Building a Secure Microsoft-First MSP: Intune, Defender & Entra ID at Scale with Albin Klinaku [MVP]

Yeah, welcome back to another edition of the M365FM podcast. The podcast where we talk with Microsoft, MVP's product experts, architects and community leaders who has shaping the future of Microsoft technologies. Today, Skest is someone who doesn't just talk about and for security, he lives it every single day. Arvin Kalin Akuh is a Microsoft, is a Microsoft Intune MVP in security founder and CEO of AdVision SwissAge, a Microsoft focused MSP and MSSP, and recognized expert in Microsoft Intune, Microsoft Defender and Microsoft EntraIT. In this episode, we will go beyond product features and dive into real-world, challenging security, thousands of devices designing modern security baselines, running a security first management service provider and helping organization move from teleditional IT to truly modern cloud first world places. Whatever you are an IT admin strator, consul and security architect, MSP owner, or simply responsible for protecting Microsoft 365 almonds, you are going to find penalty of practical advice in this conversation. I'll be welcome to the M365 podcast. Yeah, hi, thanks for having me. Yeah. So can you tell us a little bit about your journey, especially into the Microsoft ecosystem? Yeah, sure. So yeah, it's really simple. It's not that hard. So I made like school into its land and everything that you need to do. And off that, I made an apprentice in IT administration or just in system engineering as an administrator at the end of the day. And after my apprenticeship, I... Yeah, this is... Yeah, I need... I know the cloud is coming. That was 2020, 2020, I think. Exactly, 2020. And at that particular time, at my employer at that time, we didn't do cloud that much. And I want to do... Or I knew I want to do cloud things. And I knew I wanted to do a lot more M365. And that's where I thought myself, okay, should I just change my employer or should I start something myself and just have a look if it's going well, that's okay, it's great. And if not, I think IT administrators are, yeah, are demand... There is a high demand, especially in Switzerland, so I thought, yeah, if it... If it doesn't figure it out to be, yeah, on my own, then let's... There would be an EC going back to some employer. And yeah, that was like my journey. And I started and I had a lot of time in the beginning because, yeah, you won't have any customers, the customers aren't waiting for you or neither they are thinking like, oh, nice, another provider, another manager's provider who can help me with cloud, they aren't waiting. So I had a lot of time and there started my, yeah, my dedication into modern workplace, into endpoint security. I had my little lab where I, yeah, where I just tested everything I can at the time, everything which was supported at that time in the dual with defender XDR, and tried to go in cloud native. And yeah, it's nearly six years ago. And yeah, now, we are, yeah, I'm running an MSP with 10 people about. And our, yeah, we're a traditional managed service provider, just focusing on the Microsoft ecosystem and a co-managed service provider where we support, yeah, bigger organizations in adopting Microsoft Cloud, yeah, like Azure and try these moving from SCCM to in tune, moving from any other MDM to in tune, but yeah, focus on security at the end of the day. Yeah, when you look back, what were the biggest lessons during the, yeah, your, yeah, a stoner for, for your own company? There are definitely a lot, a lot of lessons learned on the way. You, you, one of, I think, one of the most of, or the biggest lessons I learned is like, there, there, if you're founding an MSP, there, you need to know who is your customer, who one, do you want to serve? And who can you serve the best? So, that's my, my biggest lessons learned there. And because you, you can, I just say it's, it's, it's more like, you're, like, feeling in a stomach, if it's this customer right from your not, and you need to listen to that feeling because you will meet customers who are great, and you will meet customers who, in the beginning, yeah, it's a nice project, but it won't be you, yeah, you won't, the value won't be great because they don't want to implement your strategy for, for example, yeah, just going cloud native, for example, he want to use, for example, not SharePoint, he want to use NextCloud. And those are signs you, you need to, yeah, to understand and to say, okay, is that a customer for us or should I move forward with my, and, and invest my energy in, in other things, yeah. Yeah. What I think it's interesting for, for people, it's, it's, how complicated is it to become a Microsoft's provider? And it's actually, it's not that hard. So, the, the hard thing is to be, yeah, becoming someone in the radar of Microsoft. So, that they acknowledge you as a managed service provider, you do just, just starting, it isn't that hard because you actually, you just need, if you, if you, you're being honest and you just need a laptop or, some computer and you can start, and that's not that hard. So, you can be a Microsoft partner with, but just a company in the back. So, if you found a company in, in America, in Germany, Europe, wherever, and, yeah, you would just, found the company, do all that, things the government wants you to do. And after that, you, you're ready, you can go into the partner center and register as a partner, yeah, you're automatically a Microsoft partner, but becoming a, acknowledge Microsoft, so Microsoft, that Microsoft knows you, that Microsoft, acknowledge your work