(00:00:00) The Siloed Security Dilemma

(00:00:04) The Rube Goldberg Machine of Security Tools

(00:00:18) The Four Blind Spots of Siloed Security

(00:01:09) The Limitations of Siloed Tools

(00:02:22) The Cost of Inaction

(00:04:45) Introducing Defender XDR

(00:06:19) Blind Spot 1: 365, Email, and Identity

(00:10:36) Blind Spot 2: Identities Without Context

(00:14:58) Blind Spot 3: Endpoints Without SaaS and Identity

(00:19:01) Blind Spot 4: Cloud Apps Without Integration

In this episode of M365.fm, Mirko Peters explains why your current “hybrid security” stack is really just four siloed tools with a shared spreadsheet — and how Defender XDR fuses Microsoft 365, Entra ID, endpoints, and cloud apps into one incident graph with one response plan.

WHAT YOU WILL LEARN

• Why separate email, identity, endpoint, and cloud app tools create context debt and dwell time instead of security
• How typical hybrid environments (on‑prem AD + Entra ID + roaming devices + SaaS) break classic SOC workflows
• How Defender XDR turns separate alerts (phish, risky sign‑ins, PowerShell abuse, OAuth consent) into a single cross‑domain incident
• How auto‑response can isolate devices, revoke tokens and sessions, roll back mailbox rules, and kill malicious OAuth grants from one place
• Why identity, tokens, and consent are the real root causes behind “phantom reinfections”
• How to move from four tickets and four consoles to one timeline that shows what actually happened, in what order, and where to respond first

THE CORE INSIGHT

Hybrid security isn’t “more vendors + more dashboards”; it is one attack surface pretending to be four. When each domain (email, identity, endpoint, cloud apps) runs its own incident process, your SOC becomes the missing correlation engine — and attackers live in the gaps.
Defender XDR changes the physics by building an incident graph that stitches mailbox rules, consent grants, token issuance, endpoint process chains, and cloud sessions to the same user and device.
This episode argues that Defender XDR is not an add‑on; it is the minimum requirement for hybrid environments that want fewer incidents, shorter dwell time, and less manual correlation tax.

WHY DEFENDER XDR IS MANDATORY FOR HYBRID

• Microsoft 365 telemetry (phish, Safe Links, mailbox rules, Teams shares) stops living in an email silo and becomes part of one incident
• Entra ID risky sign‑ins and token events are joined with device health, OAuth consent, and SharePoint activity
• Endpoint alerts include the “how we got here” story: phish → consent → token → process chain → exfiltration
• Defender for Cloud Apps signals (risky OAuth apps, unusual downloads, shadow IT) are tied directly into the same incident graph
• Auto‑IR can revoke sessions, kill grants, isolate devices, and undo malicious mailbox rules from a single orchestrated playbook

KEY TAKEAWAYS

• Siloed tools create context debt that your SOC pays for in dwell time, overtime, and missed intrusions
• The right question is no longer “what fired?” but “what happened, to whom, across which domains, in what order?”
• Defender XDR lets the platform do the stitching so humans can focus on decisions, not copy‑pasting alert IDs
• Real savings from XDR show up as fewer reinfections, fewer parallel incidents per attacker, and fewer tools your analysts must juggle

WHO THIS EPISODE IS FOR

This episode is essential for security architects, SOC leaders, incident responders, and Microsoft 365 / Azure platform owners responsible for hybrid identity and security.
If you are still correlating email, identity, endpoint, and cloud‑app alerts in your head or in spreadsheets, this conversation will show you why Defender XDR is now the baseline—not a “nice to have”—for hybrid security.

ABOUT THE HOST

Mirko Peters is a Microsoft 365 consultant and digital workplace architect focused on building attack‑aware, XDR‑driven security architectures on the Microsoft cloud.
Through M365.fm, Mirko shares practical incident stories, correlation patterns, and operating models that help security teams turn Defender XDR into a savings engine instead of just another license line.

Become a supporter of this podcast: https://www.spreaker.com/podcast/m365-fm-modern-work-security-and-productivity-with-microsoft-365--6704921/support.

