In this episode, one of the leading Microsoft security partners -

Cyclotron - https://cyclotron.com/ - discusses common and “uncommon” mistakes customers encounter while deploying Microsoft Purview.

Show notes:

Teams Channels

Public Webinars & Training

Welcome Guide

Digital Badge Program

Join the Community

Feedback Opportunities

Community Calls

Recognition & Badges

Discussion Groups

Upcoming Public Webinars

Security YouTube Channel

Public Forums

Ninja Training & Certification

Ninja Show

Need Assistance? Email our Team

Microsoft respects your privacy. Review our online Privacy Statement. ​

Microsoft Corporation | One Microsoft Way | Redmond, WA, USA 98052 ​

At any point you may opt-out of the program by filling out this form.

Watch the live replay

Join us this episode as we talk about the Customer Community Program @ Microsoft.

Watch the live replay

Join us this episode as we invite some of our awesome Microsoft Security MVPs to discuss their experiences with the MVP program.

Show Notes/Links

* Defender Experts upcoming webinar: Defender Experts: S.T.A.R. Forum - Strategies for Threat Awareness and Response, Episode 3.

ClickFix: The Threat You Can’t Afford to Ignore. Are You Ready to Respond?

Join Microsoft Defender Experts for an unfiltered breakdown of the ClickFix attack, and learn how to defend against it before it disrupts your operations.

* Register Here: https://msit.events.teams.microsoft.com/event/4cee88e5-0a8a-4f02-9e4a-453bdda2e38d@72f988bf-86f1-41af-91ab-2d7cd011db47/registration

What to Expect:

* No-Nonsense Tactics: Dive into actionable strategies for detecting, investigating, and mitigating ClickFix straight from the frontlines.

* KQL Demystified: Get hands-on with KQL to enhance your threat detection, automate responses, and build custom playbooks.

* Real Expertise: Hear from the professionals actively hunting and blocking threats like ClickFix in real-time.

* Advanced Defense: Sharpen your response to ransomware, phishing, and social engineering with field-tested techniques.

If you're serious about your defense posture, this isn’t just another webinar. This is essential knowledge to keep you ahead of the curve and out of harm’s way.

Check out content from our previous episode(s): https://aka.ms/DefenderExpertsWebinarSeries

* Secure Score over time with Power BI - Secure Score Over Time Power BI Dashboard | Microsoft Community Hub

* Analyze Conditional Access Policy impact - The policy impact view for individual Microsoft Entra Conditional Access policies enables admins to evaluate the effects of enabled and report-only Conditional Access policies in their organization, without using Log Analytics. This feature surfaces a graph for each policy in the Microsoft Entra admin center, showing the policy’s impact on the tenant’s past sign-ins.

* Microsoft Entra External ID: Sign in with Apple - Configure Apple as an external identity provider (IdP) to add Apple as a social provider for your user flows. Users can sign up and sign in to associated applications using their Apple ID accounts through the Sign in with Apple option.

* Hands-on learning resource for Defender for AI Services hosted here:

https://github.com/Azure/Microsoft-Defender-for-Cloud/blob/main/Labs/Modules/Module%2024%20-%20AI%20Workloads.md

* Microsoft is now hosting xAI’s Grok 3 models

I reported in my Notepad newsletter earlier this month that Microsoft was getting ready to host Elon Musk’s Grok AI models, and now it’s official. At Microsoft’s Build developer conference today, the company confirmed it’s expanding its Azure AI Foundry models list to include Grok 3 and Grok 3…

* Microsoft introduces GitHub AI agent that can code for you

Microsoft’s GitHub unit on Monday introduced a Copilot artificial intelligence agent that can take on specific programming work and inform people once it has finished. From there, developers can check the agent’s work from GitHub, a widely used repository for code.

Watch the live replay

Join us as we welcome Adam Brewer. Adam is a seasoned professional with a distinguished career at Microsoft and in enterprise IT. He currently serves as an Security Sales Specialist at Microsoft, focusing on the West and Midwest region. In this role, Adam is responsible for driving security initiatives and ensuring the successful implementation of Microsoft's security solutions with enterprise clients. His work involves close collaboration with various teams across Microsoft and his clients to address their security needs and challenges.

Show Notes/Links

* Defender Experts upcoming webinar: Defender Experts: S.T.A.R. Forum - Strategies for Threat Awareness and Response, Episode 3.

ClickFix: The Threat You Can’t Afford to Ignore. Are You Ready to Respond?

