Workplace Ninja Summit

MSPs earn their margin when customers don't need to call. Maurice Daly (Patch My PC) and Lewis Barry (Inforcer) on standardising Microsoft 365 security across hundreds of tenants, and the mistakes they see first.

In this episode

- Why security fundamentals are the same for every vertical, and why MSPs need standardisation to scale

- Start with Entra, then Defender for Office, then Intune: follow the attack chain

- Where tenant drift really comes from, and why you can ignore what you inherit

- PIM, GDAP and standing admin access in the MSP world

- The most common finding: a shared global admin per tenant with its password in the documentation

- What to check first when you audit a tenant

- Business Premium, Secure Score and what small businesses really need

Chapters

00:00 Welcome: Maurice Daly and Lewis Barry

04:02 Security is the same for every vertical

09:34 What MSPs get wrong: start with Entra

13:05 Drift across hundreds of tenants

18:37 PIM and standing admin access

21:19 GDAP and shared admin accounts

24:21 First finding in a tenant audit

28:02 SMB budgets and Business Premium

29:57 Is Secure Score useful?

32:03 Takeaway: go talk to people

Guests

Maurice Daly – Senior Security Architect, Patch My PC; Microsoft MVP

Workplace Ninja Summit 2026: Surviving Microsoft Security at Scale (Tue 15 Sep 11:10, Glassaal, with Lewis) · Mastering Entra ID PIM (Thu 17 Sep 08:30, Halle 36.3, with Jan Ketil Skanke) · Autopilot Unlocked (Wed 16 Sep 15:50, Glassaal, with Keeran Mistry)

Lewis Barry – Intune MVP, Inforcer

Workplace Ninja Summit 2026: Surviving Microsoft Security at Scale (Tue 15 Sep 11:10, Glassaal, with Maurice) · The MSP Challenge of Microsoft 365 Security at Scale (Mon 14 Sep 13:15, Community stage)

Hosts

Frans Oudendorp & Kenny Buntinx

Recorded at Workplace Ninja Summit 2026 in Baden, Switzerland.

Follow the Workplace Ninja Summit

Website: https://summit.wpninjas.global

LinkedIn: https://www.linkedin.com/company/wpninjasummit

X: https://x.com/wpninjasummit

Instagram: https://www.instagram.com/wpninjasummit/

#WPNinjaSummit #MSP #Microsoft365

Patches are bigger and there's no time left for slow rings. Andy Rivas (Microsoft, Delivery Optimization) and Andreas Hammarskjöld (2Pint Software) on getting content to devices fast without breaking the network.

In this episode

- Why the internet isn't an unlimited source of bandwidth, and where LEDBAT came from

- Patching at AI speed: why waiting for deployment rings no longer works

- What changed in Connected Cache: HTTPS content for Intune apps and Teams

- Download speed, not just bandwidth, from the oil rig to the coffee shop

- Is peer-to-peer still worth it when everything comes from a CDN?

- The worst misconfigurations, like one global Wi-Fi network peering across the world

- Using an agent to help design Delivery Optimization and Connected Cache

- Rebuilding devices in place after an incident

Chapters

00:00 Welcome: Andy Rivas and Andreas Hammarskjöld

02:47 Their joint session

04:20 How much bandwidth is wasted?

05:59 Patching at AI speed

09:08 What changed in Connected Cache

14:24 Is peer-to-peer still worth it?

16:37 Common misconfigurations

20:13 An agentic approach to DO design

24:17 Content delivery in a disaster

25:58 One metric: update velocity

Guests

Andy Rivas – Microsoft, Delivery Optimization and Connected Cache

Workplace Ninja Summit 2026: Delivery Optimization state of the union (Mon 14 Sep 16:20, Halle 36.1, with Andreas) · Smarter DO and MCC Deployment: An Agentic Approach (Wed 16 Sep 11:10, Glassaal, with Ken Goossens)

Andreas Hammarskjöld – Co-founder, 2Pint Software

Workplace Ninja Summit 2026: DeployR (Tue 15 Sep 11:10, Community stage, with Michael Niehaus) · IT disaster bootcamp (Wed 16 Sep 13:10, Glassaal, with Mikael Nyström)

Hosts

Frans Oudendorp & Peter Daalmans

Recorded at Workplace Ninja Summit 2026 in Baden, Switzerland.

