Practical writing, deployment guides, and community resources for Microsoft 365, security, identity, and the modern workplace.https://natehutchinson.co.uk/en-gbhttps://natehutchinson.co.uk/post/phishing-resistant-mfa-planning-your-passkey-rollout-in-microsoft-365/https://natehutchinson.co.uk/post/phishing-resistant-mfa-planning-your-passkey-rollout-in-microsoft-365/Microsoft is making passkeys the default authentication method in Entra ID, so now is the time to start planning your move to phishing-resistant MFA. This guide covers device-bound vs synced passkeys, Passkey Profiles, Authentication Strengths, Conditional Access, rollout strategy, legacy app considerations and the practical steps to get your Microsoft 365 environment ready.Tue, 11 Aug 2026 00:00:00 GMTEntra IDConditional AccessPasskeysPhishing-ResistantNathan Hutchinsonhttps://natehutchinson.co.uk/post/your-users-are-authenticating-with-what-hunting-down-the-outlook-companion-app/https://natehutchinson.co.uk/post/your-users-are-authenticating-with-what-hunting-down-the-outlook-companion-app/The Microsoft Outlook Companion app quietly registers itself as an MFA method — and most admins don't realise until it's already causing inconsistent auth flows across their user base. In this post, I walk through why I recommend disabling it, why you can't just flip the switch without breaking things, and how to use KQL to identify exactly who's using it before you doMon, 30 Mar 2026 00:00:00 GMTEntra IDAzure ADAzure MFAConditional AccessEmployee OnboardingEntra IDKQLLog AnalyticsMandatory MFAMicrosoft Entra IDUser OnboardingNathan Hutchinsonhttps://natehutchinson.co.uk/post/streamlining-employee-onboarding-with-entitlement-management-part-2/https://natehutchinson.co.uk/post/streamlining-employee-onboarding-with-entitlement-management-part-2/In Part 2, we simulate HR-driven user provisioning with PowerShell, trigger onboarding workflows, and walk through the end-user experience of requesting and receiving access via Entitlement Management. See how approvals, automation, and Access Packages remove the manual workload from IT.Mon, 15 Dec 2025 00:00:00 GMTEntra IDEntra IDIdentity and Access ManagementMicrosoft Entra IDIAMIdentity GovernanceEntitlement ManagementAccess PackagesUser OnboardingEmployee OnboardingPowerShellNathan Hutchinsonhttps://natehutchinson.co.uk/post/streamlining-employee-onboarding-with-entitlement-management-part-1/https://natehutchinson.co.uk/post/streamlining-employee-onboarding-with-entitlement-management-part-1/Learn how Access Packages in Microsoft Entra ID can streamline employee onboarding. This post covers why Access Packages matter, how to structure dynamic groups, and how to build a fully governed Access Package using catalogs, approvals, and lifecycle settings.Wed, 10 Dec 2025 00:00:00 GMTEntra IDAccess PackagesAzure ADEntra IDEntitlement ManagementIAMIdentity GovernanceIdentity and Access ManagementMicrosoft Entra IDNathan Hutchinsonhttps://natehutchinson.co.uk/post/monitoring-azure-access-elevation-in-entra-id/https://natehutchinson.co.uk/post/monitoring-azure-access-elevation-in-entra-id/Learn how to detect when a Global Admin silently elevates their access across all Azure subscriptions using Entra ID, Log Analytics, Azure Monitor, and Defender for Cloud Apps. This guide breaks down why elevation is risky, how the toggle works, and the exact steps to build alerts that keep your Azure environment secure.Fri, 14 Nov 2025 00:00:00 GMTEntra IDSecurityEntra IDCloud SecurityIdentity and Access ManagementAzure MonitorLog AnalyticsNathan