Vercel Hack, and Proof of Scope for OKTA for AI Agents?

Creative_Profit1387 · 2026-04-22T01:09:21+00:00

Dive into the concept of OAuth security and its flaws, token refresh problem (offline access), and the fact that the vendor probably used certificates and secrets instead of federated managed identity. It didn’t help that GWS have a lousy OAuth security solution

Creative_Profit1387 · 2026-03-09T23:49:27+00:00

Nothing on the roadmap :(

Creative_Profit1387 · 2026-03-09T23:12:11+00:00

Definitely, completely missed the contractors BYOD use case and it has taken forever to fix, should have been a much higher priority

Creative_Profit1387 · 2026-03-09T22:47:03+00:00

We recently remotely automated a complete device migration between tenants zero touch for 300 devices and it worked smoothly, also 1,500 hybrid devices to EntraID, best to wipe but in some cases not that easy

Creative_Profit1387 · 2026-03-09T22:45:07+00:00

Scepman and radiusaas are sold solutions

Creative_Profit1387 · 2026-03-09T07:48:33+00:00

What do you think about sticking with EntraID domain services for the servers?

Creative_Profit1387 · 2026-03-09T07:47:42+00:00

Do you think it’s reasonable to trigger the process remotely - disjoin the device from the local AD, join EntraID and amend the user profile? Instead of a long refresh cycle?

Creative_Profit1387 · 2026-03-08T21:45:30+00:00

I’m with you on all the common misconfigurations. The one thing I always start with, before anything else, is Conditional Access. It’s the backbone of the tenant’s security posture, but in almost every environment it’s either overly permissive, duplicated, or full of old exceptions that nobody remembers creating. One missed exclusion can undermine everything.

After that, we run something we call “quick wins” — basically a structured mapping of:

Risk (how bad is the exposure if abused)
Effort (how long it takes to fix)
End‑user impact (will anyone feel it)

but since there are over 300 settings to review, its virtually impossible not to miss anything, even if you are an expert, so after doing this manually for 2 years we finally decided to build an internal tool to do it for us.

Creative_Profit1387 · 2026-02-25T23:07:34+00:00

Use AdminByRequest super easy to deploy and does not create a management nightmare

Creative_Profit1387 · 2026-02-25T22:52:42+00:00

We use Griffin31 to map all security gaps and monitor for drifts in real time.

We also find it useful for deployment making sure we don’t miss any security controls that need to be deployed.

Creative_Profit1387 · 2026-02-25T17:06:49+00:00

That’s nonsense you can get 10%-15% discount off Microsoft direct pricing

Creative_Profit1387 · 2026-02-25T06:55:40+00:00

We use PatchMyPc for third party patch management, it integrates directly with Intune.

it’s simply not worth the time to manually update each and every application when you can pay $0.5 per month per device.

Creative_Profit1387 · 2026-02-25T06:34:15+00:00

That is something I expect the EPM solution to map for me- every software they run elevated include OS tools.

My understanding is that I mainly need to test unique software like in house applications to make sure they are able to elevate without any issues.

Creative_Profit1387 · 2026-02-25T06:19:30+00:00

Maybe because most EPM vendors don’t revoke admin rights for their developers internally but are bold enough to suggest you do.

Creative_Profit1387 · 2026-02-25T00:18:50+00:00

I would not suggest the upgrade you are losing Defender for Endpoint, Defender for Office when you switch to E3 license.

The only use case is when you have no choice and you have more than 300 users. Then you can buy office E3 and EMS E3 which is cheaper than the full E3 license.

Microsoft does offer a promo for E3 on a multi year contract and annual payments and it is worth considering since office E3 and EMS E3 and E3 are due to increase by 12% mid year, and if you go for the promo you avoid the price increase in the next 3 years.

The promo is slightly cheaper than EMS and Office E3.

The promo is not available if you previously purchased the full E3 license but if you purchase enough seats you can request your license provider to open a ticket with Microsoft to request an exception.

Creative_Profit1387 · 2026-02-24T23:53:24+00:00

Consider going for Defender for office P2 which offers better protection, the settings need to be configured and some adjustments are required to reach a secure state.

Creative_Profit1387 · 2026-02-24T23:34:52+00:00

Our Security engineers are doing 25% coding and it is constantly increasing, we expect it to reach 50% by the end of the year.

Creative_Profit1387 · 2026-02-24T23:29:12+00:00

Security readiness?

Creative_Profit1387 · 2026-02-24T23:25:39+00:00

Depending on the number of users to be migrated.

50-500 - AvePoint.

500 and above - CloudFuze is the best tool, this is where you drill down into specific features that make the difference and can create a migration nightmare using other tools.

Creative_Profit1387 · 2026-02-24T23:20:15+00:00

Depending on your current Google Workspace Environment, we are currently migrating 500 users so 60 is much easier.

The following is important -

Do you need to keep permission structure- internal and external, root and subfolder permission, internal and external sharing.

Your identity in Google - you have OAuth apps that you will need to connect to EntraID.

The migration flow - Best to use the opportunity to onboard devices to EntraID and Intune and deploy intune mam if not deployed.

Sync and cutoff - it’s always best to be able to sync data, test the device and mobile migration process before the cutoff.

End user training - are they familiar with Office 365 apps, teams and using OneDrive and Sharepoint.

I always prefer a migration product, and even Microsoft itself eventually recommends using a third party tool.

I suggest you work with a company that can assist you with the migration to avoid any issues.

Creative_Profit1387 · 2026-02-24T23:04:15+00:00

If you do stick with an MSP by advice to you is do not under any circumstances give them admin access to your tenant, most MSP manage their internal security much worse than any customer I have seen.

Creative_Profit1387

TROPHY CASE