Microsoft 365 security field notes for UK SMEs. Practical checks for real work.
Source-backed notes for Cyber Essentials Plus evidence, Entra ID MFA, Conditional Access, Intune, Defender, external sharing, mail security and audit cleanup.
Field notes
Start with a practical route, then scan the newest checks when the detail matters.
Start here
Four paths through the most common Microsoft 365 security decisions.
Cyber Essentials Plus Readiness Guide
This is the readiness guide I would want before booking a Cyber Essentials Plus assessment for a Microsoft 365-heavy environment: scope first, MFA proof, device evidence, patch records, mail controls and a dry run before assessment week.
Microsoft 365 Security Clean-up Checklist for UK SMEs
Most Microsoft 365 tenants do not need a new product first. They need old admin access removed, MFA gaps closed, risky mail routes checked, sharing defaults tightened and evidence collected before an audit or incident forces the issue.
Microsoft 365 Security Review for UK SMEs: The First 10 Checks
A decent first Microsoft 365 security review does not need to be dramatic. It needs to show which controls are weak, who owns them, what evidence exists and which fixes reduce tenant risk first.
Intune and Defender Endpoint Control
Endpoint control is not proved by a busy Intune portal. It is proved by managed device coverage, Defender onboarding, compliance enforcement, patch evidence, local admin control and a remediation path for exceptions.
Latest field notes
Newest first.
A Practical systemd Service Sandbox
Start from the files, privileges and resources the service actually needs, and apply restrictions in reviewable steps.
Ask Suppliers for an SBOM You Can Use
Tie the component inventory to the product you run and test how the supplier handles one concrete vulnerability question.
Back Up Live SQLite Without Losing WAL Data
A copied database file is useful only when it represents a consistent, recoverable application state.
BitLocker Recovery: Access and Key Rotation
A recovery password unlocks the drive, so its disclosure and replacement belong in the same support process.
Catch Certificate Renewal Failures Early
Check both certificate issuance and deployment, then alert early enough for a person to repair the dependency.
Change SSH Authentication Without Lockout
Test the configuration and a fresh connection before you retire the previous access method.
Check Docker Port Exposure Beyond UFW
Review container publishing and host firewall behaviour together, including IPv6 and direct routes.
Choose the Right SharePoint Recovery Route
Match recovery to what changed, then use the smallest operation that can recover the required content.
Cloud Sync Migration: Validate Every Object
Separate a successful configuration transfer from evidence that the right identities and relationships survived the migration.
DANE for SMTP: DNS and Certificate Checks
DANE needs reliable DNSSEC and coordinated mail-server changes, including every receiving route.
Entra Account Discovery: Reconcile Access
Turn discovery categories into reviewed access decisions without mistaking unmatched accounts for confirmed leavers.
Entra Provisioning Callouts: Failure Design
Decide what happens when a custom attribute service is slow, repeated or wrong before connecting it to account creation.
Entra Provisioning: Null and Missing Values
Decide which empty source values should clear the directory before enabling the preview.
Find SSH Key Owners Before the Next Leaver
Replace anonymous authorised keys with named ownership, scoped access and a removal procedure you can verify.
Fix Intune Win32 Detection Before Repackaging
An installer can succeed while Intune correctly reports that the configured detection condition has not been met.
GitHub Actions Lockfiles: Review Runner Inputs
A workflow lockfile makes dependency changes visible, provided someone actually reviews the commits it records.
GitHub AI Scan: A Finding Still Needs a Reviewer
AI Scan adds useful review signals, but its advisory results need a named person and an explicit merge decision.
GitHub Anthropic Key Scanning: Response Checks
An extra detector helps catch a leaked key. The response still needs to remove its access and restore the services that used it.
GitHub Licence Compliance: Explain Exceptions
A blocked dependency needs a clear decision path, with enough evidence to explain why an exception was approved.
Global Secure Access: Pilot Partner Access
Check partner identity, client routing and application permissions together before replacing an existing access route.
Global Secure Access: Test Device Signals
Measure the complete path from a changed device state to a blocked application connection and a successful recovery.
Intune Retire, Wipe or Delete: Choose the Outcome
Deleting an Intune record can trigger a device action, and its completed status does not prove the device has finished removing data.
Keep Linux Journal Logs Within Disk Limits
Choose retention from real log volume and verify that important events survive reboot and reach the collector.
Linux Disk Full: Blocks, Inodes and Open Files
Identify what is consuming the affected filesystem before deleting files or restarting services.
Linux Security Updates: Restart and Reboot
Track which updates are installed, which services have loaded them and which hosts still need a controlled reboot.
Longer GitHub App Tokens: Integration Checks
The token still authenticates the same installation, but an old length check or logging rule can break the integration around it.