Hutchinsonhttps://natehutchinson.co.uk/post/conditional-access-gone-too-far-navigating-zero-trust-edge-cases/https://natehutchinson.co.uk/post/conditional-access-gone-too-far-navigating-zero-trust-edge-cases/When Conditional Access meets Zero Trust, even the best intentions can backfire. In this post, we explore a real-world edge case where strict policy design blocked users from registering MFA—and how a layered policy workaround restored functionality without compromising security.Tue, 15 Jul 2025 00:00:00 GMTEntra IDSecurityEnterpriseEntra IDAzure ADConditional AccessZero-TrustNathan Hutchinsonhttps://natehutchinson.co.uk/post/seamlessly-migrating-from-symantec-endpoint-protection-to-microsoft-defender-for-business/https://natehutchinson.co.uk/post/seamlessly-migrating-from-symantec-endpoint-protection-to-microsoft-defender-for-business/Discover how to migrate from Symantec Endpoint Protection to Microsoft Defender for Business seamlessly with tips and tools!Sat, 11 Jan 2025 00:00:00 GMTDefender XDRIntunePowerShellDefender for EndpointSEPSymantecNathan Hutchinsonhttps://natehutchinson.co.uk/post/the-curious-case-of-the-missing-enterprise-app/https://natehutchinson.co.uk/post/the-curious-case-of-the-missing-enterprise-app/Troubleshooting a missing enterprise app issue in Entra ID during a zero-trust Conditional Access policy rollout with workaround solutions.Sat, 11 Jan 2025 00:00:00 GMTEntra IDSecurityEntra IDDefenderService PrincipalsEnterprise AppsNathan Hutchinsonhttps://natehutchinson.co.uk/post/mastering-the-mfa-mandate-considerations-and-recommendations-to-a-smooth-transition/https://natehutchinson.co.uk/post/mastering-the-mfa-mandate-considerations-and-recommendations-to-a-smooth-transition/Prepare for Microsoft’s mandatory MFA with practical tips on securing accounts, migrating services, and optimizing Conditional Access.Mon, 02 Sep 2024 00:00:00 GMTEntra IDEntra IDConditional AccessManaged IdentityMandatory MFANathan Hutchinsonhttps://natehutchinson.co.uk/post/laps-unleashed-navigating-the-future-of-windows-admin-security/https://natehutchinson.co.uk/post/laps-unleashed-navigating-the-future-of-windows-admin-security/Dive into LAPS for Windows: a game-changer in admin account security. Discovery of the new CSP settings and configurations.Mon, 01 Apr 2024 00:00:00 GMTIntuneModern WorkplaceSecurityMicrosoftIntuneMDMEnterpriseWindowsLAPSNathan Hutchinsonhttps://natehutchinson.co.uk/post/smart-strategies-for-storing-microsoft-entra-logs-in-azure/https://natehutchinson.co.uk/post/smart-strategies-for-storing-microsoft-entra-logs-in-azure/Explore storing Microsoft Entra logs via Azure Monitor, Storage Accounts, and Event Hubs, each offering unique benefits for IT security.Thu, 15 Feb 2024 00:00:00 GMTEntra IDMicrosoft Entra IDEntra IDAzure MonitorAzure Storage AccountLog AnalyticsLog StorageData RetentionIAMMicrosoft SentinelDefender for CloudKQLSecurityComplianceNathan Hutchinsonhttps://natehutchinson.co.uk/post/a-winget-match-made-in-heaven/https://natehutchinson.co.uk/post/a-winget-match-made-in-heaven/Learn how to package and auto-update apps in Intune using community-driven tools, WinTuner and Winget-AutoUpdate-Intune, for an efficient, lThu, 18 Jan 2024 00:00:00 GMTIntuneModern WorkplaceIntuneMDMMicrosoftMicrosoft Endpoint ManagerwingetNathan Hutchinsonhttps://natehutchinson.co.uk/post/getting-started-with-microsoft-entra-private-access/https://natehutchinson.co.uk/post/getting-started-with-microsoft-entra-private-access/Discover Microsoft Entra Private Access: advanced, secure remote access for corporate resources, surpassing traditional VPN limitations.Wed, 03 Jan 2024 00:00:00 GMTEntra