Join Microsoft Defender Experts for an unfiltered breakdown of the ClickFix attack, and learn how to defend against it before it disrupts your operations.

* Register Here: https://msit.events.teams.microsoft.com/event/4cee88e5-0a8a-4f02-9e4a-453bdda2e38d@72f988bf-86f1-41af-91ab-2d7cd011db47/registration

What to Expect:

* No-Nonsense Tactics: Dive into actionable strategies for detecting, investigating, and mitigating ClickFix straight from the frontlines.

* KQL Demystified: Get hands-on with KQL to enhance your threat detection, automate responses, and build custom playbooks.

* Real Expertise: Hear from the professionals actively hunting and blocking threats like ClickFix in real-time.

* Advanced Defense: Sharpen your response to ransomware, phishing, and social engineering with field-tested techniques.

If you're serious about your defense posture, this isn’t just another webinar. This is essential knowledge to keep you ahead of the curve and out of harm’s way.

Check out content from our previous episode(s): https://aka.ms/DefenderExpertsWebinarSeries

* Secure Score over time with Power BI - Secure Score Over Time Power BI Dashboard | Microsoft Community Hub

* Analyze Conditional Access Policy impact - The policy impact view for individual Microsoft Entra Conditional Access policies enables admins to evaluate the effects of enabled and report-only Conditional Access policies in their organization, without using Log Analytics. This feature surfaces a graph for each policy in the Microsoft Entra admin center, showing the policy’s impact on the tenant’s past sign-ins.

* Microsoft Entra External ID: Sign in with Apple - Configure Apple as an external identity provider (IdP) to add Apple as a social provider for your user flows. Users can sign up and sign in to associated applications using their Apple ID accounts through the Sign in with Apple option.

* Hands-on learning resource for Defender for AI Services hosted here:

https://github.com/Azure/Microsoft-Defender-for-Cloud/blob/main/Labs/Modules/Module%2024%20-%20AI%20Workloads.md

* Microsoft is now hosting xAI’s Grok 3 models

I reported in my Notepad newsletter earlier this month that Microsoft was getting ready to host Elon Musk’s Grok AI models, and now it’s official. At Microsoft’s Build developer conference today, the company confirmed it’s expanding its Azure AI Foundry models list to include Grok 3 and Grok 3…

* Microsoft introduces GitHub AI agent that can code for you

Microsoft’s GitHub unit on Monday introduced a Copilot artificial intelligence agent that can take on specific programming work and inform people once it has finished. From there, developers can check the agent’s work from GitHub, a widely used repository for code.

Watch the live replay

Join us as we welcome Micah Heaton from BlueVoyant and Michael Brown from Microsoft as we discuss a whole stack of things, including DEX, Security Copilot agents, and SIEM and XDR.

Show Notes/Links

* The MISA Awards - Full show: https://securitypartners.transform.microsoft.com/misa-excellence-awards-2025

* BlueVoyant XDR Threat Gap Analysis: https://appsource.microsoft.com/en-cy/product/power-bi/bluevoyant1583844909747.securitydiagnosticapp?exp=kyyw&tab=Overview

* Threat Actor Naming: https://www.microsoft.com/en-us/security/blog/2025/06/02/announcing-a-new-strategic-collaboration-to-bring-clarity-to-threat-actor-naming/

* KQL Query for Actor Names: https://learn.microsoft.com/en-us/unified-secops-platform/microsoft-threat-actor-naming#resources

* Github of Jaime: https://github.com/jguimera

* Microsoft BlueHat: https://www.microsoft.com/bluehat/

* Secure Score over time with Power BI - Secure Score Over Time Power BI Dashboard | Microsoft Community Hub

* Analyze Conditional Access Policy impact - The policy impact view for individual Microsoft Entra Conditional Access policies enables admins to evaluate the effects of enabled and report-only Conditional Access policies in their organization, without using Log Analytics. This feature surfaces a graph for each policy in the Microsoft Entra admin center, showing the policy’s impact on the tenant’s past sign-ins.

* Microsoft Entra External ID: Sign in with Apple - Configure Apple as an external identity provider (IdP) to add Apple as a social provider for your user flows. Users can sign up and sign in to associated applications using their Apple ID accounts through the Sign in with Apple option.

Watch the live replay

Stop by the show as we welcome back Performanta. During the last Performanta appearance we were wowed by their Security Copilot automation. Join us to hear how the Microsoft partner is taking Security Copilot Agents to the next level.