(00:00:00) Mission Briefing: Protecting Against Tenant Breaches

(00:00:41) The Enemy's Tactics: Consent Phishing and Token Theft

(00:04:35) The Attack Chain: From Consent to Token Abuse

(00:06:22) Detecting and Preventing Consent Phishing

(00:14:41) Lateral Movement: From Mailbox to SharePoint

(00:17:23) Exfiltration and Data Theft

(00:20:26) Implementing Effective Defenses

(00:26:01) Closing Remarks and Key Takeaways

In this episode of M365.fm, Mirko Peters walks through a real‑world style Microsoft 365 breach where attackers combine consent phishing, AiTM token theft, and OAuth abuse to bypass MFA, replay stolen cookies, and quietly live off the land with Microsoft Graph.

WHAT YOU WILL LEARN

• Why perimeter defense and “just add MFA” are lies in modern Microsoft 365 attacks
• How consent phishing, AiTM kits, and multi‑tenant OAuth apps work together to hijack identity and sessions
• Which Entra ID audit and sign‑in events actually matter: “Consent to application”, “ServicePrincipal created”, “AppRoleAssignedTo”, and risky sign‑ins with “requirements satisfied” via cookies
• How attackers use offline_access, refresh tokens, mailbox rules, and scope creep for long‑term persistence
• How Graph, Exchange, and SharePoint telemetry expose mailbox hijack, SharePoint theft, and OAuth‑based exfiltration
• Concrete Sentinel/KQL detection ideas for malicious app consent, token replay, mailbox rule abuse, and Graph exfiltration
• The one policy family that breaks this entire attack chain: consent control and token protection

THE CORE INSIGHT

Most Microsoft 365 breach models still obsess over passwords, URLs, and endpoints. Modern attackers don’t fight your MFA; they reuse your sessions and register their own apps.
The real M365 attack chain is not “phish → malware → lateral movement”, but “consent → token → Graph”: steal a cookie, gain app consent, escalate scopes, and drain data under the cover of normal cloud traffic.
This episode argues that if you’re not governing consent, protecting tokens, and watching service principals, you don’t have a modern M365 defense — you have a firewall nostalgia project.

WHY YOUR CURRENT M365 ATTACK MODEL IS WRONG

• It assumes the front door is the login page, not the consent screen and device code flows
• It treats OAuth apps and service principals as background plumbing, not as first‑class actors in attacks
• It focuses on password theft, not on session replay, refresh tokens, and offline_access scopes
• It ignores that most of the critical telemetry already exists in Entra ID, Exchange, SharePoint, and Graph — just without tuned detections

WHAT YOU’LL TAKE AWAY IN PRACTICE

• A step‑by‑step picture of the M365 attack chain: from AiTM phish to malicious app consent to Graph‑driven exfiltration
• Concrete Entra and Exchange events to hunt for, plus example Sentinel/KQL patterns to operationalize them
• A consent hardening plan: disabling broad user consent, enforcing admin workflows, and using verified publishers and low‑risk scopes
• Token and session defenses: Token Protection, risk‑based Conditional Access, and revocation practices that make stolen cookies worthless

WHO THIS EPISODE IS FOR

This episode is essential for Microsoft 365 security engineers, identity architects, SOC analysts, and cloud security leaders who own Entra ID, Exchange Online, SharePoint, and Sentinel.
If your threat model still starts with “user clicks malicious link” and ends with “EDR catches malware,” this conversation will give you a new, identity‑ and consent‑centric view of how M365 actually gets breached.

ABOUT THE HOST

Mirko Peters is a Microsoft 365 consultant and digital workplace architect focused on building identity‑first, attack‑aware security architectures on the Microsoft cloud.
Through M365.fm, Mirko shares real‑world breach patterns, KQL approaches, and governance models that help security teams move from perimeter stories to the true Microsoft 365 attack chain.

Become a supporter of this podcast: https://www.spreaker.com/podcast/m365-fm-modern-work-security-and-productivity-with-microsoft-365--6704921/support.

(00:00:00) The MFA Illusion

(00:00:00) Consent Bypassing MFA

(00:00:54) The Power of OAuth Consent

(00:02:08) Persistence and Refresh Tokens

(00:02:27) Admin Consent: The Ultimate Key

(00:05:47) The Three Non-Negotiable Controls

(00:12:11) Case Study: MFA Fails to Stop OAuth Attacks

(00:16:48) Detection and Remediation Strategies

(00:25:06) Hardening and Ongoing Monitoring

(00:28:37) The Consent Control Key Takeaway

In this episode of M365.fm, Mirko Peters explains why your MFA and password reset playbooks do nothing against illicit OAuth consent attacks in Entra ID — and shows how attackers use refresh tokens and offline_access to stay in your tenant long after you “kick them out.”

