You Don’t Need to Manage the Phone. You Need to Manage the Data.
For personal phones, Mobile Application Management protects corporate data inside approved apps without enrolling the entire device. Full MDM fits company-owned devices.
Eligible, Not Active: Why PIM-Enabled Groups Are the Right Way to Hold a Role
PIM-enabled groups should make users eligible, not permanently active. Activation should be time-limited, logged, and monitored for direct additions that bypass PIM.
Did You Really Secure LDAP – or Just One-Third of It? (Part 1 of 6)
LDAP security is three separate jobs: encrypt the connection, strengthen the authentication method, and secure the account. Enabling LDAPS completes only the first job.
Is Your Domain Controller Leaking Passwords? (Part 2 of 6)
Cleartext or unsigned LDAP simple binds expose reusable passwords. Event IDs 2887 and 2889 identify the affected volume, clients, and accounts before enforcement.
Is Your “Encrypted” LDAP Actually Protected? (Part 3 of 6)
LDAPS and StartTLS can protect LDAP traffic equally when correctly enforced. Protection fails when StartTLS falls back to cleartext or weak TLS remains enabled.
Why Send a Password You Can’t Take Back? (Part 4 of 6)
SASL with Kerberos replaces a reusable LDAP password with a short-lived ticket. Signing and channel binding then protect that authentication from tampering and relay.
When Did That Service Account Last Rotate? (Part 5 of 6)
gMSA and dMSA reduce service-account risk through automatic password management and machine-bound use. They still require protected LDAP transport and least privilege.
Are You Hoping Your LDAP Is Secure – or Do You Know? (Part 6 of 6)
A complete LDAP migration starts with auditing, then secures the channel, bind, and account before enforcing signing and channel binding and validating the result.
There are three ways BYOD quietly becomes your biggest security liability — and only one of them shows up on a device audit.
BYOD risk usually comes from an outdated policy, limited visibility into app behavior, and misplaced trust in how employees handle corporate data on personal devices.
The layer Microsoft’s docs never show you.
Privileged Access Groups work in layers: security groups hold permissions, PIM makes membership eligible, activation grants time-bound access, and some directory roles require a second activation.
Phishing-Resistant MFA for Admins Without the Lockout
Phishing-resistant MFA for admins is stronger than codes. Roll it out in...