* Performanta:

https://www.performanta.com/

* Microsoft Security Copilot Agent videos: https://adoption.microsoft.com/security-copilot/video-hub/

* MDEAutomator: https://github.com/msdirtbag/MDEAutomator

General

Securing generative AI models on Azure AI Foundry

Microsoft's Zero Trust approach

Threat Intelligence & ESAM

Azure Security & Defender for Cloud News

Sentinel News

Microsoft Sentinel Project Deployment Tracker

Ingesting Akamai Audit Logs into Microsoft Sentinel using Azure Function Apps

Defender for IoT

Sensor Disconnection Notifications with Microsoft Defender for IoT and Microsoft Sentinel

What's new in Microsoft Defender for IoT?

Microsoft 365 Security (All Up News)

Security Update Release Summary March 2025

Microsoft Entra

Help Desk & Account Recovery - Face Check with Microsoft Entra Verified ID

Remote Onboarding - Face Check with Microsoft Entra Verified ID

Secure Access to Resources - Face Check with Microsoft Entra Verified ID

Device Management & Protection (Intune)

Fortify your security posture with Microsoft Intune and Windows

Stay ahead of evolving threats with the latest AI in Intune

Expand endpoint visibility across device platforms

Microsoft Intune provides key advantages for macOS management

What's New in Azure Firewall - March 2025

Configure Entra Private Access and Quick Access in Microsoft Entra Global Secure Access

What's new in Microsoft Intune

M365 Defender (Defender for Office, Defender for Endpoint, Defender for Identity, Defender for Cloud Apps)

Resolving high CPU utilization in Microsoft Defender Antivirus

Mastering endpoint security settings issues with Defender for Endpoint Client Analyzer

Mastering onboarding issues with Defender for Endpoint Client Analyzer

Microsoft Defender for Endpoint Client Analyzer overview

What's new in Microsoft Defender XDR

What's new in Microsoft Defender for Endpoint

What's new in Microsoft Defender for Office 365

What's new in Microsoft Defender for Identity

What's new in Microsoft Defender for Cloud Apps

Defender Experts for XDR

Copilot for Security

Announcing Alert Triage Agents in Microsoft Purview, powered by Security Copilot

What's new in Microsoft Security Copilot?

Incident Response

Purview - Compliance & Governance

Mitigating insider risks in the age of AI with Microsoft Purview Insider Risk Management

Learning

Microsoft Defender for Cloud Apps - Ninja Training

Watch the live replay

In this episode, we dive into the recent wave of layoffs at Microsoft, where 6,000 employees—about 3% of the workforce—were let go. We explore the broader implications of these cuts, from the restructuring of management layers to the increasing role of AI in shaping the future of work.

Join us as we hear from industry experts, affected employees, and analysts who break down what this means for tech professionals, corporate strategy, and the evolving job market. How do these layoffs fit into the larger trend of workforce reductions across the tech sector? What lessons can be learned from past restructuring efforts? And most importantly, how can professionals adapt and thrive in an industry that’s constantly evolving?

Whether you're in tech, navigating career shifts, or simply curious about the forces shaping the modern workplace, this episode offers insights, perspectives, and strategies for moving forward.

Tune in for a thoughtful discussion on resilience, adaptation, and the future of work in the age of AI.

Show Links/Notes

* Amanda's LinkedIn Profile: https://www.linkedin.com/in/amanda-schilling-5863a551/

* Microsoft Build Books of News: aka.ms/BookofNews

* Changes to Microsoft Authenticator autofill: https://support.microsoft.com/en-us/account-billing/changes-to-microsoft-authenticator-autofill-09fd75df-dc04-4477-9619-811510805ab6

* MISA Partners: https://securitypartners.transform.microsoft.com/misa-members

Watch the live replay

Welcome to Partner month on the MSI Show. This episode we talk with Tanium to hear about the company’s latest developments for Microsoft Security Copilot and a new Agent that helps automate security operations.

Show Notes/Links

* Tanium: https://www.tanium.com/

* Microsoft Partner Spotlight - Tanium: https://www.tanium.com/partners/microsoft/spotlight/

* Michael Fiorina’s LinkedIn profile: https://www.linkedin.com/in/mikefiorina/

* Microsoft Security Copilot Agent videos: https://adoption.microsoft.com/security-copilot/video-hub/

* MDEAutomator: https://github.com/msdirtbag/MDEAutomator

* SRA’s Crowpilot: https://sra.io/blog/crowpilot-the-ai-agent-that-connects-security-copilot-with-crowdstrike-falcon/

General

Securing generative AI models on Azure AI Foundry

Microsoft's Zero Trust approach

Threat Intelligence & ESAM

Azure Security & Defender for Cloud News

Sentinel News

Microsoft Sentinel Project Deployment Tracker

Ingesting Akamai Audit Logs into Microsoft Sentinel using Azure Function Apps

Defender for IoT

Sensor Disconnection Notifications with Microsoft Defender for IoT and Microsoft Sentinel

What's new in Microsoft Defender for IoT?

