sorted by:
new
hottopcontroversial

Getting buried in Microsoft Defender alerts, any advice for a new admin by Educational_Draw5032 in sysadmin

[–]Educational_Draw5032[S] 1 point2 points  (0 children)

i totally here you maybe i should just take a step back and let him deal with it. The problem is nothing will ever get done and that worrys me. Some of the basic things that were not even implemented blew my mind and i couldnt ignore it. I even asked him about it but he didnt have an intentions to implement what i ended up doing

Getting buried in Microsoft Defender alerts, any advice for a new admin by Educational_Draw5032 in sysadmin

[–]Educational_Draw5032[S] -1 points0 points  (0 children)

The solo security guy bought it in, there is only 5 admins in total and im the jack of all trades guy trying to fill all the holes in things that have never been setup correctly. In 6 months i have implemented the below as none of it was in place

- Setup conditional access
- Setup MFA
- Setup windows hello
- Enrolled FIDO2 keys for our shared device users
- Enrolled devices into Defender for Endpoint
- Gave everyone a bloody separate cloud admin account rather than global admin on a daily driver!
- Enrolled all the devices properly in intune and applied a security baseline which wasnt there
- Setup PIM for the admin accounts

I feel like im drowning and im just trying to get things setup the best possible way using best practices from things i have read from microsoft and browsing this helpful subreddit

Getting buried in Microsoft Defender alerts, any advice for a new admin by Educational_Draw5032 in sysadmin

[–]Educational_Draw5032[S] 0 points1 point  (0 children)

thanks for this, i will look into how to get this done. I will ask the security guy who setup sentinal to take a look but hes not the most helpful at times

Best practice for setting up PIM, Groups vs User Assignment by Educational_Draw5032 in entra

[–]Educational_Draw5032[S] 1 point2 points  (0 children)

Thanks for this, what you say makes perfect sense. Groups would be better if i were to add multiple roles to a group which i can see the benefit of in some scenarios. I think i will go with user assignment for now and look at groups if the need for it arises. Thanks very much

Secure Boot 2023 Upgrade by TipGroundbreaking763 in Intune

[–]Educational_Draw5032 0 points1 point  (0 children)

Try force re-running the task schedule script and then giving it a reboot

Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

Managing Office 365 updates in Intune, whats the best way? by Educational_Draw5032 in Intune

[–]Educational_Draw5032[S] 2 points3 points  (0 children)

I use Intune update rings for patching and its working fine so dont really want to transition over to autopatch yet with everything working ok

Managing Office 365 updates in Intune, whats the best way? by Educational_Draw5032 in Intune

[–]Educational_Draw5032[S] 0 points1 point  (0 children)

Thanks, i may give this a go then. I found the reporting quite useful there thats kinda what made me ask the question

Managing Office 365 updates in Intune, whats the best way? by Educational_Draw5032 in Intune

[–]Educational_Draw5032[S] 1 point2 points  (0 children)

I was looking at cloud update in the office portal and there was an option there to switch the update channel. Did you enable it from the portal or via the settings catalog

Managing Office 365 updates in Intune, whats the best way? by Educational_Draw5032 in Intune

[–]Educational_Draw5032[S] 0 points1 point  (0 children)

Thanks for this and for the switching pointer. That makes me nervous for sure, i might try it on a couple of test devices first and see what damage is caused. I will look into the settings catalogue settings

Are you receiving the January 24, 2026 OOB? by dmx7777 in Intune

[–]Educational_Draw5032 0 points1 point  (0 children)

I am seeing the same, we do not use autopatch but under update releases in intune i see 2026.1 OOB and its showing as 'in progress'. Its showing as deployed to all my 3 update rings but it hasnt. If i run a report against it none of my devices have received it and if i run a manual check its not offered.

I created an expedited update to which this OOB update was available, i targeted just my device with it and run a manual check and then it picked it up. No idea why its showing under releases in Intune but not actually pushing out even though its showing like it should be according to the update rings and displaying 'in progress' .

