Category: M365 – Security

Managing the same groups in multiple Entra tenants?

🔒 Secure Bits 💡 𝗠𝗮𝗻𝗮𝗴𝗶𝗻𝗴 𝘁𝗵𝗲 𝘀𝗮𝗺𝗲 𝗴𝗿𝗼𝘂𝗽𝘀 𝗶𝗻 𝗺𝘂𝗹𝘁𝗶𝗽𝗹𝗲 𝗘𝗻𝘁𝗿𝗮 𝘁𝗲𝗻𝗮𝗻𝘁𝘀? 𝗧𝗵𝗮𝘁 𝗺𝗮𝘆 𝗻𝗼 𝗹𝗼𝗻𝗴𝗲𝗿 𝗯𝗲 𝗻𝗲𝗰𝗲𝘀𝘀𝗮𝗿𝘆. 📆 Newly added feature in May 2026 Organizations with multiple Entra tenants often end up maintaining the same access groups repeatedly across environments. One group for employees in Tenant A. Another group for the same employees in […]

Exchange Online – DNSSEC enablement wizard?

🔒 Secure Bits 💡 𝗠𝗶𝗰𝗿𝗼𝘀𝗼𝗳𝘁 𝗶𝘀 𝗳𝗶𝗻𝗮𝗹𝗹𝘆 𝗯𝗿𝗶𝗻𝗴𝗶𝗻𝗴 𝗮 𝗗𝗡𝗦𝗦𝗘𝗖 𝗲𝗻𝗮𝗯𝗹𝗲𝗺𝗲𝗻𝘁 𝘄𝗶𝘇𝗮𝗿𝗱 𝘁𝗼 𝗘𝘅𝗰𝗵𝗮𝗻𝗴𝗲 𝗢𝗻𝗹𝗶𝗻𝗲. This is a very welcome change. DANE is available in Microsoft 365 for almost a year now and yet the only way to date was to set it via PowerShell. To give you some context, DANE (DNS-based Authentication of Named […]

M365 Break Glass Accounts – full guide

🔒 Secure Bits 💡 𝗕𝗿𝗲𝗮𝗸-𝗴𝗹𝗮𝘀𝘀 𝗮𝗰𝗰𝗼𝘂𝗻𝘁𝘀: 𝗳𝘂𝗹𝗹 𝗴𝘂𝗶𝗱𝗲 (𝗣𝗗𝗙) In my last post I talked about the “worst day” scenario: CA misconfig → admins locked out. Most orgs think they’re covered… until they test it. As promised, 𝗵𝗲𝗿𝗲’𝘀 𝘁𝗵𝗲 𝗳𝘂𝗹𝗹 𝗣𝗗𝗙 𝗴𝘂𝗶𝗱𝗲 that walks you through a practical break-glass setup: ▪️ Naming ▪️ Permissions ▪️ Role-Assignable Security Group ▪️ […]

M365 Break Glass Accounts

🔒 Secure Bits 💡 𝗬𝗼𝘂𝗿 𝘁𝗲𝗻𝗮𝗻𝘁 𝗵𝗮𝘀 𝗖𝗔 𝗺𝗶𝘀𝗰𝗼𝗻𝗳𝗶𝗴𝘂𝗿𝗮𝘁𝗶𝗼𝗻. 𝗘𝘃𝗲𝗿𝘆 𝗮𝗱𝗺𝗶𝗻 𝗶𝘀 𝗹𝗼𝗰𝗸𝗲𝗱 𝗼𝘂𝘁. 𝗗𝗼 𝘆𝗼𝘂 𝗵𝗮𝘃𝗲 𝗮 𝘄𝗮𝘆 𝗯𝗮𝗰𝗸 𝗶𝗻? Most organizations don’t — or think they do, until they discover their break-glass accounts are untested, unmonitored, or built on outdated guidance. You don’t want to find that out the hard way, and you […]

