In this installment of the Graph Activity Log series, we uncover how attackers exploit OAuth app consent to silently access Microsoft 365 data. Using targeted KQL queries and PowerShell automation, this blog shows how to detect, investigate, and respond to these stealthy identity-based threats.
In this blog, we explore how IT admins can leverage WinGet, Microsoft’s Windows Package Manager, to streamline application deployment and updates across Intune-managed devices.
In this installment of our Graph Activity Log series, we’ll provide a practical playbook for using the Graph Activity Log and Kusto Query Language (KQL) to hunt for indicators of document exfiltration.
In this article, Sean McAvinue explores how Microsoft's Multi-Tenant Organizations (MTO) can help make tenant-to-tenant migrations a smoother process for both administrators and end users.
In this article, Thorsten Pickhan covers how to add Direct Routing phone numbers to the internal Teams Phone Number database, how to remove phone numbers, and the benefits of doing so.
In this installment of Practical Teams, we explain what App-Centric Management is, how Integrated Apps work, and how Unified App Management differs from earlier methods.
In this article, we guide you through the process of using the Graph Activity Log and Kusto Query Language (KQL) to hunt for common indicators of mailbox compromise, with useful tips along the way.
The new Purview eDiscovery implementation supports a Graph API. Where there's a Graph API, there are PowerShell cmdlets based on the API. This article explains how to use PowerShell to automate different aspects of eDiscovery cases. PowerShell can't review the items found by searches, but it can handle most of the other processing.
In the first installment of Securing Microsoft 365 with Graph Activity Logs, Mezba Uddin dives into the essentials of the Microsoft Graph Activity Log, what it does, its importance for visibility, and how to get it running to start seeing it's data.
PowerShell scripting becomes far more powerful when you master collections like arrays and hash tables. In this article, we review the basics of standard collection types. Then, walk through additional useful options that leverage other object types available through the .NET Framework.
Calendar events make up user and group calendars. It's possible to create, update, cancel, and remove calendar appointments and meetings, including recurring events, through the Graph API. This article explains how to pass all the properties needed to create and manage events using PowerShell and the Graph APIs.
Any time you allow a third-party application to run in a system you own or control, you’re assuming risk. In this episode of Practical Protection, we discuss how to reduce that risk by managing app consent in Microsoft Entra ID, as well as a few other alternatives.