Microsoft 365 Security (All Up News)

Security Update Release Summary March 2025

Microsoft Entra

Help Desk & Account Recovery - Face Check with Microsoft Entra Verified ID -V

Remote Onboarding - Face Check with Microsoft Entra Verified ID -V

Secure Access to Resources - Face Check with Microsoft Entra Verified ID -V

Device Management & Protection (Intune)

Fortify your security posture with Microsoft Intune and Windows

Stay ahead of evolving threats with the latest AI in Intune

Expand endpoint visibility across device platforms

Microsoft Intune provides key advantages for macOS management

What's New in Azure Firewall - March 2025 -V

Configure Entra Private Access and Quick Access in Microsoft Entra Global Secure Access

What's new in Microsoft Intune

M365 Defender (Defender for Office, Defender for Endpoint, Defender for Identity, Defender for Cloud Apps)

Resolving high CPU utilization in Microsoft Defender Antivirus

Mastering endpoint security settings issues with Defender for Endpoint Client Analyzer

Mastering onboarding issues with Defender for Endpoint Client Analyzer

Microsoft Defender for Endpoint Client Analyzer overview

What's new in Microsoft Defender XDR

What's new in Microsoft Defender for Endpoint

What's new in Microsoft Defender for Office 365

What's new in Microsoft Defender for Identity

What's new in Microsoft Defender for Cloud Apps

Defender Experts for XDR

Copilot for Security

Announcing Alert Triage Agents in Microsoft Purview, powered by Security Copilot

What's new in Microsoft Security Copilot?

Incident Response

Purview - Compliance & Governance

Mitigating insider risks in the age of AI with Microsoft Purview Insider Risk Management

Learning

Microsoft Defender for Cloud Apps - Ninja Training

Watch the live replay

JP Bourget was the founder of Syncurity, an early entrant in the SOAR market, which sold to Swimlane in 2020. He currently is President Blue Cycle, a SecOps maturity advisory, services and development firm. Blue Cycle focuses on the core technologies, architecture, integration, and customization of modern sec ops programs and meet clients where they are to help level up their capabilities. Blue Cycle is a Microsoft Partner with designations in Security, Modern Work, Infrastructure, Data and AI, and Digital and App innovation. JP has designed Sentinel architecture for F500s and XDR providers and touched his first SIEM in 2005. JP is also the Entrepreneur/CISO in Residence at Lytical Ventures based in NYC, and lives in upstate NY.

Show Notes/Links

* JP’s LinkedIn Profile: JP Bourget

* BlueCycle website: https://www.bluecycle.net/

Tools, Blogs and Stuff:

* Noodle’s new blog: https://sentinel.blog

* https://aadinternals.com

General:

* AI innovation requires AI security: Hear what’s new at Microsoft Secure

* Transforming public sector security operations in the AI era

Threat Intelligence:

* Malvertising campaign leads to info stealers hosted on GitHub

* Silk Typhoon targeting IT supply chain

Azure Security:

* Implementing Multi-Layered Security with Azure DDoS Protection and Azure WAF

Defender for Cloud:

* API Security Posture with Defender for Cloud

* Secure your AI application transformation with Microsoft Defender for Cloud

Sentinel News:

* New capabilities coming to Microsoft Sentinel this Spring

* Microsoft Sentinel - Custom ASIM Parser for Solarwind Data source

Microsoft Entra:

* Securing B2B Collaboration with Microsoft Entra ID -V

* Microsoft Entra External ID: User activity insights

* Quick Setup - Microsoft Entra Verified ID

M365 Defender | XDR - (MDO, MDE, MDI, MDCA):

* Transition to the Unified SOC Platform: Deep Dive and Interactive Q&A for SOC Professionals

* Microsoft Defender for Endpoint Client Analyzer overview

* Connecting your Apps to Defender for Cloud Apps

Security Copilot:

* Automate cybersecurity at scale with Microsoft Security Copilot agents

* Take Flight with Microsoft Security Copilot Flight School

Microsoft Purview:

* Strengthen data security posture in the era of AI with Microsoft Purview

* Prevent data loss across your ever-expanding data estate with Microsoft Purview Data Loss Prevention

Microsoft Learning | Skilling:

* Microsoft Defender for Cloud Apps - Ninja Training

Webinars and Stuff:

* Microsoft Cloud Security Public Webinars

Watch the live replay

Advanced Prompt Engineering for Security Copilot. As a cybersecurity professional with over 20 years of experience, Rick specializes in cybersecurity architecture and IT risk management. He is passionate about artificial intelligence, continuous learning, exchanging ideas, and contributing to endeavors that help others achieve success.

