Practitioner security field notes
Hands-on notes from actual engagements — identity, detection, incident response, and the PowerShell that ties it together. The mechanism, the gotcha, the reusable lesson. Never a client story.
Latest
You're asked to pull someone's activity and say whether they were really working. You can pull the data — the skill is reading it without inventing a
A departed user's OneDrive 404s. That's not a diagnosis — it's in the deleted-site bin. But restoring it brings back the files, not the owner, and the
The Entra roles blade shows you who holds a privileged role. It doesn't show you the thing that actually matters for an access review — how they hold
People call TAP an "MFA bypass." It isn't — and that misunderstanding is exactly what makes it dangerous, because teams either ban it or wave it throu