WHAT YOU WILL LEARN

• What illicit OAuth consent grants actually are and why this is authorization abuse, not credential theft
• How a friendly Microsoft consent screen hides powerful scopes like Mail.ReadWrite, Files.ReadWrite.All, and Directory.ReadWrite.All
• Why offline_access and refresh tokens keep attackers in your tenant even after password resets, forced sign‑outs, and MFA enforcement
• The three non‑negotiable Entra controls that collapse most of this attack surface: user consent lockdown, verified publishers, and admin consent workflow
• How to detect, prove, and remediate malicious OAuth grants using Entra audit logs, service principals, and Graph / PowerShell queries
• A step‑by‑step case study that proves why your current “reset + revoke sessions” incident response is not enough

THE CORE INSIGHT

Most Microsoft 365 incident playbooks still assume “user account compromised” means “change password, reset sessions, enforce MFA.” In an OAuth consent attack, the attacker doesn’t need your password again — they already have a standing grant with offline_access and Graph scopes that survive all of that.
The real control point is not the login; it’s the consent event that creates an OAuth2PermissionGrant and a service principal with delegated or application permissions to your data.
This episode argues that defending Entra ID means treating app consent, service principals, and scopes as first‑class security objects — and designing your policies, detections, and incident response around them.

KEY TOPICS COVERED

• Illicit consent grants 101: delegated vs application permissions, offline_access, and why MFA never fires
• Why refresh tokens and OAuth grants outlive password resets and “force sign‑out” actions
• The three critical Entra configurations: lock down user consent, require verified publishers, and enforce admin consent workflow with least‑privilege scopes
• High‑signal audit events to hunt: Add servicePrincipalOAuth2PermissionGrant, Add passwordCredential, Add keyCredential, Update application
• How to inventory risky apps and grants (offline_access + * .All scopes, tenant‑wide consents, privileged users)
• A practical remediation and hardening playbook: purge bad grants, rotate secrets, delete rogue service principals, and build a recurring consent hygiene routine

WHO THIS EPISODE IS FOR

This episode is essential for CISOs, identity and access management teams, SOC and detection engineers, and cloud security/platform teams running Microsoft 365 and Entra ID.
If your organization still treats MFA as the final line of defense and assumes password resets “fix” account‑based attacks, this conversation is your wake‑up call on OAuth, consent, and refresh‑token‑based persistence.

ABOUT THE HOST

Mirko Peters is a Microsoft 365 consultant and digital workplace architect focused on building identity‑first, token‑aware security architectures on the Microsoft cloud.
Through M365.fm, Mirko shares practical attack walkthroughs, Entra governance patterns, and real‑world detection and hardening strategies that help security teams close the OAuth consent gap before it becomes their next breach report

Become a supporter of this podcast: https://www.spreaker.com/podcast/m365-fm-modern-work-security-and-productivity-with-microsoft-365--6704921/support.

(00:00:00) The Heresy of Manual Sharing

(00:00:42) The Dangers of Scattered Truth

(00:02:26) The Sanctuary of Org Apps

(00:02:57) The Five Pillars of Governance

(00:05:51) The Importance of Roles and Boundaries

(00:09:57) The Lamp That Goes Out

(00:14:19) The Canonical Doorway

(00:20:35) The Procession of Deployment

(00:24:27) The Thirty-Day Right of Migration

(00:29:16) The Charge and Call to Action

In this episode of M365.fm, Mirko Peters lays out a governance doctrine for Power BI: why manual sharing is heresy, why reports need apostolic succession from dataset to Org App, and how to build a distribution pattern that keeps truth, lineage, and access under control.

WHAT YOU WILL LEARN

• Why ad‑hoc share links, emailed PDFs, and private bookmarks quietly destroy lineage and trust in Power BI
• How to make Org Apps the canonical doorway for consumers — and kill the “send me your version” culture
• How to design RLS and OLS as guardianship, not guesswork: clear personas, stable roles, and tested audiences from Dev to Prod
• How to stop stale workspaces and “Final_v7” reports from misleading leaders months after projects end
• How to use deployment pipelines as your liturgy: Dev → Test → Prod with endorsements, labels, and tenant settings as the covenant
• How to align sensitivity labels, tenant settings, and workspace strategy so classification and protection travel with your data

THE CORE INSIGHT

Most Power BI pain is not DAX — it is distribution. Every manual share breaks the chain between certified datasets, governed workspaces, and the Org App that should act as the single source of truth.
When you treat Org Apps as the only doorway, RLS/OLS as sacred boundaries at the dataset, and deployment pipelines as your promotion ritual, you replace rumor dashboards with a canon of endorsed, testable truth.
This episode argues that Power BI governance is less about adding tools and more about removing alternate paths — so if it’s not in the app, it’s not trusted, and if it bypasses lineage, it doesn’t get used.