Follow the Workplace Ninja Summit

Website: https://summit.wpninjas.global

LinkedIn: https://www.linkedin.com/company/wpninjasummit

X: https://x.com/wpninjasummit

Instagram: https://www.instagram.com/wpninjasummit/

#WPNinjaSummit #DeliveryOptimization #ConnectedCache

Vendor baselines are written by security people, not by the admins who run them. James Robinson (OpenIntuneBaseline) and Kenneth van Surksum (Conditional Access baseline) on building baselines people can understand, test and maintain.

In this episode

- Why James built the OpenIntuneBaseline, and what he learned working with CIS

- How a community baseline stays trustworthy: GitHub, issues and feedback

- Keeping up with constant change, and why structure and versioning beat 200 ad-hoc policies

- Designing compliance policies: grace periods, user notifications, and feeding Conditional Access

- Rolling out safely with deployment rings and documented exceptions

- Why the OpenIntuneBaseline instead of the built-in Intune security baseline

- Configs to clean up: local password compliance and old custom CSPs

Chapters

00:00 Welcome: James Robinson and Kenneth van Surksum

02:24 Why vendor baselines fall short

04:54 Keeping a community baseline trustworthy

08:45 Why these baselines exist

11:02 Is Intune hard, or the defaults?

15:55 Designing compliance policies

18:20 Testing safely with rings

22:47 OIB vs the built-in baseline

29:38 Configs that shouldn't be there

31:33 Nothing is set and forget

Guests

James Robinson – Intune and Windows MVP, Threatscape; creator of the OpenIntuneBaseline

Workplace Ninja Summit 2026: OpenIntuneBaseline 101 (Mon 14 Sep 16:20, Halle 36.2)

Kenneth van Surksum – Modern workplace consultant, Secure At Work

Workplace Ninja Summit 2026: Compliance Policies at Scale (Thu 17 Sep 11:10, Halle 36.2) · What's Next After Phishing-Resistant MFA (Wed 16 Sep 11:10, Halle 36.3, with Erik Loef)

Links

OpenIntuneBaseline: https://openintunebaseline.com/

Conditional Access baseline: https://github.com/kennethvs/cabaseline202510

Hosts

Frans Oudendorp & Kenny Buntinx

Recorded at Workplace Ninja Summit 2026 in Baden, Switzerland.

Follow the Workplace Ninja Summit

Website: https://summit.wpninjas.global

LinkedIn: https://www.linkedin.com/company/wpninjasummit

X: https://x.com/wpninjasummit

Instagram: https://www.instagram.com/wpninjasummit/

#WPNinjaSummit #MicrosoftIntune #ConditionalAccess

glueckkanja runs managed services on Microsoft's stack, and builds products when Microsoft leaves a gap. CEO Christian Kanja and Stefan Schoenleber on SCEPman, Autopilot Monitor and why the community is their main audience.

In this episode

- Why the name became glueckkanja

- Why glueckkanja focuses on community events

- Managed Entra, Intune, SOC and Azure services, and why products came out of them

- The products: Intune extensions, Autopilot Monitor, SCEPman and RADIUS as a service

- Retiring the last on-prem Exchange server that only exists for scanners and old SMTP

- First try to get Microsoft to fix a gap, then build it

- A sneak peek at the next identity product

Chapters

00:00 Welcome: Christian Kanja and Stefan

01:03 Meet glueckkanja

02:12 The name change

03:07 Why community matters

04:09 Managed services and products

06:10 The product portfolio

08:38 Retiring the last Exchange server

10:08 SCEPman and Microsoft's own PKI

13:46 What's at the booth

15:43 What's next: identity

Guests

Christian Kanja – Founder and CEO, glueckkanja

Stefan Schoenleber – Companion products (sales, marketing, customer support), glueckkanja

Workplace Ninja Summit 2026: Live NAC build with Intune (Wed 16 Sep 13:10, Community stage, with Constantin Heinzler)

glueckkanja at the summit

Fabian Bader, Christopher Brumm, Constantin Heinzler, Stefan Schoenleber and Oliver Kieselbach

Hosts

Frans Oudendorp & Jose Schenardie

Recorded at Workplace Ninja Summit 2026 in Baden, Switzerland.

