Blue Team of Onefield notes · security

Practitioner security field notes

Real defensive work, written honestly.

Hands-on notes from actual engagements — identity, detection, incident response, and the PowerShell that ties it together. The mechanism, the gotcha, the reusable lesson. Never a client story.

Ram Mudigina
Ram Mudigina
Security Lead · Surya Technologies · Bengaluru

Latest

PowerShell LibraryAug 2026

A privileged-access reporter: who holds admin, and is it standing or JIT?

The Entra roles blade shows you who holds a privileged role. It doesn't show you the thing that actually matters for an access review — how they hold

Identity SecurityAug 2026

Temporary Access Pass is a loaded gun: using it without shooting yourself

People call TAP an "MFA bypass." It isn't — and that misunderstanding is exactly what makes it dangerous, because teams either ban it or wave it throu

Identity SecurityAug 2026

Killing standing admin: tiered privileged access with PIM

Every tenant I inherit has the same disease: someone holds Global Administrator permanently, others hold six or seven roles "just in case," and nobody

Endpoint SecurityAug 2026

Windows Hello for Business via Intune: the two paths, and picking the right one

There are two ways to deploy Windows Hello for Business from Intune, and they behave completely differently — one is a tenant-wide default you can't t

Browse by topic