WHO THIS EPISODE IS FOR

This episode is essential for Power BI admins, data architects, BI leads, and analytics product owners responsible for enterprise reporting on Microsoft Fabric and Power BI.
If your organization is drowning in conflicting dashboards, stale workspaces, and shadow copies of “the truth,” this conversation will give you a concrete doctrine for report distribution, RLS/OLS, and workspace strategy that users and leadership can actually live with.

ABOUT THE HOST

Mirko Peters is a Microsoft 365 and data platform consultant who helps organizations turn Power BI and Microsoft Fabric into governed, trustworthy analytics platforms.
Through M365.fm, Mirko shares practical governance patterns, workspace strategies, and real‑world stories that help teams move from scattered reports to a disciplined Power BI distribution model.
















Become a supporter of this podcast: https://www.spreaker.com/podcast/m365-fm-modern-work-security-and-productivity-with-microsoft-365--6704921/support.

(00:00:00) The Excel Dilemma

(00:00:29) The Hidden Dangers of Spreadsheets

(00:02:58) Excel vs. Databases: A Fundamental Difference

(00:04:07) The Three Fatal Failures of Excel

(00:07:49) Introducing Data Verse: A New Paradigm

(00:09:24) Data Verse Features and Benefits

(00:12:30) The Correct Migration Strategy

(00:16:35) Data Landscape and Tool Selection

(00:20:10) The Ten-Step Migration Plan

(00:26:05) The Crucial Decision for Success

In this episode of M365.fm, Mirko Peters explains why Excel is great for analysis but fundamentally broken as the data backbone of a Power App — and how Dataverse fixes the mess before it explodes in production.

WHAT YOU WILL LEARN

• Why Excel collapses the moment your Power App goes from one user to a real team
• How silent data corruption, last‑save‑wins, and broken formulas destroy trust in your app
• Why structure drift (columns changing, copies everywhere) is the real enemy of governance
• How Dataverse brings schema, transactions, security roles, and auditing into your Power Apps
• How to think about Dataverse vs Fabric Lakehouse vs SQL vs “just keep it in Excel”
• A practical 10‑step path to migrate an existing Excel‑backed app into Dataverse

THE CORE INSIGHT

Excel feels safe because it’s forgiving — anyone can change anything, anytime. That freedom is perfect for modeling and individual analysis, but lethal when your spreadsheet becomes an operational system. When multiple users edit the same file, you get last‑save‑wins, silent overwrites, and drift between versions that only show up months later as “unexplainable” numbers.Dataverse solves the problems Excel was never designed to handle: required fields, proper data types, relationships, role‑based security, ACID transactions, and a real audit trail. Instead of hoping your spreadsheet behaves, you let the platform enforce rules, integrity, and access while Power Apps focuses on the experience.

WHY EXCEL FAILS AS A BACKEND

• No concurrency control: two saves at once means valid updates are silently lost
• No schema enforcement: columns, types, and IDs mutate as people improvise
• No referential integrity: relationships exist only in formulas and people’s heads
• No real audit log: you can’t prove who changed what, when, or why
• Constant drift between “master” files, emailed copies, and SharePoint versions

WHAT DATAVERSE GIVES YOU INSTEAD

• Real schema: required fields, data types, keys, and lookups
• Real security: role‑based access, row‑level ownership, and field‑level control
• Real integrity: transactions, referential constraints, and server‑side validation
• Real governance: audit trail, DLP, environments, and predictable APIs
• Real performance: multi‑user concurrency and scalable, queryable storage

YOUR MIGRATION PATH (HIGH LEVEL)

• Inventory Excel‑backed apps and classify the risk
• Extract real entities, keys, and relationships from your workbook
• Design a Dataverse schema that matches how the business actually works
• Set up environments, security roles, and DLP policies
• Transform and load your data, then validate and dedupe
• Point your Power App at Dataverse, run a staged cutover, and finally deprecate Excel as the source of truth

WHO THIS EPISODE IS FOR

This episode is ideal for Power Apps makers, Power Platform admins, solution architects, and business owners whose critical processes still run on “just a spreadsheet” behind a canvas app. If your Power Apps read or write to Excel — especially in SharePoint — this conversation gives you the language and roadmap to move to Dataverse before your luck runs out.