Follow the Workplace Ninja Summit

Website: https://summit.wpninjas.global

LinkedIn: https://www.linkedin.com/company/wpninjasummit

X: https://x.com/wpninjasummit

Instagram: https://www.instagram.com/wpninjasummit/

#WPNinjaSummit #glueckkanja #SCEPman

Agents now live in the cloud, in apps and on endpoints. Heena Macwan, Venkata Pampana and Zach Dvorak from the Microsoft Intune team explain how to discover, govern and secure them, and why it starts with a healthy, managed estate.

In this episode

- The keynote's message: AI changes the admin's job, and agents are everywhere

- Why security and IT are merging as attacks speed up

- Is an agent an app or a user? Why Entra agent identities matter, and how Conditional Access extends to agents acting on a user's behalf

- Project Perception and the multi-agent pattern behind it

- Discovering local agents with the Intune properties catalog: app inventory plus the local AI agent entity

- What an agent can actually access, and why you have to protect the full stack

- Keeping apps current with Enterprise App Management and automatic app updates

- What to put on your CISO's agenda

Chapters

00:00 Welcome: Heena, Venkata and Zach

03:27 The keynote: AI changes the job

04:39 Agents are everywhere

08:48 Is an agent a user or an app?

11:44 Project Perception explained

14:24 Discovering local agents with Intune

16:08 What can an agent access?

17:41 Apps, updates and exposure

21:26 Agents as managed apps?

25:48 What to tell your CISO

Guests

Heena Macwan – Microsoft Intune (apps and app lifecycle)

Workplace Ninja Summit 2026: Cloud-Native Windows (Thu 17 Sep 13:10, Glassaal) · From deployment to defense (Mon 14 Sep 16:20, Glassaal)

Venkata Pampana – Architect, Microsoft Intune (AI and data platforms)

Workplace Ninja Summit 2026: Keynote: Rethinking the Endpoint (Mon 14 Sep 10:00) · Project Perception / Adaptive Defense (Thu 17 Sep 09:50) · Questions your CISO is asking about security for AI (Thu 17 Sep 14:30, Trafohall)

Zach Dvorak – Product Manager, Microsoft Intune (security for AI)

Workplace Ninja Summit 2026: Questions your CISO is asking about security for AI (Thu 17 Sep 14:30, Trafohall)

Hosts

Frans Oudendorp & Mirko Colemberg

Recorded at Workplace Ninja Summit 2026 in Baden, Switzerland.

Follow the Workplace Ninja Summit

Website: https://summit.wpninjas.global

LinkedIn: https://www.linkedin.com/company/wpninjasummit

X: https://x.com/wpninjasummit

Instagram: https://www.instagram.com/wpninjasummit/

#WPNinjaSummit #MicrosoftIntune #AIAgents

Why does a commercial vendor keep giving tools away? Ben Ward, Field CTO UK & Ireland at Recast Software, on Right Click Tools Community, OSDCloud and why application management is still the hard part.

In this episode

- Why Recast has sponsored the summit and keeps coming back

- Free community tools like Right Click Tools Community Edition and OSDCloud, and what Recast gets back from them

- The problem customers call about most: application management that never shows up as a budget line

- The Recast portfolio, from Right Click Tools to Application Workspace and OSDCloud

- What's coming in OSDCloud, and the question of community licensing

- Why Windows is the easy part and applications are snowflakes

Chapters

00:00 Welcome: Ben Ward

01:25 Meet Recast Software

02:40 Why Recast keeps sponsoring

03:38 Free community tools

05:26 Why customers call: app management

06:57 The Recast portfolio

09:42 OSDCloud and licensing

11:56 Applications are snowflakes

Guest

Ben Ward – Field CTO UK & Ireland, Recast Software

Recast at the summit

David Segura – What's new in OSDCloud Community Edition (Tue 15 Sep 15:50, Halle 36.3) · New OSDeploy Tools (Mon 14 Sep 15:00, Trafohall)

Nico Zieck – What 100 IT Pros Told Us About the Modern Workspace (Mon 14 Sep 13:40, Halle 36.1)

Hosts

Frans Oudendorp & Jose Schenardie

Recorded at Workplace Ninja Summit 2026 in Baden, Switzerland.

