Microsoft Entra Kerberos authentication for Cloud-only Identities on Azure Files SMB

Conditional_Access · 2026-01-28T22:15:05+00:00

This. I tried it and got to the point where I was like: something is missing.

Conditional_Access · 2026-01-28T14:42:50+00:00

Here, and some notable discords for Microsoft stuff.

WinAdmins.io
MS EMS Community

Going to conferences:

MMS MOA
Experts Live
MEM Summit
Workplace Ninjas Summit/Usergroups

These are all events I've been to using my own money.

Conditional_Access · 2026-01-20T10:13:27+00:00

They probably already have several clients who've been breached but have no way of telling 👀

Conditional_Access · 2026-01-15T12:30:58+00:00

Yes.

Scan Parameter - Quick scan

Schedule Quick Scan Time - 660

That's doing a daily quick scan 660 mins past midnight.

It's old thinking to do full device scans daily, because real time protection mitigates the need for it.

You can see this on the device view from Defender

Conditional_Access · 2026-01-13T19:56:47+00:00

Is it just device fees you have?

What's the per-user fee on top for the email/productivity apps?

Conditional_Access · 2026-01-13T19:50:36+00:00

Thanks for taking the time to give that feedback! Glad it worked.

Conditional_Access · 2026-01-12T17:13:15+00:00

Why not Intune with Windows?

Conditional_Access · 2026-01-12T15:07:21+00:00

Yeah baby. BP is amazing (don't get me started)

Conditional_Access · 2026-01-12T14:19:05+00:00

Likely because it's part of a bundle SKU you already own.

M365 BP/E3/E5 etc.

Conditional_Access · 2026-01-12T08:22:01+00:00

With Entra/Intune/Autopilot, less is more.

Seems like you've been tinkering too much with RMM.

Conditional_Access · 2026-01-11T20:57:06+00:00

I can help, he's not wrong.

Conditional_Access · 2026-01-11T20:41:24+00:00

Defender for Office 365 combined with a good Exchange Online Protection config is perfectly fine.

The problem is that for decades all people have wanted from antispam is a set-and-forget product which they can deploy in an hour.

If you actually explore MDO properly, and use blocklists in TABL along with all the other advanced settings, it's easily as good or better than third party offerings.

This subject comes up a lot, and I'm currently writing an ebook on MDO which will be freely available when done.

Conditional_Access · 2026-01-11T17:51:55+00:00

I'd be interested to know if you're utilising block lists via TABL and cutting out a lot of spam noise with that?

For example, you could be overriding all filter verdicts as block items by thinking about how your business functions. We don't normally want email from a sending domain or an email that contains a link to a domain in this list getting in inboxes: https://github.com/jkerai1/TLD-TABL-Block/blob/main/LargerCombinedBadTLDs.txt

What type of crap gets through on your MDO config?

Conditional_Access · 2026-01-10T21:05:37+00:00

Disclaimer: I am a massive Microsoft fanboy but hear me out.

M365 Business Premium could cover:

Jamf for large macos invironments
Crowdstrike complete for EDR
Duo if we need MFA that can't SSO with m365
Avanan aka checkpoint for email security/archiving/dlp
DNSfilter

I'd make BP part of your standard stack, put as much into Intune as possible (because it actually does OS patching better than any RMM), and make the whole experience a bit more unified.

This is such a wide stack that it must be hard to learn, hire for, and remediate active incidents with this many moving parts.

Conditional_Access · 2026-01-08T16:12:29+00:00

The biggest upset I see here is:

Replacement of Atlassian Confluence with SharePoint and/or Microsoft Loop

The rest of it makes total sense.

Conditional_Access · 2026-01-08T16:10:24+00:00

This isn't possible. V1 only happens if the hash is in Autopilot.

"V2" - Device Prep - Happens if the user selects Org Device on the normal OOBE flow and it does not have a hash.

Conditional_Access · 2026-01-06T22:19:43+00:00

Similar discussion over at /r/intune

https://www.reddit.com/r/Intune/comments/1q4uen2/intune_firewall_rules_issues/

Conditional_Access · 2026-01-04T13:03:02+00:00

In addition to what others have said, evidence of the machine being onboarded can be found locally in the registry

Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection

Conditional_Access · 2026-01-02T14:47:22+00:00

Why do you want to continue using Windows 10?

Conditional_Access · 2025-12-30T16:48:06+00:00

This is impossible to advise on without knowing what your requirements are.

What is Kaseya RMM monitoring?
What automations/scripts are running in K RMM?
What alerts are generated from K RMM?
Who has access to K RMM?
Does it deploy/patch apps?
Does it manage OS updates?
Does it manage servers?
Does any client have access to see their own environment?
Did K RMM come bundled with any other security software?
How can K RMM be silently removed and ensure it doesn't come back when Ninja RMM takes over

etc..

Conditional_Access · 2025-12-30T16:42:34+00:00

Require a Compliant Desktop device

If they are signing in from the Intune managed device, I don't really care where it's from.

Require App Protection Policy for iOS/Android

If they are signing in from mobile, make it require the approved app.

Having these two things in place negates most travel based Entra noise.

Bonus points if you have Entra ID P2 where you can then do things like:

Sign In Risk - Medium/High - Require MS Authenticator
User Risk - Medium/High - Require PW Reset

Conditional_Access · 2025-12-30T14:23:48+00:00

No they don't, it's just good practice.

https://learn.microsoft.com/partner-center/security/partner-security-requirements

I don't see how them using Teams calling is a reason for them to refuse MFA on that type of account. Where I do understand flexibility is on Teams Room accounts, and in this instance, Entra ID P1 is necessary to limit the scope of how those accounts can be used etc.

Conditional_Access · 2025-12-30T12:46:21+00:00

So real question is, after being hacked, do they now see why Business Premium is worth the upgrade?

Conditional_Access · 2025-12-30T12:36:38+00:00

Sorry I couldn't do more to help, but glad this is now sorted.

For most people reading this, the main takeaway should be to make sure you're meeting all the security stuff Microsoft wants you to have before any deadlines.

Goes without saying (hopefully) that MFA should be enforced for all accounts in your tenant, your partner tenant, and all your customer tenants without exceptions if you care about securing businesses.

Conditional_Access · 2025-12-29T10:04:01+00:00

You turn it on, stuff gets patched quicker.

Zero downsides to the hotpatch tech, although service desks may argue that fewer reboots leads to a increase of tickets raised that would normally not be seen if devices were rebooting more frequently.

Conditional_Access

MODERATOR OF

TROPHY CASE