and all that stuff, that's the hard, part of the thing. That's interesting. And, and how do we, I say, the MVP title help you in your professional life? Yeah, so the MVP title is fairly new to me. I got recognized as an MVP in, in May. So, I, and I'm like, that vision is like, I think more than five years old. So, the title is fairly new to me, but I, if you're an MVP, there is, you, you have some traction, which you wouldn't have otherwise. Let's say that in, in, in that way. And that sure, this helps you a lot with getting to know, in the world direction in Microsoft is heading, and this helps you, yeah, a lot. Yeah, this is, this is interesting. Yeah, a lot of people say that, that's, be awesome to be a Microsoft MVP and that helps a lot. And yeah, let's just jump into the first topic, in tune. How has in tune evolved over the past few years from your perspective? A lot, a lot. And I think it's evolved that fast that a lot of people or organizations don't recognize it, how fast it evolved. For example, the eight armist, which is such strong in our, in the minds of a lot of customers we talk to. And yeah, that's, so those things are, yeah, you see it evolved and you know it evolved, but the organization's who, for example, is the potential customer doesn't know about that. He hears just from another organization. Yeah, we tried in tune, but it takes like ages to deploy policy and they started immediately looking into other, in, to other MDM solutions. And I think, yeah, we need to make more, or yeah, you have to educate, especially as an MVP, I think our job is to educate or to inform, and potential customers or just, yeah, in general, helping the community to know where are the myths, where are the downsides, for example, and what were our strengths of, of in tune. And that's, I think, a really important one. Yeah, he said policy, one out of the first policy you deployed every environment. I think, I think when I started testing with, I think it was like, how can I, how can I let some settings disappear in the control panel? I think there was like one of the, the first things because you see it immediately if it, yeah, if it works or not. So for me was beginning with some obvious things. And before I'm going into like app blocker or something or WDAC and in any other technology. So those, so some appearance things were, were the first things I tested or tried. And how do you build security baselines? So the, the good thing is you, you don't need to build it yourself. So you have, for example, and I know that everyone knows those open into baselines, which is an amazing community project as well. Either you are going with those, which we see a lot of customers, especially or bigger organizations start with those or you start with the, the baselines, which are built into Microsoft Intune. Yeah, you can like talk to a lot of people, some say, yeah, the baselines in the portal are good and some say, no, I won't, would use them. I personally use them, especially at some smaller customers because they are getting you fast off the ground. You could build them yourself. So, but it's just a, yeah, a question of resources, do you have them? Is it a customer willing to pay for that or does it just need basic security to, yeah, get the rate of 80% of the most common attacks, for example. But yeah, and it depends if your organization needs these security levels or whatever. And what separates a good Intune deployment from a great one? Yeah. So, I think to be honest, when we are doing or when I do some infinite assessments or I'm going to a customer and just looking into the deployment is it good? Is it not good? I just go ahead and go into the settings where you see what can be enrolled in the and that tenant. Can a personal device be enrolled into a tenant or is it blocked? And if I see those that it's blocked, that most of the time it's it's more or less good deployment. Or but if I see at that point, like after five minutes being into the tenant, I see it's nothing blocked, everything open. Yeah, then I know it's that's not a good deployment, but yeah, it's like just knowing what you need what your need is and knowing the what most of the time you can see in the configuration if the customer or if the the architecture is with the is it built with the right mindset in the back or is is it like was it a yeah is one trying to just duplicate their old MDM and yeah, that's that's most that that's our that those are times if it's a good deployment or a bad one and a great deployment is for me. If you have on every device security baseline and not just on a group, for example, and those everything is scope to all devices. Have you yeah, have you checked the features or are you using the features you can, for example, just using it for for some application management is not intended. So you should use everything you can in the portal like configuration if you have e3 for example, or e5 and so are using reveredations and so on. So it's more or less do you see the mindset the right mindset behind the configuration so not that is for me a great deployment. But did you see some common miscalfigurations often or yeah, so it's we we see a lot of miscalfigurations and it's not every time just the customer has done those but we see a lot of miscalfigurations when we take over a and either a small organization which had a previous MSP and just doing some yeah application management on Intune but no security baselines for example and that's one called miscalfiguration I would say and yeah, what I told earlier like what can be actually enrolled into the portal and is it just open for every device