ABOUT THE HOST
Mirko Peters is a Microsoft 365 consultant and digital workplace architect who helps organizations move from spreadsheet‑driven operations to governed, scalable platforms on Power Platform, Dataverse, and Fabric. Through M365.fm, Mirko shares practical migration stories, data‑model patterns, and governance approaches that help IT and business teams replace fragile Excel “systems” with resilient applications that stand up to real users and real audits.

Become a supporter of this podcast: https://www.spreaker.com/podcast/m365-fm-modern-work-security-and-productivity-with-microsoft-365--6704921/support.

(00:00:00) Conditional Access Troubleshooting

(00:00:30) Overbroad Exclusions: The Invisible Leaks

(00:04:56) Device Compliance Gaps: Setting Clear Boundaries

(00:09:02) Token Theft Scenarios: Protecting Against Session Hijacking

(00:12:46) Building a Calming Baseline

(00:18:06) Safe Rollout Test Plan

(00:20:34) Monitoring and Alerts for Healthy CA

(00:25:02) Closing Thoughts and Next Episode Preview

In this episode of M365.fm, Mirko Peters explains why your Conditional Access policy isn’t misbehaving — it’s overwhelmed by mixed messages, permanent exclusions, and unclear device signals. You’ll see how over‑broad exclusions, fuzzy device compliance, and unprotected token paths quietly turn “Zero Trust” into “sometimes trust,” creating exactly the bypasses attackers love.

WHAT YOU WILL LEARN

• Why exclusions for VIPs, break‑glass, and partner domains slowly become permanent backdoors
• How to spot leaking trust using Entra sign‑in logs and “Not applied” Conditional Access results
• How to replace static exclusions with short‑lived Emergency Bypass using authentication context
• Why “Require compliant device” often fails in practice — and how to separate compliant, joined, registered, and unknown device states
• How to design fallback policies so you can remove risky exclusions without locking out the business
• Where token theft fits into this story, and why session lifetime, sign‑in frequency, and continuous access evaluation matter more than you think

THE CORE INSIGHT

Conditional Access is only as healthy as the boundaries you give it. If you rely on wide exclusions and vague device states, the engine spends more energy deciding who not to protect than enforcing Zero Trust.
Mirko shows a better pattern: start with inclusive policies (all users, all apps), eliminate permanent exclusions, and route true exceptions through a time‑bound Emergency Bypass context with clear approvals and logs. Then, clarify your device tiers (compliant, AAD joined, hybrid joined, registered) and design policies that greet each tier with the right level of friction instead of a single “compliant or blocked” toggle. The result is a Conditional Access layer that protects first, allows relief intentionally, and stops attackers from hiding in your comfort settings.

WHO THIS EPISODE IS FOR

This episode is ideal for identity architects, security engineers, and Microsoft 365 / Entra ID admins responsible for Conditional Access, device requirements, and emergency access patterns. If your policies “work” but you’re relying on exclusions, trusted locations, and vague device settings to keep people happy, this conversation will give you a field‑tested way to heal your Conditional Access trust issues without breaking your users.

ABOUT THE HOST

Mirko Peters is a Microsoft 365 consultant and digital workplace architect focused on building identity‑first, Conditional‑Access‑driven security on the Microsoft cloud. Through M365.fm, Mirko shares practical policy patterns, investigation stories, and governance models that help organizations turn Conditional Access from a scary toggle into a reliable core of their Zero Trust design.

Become a supporter of this podcast: https://www.spreaker.com/podcast/m365-fm-modern-work-security-and-productivity-with-microsoft-365--6704921/support.

(00:00:00) AI Governance Challenges in LLMs

(00:00:32) The Prompt Injection Threat

(00:01:10) Output Validation and Tool Registry

(00:02:21) Copilot Studio's Naive Grounding Pitfall

(00:03:05) Fixing the Gaps in LLM Governance

(00:05:15) The Permissive Connector Dilemma

(00:07:12) Access Control and Secret Management

(00:09:22) Audit Logging and Visibility

(00:13:17) Agent RBAC and Identity Management

(00:17:15) Data Loss Prevention Policies

In this episode of M365.fm, Mirko Peters tears down the governance mess around LangChain4j and Copilot Studio — from prompt injection to over‑permissive connectors — and shows how to turn “ship it and hope” agents into governed systems with real guardrails.