Microsoft 365 Backup: Test the Recovered Data
A completed restore job is one checkpoint; the drill finishes when the right person can use the right recovered data.
Microsoft 365 Leavers: Access and Data Handover
Keep the leaver unable to sign in while the authorised successor receives only the business data they need.
Monitor Transactional Email After Sending
Connect the application's message record to the mail provider's outcome and the business action needed after failure.
MTA-STS and TLS Reporting: A Careful Rollout
Use TLS reporting to find delivery problems before enforcing your inbound mail transport policy.
Object Lock Backups: Test Deletion Resistance
An immutable backup needs a protected recovery path as well as a protected object.
Plan a DNSSEC Key Rollover Without an Outage
Treat the parent delegation and the signed zone as one change, with evidence at each stage.
Post-Quantum TLS: Questions for Suppliers
Ask for the exact protocol, negotiated key exchange and affected service path before accepting a post-quantum claim.
PostgreSQL Recovery: Test the Restore Point
A recent dump cannot provide every recovery option that a base backup and a complete WAL archive can.
Prioritise Patches with KEV, EPSS and CVSS
Keep the different signals visible instead of turning every vulnerability into one unexplained score.
Recover Backups Without the Primary Tenant
A recovery exercise should begin without your normal signed-in browser or password vault session.
Recover Domain and DNS Administrator Access
Put domain ownership, recovery access and DNS configuration into a plan another authorised person can use.
Release Windows Autopilot Before Resale
A reset laptop can still be tied to your tenant; verify its release before the buyer or next organisation starts setup.
Remove WireGuard Access and Retire the Peer
A complete VPN removal covers the peer, its persistent configuration and the application access behind the tunnel.
Restic: Monitor Backups, Retention and Checks
Track the age and completeness of each backup set, then verify the stored data and retention decisions separately.
Review Cross-Tenant MFA and Device Trust
Trust settings let you accept a partner’s claims, so agree what those claims mean before relying on them.
Run a Timed Recovery Drill for a Key Service
Recover one useful service in an isolated environment and measure the delays that the backup dashboard cannot show.
ServiceNow Access Packages: Approval Ownership
Give users a familiar request portal without creating a second, conflicting access policy.
SuccessFactors: Move to Workload Identity
Treat credential replacement and HR data correctness as separate acceptance tests.
Teams Shared Channels: Owners and Access Removal
Review the channel, its connected site and any separate file access before calling a partner handover complete.
Temporary Access Pass: Recovery Checks
The recovery is complete when the user can sign in with an approved replacement method and the lost method has been addressed.
Test PIM Approval When the Approver Is Away
An approval requirement is only operational when someone authorised can act on it during the hours the role may be needed.
TLS Inspection: Deploy Client Certificate Trust
Separate certificate creation from the work needed to make inspected connections reliable on managed devices.
Token Protection: Registration Readiness
Use registration evidence and real application journeys to decide which users are ready for token protection.
Verify Container Digests, Signers and Builds
Approve a specific image from an expected source, then keep a deliberate route for security updates.
Verify DNS Filtering on Managed Devices
Verify the resolver used by real applications, including encrypted DNS and remote-working paths.
Verify Exchange App RBAC Mailbox Scope
A narrow Exchange role assignment does not cancel a broad application permission granted through Entra.
Windows 26H2: Pilot Intune Settings
Separate the new settings, the baseline and the operating system upgrade, then test the work each device actually needs to do.
Windows MDM CNAME Discovery: January 2027 Change
The discovery method is changing; map the affected enrolment journeys and give users the correct server address where needed.
Windows Server Hotpatch: Plan Baseline Reboots
Use Hotpatch to reduce routine restarts while keeping a tested maintenance path for the updates that still require one.
AI Phishing and UK SMEs: Controls That Work
AI has made phishing more convincing, not fundamentally different. The controls that stop it are phishing-resistant sign-in, layered email filtering and a payment process that does not trust email.
DMARC, DKIM and SPF on Microsoft 365 for UK SMEs
Most SMEs publish SPF, leave DKIM half done and park DMARC at p=none forever. Here is a practical route to enforcement on Microsoft 365.
Entra SMS and Voice MFA Retirement: Passkeys
Microsoft is retiring its own SMS and voice MFA delivery in Entra ID. Passkeys are already being switched on for SMS and voice users, and the hard deadline is 1 February 2027.
Microsoft 365 Companion Apps Retirement 2026
The Microsoft 365 companion apps for Calendar, People and Files retire on 16 December 2026. Admins must stop deployments and remove them from managed devices.