Follow the Workplace Ninja Summit

Website: https://summit.wpninjas.global

LinkedIn: https://www.linkedin.com/company/wpninjasummit

X: https://x.com/wpninjasummit

Instagram: https://www.instagram.com/wpninjasummit/

#WPNinjaSummit #RecastSoftware #AppManagement

Why do Windows updates and device recovery belong in one conversation? Lia Vargas (Windows recovery) and Mounica Battula (Windows Autopatch) from Microsoft explain how they keep devices current, and what happens when an update goes wrong.

In this episode

- Why update management and recovery are two halves of the same device lifecycle

- What the Windows team changed after the July 2024 outage, and how Quick Machine Recovery delivers fixes through Windows Update

- What happens when a device can't reach the network, and where Windows 365 Reserve fits

- The recovery escalation ladder and Microsoft's new Windows device recovery framework blog

- The customer finding that surprised the team: most admins block end users from their BitLocker recovery key

- How Autopatch update readiness checks work at three levels, including hotpatch

- Why Feedback Hub feedback really gets read every week

Chapters

00:00 Welcome: Lia Vargas and Mounica Battula

02:48 Autopatch and Windows recovery teams

05:04 Why updates and recovery belong together

07:42 Quick Machine Recovery after July 2024

10:26 When a device can't connect

12:28 The recovery escalation ladder

13:40 Cloud-managed, hybrid and on-prem

17:38 Surprise: BitLocker keys and self-service

19:43 Ask Windows Anything and one admin pane

22:16 Autopatch update readiness checks

24:25 One ask: use Feedback Hub

Guests

Lia Vargas – Product Manager, Windows device recovery, Microsoft

Workplace Ninja Summit 2026: From managing updates to recovery (Tue 15 Sep 15:50, Trafohall) · Ask Windows Anything panel (Tue 15 Sep 17:00, Halle 36.2)

Mounica Lakshmi Sai Battula – Senior Product Manager, Windows Autopatch, Microsoft

Workplace Ninja Summit 2026: From managing updates to recovery (Tue 15 Sep 15:50, Trafohall) · Ask Windows Anything panel (Tue 15 Sep 17:00, Halle 36.2)

Hosts

Frans Oudendorp & Kenny Buntinx

Recorded at Workplace Ninja Summit 2026 in Baden, Switzerland.

Follow the Workplace Ninja Summit

Website: https://summit.wpninjas.global

LinkedIn: https://www.linkedin.com/company/wpninjasummit

X: https://x.com/wpninjasummit

Instagram: https://www.instagram.com/wpninjasummit/

#WPNinjaSummit #WindowsAutopatch #WindowsRecovery

Most breaches don't need clever hacking: someone logs in with real credentials. Sami Laiho and Mikael Nyström (Truesec incident response) on why, what to do in the first hour, and which security measures are pure theater.

In this episode

- Why 'they don't hack, they log in' is how most incidents really start

- Windows 11 isn't secure by default until you configure and harden it

- Attackers specialise in one weakness and try it everywhere

- The first hour after the phone rings: assume breach, don't reboot, pull cables, cut outbound internet

- A recovery plan fits on one page, and IT needs a 'wartime' mode

- The controls that matter most: privileged access workstations, no password reuse, no admin rights for developers

- Why remote tools are risky and RDP gives you logs

- Security theater: BitLocker as your main control and expensive 'AI' firewalls

Chapters

00:00 Welcome: Sami Laiho and Mikael Nyström

05:02 They don't hack, they log in

07:35 Is Windows 11 secure by default?