IDEntra Private AccessEntra IDGlobal Secure AccessIntuneConditional AccessEnterpriseMicrosoftSecurityNathan Hutchinsonhttps://natehutchinson.co.uk/post/getting-started-with-microsoft-global-secure-access/https://natehutchinson.co.uk/post/getting-started-with-microsoft-global-secure-access/Boost security, speed, and access with Microsoft's Entra Internet for M365. A game-changer!Sun, 22 Oct 2023 00:00:00 GMTEntra IDMicrosoft Global Secure AccessEntra Internet AccessCloud SecuritySecure Access Service Edge (SASE)Zero-Trust Network Access (ZTNA)CASB (Cloud Access Security Broker)Secure Web Gateway (SWG)Firewall as a Service (FWaaS)SD-WAN (Software Defined Wide Area Network)Security Service Edge (SSE)Conditional AccessVPN AlternativesNetwork SecurityMulti-Cloud AccessIdentity and Access ManagementGlobal NetworkNathan Hutchinsonhttps://natehutchinson.co.uk/post/deploying-mde-to-macos/https://natehutchinson.co.uk/post/deploying-mde-to-macos/This guide will get you up and running with MDE for macOS in no time.Tue, 19 Sep 2023 00:00:00 GMTIntuneModern WorkplaceDefenderDeployment GuidesEnterpriseIntuneMDMMicrosoft Endpoint ManagerSecuritymacOSNathan Hutchinsonhttps://natehutchinson.co.uk/post/easily-import-export-and-document-intune-configurations/https://natehutchinson.co.uk/post/easily-import-export-and-document-intune-configurations/Need to bulk import, export or document your Intune configurations, this guide has you covered.Mon, 18 Sep 2023 00:00:00 GMTIntuneModern WorkplaceIntuneMDMMicrosoft Endpoint ManagerMicrosoftPowerShellNathan Hutchinsonhttps://natehutchinson.co.uk/post/sending-email-with-azure-automation-and-managed-identity/https://natehutchinson.co.uk/post/sending-email-with-azure-automation-and-managed-identity/Using Azure Automation Accounts to send scheduled emails, ditch those scheduled tasks and insecure scripts!Mon, 19 Jun 2023 00:00:00 GMTMicrosoft 365Modern WorkplaceEnterprisePowerShellSecurityManaged IdentityAutomationExchange OnlineNathan Hutchinsonhttps://natehutchinson.co.uk/post/deploy-microsoft-teams-on-azure-virtual-desktop-using-intune/https://natehutchinson.co.uk/post/deploy-microsoft-teams-on-azure-virtual-desktop-using-intune/Deploy Microsoft Teams to Azure Virtual Desktop using Intune.Wed, 05 Apr 2023 00:00:00 GMTMicrosoft 365Modern WorkplaceBusinessCollaborationEnterpriseIntuneMDMMicrosoftMicrosoft Endpoint ManagerTeamsAVDAzure Virtual DesktopVDINathan Hutchinsonhttps://natehutchinson.co.uk/post/microsoft-defender-for-identity-deployment-guide/https://natehutchinson.co.uk/post/microsoft-defender-for-identity-deployment-guide/Deployment guide for Microsoft Defender for Identity.Tue, 04 Apr 2023 00:00:00 GMTDefender XDRDeployment GuidesDefender for IdentityDefenderHybridMicrosoftSecurityNathan Hutchinsonhttps://natehutchinson.co.uk/post/getting-started-with-cross-tenant-synchronisation/https://natehutchinson.co.uk/post/getting-started-with-cross-tenant-synchronisation/Cross tenant sync is a feature I've been waiting to see for a while and with the announcement of cross tenant access settings, I knew it...Sun, 05 Feb 2023 00:00:00 GMTEntra IDModern WorkplaceAzure ADBusinessCollaborationEnterpriseMicrosoftMergersAcquisitionsCross tenantNathan Hutchinsonhttps://natehutchinson.co.uk/post/how-to-manage-your-microsoft-edge-enterprise-cloud-site-list-like-a-boss/https://natehutchinson.co.uk/post/how-to-manage-your-microsoft-edge-enterprise-cloud-site-list-like-a-boss/In this article I describe how to enable IE mode on your Intune enabled devices and how you can easily manage a corporate site list!Thu, 01 Dec 2022 00:00:00 GMTIntuneModern