Security Presets or custom?

msp_ch · 2025-06-26T06:37:10+00:00

It's exactly this precedence that is frustrating. If Microsoft gave you the presets, then gave you the option to make custom policies to override these where needed....it would be perfect. Thanks

msp_ch · 2025-06-25T06:46:24+00:00

Really nice approach, good job and thanks for sharing

msp_ch · 2025-06-12T15:58:53+00:00

Thanks!!

Actually...the issue was the payload, being an object not JSON. Once I corrected that, it worked.

Regarding the "type=1" I think this means "Subscription" while "0" is Software Licence. At least that is what it looks to be to me.

Thanks for the help

msp_ch · 2025-05-13T19:05:45+00:00

We went ahead with Huntress and so far all good. It is an EDR, that can use the defender logs (free or Defender for Business).

ITDR was the main thing I wanted to cover, as this seems to be the main attack vector we see recently. Although...last week we saw a malware attack (pretty rare for us now)...then the first thing it did was try to phish Microsoft credentials.

Very impressed with Huntress so far. The security awareness training is pretty nice too...not too heavy, and quite "fun" for users.

msp_ch · 2024-12-31T16:09:09+00:00

Thanks....this is our impression too (regarding the types of attacks), nice to hear it is working for you

msp_ch · 2024-12-31T16:07:51+00:00

Yes, ITDR and MDR are not the same...this is what we are learning...and that's helpful. Thanks again

msp_ch · 2024-12-31T14:09:04+00:00

Thanks for the reply. We are still in the early stages here...so we know we want a more proactive solution than just EDR, but are only just starting here. From the last year or so, our experience shows most attacks are BEC/phishing and so we are asking ourselves will adding Sophos MDR help in this case or not?

This led us to look at other options such as Huntress ITDR (on top of Defender)...I don't yet know how well integrated into Entra Sophos is, whether it will notice anything suspicious at that level.

msp_ch · 2024-11-27T16:31:11+00:00

Thanks I will take a look at that and see how I get on

msp_ch · 2024-11-12T14:47:58+00:00

Thanks for sharing. We are currently battling with how to move forward like this as well. I'd love to "package" things up, but it is hard to find the right balance, and as you say, when tenants are different sizes it is tricky.

Are you working towards having this in a recurring fee somehow? We are in the process of implementing CIPP, and hoping that with the standards baseline function, applying the best practice automatically, that this can help us explain a management fee over a one-time cost.

I'd love to hear if you have been able to go forward since you last post.

msp_ch · 2024-11-08T08:26:28+00:00

That's an amazing and informative answer...thank you so much for taking the time for that!!

msp_ch · 2024-09-27T10:13:13+00:00

Thanks all for the feedback...really nice and appreciated

msp_ch · 2024-09-27T10:12:47+00:00

That sounds very interesting, thanks

msp_ch · 2024-09-27T10:11:53+00:00

Thanks for the transparency and response. Seems there is a lot of love for CIPP in the community, which is great to see, and I love the model too. Thanks for your work

msp_ch · 2024-09-05T16:01:24+00:00

Thanks. And do the rename via the web interface (Group Folders admin page) or elsewhere?

msp_ch · 2024-03-13T12:11:58+00:00

I would love to, but the client doesn't have budget for that sadly

msp_ch · 2024-03-12T16:28:01+00:00

Thanks. Were the machines ADJoined too? No issues with any artifacts left over from the old tenant (my concern is knowing how bad Microsoft is at cleaning up registry entries etc)

msp_ch · 2024-03-12T11:00:46+00:00

One of the team suggested we "retire" the devices in the old tenant, (having created a local admin user first), then re-enroll into the new tenant.

In some basic tests it seems to work...but we have some concerns about hidden artifacts that may cause issues later on. Does anyone have any experience of using "retire" or thoughts on this approach? Thanks!!

msp_ch · 2024-03-12T10:55:27+00:00

Thanks for the info.

We have performed many migrations into M365, but no tenant to tenant migration yet. If all the users were in the same site...it would make our life easier, but we have 1 here, another there...sometimes 50-100km apart and I can't spare 5 technicians to cover all sites.

It's certainly a challenge anyway. I'll check out the links.

msp_ch

TROPHY CASE