Purview Retention Auto-Archive for SharePoint
Microsoft Purview is adding an archive action to retention policies. It can cut storage spend and Copilot noise, but only if you pilot it on the right content first.
Windows Secure Boot Certificate Expiry 2026
Two of Microsoft's 2011 Secure Boot certificates expired in June 2026 and the Windows Production PCA 2011 expires on 19 October 2026. Devices still boot, but they stop getting boot-chain protections.
Cyber Essentials Plus BYOD and Mobile MAM Policy
Personal smartphones accessing Microsoft 365 fall in scope for Cyber Essentials Plus. Intune MAM app protection protects corporate data without full MDM enrolment.
Defender for Business Web Content Filtering
Microsoft 365 Business Premium includes native web content filtering. Protect remote laptops and block malicious web categories without third-party agents.
Entra ID Mandatory MFA Phase 2: Fixing Broken Scripts
Microsoft's mandatory MFA rollout affects PowerShell and Azure CLI. Learn how to migrate legacy credentials to certificate-based service principals.
Windows LAPS with Entra ID Cloud Setup Guide
Shared local admin passwords are a finding waiting to happen in a Cyber Essentials Plus assessment. Windows LAPS with Entra ID rotates a unique password per device.
Conditional Access Resource Exclusions: 2026
A narrow Conditional Access enforcement change started rolling out in June 2026. Most tenants need no action, but affected custom apps can now receive challenges they did not receive before.
Entra Connect Sync: September 2026 Deadline
Microsoft says Entra Connect Sync services below version 2.5.79.0 will stop on 30 September 2026. Check the live server, then choose upgrade or migration deliberately.
Exchange Online EWS Retirement: October 2026
Exchange Web Services starts its phased retirement in October 2026. The useful work now is finding every dependency, assigning an owner, and testing a replacement.
July 2026 Intune Changes for M365 E3 and E5
Microsoft has changed which advanced Intune capabilities sit inside Microsoft 365 E3 and E5. Check the tenant and contract before buying, renewing or cancelling an add-on.
SMTP AUTH Basic Auth: December 2026 Plan
Microsoft changed the SMTP AUTH Basic authentication timeline. The extra runway should be used to identify devices and applications, not to preserve shared mailbox passwords.
UK Cyber Resilience Pledge: M365 Evidence
The UK Cyber Resilience Pledge is voluntary, but its board, Early Warning and supply-chain commitments are specific. Treat it as operating work, not website copy.
Security policies vs helpdesk reality
I have run an internal helpdesk and watched theoretical security policies crumble on day one. Here is why external advice usually misses the mark, and how to fix it.
Microsoft 365 Security Backlog 2026
A backlog is useful when it reflects operational reality, not product marketing. This one is built around the problems smaller Microsoft 365 tenants keep tripping over.
Cyber Essentials Plus Endpoint Samples
The assessor does not care about your best three laptops. They care whether an ordinary sample of business devices reflects the controls you say are in place.
Cyber Breaches Survey Lessons for M365
The latest UK breaches survey is not a reason to panic. It is a reason to tighten the day-to-day Microsoft 365 controls that often get treated as background admin.
Cyber Essentials Patch Evidence
The new patching conversation is not just about whether you patch. It is about proving supported software, timely updates, and controlled exceptions across the endpoint estate.
Cyber Essentials v3.3: Missing MFA on Cloud Services Is an Automatic Fail
Cyber Essentials v3.3 is blunt on MFA. In-scope cloud service access must use it, and Microsoft 365 teams need to prove policy enforcement across users, admins, guests, exclusions and emergency accounts.
Cyber Essentials v3.3: Cloud Services Scope for Teams on Microsoft 365
Cyber Essentials v3.3 removes a lot of wiggle room around cloud scope. For Microsoft 365 teams, that matters more than most people first think.
Endpoint DLP Only Works When the Endpoint Is Actually Managed
What Endpoint DLP really needs before it becomes useful, and why unmanaged or poorly managed devices make the whole story weaker.
Purview DSPM for AI: Copilot Readiness
Copilot readiness is usually not an AI settings question first. It is a data posture question with a lot of old permissions and neglected workspaces hiding inside it.
Intune Policy Conflict Map: Baselines, Settings Catalog and Endpoint Security
How to give each Intune control family a proper home, instead of layering settings until nobody trusts the result.
Intune Mobile Passkeys: Small Change, Useful Control
A practical look at passkeys on mobile, what Intune can protect, and where phone access still weakens Microsoft 365 control.
Microsoft-Managed Conditional Access Policies: Useful, but Still Needs Ownership
What Microsoft-managed Conditional Access policies actually do, where they help, and why they still need local ownership before anyone treats them as finished security work.