from everywhere or do we have the appropriate conditional access policies do we have the setting set on if you don't use MAC or macOS why should you let macOS be enrolled in your tenant. So that's some of the most one we see and yeah that when you have no security policies in use is another big one which we see often yeah that's I think the most three and how do you approach the device lifecycle management. Device lifecycle management is a pretty big topic so we at we have for example we have co-managed customers where they are just they there is never ending lifecycle so you are every year in the lifecycle you are every year changing devices so with them mostly they have you just need a pretty a good Intune setup how long does it internal IT team for example take to re-stage a device and getting into operation again and it's mostly a thing of processes and if you have a good process behind you yeah you get you get the devices pretty much really fast re-stage and into operation again and we help them like build first the processes and then or build first the infrastructure around that process and then have a look into the process how you are changing those devices and but yeah it's it's pretty yeah there is a big difference are you doing it for a big organization which yeah like they are the whole year into a lifecycle into the lifecycle and are re-staging or redeploying or retiring a device or if it's a smaller one where you just every three or four years change all devices yeah and how do you handle what's your strategy for Windows Auto pilot and how do you handle bring your own device so we have at at RMSP we we're only working with device preparation or yeah autopilot v2 but it's yeah they don't like if we call it autopilot v2 and so yeah device prep and but yeah you need to know what do you need to self deploy or do you need something else but yeah we're mostly using device preparation there are some kveets where like you have no naming for example but you can script the naming of the device for example and yeah it's again it's do you have a big organization where you need to automate a lot of things or is it a small organization which you serve as nmsp that there's a really really big difference so when you're serving a customer as nmsp you could easily drive it through device preparation because most of the time you will get you will yeah or the device for the for the customer you will stage it you will get a field engineer or an operation engineer to the customer to yeah take the take the device into operation in the bigger organization we have a lot of yeah traditional autopilot v1 customers where we just automate a lot of things from the yeah from putting those harder hatches into the tenant from the vendor into staging them with for with the device device deployment of that send it to the user for for the rest of the user deployment for example yeah there are there are a lot of strategies you can you can look into but I think it's it's a really big difference are you working as nmsp for a customer or do you need to automate as much as possible for the intern iD team that yeah they can use their resources or their knowledge for all the things because most of the customer don't have enough iD professionals in their teams so they are yeah they have a really really high workload and so you you you you you look into automate yeah a lot of things yeah I think this was was a good deep depth into iTune so that's a jump to the to the next tool to the defenders so I think Microsoft's defender has grown tremendously which products do you deploy most often yeah it's a different frame point and we add a lot of projects so it's it's it's again it's it's a question do you are you deploying it for a comash customer or are you just helping them moving from any third party AV or ETR into defender for mp for example or like we do it at rmsp and standardize on different frame points so we we aren't using any central one or something like that we are just using defender for mp and i think the most deployments we do it's clearly defender for mp point and apart from defender for office or defender for cloud i think it's the most one what are organizations still missing when implementing defender yeah i had recently deployed which i saw with no attack surface reduction rules and that's something they miss a lot and i think there is a misunderstanding of licensing a lot of the time because i see a lot of customers using eTR with mp 65 e3 licenses where it's basically not licensed and you basically you just have for example in the e3 case you just have different frame point p1 and p1 doesn't give you the eTR abilities for example and those i think those two things are the most common ones which which which i see personally and you know how did you pre-rise all these defender features that's that's a good question because there are a lot of features which you can use you need to i think or or i i tell our team members a lot it's it i think mp 365 or the whole max of ecosystem sure you you can you can wait or you you just can learn by doing but i think you need to invest a lot yeah so you need to invest a lot of free time i think if you want to be an expert in those topics and especially in those features because and you won't learn you clearly you clearly have to use cases in the day to day basis if you are in engineering and to defender projects or something that you you will learn those but the deep types the the things you understand how is the technology working or how is defender reacting on on on what types of threats and i think for for me it's it's just are you keen enough to