys / FIDO2SC-300
• DevicesSecurity baselines via Intune · Defender for Endpoint · compliance as a conditionProtected

  Sound familiar?

  A compliance policy nobody dares to enable and Defender that is "on somewhere". I roll out security baselines, Defender for Endpoint, BitLocker, LAPS and Attack Surface Reduction through Intune. As code, with compliance as the condition for reaching your data.

  What you get

  Only healthy, managed devices reach your data.

  IntuneDefender for EndpointSecurity BaselinesBitLockerLAPSASR
• Data & emailPurview labels · DLP · Defender for Office 365Protected

  Sound familiar?

  Sensitive documents in a shared folder called "Everyone" and phishing that simply lands in the inbox. I apply Purview labels and DLP pragmatically (the three things that matter first), with Defender for Office 365 and Safe Links in front.

  What you get

  Data that knows what it is worth, and an inbox that knows it too.

  PurviewSensitivity labelsDLPDefender for Office 365
• Cloud & infrastructureDefender for Cloud · Azure Policy · private endpoints · managed identitiesProtected

  Sound familiar?

  An Azure environment with public endpoints, service principals with secrets from 2021 and a Key Vault nobody uses. I build landing zones with private endpoints, managed identities, Defender for Cloud and Azure Policy. As Bicep, so the secure choice is the default.

  What you get

  A landing zone where deploying insecurely simply does not work.

  Defender for CloudAzure PolicyPrivate EndpointsManaged IdentityKey VaultBicep
• Pipelines & codeWorkload identity (no secrets) · approvals · secret scanningProtected

  Sound familiar?

  A service connection with Owner on the subscription, passwords in the YAML and a pipeline anyone can start. I move pipelines to workload identity federation, least privilege per environment, branch policies, approvals and secret scanning.

  What you get

  A pipeline that is its own gatekeeper.

  Workload IdentityApprovalsBranch policiesSecret scanningAzure DevOpsGitHub Actions
• Baseline & drift3 deviations found since yesterday · fix ready as a pull requestAttention

  Sound familiar?

  Everything was fine. On delivery day. Then someone clicked a "temporary" exception. I pin the security baseline (CIS, Microsoft) in Git and compare it with your tenant every night: Conditional Access, Defender, Intune and Entra settings. You see the drift in the morning, with the fix as a pull request.

  What you get

  A baseline that holds, even after I am gone.

  Microsoft365DSCMicrosoft GraphKQLSecure ScoreCIS Benchmark

Security architecture based on SC-100 (Cybersecurity Architect Expert) and SC-300 (Identity & Access), built by an Azure Solutions Architect Expert. Not a pentester, but the one who makes sure the pentester gets bored.