Update — 1 October 2026: This article describes the earlier Agent Application model. Microsoft now documents a newer agent model in which newly created agents…
Microsoft Security, tested in practice. By Andreas Rogge.
Articles & field notes
M365 x Azure Posts
The first time you enable a new feature in Sentinel, you usually get one of two outcomes: either nothing happens for hours, or you get…
Welcome to this week’s Microsoft Security digest, covering the most significant updates across Microsoft Sentinel, Defender XDR, and the broader security ecosystem. From AI-powered automation…
Weekly digest covering Sentinel data lake KQL execution modes, notebooks, and a Feb 25 Advanced Hunting export schema change.
Every SOC has that moment. If you have spent time in a SOC, you know this feeling all too well. An alert pops up. Then…
Discover how Security Orchestration, Automation, and Response (SOAR) in Microsoft Sentinel can streamline your cybersecurity operations. This guide unpacks the core components of SOAR, illustrating…
By using Microsoft Defender for Endpoint (MDE) to protect your Windows Server, you can safeguard your organization’s critical data, applications, and services from a wide…
Phishing is one of the biggest security threats facing organizations today. Phishing is an attack that involves tricking people into revealing sensitive information through fraudulent…
Recently, I was having a problem creating Defender for Office365 threat policies in new M365 tenants. Every time I tried to create an anti-spam policy,…
Microsoft Defender for Identity (short MDI, formerly Azure Advanced Threat Protection, also known as Azure ATP) is a cloud-based security solution that leverages your on-premises…