Container Labels for Teams, Sites and Groups: Control the Place, Not Just the File
Sometimes the real problem is not one badly handled document. It is the workspace around it being too open, too easy to share, or too loose on unmanaged access.
Sensitivity Labels in SharePoint and OneDrive: A Practical Start
Most label rollouts fail because they are too abstract. People get a list of terms, not a small set of decisions that actually helps them handle data better.
DLP for Copilot and Third-Party AI
AI does not invent a permissions mess. It tends to find it faster, summarise it faster, and make sloppy data controls harder to ignore.
Password Spray Controls for Microsoft 365
The Microsoft 365 controls that do the most to raise the cost of password spray attacks, without pretending the answer is one magic setting.
Passkeys in Entra ID: Practical Rollout for Microsoft 365 Admins
A grounded rollout plan for passkeys in Microsoft Entra ID, including pilot scope, recovery, and the policy choices that matter more than the launch announcement.
Audit Logs and Evidence: What to Capture Before Assessment Week
Good evidence packs are not glamorous. They are dated, easy to navigate, and strong enough that nobody reconstructs the tenant from memory under pressure.
OAuth App Consent Audit: The Microsoft 365 Backdoor People Miss
How to review OAuth app consent in Microsoft 365 properly, including user consent settings, admin workflow, and the apps that quietly end up with far too much access.
Defender for Office 365 Operations
Email security does not usually fail because the licence was wrong. It fails because the queue had no owner, exceptions multiplied and the monthly review stopped happening.
Microsoft 365 Incident Response Plan
A good Microsoft 365 incident plan does not need to be huge. It needs to help a small team make clean decisions in the first hour, while evidence is fresh.
Guest Access Reviews in Teams
Guest access is usually not risky because it exists. It becomes risky when nobody can explain who still needs it, what they can see, and when it should end.
Break-Glass Accounts in Microsoft 365
How to design Microsoft 365 emergency access accounts that actually help in a lockout without turning into permanent unmanaged admin shortcuts.
Mail Forwarding and Inbox Rules: The Audit Nobody Should Skip
Password resets are not cleanup. If you have not checked forwarding, inbox rules and transport rules, you may be leaving the quiet part of an email compromise behind.
Windows 10 After End of Support: Microsoft 365 and Cyber Essentials Risk
What Windows 10 end of support really changes for Microsoft 365 teams, and where people overstate or understate the risk.
Device Compliance and Conditional Access
How to make device compliance matter at the access layer, instead of leaving it as a nice-looking dashboard.
AVD Least Privilege with Intune EPM
A practical way to think about least privilege in Azure Virtual Desktop, without pretending virtual desktops remove endpoint risk.
Endpoint Privilege Management
A grounded way to use Endpoint Privilege Management, with tighter exception handling and less wishful thinking.
Intune Baseline Conflict Fixes
Why Intune conflicts usually come from overlapping ownership, and how to simplify the estate without breaking devices.
Microsoft Secure Score Backlog
Secure Score is useful because it points at work. It becomes less useful when people turn it into a trophy number and stop asking which recommendations reduce real risk.
SharePoint External Sharing Clean-up
External sharing in Microsoft 365 is usually not one giant mistake. It is dozens of small permissions that nobody came back to tidy up.
Phishing Still Pays: A Microsoft 365 Action Plan for UK SMEs
Phishing is still cheap, common and effective when basic follow-up controls are weak. A Microsoft 365 action plan that makes sense for UK teams without turning into theatre.
Email Security Baselines: Standard vs Strict
Standard and Strict are not personality types. They are operating choices. A practical way to decide what goes where and stop phishing tuning becoming a weekly argument.
MFA in Microsoft 365: Security Defaults, Conditional Access or Per-User MFA?
A practical comparison of Security Defaults, Conditional Access, and per-user MFA, including when each option still makes sense and when it does not.
Global Admin Clean-up in Microsoft 365
How to clean up Global Administrator sprawl in Microsoft 365 without turning the exercise into guesswork or politics.
Conditional Access: From Report-Only to Enforcement
A practical plan for moving Microsoft Entra Conditional Access policies from report-only to enforced, without pretending the hard parts are somebody else's problem.
Breaches are not falling
The share of UK businesses reporting a breach or attack has held at 43% for two years.
- 50%2023/24
- 43%2024/25
- 43%2025/26
How attacks get in
Phishing leads by a wide margin, which is why so many of these notes start with mail and identity.
- Phishing38%
- Impersonation in emails or online12%
- Malware on devices7%
- Online bank account hacking3%
- Denial of service3%
- Account takeovers2%
- Ransomware1%
Browse by topic
Group the notes by Cyber Essentials Plus, identity, endpoint management or tenant security.
Related pages