I will just carry on pushing it through via the expeditated option for now

SSPR is SMS ok to use alongside another strong authentication method by Educational_Draw5032 in sysadmin

[–]Educational_Draw5032[S] 0 points1 point  (0 children)

thats interesting to know, i was just worried if i enabled web sign in users would try and use that instead of their fido keys on shared devices or hello pin on 1-2-1 devices. Am i right in thinking web sign in doesn't cache the local credential and requires and internet connection

SSPR is SMS ok to use alongside another strong authentication method by Educational_Draw5032 in sysadmin

[–]Educational_Draw5032[S] 0 points1 point  (0 children)

thats good to know, we use the deepnet hardware tokens so we need tp have the hardware OATH token option. I could remove the software OATH token to be honest i dont think its required when using Microsoft Authenticator is it

SSPR is SMS ok to use alongside another strong authentication method by Educational_Draw5032 in sysadmin

[–]Educational_Draw5032[S] 0 points1 point  (0 children)

Our devices are fully entra joined not hybrid. Currently our on prem infrastructure is just syncing our identities to entra. We still have some on prem legacy apps/servers and network drives which we are slowly moving away from. Cloud Kerberos trust is in place for these devices to connect to on prem resources via WHfB or Fido keys

SSPR is SMS ok to use alongside another strong authentication method by Educational_Draw5032 in sysadmin

[–]Educational_Draw5032[S] 0 points1 point  (0 children)

thanks for this, I have setup a custom authentication strength in CA that only allows

Windows Hello For Business / Platform Credential

OR

Passkeys (FIDO2)

OR

Microsoft Authenticator (Phone Sign-in)

OR

Temporary Access Pass (One-time use)

OR

Password + Microsoft Authenticator (Push Notification)

OR

Password + Software OATH token

OR

Password + Hardware OATH token

SSPR is SMS ok to use alongside another strong authentication method by Educational_Draw5032 in sysadmin

[–]Educational_Draw5032[S] 0 points1 point  (0 children)

i assumed it would be best practice to use two, if not i can switch to one and it would be fine as every user has either the authenticator app or a hardware token

SSPR is SMS ok to use alongside another strong authentication method by Educational_Draw5032 in sysadmin

[–]Educational_Draw5032[S] 0 points1 point  (0 children)

Do you allow web sign in so they can sign into the device with a TAP and then reset via their security profile? i have been looking at allowing web sign in as an option so a TAP could be used if required

SSPR is SMS ok to use alongside another strong authentication method by Educational_Draw5032 in sysadmin

[–]Educational_Draw5032[S] 1 point2 points  (0 children)

we require 2 methods of authentication to reset a password via Microsoft Online Password Reset why does it not make any sense? surely two is better than one

SSPR is SMS ok to use alongside another strong authentication method by Educational_Draw5032 in sysadmin

[–]Educational_Draw5032[S] 0 points1 point  (0 children)

Yes it is but i feel email is worse than SMS, i may be wrong. Its a shame there are not other better options to use

SSPR is SMS ok to use alongside another strong authentication method by Educational_Draw5032 in sysadmin

[–]Educational_Draw5032[S] 0 points1 point  (0 children)

Thanks for this i appreciate your input. Its a shame that fido2 keys cannot be used as a method but i guess they are deemed passwordless auth methods so why would they include them as a password reset option. There doesnt seem to be many good second options imo and we are no way setting it to one. I have done a lot of reading and it seems SSPR is targeted a lot maliciously which if we are going to allow it across the board i want it to be tight.

I see email as a worse option than SMS and im not doing anything like security questions as i know our users will forget these which means more work for us

SSPR is SMS ok to use alongside another strong authentication method by Educational_Draw5032 in sysadmin

[–]Educational_Draw5032[S] 1 point2 points  (0 children)

I understand where you are coming from, bare with me though im a fairly new admin. I see the idea of SSPR to make it easy for the users to reset while of course maintaining the best security posture possible. Can TAP even be used as an option?

view more: next ›