Show Notes/Links

Rick’s LinkedIn Profile: https://www.linkedin.com/in/rick-kotlarz/

Tools, Blogs and Stuff:

Noodle’s new blog: https://sentinel.blog

https://aadinternals.com

General:

* Create | Microsoft 365 Copilot

* Microsoft Security Insider

* Exploring the Extensibility of Active Directory Migration Service (ADMS) Device Migration

* Introducing the Secure Future Initiative Tech Tips show!

* Navigating Mergers and Acquisitions: IT Consolidation Best Practices and Approach

* Blog Series: Charting Your Path to Cyber Resiliency

Threat Intelligence:

* https://www.activecountermeasures.com/malware-of-the-day-ipv6-address-aliasing/

* New XCSSET malware adds new obfuscation, persistence techniques to infect Xcode projects

* New innovations to protect custom AI applications with Defender for Cloud

* Enhance AI security and governance across multi-model and multi-cloud environments

* All Key Vaults Are Critical, But Some Are More Critical Than Others: Finding the Crown Jewels

* Securing your organization from 'IngressNightmare' using Microsoft Security capabilities

Azure Security:

* Manage cloud security posture with Microsoft Defender for Cloud

* What's new in Defender for Cloud features

Defender for Cloud:

* API Security Posture with Defender for Cloud

* Secure your AI application transformation with Microsoft Defender for Cloud

Sentinel News:

Want to know how to view Sentinel incidents in Teams?

Azure Lighthouse support for MSSP use of Security Copilot Sentinel scenarios in Public Preview | Microsoft Community Hub

Monitor User Activities and System Events with Security Copilot and Microsoft Sentinel | Microsoft Community Hub -

Microsoft Entra:

* Using phishing resistant creds | Protect identities and secrets

* How do Microsoft Entra ID Protection Risk Signals Work?

* Configure API driven Provisioning in Microsoft Entra ID Governance

* Configure auto-assignment policies in Microsoft Entra ID Governance using Entitlement Management

* Microsoft Entra custom authentication extension overview

* Implementing managed identities | Protect identities and secrets

* Create Custom reports for Microsoft Entra ID Governance data using Azure Data Explorer

* What's new in Entra ID

M365 Defender | XDR - (MDO, MDE, MDI, MDCA):

* ​​Built-in report button is available in Microsoft Outlook across platforms

* Monthly news - March 2025

* Defending Against OAuth-Based Attacks with Automatic Attack Disruption

* Level Up Your App Governance With Microsoft Defender for Cloud Apps Workshop Series

* Strengthening Email Security: Our New Approach to Non-RFC Compliant Emails

* Unveiling the Shadows: Extended Critical Asset Protection with MSEM

* Level up your defense: protect against attacks using stale user accounts

* Discover and protect Service Accounts with Microsoft Defender for Identity

* Protect SaaS apps from OAuth threats with attack path, advanced hunting and more

* General Availability for Collaboration Security for Microsoft Teams

Security Copilot:

* Protect at the scale and speed of AI with Microsoft Security Copilot

* Microsoft Security Copilot – Microsoft Adoption

* Empowering Security Copilot with NL2KQL: Transforming Natural Language into Insightful KQL queries | Microsoft Community Hub

* Advancing Security Copilot with MAGIC: Automating Self-Correction in NL2KQL and Beyond

* Take Flight with Microsoft Security Copilot Flight School

Microsoft Purview:

* 3 Tips for Comprehensive Data Security

* Advanced hunting for Microsoft Purview Data Loss Prevention (DLP) incidents | Microsoft Community Hub

* New innovations in Microsoft Purview for protected, AI-ready data

* Unlocking the Power of Microsoft Purview for ChatGPT Enterprise

* What's new in Microsoft Purview

Webinars and Stuff:

* Microsoft Cloud Security Public Webinars

Watch the live replay