Practitioner security field notes
Hands-on notes from actual engagements — identity, detection, incident response, and the PowerShell that ties it together. The mechanism, the gotcha, the reusable lesson. Never a client story.
Latest
A departed user's OneDrive 404s. That's not a diagnosis — it's in the deleted-site bin. But restoring it brings back the files, not the owner, and the
The Entra roles blade shows you who holds a privileged role. It doesn't show you the thing that actually matters for an access review — how they hold
People call TAP an "MFA bypass." It isn't — and that misunderstanding is exactly what makes it dangerous, because teams either ban it or wave it throu
Every tenant I inherit has the same disease: someone holds Global Administrator permanently, others hold six or seven roles "just in case," and nobody