WHAT YOU WILL LEARN

• Why prompt injection turns your agent into an unsupervised intern with production access
• How weak tool schemas and “JSON‑ish” outputs let attackers smuggle commands through models
• What breaks when Copilot Studio is grounded on “the whole SharePoint farm” and prompts are editable by business users
• How over‑permissive connectors and shared credentials become keys to the whole castle
• The practical guardrails for LangChain4j: allow‑listed tools, JSON schema validation, output filters, and fail‑closed execution
• The practical guardrails for Copilot Studio: locked system prompts, scoped connectors per environment, DLP, and tenant‑level moderation

THE CORE INSIGHT

Most AI teams try to fix governance in the prompt while leaving tools, connectors, and identities wide open. That never works. Real safety lives in code, schemas, scopes, and RBAC — not in “please be safe” instructions tacked onto a system message.
Mirko walks through concrete cases where prompt injection, unvalidated tool arguments, and broad connectors produced near‑miss incidents, then shows how small changes at the tool boundary (schemas, validation, Bloom filters, policy checks) stop bad calls before they hit your APIs. For Copilot Studio, you’ll hear why environment separation, sensitivity‑tagged grounding, and strict connector scopes matter more than any clever wording in your copilot’s description.

WHO THIS EPISODE IS FOR

This episode is ideal for platform engineers, AI product owners, security architects, and anyone shipping LangChain4j agents or Copilot Studio copilots into real tenants. If your agents can currently see “everything” and you’re relying on prompts and goodwill to stay safe, this conversation will give you a concrete RBAC model, governance checklist, and red‑team starting point you can apply immediately.

ABOUT THE HOST

Mirko Peters is a Microsoft 365 consultant and digital workplace architect focused on building safe, governed AI systems on the Microsoft cloud. Through M365.fm, Mirko shares real incident patterns, governance models, and practical guardrail techniques that help teams ship AI agents without turning their tenants into unsupervised experiments.
























Become a supporter of this podcast: https://www.spreaker.com/podcast/m365-fm-modern-work-security-and-productivity-with-microsoft-365--6704921/support.

(00:00:00) The Mysterious GPU Slowdown

(00:03:31) The Silent Saboteur: CPU Fallback

(00:07:43) The Hidden Pitfalls of Version Mismatch

(00:12:24) The Container Culprit: Efficiency Erosion

(00:16:52) The Remedy: Provable Acceleration

(00:22:05) Closing Thoughts and Next Steps

In this episode of M365.fm, Mirko Peters investigates a familiar horror story in AI operations: GPU bills climbing while GPU utilization is near zero and latency quietly explodes. He dissects a real text‑to‑image Stable Diffusion workload where everything on paper looks right — ONNX/TensorRT, NVIDIA GPUs, containers, CI‑controlled rollouts — yet requests crawl and P95 latency blows past every SLO.

WHAT YOU WILL LEARN

• Why your “GPU‑accelerated” service may actually be running on CPU without telling you
• How CPU fallback in ONNX Runtime works and why it almost never raises a visible error
• How subtle CUDA / ONNX Runtime / TensorRT version mismatches destroy fused kernels and fast paths
• How container misconfiguration (missing device mounts, wrong nvidia‑container‑toolkit setup) turns accelerators into expensive heaters
• Which three metrics — latency, throughput, and GPU utilization — tell you the truth when dashboards lie

THE CORE INSIGHT

Most AI outages at scale aren’t about the model; they’re about infrastructure honesty. Your system will happily “work” on the wrong execution provider, with degraded kernels, or with no GPU attached at all — and it will do so silently unless you force it to prove otherwise. Mirko shows how provider order, capability logs, and device mounts form the real chain of evidence for whether your GPUs are actually doing the work you’re paying for.You’ll hear a detailed walk‑through of “Evidence File A”: CPU fallback as the quiet saboteur. ONNX Runtime tries TensorRT, then CUDA, then shrugs and runs everything on CPU when drivers, libraries, or device mounts don’t line up — logging a single line most teams never read. The service stays green, but GPU duty cycles hover at 5%, CPU cores peg, P50 latency quadruples, and P95 unravels under bursty traffic as autoscale happily spreads the defect across more replicas.Then in “Evidence File B,” Mirko explores version drift: CUDA, cuDNN, ONNX Runtime, and TensorRT that technically run but miss fused attention kernels, FP16 paths, and tensor core optimizations. Engines deserialize with warnings, fall back to generic kernels, and keep responding — just slower and more memory‑hungry. Utilization charts look “busy enough,” but PCIe and memory movement dominate, and your cost per request quietly spikes.Most teams treat containerization and CI as safety nets; here you’ll see how they can just as easily freeze defects in amber when you don’t assert GPU health at startup. Mirko outlines concrete countermeasures: hard‑fail if GPU providers aren’t present, validate IO binding with a warm‑up inference, enforce latency gates during rollout, and build canary prompts that exercise the fused kernels you care about. In other words, trade a bit of availability at deploy time for integrity and predictable performance in production.