WorkplaceBusinessEdgeEnterpriseHybridIntuneMicrosoft Endpoint ManagerIENathan Hutchinsonhttps://natehutchinson.co.uk/post/setting-up-azure-mfa-for-vpn-and-remote-desktop-gateway/https://natehutchinson.co.uk/post/setting-up-azure-mfa-for-vpn-and-remote-desktop-gateway/This article will go into detail on how to configure Azure MFA for access to on-premises VPN and RD Gateway.Fri, 07 Oct 2022 00:00:00 GMTEntra IDSecurityAzure ADAzure MFANathan Hutchinsonhttps://natehutchinson.co.uk/post/deploying-winget-apps-with-microsoft-endpoint-manager-and-auto-update/https://natehutchinson.co.uk/post/deploying-winget-apps-with-microsoft-endpoint-manager-and-auto-update/A brief overview on how you can deploy applications using winget in Microsoft Intune and even keep them updated!Sun, 25 Sep 2022 00:00:00 GMTIntuneModern WorkplaceHybridIntuneMDMMicrosoft Endpoint ManagerPowerShellApp DeploymentwingetupdatesNathan Hutchinsonhttps://natehutchinson.co.uk/post/blocking-web-push-notifications-with-endpoint-manager-and-why-you-should/https://natehutchinson.co.uk/post/blocking-web-push-notifications-with-endpoint-manager-and-why-you-should/Admit it, we've all fallen foul of that annoying (and scary for some) popup that seems to rear it's ugly head after you've spent the last...Fri, 16 Sep 2022 00:00:00 GMTIntuneModern WorkplaceBusinessMDMIntuneMicrosoft Endpoint ManagerSecurityEdgeGoogle ChromeNathan Hutchinsonhttps://natehutchinson.co.uk/post/how-to-make-a-team-or-microsoft-365-group-calendar-accessible-in-outlook/https://natehutchinson.co.uk/post/how-to-make-a-team-or-microsoft-365-group-calendar-accessible-in-outlook/Recently I found myself in a scenario where I needed to quickly and easily access a calendar from a Microsoft Teams group, I didn't think...Sun, 11 Sep 2022 00:00:00 GMTMicrosoft 365Modern WorkplaceBusinessCollaborationPowerShellExchange OnlineNathan Hutchinsonhttps://natehutchinson.co.uk/post/setting-up-azure-ad-connect-cloud-sync-and-does-it-run-on-server-2012/https://natehutchinson.co.uk/post/setting-up-azure-ad-connect-cloud-sync-and-does-it-run-on-server-2012/Microsoft as of August 31 2022 will retire all 1.x versions of Azure AD Connect because they include SQL Server 2012 components. If you...Fri, 26 Aug 2022 00:00:00 GMTEntra IDModern WorkplaceMicrosoftAzure ADHybridNathan Hutchinsonhttps://natehutchinson.co.uk/post/getting-started-with-defender-for-office-365-part-3/https://natehutchinson.co.uk/post/getting-started-with-defender-for-office-365-part-3/In my previous Defender for Office 365 posts I walked through the setup and configuration of threat policies covering each policy type...Mon, 22 Aug 2022 00:00:00 GMTDefender XDRSecurityMicrosoftDefenderDefender for Office 365EmailNathan Hutchinsonhttps://natehutchinson.co.uk/post/use-sharepoint-to-store-document-templates-and-branding-for-use-in-office-apps/https://natehutchinson.co.uk/post/use-sharepoint-to-store-document-templates-and-branding-for-use-in-office-apps/One of the most requested tasks from clients is the ability to distribute document templates for end users to make use of. There are many...Wed, 18 May 2022 00:00:00 GMTMicrosoft 365BusinessMicrosoftModern WorkplacePowerShellSharePointNathan Hutchinsonhttps://natehutchinson.co.uk/post/configuring-mdfc-and-microsoft-sentinel-to-use-the-same-log-analytics-workspace-and-why-you-should/https://natehutchinson.co.uk/post/configuring-mdfc-and-microsoft-sentinel-to-use-the-same-log-analytics-workspace-and-why-you-should/So this week I've had the pleasure of setting up Microsoft Defender for Cloud (MDFC) for a client with a view to onboarded all