I'm Bence Weiszmann, a Microsoft Cloud Engineer focused on identity and cybersecurity. I write practical, technical deep dives into Microsoft Security technologies: how they work, how to implement them, and where their limitations matter.
Onboarding Intune-managed Windows devices with an endpoint detection and response policy: no scripts or onboarding packages to maintain, and every new device in the target group is onboarded automatically.
Why SMS-based MFA no longer counts as phishing-resistant, and what Microsoft's shift to passkeys as the default authentication experience in Entra ID changes.
How access to Defender for Endpoint is managed, and the permission approaches that let administrators and SOC team members work in the service.
The prerequisites and basic configuration options to work through before Defender for Endpoint is ready to use in a new tenant.
Defender for Endpoint as a platform rather than a single product: its architecture, its prevention, detection and response capabilities, and where it fits in the wider ecosystem.
Building on the cross-domain correlation from Part 1: how the telemetry behind Defender XDR is structured, and how Advanced Hunting works on top of it.
From architecture to onboarding, one part at a time. Read in order, the parts build on each other.
Authentication, Conditional Access, passkeys and the identity state everything else depends on.
6 articles
How endpoint, identity, email and cloud signals are correlated into incidents, and how to hunt across them.
3 articles
Architecture, configuration, permissions and onboarding, worked through as a multi-part series.
4 articles
Cloud-native SIEM and SOAR: data, detections and newer ways of modelling relationships between entities.
1 article
Securing Azure workloads and subscriptions, including Defender for Cloud.
Nothing published yet
Zero Trust and the design decisions behind identity-driven security.
2 articles
Advanced Hunting, detection logic and the queries behind an investigation.
1 article
Scripts and automation that make security operations repeatable.
Nothing published yet
The articles are written for engineers who have to make these products work in a real tenant: prerequisites, permissions, licensing and the parts the documentation glosses over. LinkedIn is the easiest way to follow along.
Follow on LinkedIn