WHO THIS EPISODE IS FOR

This episode is ideal for ML engineers, MLOps and platform teams, SREs, and cloud architects running GPU‑backed inference for diffusion models and other heavy workloads. If your GPU bill is high, your latency is unstable, and your dashboards insist everything is fine, this conversation will give you a field manual for proving whether your accelerators are actually accelerating — and what to fix when they’re not.

BOUT THE HOST

Mirko Peters is a Microsoft 365 and cloud consultant who helps organizations turn AI infrastructure from expensive experiments into reliable, observable production systems. Through M365.fm, Mirko shares real incident stories, performance forensics, and hard‑won patterns that help teams keep their GPUs honest and their SLOs intact.

Become a supporter of this podcast: https://www.spreaker.com/podcast/m365-fm-modern-work-security-and-productivity-with-microsoft-365--6704921/support.

(00:00:00) The Case for AI-Powered Java Modernization

(00:00:26) The Legacy Java Dilemma

(00:01:47) AI-Driven Modernization Process

(00:04:22) The Assessment Phase: Exposing Technical Debt

(00:12:39) Cloud Migration and Cost Optimization

(00:17:06) The Results and Benefits of Automated Modernization

(00:20:53) Closing Thoughts and Call to Action

In this episode of M365.fm, Mirko Peters shows why manually upgrading legacy Java apps is unpaid penance — and how AI‑driven modernization can take you from Java 8 on AWS to Java 21 on Azure with receipts instead of heroics.

WHAT YOU WILL LEARN

• Why manual Java modernization is slow, error‑prone, and always behind on CVEs and tech debt
• How to inventory a legacy Java 8 Spring/Maven stack with drifted POMs, pinned dependencies, and brittle CI
• What Java 21 actually buys you: virtual threads, better GC, and a more stable platform for concurrency and performance
• How an AI agent builds a concrete plan: CVE remediation, dependency upgrades, OpenRewrite recipes, and cloud‑readiness checks
• How to move from AWS to Azure (App Service or Azure Spring Apps + Azure SQL) with proper bindings, Key Vault, and managed identities
• Why every action must land in Git as small, reviewable commits with SBOMs, scanner outputs, and full audit trail

THE CORE INSIGHT

Most teams think they “know” their legacy stack; the AI assessment proves they don’t. Forked parent POMs, transitive dependency roulette, duplicate logging bridges, and quiet CVEs all hide in plain sight until a structured agent inventories them. The real shift is from heroic, manual fixes to a loop where the agent proposes code changes, dependency bumps, and infra tweaks — and you approve them in Git with evidence attached.Mirko walks through how the agent: scans code, build files, plugins, Docker bits, and config; maps CVEs to real reachability; runs OpenRewrite recipes for Java 21; flags cloud anti‑patterns like stateful disk writes and hard‑coded secrets; and produces a plan that security, platform, and finance can all live with. You’ll hear why the most powerful slide in the deck was the cost and risk baseline: compute waste, CVE counts, and migration impact all quantified before a single line of code changed.Once the plan is approved, the agent stops talking and starts doing: applying recipes, fixing APIs, resolving dependency hell, regenerating SBOMs, and rerunning scanners in a tight loop until builds are green. From there, it containers the app, wires Azure hosting, connects to Azure SQL, and sets up CI/CD with staged rollouts and policy gates — all as traceable commits instead of 2 a.m. shell scripts.

WHO THIS EPISODE IS FOR

This episode is ideal for Java leads, platform engineers, cloud architects, and security owners who live with noisy legacy Java apps on AWS or other platforms. If your organization keeps postponing modernization because “it’s too risky” or “we don’t have time,” this conversation will give you a concrete, AI‑assisted pattern to upgrade, secure, and move your stack to Azure with evidence instead of anecdotes.

