Microsoft Security Episodes

Quick answer: AI transformation leadership with Areti Iles is covered in this M365 FM episode with a practical focus on how it works, where it fits, and the architecture, security, governance, or operational choices that matter in real Microsoft environments. In this episode of the M365 FM Podcast, Mirko Peters welcomes Areti Iles, Microsoft MVP, Head of Professional Services at Telefonica Tech’s AI Business Solutions Division, community leader, mentor, conference organizer, and one of the most...

"The Model Is the Vulnerability" explains that the biggest security risk in Microsoft Copilot is not the AI itself, but the data, identities, and permissions the model can access. Copilot amplifies existing security weaknesses by making enterprise information easier to discover, summarize, and expose at scale. The article emphasizes that Copilot does not create new permissions. Instead, it operates within existing Microsoft 365 access controls. If organizations have excessive privileges, outdated permissions, poor governance, or weak identity management, AI will surface those problems faster and with greater impact. To reduce risk, the article recommends an identity-first security model built on Microsoft Entra ID and Zero Trust principles. Every user, device, application, and request should be continuously verified rather than automatically trusted. Key controls include Multi-Factor Authentication (MFA), Conditional Access, least-privilege access, Privileged Identity Management…

In this episode of M365.fm, host Mirko Peters explores the hidden cost behind many enterprise AI initiatives: what he calls the “Copilot Tax.” While organizations often focus on licenses, adoption metrics, and productivity gains, the real challenge lies in the growing operational complexity, governance overhead, and architectural debt created when AI is deployed into environments that were never designed for probabilistic systems. The episode argues that Microsoft Copilot is not simply another software feature. It changes how decisions are made, how information is interpreted, and how accountability works inside the enterprise. Traditional Microsoft 365 environments are built around deterministic workflows where actions are traceable and predictable. AI systems operate differently, generating outputs based on context, inference, and probability, making governance, auditing, and risk management significantly more difficult. Listeners learn why many AI strategies unintentionally s…

Microsoft 365’s built-in redundancy keeps services running, but it does not guarantee business recovery after ransomware, insider threats, or accidental deletion. This article explains why many organizations wrongly assume synchronization equals protection, when in reality corrupted or deleted data can spread instantly across the environment. The core argument is that traditional backup strategies are no longer enough in modern cloud environments. Businesses need an isolated vault architecture — a logically separated and immutable recovery layer that cannot be compromised by the same identities, permissions, or attack paths affecting production systems. The article highlights how attackers increasingly target backup systems first, making “connected backups” a major weakness. A secure recovery strategy therefore requires isolation, immutability, strict access separation, and clean recovery points that survive tenant-wide compromise. It also emphasizes that resilience is not ju…

Enterprise governance for Microsoft Copilot is no longer optional. As AI becomes deeply integrated into Microsoft 365, organizations must rethink how they manage security, compliance, permissions, and operational control. Traditional governance models were designed for static collaboration environments, but Copilot changes the landscape by turning existing data into instantly accessible intelligence. The core message across M365.fm discussions is clear: Copilot does not create governance problems — it exposes the ones already hidden inside the organization. A major challenge for enterprises is oversharing and uncontrolled access to files, Teams, SharePoint sites, and sensitive information. Copilot can surface content users already have permission to access, which means weak governance structures become visible immediately. Organizations therefore need strong identity management, role-based access controls, sensitivity labels, lifecycle management, and continuous auditing before sca…

In this episode of the m365.fm podcast, Mirko Peters speaks with Microsoft MVP and cloud security expert Martin Dimovski about securing AI workloads and MLOps environments in Microsoft Cloud. The conversation focuses on why AI security must be treated as a core business requirement instead of an afterthought. Martin explains the growing risks organizations face as they rapidly deploy AI agents, large language models, APIs, and cloud-native AI solutions without fully understanding the security implications. The episode highlights how AI introduces new attack surfaces while also amplifying existing cybersecurity weaknesses. A major theme is “secure-by-design” architecture. Martin stresses that security should start during the planning and design phase, not after deployment. Topics include threat modeling, identity protection, secure pipelines, infrastructure hardening, API security, and governance. He emphasizes that security teams should work alongside developers and DevOps teams…