Azure...Wed, 11 May 2022 00:00:00 GMTSentinel & KQLSecurityMicrosoftSOCDefender for CloudSentinelSIEMNathan Hutchinsonhttps://natehutchinson.co.uk/post/getting-started-with-defender-for-office-365-part-2/https://natehutchinson.co.uk/post/getting-started-with-defender-for-office-365-part-2/In part 1 of our Defender for Office 365 series we talked about licensing, quarantine policies, anti-phishing, anti-spam and anti-malware...Tue, 26 Apr 2022 00:00:00 GMTDefender XDRModern WorkplaceCollaborationSecurityNathan Hutchinsonhttps://natehutchinson.co.uk/post/getting-started-with-defender-for-office-365-part-1/https://natehutchinson.co.uk/post/getting-started-with-defender-for-office-365-part-1/Microsoft Defender for Office 365 (MDO) is one of the modules included within Microsoft's Extended Detection and Response platform (XDR)...Sun, 24 Apr 2022 00:00:00 GMTDefender XDRModern WorkplaceCollaborationNathan Hutchinsonhttps://natehutchinson.co.uk/post/setting-up-shared-channels-in-microsoft-teams/https://natehutchinson.co.uk/post/setting-up-shared-channels-in-microsoft-teams/Collaboration with external partners is becoming more and more the norm, COVID pushed most organisations into the cloud and even helped...Thu, 07 Apr 2022 00:00:00 GMTEntra IDModern WorkplaceBusinessTeamsExternal SharingCollaborationNathan Hutchinsonhttps://natehutchinson.co.uk/post/is-there-still-a-place-for-the-current-microsoft-365-e3-license/https://natehutchinson.co.uk/post/is-there-still-a-place-for-the-current-microsoft-365-e3-license/With the addition of Defender for Business into the Microsoft 365 Business Premium license the gap between it, and Microsoft 365 E3 just...Mon, 14 Mar 2022 00:00:00 GMTMicrosoft 365Modern WorkplaceBusinessSecurityEnterpriseLicensingMicrosoftNathan Hutchinsonhttps://natehutchinson.co.uk/post/defender-for-business-now-available/https://natehutchinson.co.uk/post/defender-for-business-now-available/It's here, the moment we've all been waiting for, Defender for Business is live in tenants using the Microsoft Business Premium license...Tue, 08 Mar 2022 00:00:00 GMTDefender XDRDefender XDRNathan Hutchinsonhttps://natehutchinson.co.uk/post/should-you-still-disable-legacy-sign-in-even-if-using-conditional-access/https://natehutchinson.co.uk/post/should-you-still-disable-legacy-sign-in-even-if-using-conditional-access/It's no secret that Conditional Access is the pillar of any good security plan and one of the best features available as part of the...Tue, 08 Mar 2022 00:00:00 GMTEntra IDMicrosoft Endpoint ManagerModern WorkplacePowerShellSecurityBusinessNathan Hutchinsonhttps://natehutchinson.co.uk/post/how-to-deploy-wallpaper-and-lockscreen-image-to-windows-pro-edition-using-microsoft-endpoint-manager/https://natehutchinson.co.uk/post/how-to-deploy-wallpaper-and-lockscreen-image-to-windows-pro-edition-using-microsoft-endpoint-manager/As most of you may already know the built in configuration settings for deploying a wallpaper and lockscreen image within Microsoft...Wed, 02 Mar 2022 00:00:00 GMTIntuneMicrosoft Endpoint ManagerModern WorkplaceIntuneMDMPowerShellWindows 10Windows 11ProBusinessSharePointNathan Hutchinsonhttps://natehutchinson.co.uk/post/deploying-datto-rmm-as-win32-app-using-microsoft-endpoint-manager/https://natehutchinson.co.uk/post/deploying-datto-rmm-as-win32-app-using-microsoft-endpoint-manager/As most of you reading this article will know there are many different ways to deploy apps using Microsoft Endpoint Manager (MEM), this...Sun, 27 Feb 2022 00:00:00 GMTIntuneWin32 AppsMicrosoft Endpoint ManagerModern WorkplaceMDMIntuneDattoRMMNathan Hutchinson