ABOUT THE HOST

Mirko Peters is a Microsoft 365 and cloud consultant who helps organizations turn fragile, legacy workloads into governed, modern applications on Azure. Through M365.fm, Mirko shares real modernization stories, governance patterns, and platform designs that let teams replace manual Java heroics with repeatable, AI‑assisted modernization.

Become a supporter of this podcast: https://www.spreaker.com/podcast/m365-fm-modern-work-security-and-productivity-with-microsoft-365--6704921/support.

(00:00:00) The Validator's Triple Check

(00:00:07) Capability, Policy, and Feasibility: The Validator's Three Pillars

(00:01:47) The Triogate: Ensuring Safe Execution

(00:02:59) Implementation and Architecture

(00:04:19) Subscribe and Watch Next Episode

(00:04:36) The Executor's Role: Operations and Guarantees

(00:08:41) Workflows as Graphs: Structuring Reliability

(00:12:16) Observability and Security in Graph Validation

(00:12:53) Microsoft 365 Integration: A Secure Architecture

(00:22:31) Measuring Success: Metrics and Benefits

In this episode of M365.fm, Mirko Peters explains why most AI agents don’t fail because the prompt is bad — they fail because there is no real architecture behind them. You’ll see how separating cognition (LLMs) from operations (executors), plus adding validation and explicit workflows, turns “smart but flaky” agents into stable, predictable systems that enterprises can actually trust.

WHAT YOU WILL LEARN

• Why prompts alone can’t guarantee correct, repeatable behavior in real workflows
• The difference between thinking (LLM) and doing (executors with contracts, retries, and postconditions)
• How workflow graphs (nodes, edges, state, compensations) give agents a real map instead of improvisation
• How static graph validation and runtime policy checks catch bad plans before they hit production systems
• How to use Microsoft 365 Graph as a grounded data layer with least‑privilege access and citations
• How Azure OpenAI, schema‑bound outputs, and Copilot Studio orchestration fit together in one stack
• Which metrics actually prove that your agent is reliable: accuracy, p95 latency, cost, and first‑pass completion

THE CORE INSIGHT

Prompts are thoughts. Executors are actions. Validation is safety. When you rely only on prompts, the model hallucinates tools, ignores preconditions, and happily produces “partial success” that breaks downstream systems without throwing an error. The fix is a contract‑first design: each node in a workflow has explicit inputs, outputs, and postconditions, and every tool call is checked against a policy and schema before it runs.Mirko shows how this looks in practice: DAG‑shaped workflows with clear state boundaries, compensation logic for side effects, and node‑level tracing so you can replay exactly what happened. Static validation catches cycles, unreachable nodes, and broken contracts before deployment; runtime guards enforce RBAC, ABAC, scopes, and safe egress. With Microsoft Graph as the grounded data layer and Azure OpenAI as the reasoning engine, the system can both think and prove where its answers came from.

MICROSOFT INTEGRATION YOU’LL HEAR ABOUT

• M365 Graph with selective fields, delta queries, and provenance for citations
• Azure OpenAI as a reasoning layer with JSON/schema‑bound tool calls
• Copilot Studio for human checkpoints, approvals, and orchestration over the agent graph
• Idempotency keys, retries, and validation gates so repeated runs don’t cause repeated damage

KEY TAKEAWAYS

• Reliable AI agents require architecture, not vibes
• Workflow graphs, contracts, and validation turn LLM creativity into safe, auditable behavior
• Grounding on Microsoft Graph and enforcing citations raises factual accuracy you can actually audit
• A single pre‑execution contract gate (capability, policy, postcondition feasibility) prevents most catastrophic mistakes

WHO THIS EPISODE IS FOR

This episode is ideal for AI engineers, platform teams, solution architects, and product owners who want AI agents to execute real business workflows in Microsoft 365 and Azure, not just chat about them. If your current agents sometimes work and sometimes fail in weird, silent ways, this conversation will give you the mental model and blueprint you should have started with.

ABOUT THE HOST

Mirko Peters is a Microsoft 365 consultant and digital workplace architect focused on building safe, observable AI systems on the Microsoft cloud. Through M365.fm, Mirko shares practical architectures, governance patterns, and real incident stories that help teams turn AI agents from unreliable demos into enterprise‑ready automation.

Become a supporter of this podcast: https://www.spreaker.com/podcast/m365-fm-modern-work-security-and-productivity-with-microsoft-365--6704921/support.