Microsoft Entra Backup and Recovery is now in Public Preview

🔒 Secure Bits 💡 𝗠𝗶𝗰𝗿𝗼𝘀𝗼𝗳𝘁 𝗘𝗻𝘁𝗿𝗮 𝗕𝗮𝗰𝗸𝘂𝗽 𝗮𝗻𝗱 𝗥𝗲𝗰𝗼𝘃𝗲𝗿𝘆 𝗶𝘀 𝗻𝗼𝘄 𝗶𝗻 𝗣𝘂𝗯𝗹𝗶𝗰 𝗣𝗿𝗲𝘃𝗶𝗲𝘄 — and it fills a major gap in identity resilience. Someone disables a Conditional Access policy. A bulk import overwrites user attributes. A service principal loses its permissions. Until now, recovery meant digging through audit logs and manually reconstructing the state […]

Microsoft is changing MX records in Exchange Online

🔒 Secure Bits 💡 𝗠𝗶𝗰𝗿𝗼𝘀𝗼𝗳𝘁 𝗶𝘀 𝗰𝗵𝗮𝗻𝗴𝗶𝗻𝗴 𝗠𝗫 𝗿𝗲𝗰𝗼𝗿𝗱𝘀 𝗶𝗻 𝗘𝘅𝗰𝗵𝗮𝗻𝗴𝗲 𝗢𝗻𝗹𝗶𝗻𝗲 (𝗝𝘂𝗹𝘆 𝟮𝟬𝟮𝟲) — 𝗮𝗻𝗱 𝗶𝘁 𝘂𝗻𝗹𝗼𝗰𝗸𝘀 𝘀𝘁𝗿𝗼𝗻𝗴𝗲𝗿 𝗲𝗺𝗮𝗶𝗹 𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆. A change coming to Exchange Online in 📆 July 2026 will modify how new accepted domains receive their MX records. Instead of the traditional \*.𝘮𝘢𝘪𝘭.𝘱𝘳𝘰𝘵𝘦𝘤𝘵𝘪𝘰𝘯.𝘰𝘶𝘵𝘭𝘰𝘰𝘬.𝘤𝘰𝘮, Microsoft will start provisioning MX records under \*.𝘮𝘹.𝘮𝘪𝘤𝘳𝘰𝘴𝘰𝘧𝘵. At […]

EWS is going away

🔒 Secure Bits 💡 𝗘𝘅𝗰𝗵𝗮𝗻𝗴𝗲 𝗪𝗲𝗯 𝗦𝗲𝗿𝘃𝗶𝗰𝗲𝘀 (𝗘𝗪𝗦) 𝗶𝗻 𝗘𝘅𝗰𝗵𝗮𝗻𝗴𝗲 𝗢𝗻𝗹𝗶𝗻𝗲 𝗶𝘀 𝗼𝗳𝗳𝗶𝗰𝗶𝗮𝗹𝗹𝘆 𝗴𝗼𝗶𝗻𝗴 𝗮𝘄𝗮𝘆. Microsoft will start disabling EWS in Exchange Online from October 1, 2026, with 𝗳𝘂𝗹𝗹 𝗮𝗻𝗱 𝗽𝗲𝗿𝗺𝗮𝗻𝗲𝗻𝘁 𝗿𝗲𝘁𝗶𝗿𝗲𝗺𝗲𝗻𝘁 𝗼𝗻 𝗔𝗽𝗿𝗶𝗹 𝟭, 𝟮𝟬𝟮𝟳. If any of your apps still rely on EWS, they 𝑤𝑖𝑙𝑙 break unless you act. This often goes unnoticed […]