In this episode of the m365.fm podcast, host Mirko Peters speaks with cybersecurity expert Viktor Hedberg about the importance of securing enterprise environments through Active Directory (AD) tiering and privileged access management. The discussion explores how attackers commonly target privileged accounts to move laterally through corporate networks and why traditional “flat” admin models are no longer sufficient. Viktor explains the concept of AD tiering, where administrative privileges are separated into security tiers to reduce the blast radius of compromised credentials. He also highlights the role of privileged access workstations (PAWs), just-in-time administration, and strong identity protection practices. The episode covers real-world attack scenarios, lessons learned from incident response engagements, and practical recommendations for organizations running hybrid Microsoft environments. Key themes include reducing standing privileges, enforcing multi-factor authentic…

“AI Meets Security” is a deep-dive conversation between Mirko Peters and Microsoft Senior Product Manager Danilo Nogueira about how AI is reshaping enterprise security, governance, and compliance. The episode explains that the biggest challenge with Microsoft Copilot and AI adoption is not the technology itself, but the hidden weaknesses already existing inside many Microsoft 365 environments. Danilo highlights that oversharing in SharePoint, weak permissions, poor governance, and missing classification policies become far more dangerous once AI can instantly surface information through natural language prompts. Organizations often believe they are “AI ready” because they purchased licenses, but true readiness requires understanding data access, governance structures, and organizational behavior. A major focus is Microsoft Purview, which Danilo compares to a “baby monitor” for enterprise data. Instead of blocking everything, modern security should focus on monitoring, visibility…

“Automating Azure Securely” explores how organizations can modernize Azure automation without creating hidden security risks. The core message is that automation is no longer optional in large Microsoft cloud environments, but poorly designed automation can quickly become a major attack surface. The episode explains that many companies still rely on outdated service accounts, excessive permissions, hardcoded credentials, and unmanaged scripts that silently weaken their Azure security posture. The discussion highlights how secure automation should be built around Zero Trust principles, least privilege access, identity governance, and modern authentication methods such as managed identities and Microsoft Graph integrations. Instead of giving automation tools broad tenant-wide permissions, organizations should isolate workloads, scope permissions tightly, and continuously monitor automated actions. A major focus is the transition away from legacy AzureAD and MSOnline modules toward…

In this episode of the M365.fm podcast, Microsoft MVP Alan Cox joins us to discuss how organizations can securely adopt Microsoft 365 Copilot using Microsoft Purview, Data Loss Prevention (DLP), and Insider Risk Management. As AI becomes increasingly integrated into daily work, protecting sensitive business data while enabling productivity is becoming a major priority for IT and security teams. Alan explains how Microsoft Purview helps organizations manage data governance, reduce oversharing risks, and apply security controls that work alongside Microsoft 365 Copilot. The conversation explores how DLP policies can help prevent sensitive information from being exposed through AI-powered experiences, how Insider Risk Management can identify potentially risky user behavior, and why adaptive protection is changing the way businesses approach security and compliance in Microsoft 365. Alan also shares practical guidance around Copilot readiness, governance strategies, compliance co…

In this episode of the M365.fm podcast, Carina de Vries shares practical strategies for making AI adoption successful inside organizations and turning Microsoft Copilot into a tool employees actually use every day. Drawing from her own personal journey with AI and years of experience in user adoption, she explains why most AI rollouts fail: companies focus too much on the technology and not enough on the real problems employees are trying to solve. The conversation explores how organizations can move from experimentation to measurable productivity within 90 days by focusing on small, repeatable habits instead of overwhelming users with one-time training sessions. Carina highlights the importance of trust, confidence, and behavior change, explaining that successful AI adoption starts with understanding user needs, daily workflows, and business outcomes before introducing tools like Microsoft Copilot or ChatGPT. The episode also dives into the challenges companies face when employ…

Your Microsoft 365 automation environment is probably running on borrowed identity. In this episode of the M365FM Podcast, we expose one of the biggest hidden risks inside modern cloud architecture: enterprise workflows tethered to personal user accounts. It starts innocently enough. An engineer builds a Power Automate flow, connects a Logic App, configures a Power BI refresh, or deploys a SharePoint integration using their own credentials because it is fast and convenient. But the moment that p...

