Practitioner security field notes
Hands-on notes from actual engagements — identity, detection, incident response, and the PowerShell that ties it together. The mechanism, the gotcha, the reusable lesson. Never a client story.
Latest
The Entra roles blade shows you who holds a privileged role. It doesn't show you the thing that actually matters for an access review — how they hold
People call TAP an "MFA bypass." It isn't — and that misunderstanding is exactly what makes it dangerous, because teams either ban it or wave it throu
Every tenant I inherit has the same disease: someone holds Global Administrator permanently, others hold six or seven roles "just in case," and nobody
There are two ways to deploy Windows Hello for Business from Intune, and they behave completely differently — one is a tenant-wide default you can't t