SMTP AUTH is officially going away

🔒 Secure Bits 💡 𝗦𝗠𝗧𝗣 𝗔𝗨𝗧𝗛 𝗶𝗻 𝗘𝘅𝗰𝗵𝗮𝗻𝗴𝗲 𝗢𝗻𝗹𝗶𝗻𝗲 𝗶𝘀 𝗼𝗳𝗳𝗶𝗰𝗶𝗮𝗹𝗹𝘆 𝗴𝗼𝗶𝗻𝗴 𝗮𝘄𝗮𝘆 — 𝘁𝗵𝗲 𝘁𝗶𝗺𝗲𝗹𝗶𝗻𝗲 𝗶𝘀 𝗻𝗼𝘄 𝘂𝗽𝗱𝗮𝘁𝗲𝗱. Microsoft has published an 𝘂𝗽𝗱𝗮𝘁𝗲𝗱 𝗱𝗲𝗽𝗿𝗲𝗰𝗮𝘁𝗶𝗼𝗻 𝘁𝗶𝗺𝗲𝗹𝗶𝗻𝗲 𝗳𝗼𝗿 𝗦𝗠𝗧𝗣 𝗔𝗨𝗧𝗛 𝘂𝘀𝗶𝗻𝗴 𝗕𝗮𝘀𝗶𝗰 𝗔𝘂𝘁𝗵𝗲𝗻𝘁𝗶𝗰𝗮𝘁𝗶𝗼𝗻 in Exchange Online – and it will end fairly soon. If you still rely on SMTP AUTH for: – Applications and scripts – […]

Deactive an app in Entra ID

🔒 Secure Bits 💡 𝗦𝘁𝗼𝗽𝗽𝗶𝗻𝗴 𝗮𝗻 𝗮𝗽𝗽 𝗶𝗻 𝗘𝗻𝘁𝗿𝗮 𝗜𝗗 𝗻𝗼 𝗹𝗼𝗻𝗴𝗲𝗿 𝗺𝗲𝗮𝗻𝘀 𝗱𝗲𝗹𝗲𝘁𝗶𝗻𝗴 𝗶𝘁. 𝗔𝗻𝗱 𝘁𝗵𝗮𝘁’𝘀 𝗮 𝗯𝗶𝗴 𝗱𝗲𝗮𝗹. A new feature is coming to Microsoft Entra ID that finally gives admins a safer option: 𝗱𝗲𝗮𝗰𝘁𝗶𝘃𝗮𝘁𝗲 𝗮𝗻 𝗲𝗻𝘁𝗲𝗿𝗽𝗿𝗶𝘀𝗲 𝗮𝗽𝗽𝗹𝗶𝗰𝗮𝘁𝗶𝗼𝗻 𝗶𝗻𝘀𝘁𝗲𝗮𝗱 𝗼𝗳 𝗱𝗲𝗹𝗲𝘁𝗶𝗻𝗴 𝗶𝘁. Until now, disabling an app usually meant deleting it entirely — […]

Microsoft 365 Business 300-user limit

🔒 Secure Bits 💡 𝗧𝗵𝗲 𝗠𝗶𝗰𝗿𝗼𝘀𝗼𝗳𝘁 𝟯𝟲𝟱 𝗕𝘂𝘀𝗶𝗻𝗲𝘀𝘀 𝟯𝟬𝟬-𝘂𝘀𝗲𝗿 𝗹𝗶𝗺𝗶𝘁 𝗶𝘀 𝗼𝗳𝘁𝗲𝗻 𝗺𝗶𝘀𝘂𝗻𝗱𝗲𝗿𝘀𝘁𝗼𝗼𝗱. I still hear this form admins all the time: “𝘞𝘦’𝘭𝘭 𝘫𝘶𝘴𝘵 𝘮𝘪𝘹 𝘉𝘶𝘴𝘪𝘯𝘦𝘴𝘴 𝘉𝘢𝘴𝘪𝘤, 𝘚𝘵𝘢𝘯𝘥𝘢𝘳𝘥, 𝘢𝘯𝘥 𝘗𝘳𝘦𝘮𝘪𝘶𝘮 — 𝘸𝘦 𝘩𝘢𝘷𝘦 𝘭𝘪𝘬𝘦 450 𝘰𝘧 𝘵𝘩𝘦𝘮 𝘤𝘰𝘮𝘣𝘪𝘯𝘦𝘥.” Feels relatable? But that is not how it should be. 🤔 𝗛𝗲𝗿𝗲’𝘀 𝘁𝗵𝗲 𝗰𝗮𝘁𝗰𝗵 The 300-user limit […]