In this episode of the M365.FM Podcast, the discussion focuses on a critical shift happening in cloud security: the collapse of the traditional network perimeter. The episode explains why Azure SQL firewall rules, static IP allowlists, VPN-based trust models, and long-standing “inside the network equals safe” assumptions are no longer effective in modern enterprise environments. Instead of attacking infrastructure directly, modern attackers increasingly bypass perimeter controls through compromised identities, stolen credentials, over-privileged service principals, token abuse, and lateral movement inside trusted environments. The episode argues that many organizations still operate Azure SQL deployments using outdated security patterns designed for traditional datacenters rather than cloud-native systems. While companies continue relying on firewall rules, trusted VNets, and static connection methods, modern workloads constantly move across APIs, pipelines, automation platforms, A…

In this episode of the m365.fm podcast, Mirko Peters explores why traditional AI security testing is no longer enough in modern enterprise environments. The discussion focuses on “red teaming” for multi-model AI systems, especially in highly regulated industries like finance, where multiple AI models, copilots, APIs, and automation layers interact with each other. The episode explains how manual testing methods fail because AI systems behave differently depending on context, chained prompts, integrations, memory, and user behavior. A model that appears secure in isolation can become vulnerable once connected to other systems or autonomous workflows. Mirko highlights that modern attacks are no longer simple prompt injections — they are multi-step, adaptive, and often invisible until damage has already occurred. A key theme is that organizations must stop treating AI as a chatbot and instead view it as an operational decision system with real business impact. The episode breaks do…

In this episode of the M365 FM Podcast, Mirko Peters explains why traditional FinOps and Azure cost management approaches fail in modern cloud environments. Most organizations still rely on dashboards, alerts, and monthly reviews, but by the time overspending appears in reports, the expensive resources already exist and the cleanup process has already become costly and political. The episode argues that Azure Policy should not be treated as a passive compliance or audit tool. Instead, it should act as a real-time enforcement engine directly in the Azure Resource Manager deployment path. This allows organizations to block waste before resources are created, rather than documenting problems afterward. Mirko breaks down how Azure Policy actually works, including deny, modify, append, and deployIfNotExists behaviors, and explains why many companies misuse policy by leaving it permanently in audit mode. He highlights common governance failures such as unmanaged exemptions, weak landi…

In this episode of the M365 FM Podcast, Åsne Holtklimpen joins Mirko Peters to discuss the real challenges behind Microsoft Copilot adoption and AI readiness in Microsoft 365 environments. The core message is clear: Copilot does not create security problems — it exposes the governance and security gaps that already exist inside organizations. The conversation focuses on common issues such as overshared SharePoint sites, outdated permissions, forgotten Teams channels, uncontrolled data sprawl, and missing governance strategies. Åsne explains how many organizations rushed into cloud collaboration during the pandemic without proper structure, and AI tools now make these weaknesses far more visible. A major part of the episode highlights the importance of Microsoft Purview, sensitivity labels, Data Loss Prevention (DLP), Conditional Access, and Zero Trust principles. These tools help organizations classify sensitive information, secure access, and prevent Copilot from exposing confide…

Identity used to revolve around corporate networks, managed devices, and centralized directories. But that model no longer works in a world where customers, partners, contractors, AI agents, and automated workflows constantly move across systems and organizations. In this episode, Mirko Peters explains why modern identity is no longer just a security problem — it has become a business growth, governance, and digital trust challenge. The conversation explores the “death of the perimeter” and how traditional identity systems create friction through duplicate accounts, passwords, onboarding delays, and isolated identity silos. That friction impacts customer conversion, support costs, partner onboarding speed, and overall business agility. Mirko breaks down the shift from account-centric identity to claim-centric identity, where organizations focus less on storing accounts and more on verifying trusted claims when needed. The episode explains how passkeys, verifiable credentials, an…

In this episode of the M365.fm podcast, the discussion focuses on one of the biggest hidden risks in Microsoft Copilot environments: prompt injection attacks. The episode explains that the real security problem is not weak prompts or missing filters, but the architecture behind how AI models process information. Modern AI systems like Microsoft Copilot retrieve data from multiple Microsoft 365 sources such as emails, SharePoint files, chats, and forms. If malicious instructions are hidden inside that content, Copilot can unknowingly treat them as trusted instructions. The episode highlights how attacks like EchoLeak and ShareLeak demonstrated that attackers do not need direct access to the AI system itself. Instead, they can poison the surrounding context by embedding malicious payloads into documents or messages that Copilot later retrieves. Once the model processes those inputs, sensitive information may be exposed or workflows may be manipulated. Traditional security approach…