16:19 The first hour after the call

20:09 A recovery plan on one page

22:26 One control: separate admin devices

23:53 Admin rights and developers

28:56 Security theater

33:08 Why does your DC need internet?

36:52 The hilarious history of Windows

Guests

Sami Laiho – Microsoft MVP, Adminize

Workplace Ninja Summit 2026: 11 Ways to Hack Windows 11 (Tue 15 Sep 14:30, Trafohall) · Hilarious History of Windows (Tue 15 Sep 17:00, Trafohall) · Keynote: Cybersecurity from Disabler to Enabler (Wed 16 Sep 09:50, Trafohall)

Mikael Nyström – Incident response (CSIRT), Truesec

Workplace Ninja Summit 2026: IT disaster bootcamp (Wed 16 Sep 13:10, Glassaal, with Andreas Hammarskjöld) · You Don't Get Hacked — They Log In (Thu 17 Sep 13:10, Trafohall)

Hosts

Frans Oudendorp & Peter Daalmans

Recorded at Workplace Ninja Summit 2026 in Baden, Switzerland.

Follow the Workplace Ninja Summit

Website: https://summit.wpninjas.global

LinkedIn: https://www.linkedin.com/company/wpninjasummit

X: https://x.com/wpninjasummit

Instagram: https://www.instagram.com/wpninjasummit/

#WPNinjaSummit #CyberSecurity #IncidentResponse

Itay Peled (Project Perception) and Yuri Diogenes (Defender for Cloud) on the two sides of AI in security: using AI to defend, and securing the AI everyone is deploying. Recorded live at Workplace Ninja Summit 2026 with Frans Oudendorp and Alex Verboon.

In this episode

- Why "AI for security" and "security for AI" are different problems that you can't solve separately

- Exposure management for agents: an agent that was never meant to be internet-facing can still be reachable through an attack path

- Prompt injection and indirect prompt injection as the big threat to agents, and why MITRE ATLAS is worth knowing

- How attackers use AI today: more scale, and digging deeper than they could before

- Agent sprawl: start with an inventory through AI security posture management, and give every agent an identity in Entra so Conditional Access applies

- Agent 365 as the control plane, Defender as the security view, and why data classification has to be in place before you point an agent at SharePoint

- Project Perception is read-only today: it recommends and explains, and a human takes the action

- Careers: admins and analysts won't be replaced but will need new skills, and why soft skills and in-person networking still matter

Chapters

00:00 Welcome: Itay Peled and Yuri Diogenes

01:52 AI for security vs. security for AI

04:55 Exposure management for AI agents

06:37 Prompt injection and MITRE ATLAS

09:13 How attackers use AI today

10:24 Agent inventory and agent identities

13:07 Agent 365, Defender and data protection

17:55 Human in the loop: when the agent is wrong

19:08 Will AI replace admins and analysts?

25:06 Yuri's 35 books, soft skills and networking

29:56 What Itay wants asked at the AMA

Guests

Itay Peled – Microsoft Security Research, working on Project Perception, Microsoft's agentic SOC

Workplace Ninja Summit 2026: Project Perception / agentic SOC · Threat landscape · Microsoft Security AMA

Yuri Diogenes – Microsoft, customer experience engineering for Defender for Cloud and exposure management

Workplace Ninja Summit 2026: AI-SPM & Threat Detection · Proactive Security Posture Management

Hosts

Frans Oudendorp & Alex Verboon

Recorded at Workplace Ninja Summit 2026 in Baden, Switzerland.

Follow the Workplace Ninja Summit

Website: https://summit.wpninjas.global

LinkedIn: https://www.linkedin.com/company/wpninjasummit

X: https://x.com/wpninjasummit

Instagram: https://www.instagram.com/wpninjasummit/

#WPNinjaSummit #AISecurity #MicrosoftDefender

The Ninja BE organizing team — Nicky, Kenny, and Dieter — take the stage to explain what the Ninja BE user group is all about: its mission, community, and what members can expect from future events.

📍 Recorded live at the Ninja BE User Group Event, June 4, 2026 (Belgium)

#NinjaBE #UserGroup #Community #ITCommunity #Belgium