This episode explores how deepfake-enabled Business Email Compromise (BEC) attacks are becoming more convincing and dangerous for organizations. Traditional trust signals like email addresses, writing style, or even voice messages are no longer reliable because attackers can now imitate executives and employees with AI-generated content. The episode explains that organizations must move away from trust based on appearance and instead adopt identity verification as a core security strategy. Verified ID systems, strong identity governance, and cryptographic proof of identity are presented as the future foundation for secure communication and approval workflows. A major focus is the risk around financial approvals, executive requests, and sensitive business operations. The discussion highlights how attackers exploit urgency, authority, and familiarity to bypass human judgment. Even experienced employees can be manipulated when deepfake audio, video, or realistic email impersonation…

The episode argues that Power Platform itself is not the real risk—poor governance is. Many organizations blame low-code tools for creating chaos, but the issue actually comes from a lack of structure around how those tools are used. Shadow IT existed long before Power Platform, through tools like Excel, Access, and macros. What Power Platform does is make this type of development faster, more visible, and easier to scale. This exposes existing weaknesses in how organizations manage and control user-built solutions. The main challenge is that low-code development moves much faster than traditional IT governance models. Apps and automations can be created and changed quickly, often without clear ownership, monitoring, or lifecycle management. This leads to risks such as unclear data flows, compliance issues, and fragile business processes. The key distinction highlighted is between security and governance. Power Platform is secure by design, but governance determines how safel…

This episode argues that sensitivity labels are widely misunderstood and often give organizations a false sense of security. While they appear to enforce governance, in reality they are static, incomplete, and poorly maintained—making them ineffective in dynamic, AI-driven environments. The core issue is not the labeling technology itself, but the way organizations structure and manage their data. Most environments suffer from fragmented information spread across Teams, SharePoint, and other systems, creating silos that block both collaboration and effective AI usage. As a result, AI tools like Copilot cannot access the right data and are forced to generate outputs based on incomplete or outdated information. This leads to what the episode describes as an “AI rework loop”: AI produces confident but incorrect results, and employees must spend significant time validating and fixing them. In many cases, a large portion of AI-generated work requires correction, eroding the expected …

In this episode of the M365 FM Podcast, the traditional role of the Microsoft 365 admin is challenged. Instead of acting as gatekeepers who manually approve, control, and fix everything, admins must shift toward designing automated systems that govern access, lifecycle, and security at scale. The episode argues that manual control does not scale in modern cloud environments and often creates bottlenecks, risk, and hidden dependencies. The “death of the admin” isn’t about losing relevance—it’s about evolving into an architect of policies, automation, and guardrails that enable the business to move faster without constant intervention.

This episode explains why Power Automate often creates more problems than it solves when used at scale. While it works well for simple, user-driven tasks, it breaks down with complex workflows due to throttling, weak error handling, and limited scalability. The core message: automation doesn’t fix bad processes—it amplifies them. If your system is messy, Power Automate will scale that chaos instead of removing it. The recommended approach is a hybrid model: use Power Automate for lightweight triggers (like user actions) and move heavy, business-critical processing to Azure Logic Apps. This gives you better performance, reliability, governance, and cost control. Bottom line: treat Power Automate as a front-end convenience tool—not a scalable automation engine—and design your architecture accordingly.

This episode explains that treating AI like a simple add-on tool—especially Microsoft Copilot—can quietly create “digital debt” inside organizations. The problem isn’t the AI itself, but the messy, ungoverned Microsoft 365 environments it relies on. Copilot acts as a powerful coworker that instantly exposes all accessible data, meaning existing issues like oversharing, poor structure, and lack of governance become highly visible and amplified. The key message is that AI doesn’t fix broken systems—it scales them. If your environment is chaotic, AI will accelerate that chaos. Without proper data governance, security controls, and clear operating models, companies risk building long-term complexity and risk instead of value. To avoid this “digital debt,” organizations need to focus on fixing their foundations first—clean data, controlled access, and strong governance—before scaling AI adoption.