to learn it for yourself or are you just working with those i think there is the difference between working with a technology and making those deep dives into learning those and we just say we have all of one defender coupled capability that provides the faster security improvements the capability with the faster security i think i think it takes surface reduction rules and not letting them on report only on audit but getting them into block mode will i think we'll save you a lot of headaches if you if you know what you're doing sure you can with those block rules you can you can make mistakes and break some applications or line of business apps then sure you need to go on audit first but i see a lot of deployments where there was a defender project for example they getting into EDR and they configure those ASRs and just into audit audit and letting them for a year on audit instead of putting them after some time checking those audit logs and after that putting them into block mode and i think yeah defender can can produce produce a lot of alerts and the people get tired how do you reduce these a lot fettinue? yeah so it's that's a good question because we see a lot of alerts will get you into the alert fatigue if you want or not so you need to know you need first you need to understand your infrastructure which where is the noise being generated and why is it being generated and after that is it have a look into how is it something you need to make an exclusion for is it something you need to take action or take care of and mostly most of the time it's the defender hiking in how i tell our customers you need to have a look into the portal every day what is going on into the infrastructure what is what alerts are there what are they being resolved yeah it's alter remediation on and so on so i think you can basically security isn't isn't something you can switch on or off it's a it's a process and this process is never ending and yeah it's basically you need to understand the infrastructure you need to understand the alerts you need to understand and you need the alert you need the help of alert tuning rules getting the most out of it because if you have yeah you said that if you have too many alerts you will get alert fatigue and that's nonsense so yeah you need to stretch here as well there and what crawledoos threat hunting play in your daily life on your daily work i yeah yeah it plays it plays a really big role actually so threat hunting is something which i see a lot of other teams don't know how to use especially or for example cake well as well they know it exists since yeah somehow when it does something and you have to write prayers and all that stuff but they don't know how to use it actually and i show for example if i'm on a different project i try to educate the customer i try to make them yeah to make them to make sure they have the knowledge i can't teach them every single use case but i try to educate them on just their infrastructure what's normal what's unnormal and threat hunting is one of that so they should be able to see some commands and or know some commands which they can use in threat hunting to just check for something especially we have customers they have like a security team with 10-15 people for example which for someone may it seem yeah not that much but in switch the length if you have like an IT team of 20-30 people it's really it's actually really a really big customer because they they will serve a lot of users otherwise they wouldn't need like 30-40 IT staff and and you when you have security teams it's easy for for them to adopt to adopt the threat hunting capabilities because they have the time for that but if you have for example a customer which does not have a secured dedicated security people that that's the point where where it gets really hard into enabling them on using or enabling their skill in using the threat hunting capabilities in my life or in my daily daily role it plays a big role because I need to be able in the first place to educate our internal team and to how using those capabilities but I need to be able as well and to help the customer if there is an alert they we often see it before the customer because all the alerts we are or our customers are generating will are going into our send-ins as well but most of the time yeah they they are coming or we just do the threat hunting the background and before they even know we are threat hunting for something yeah and vulnerability management yeah that's that's a pretty hard thing so it's it's a lot of people just talk about vulnerability management but in in my opinion it's not just you can just talk about vulnerability management because you need to talk if you talk about vulnerability management you need to talk about patch management as well so in my in my or when I when I'm starting a project is it a different project or Intune project it yeah it's not important but I just asked the customer how are your processes today how do are you doing patch management today and most of the time either they don't have they they just set everything on autoptid like yeah the most common things that will be or it will be acrobat or edge or yeah those ones and and all the customers are having like third party tools like patch rapeseer something and they are actually yeah they have some some guy who is doing the patch management if you don't have a patch management in place at in my opinion you don't need to start vulnerability management or getting into vulnerability management at all because the most vulnerability is you will have is unpatched software and so you need to make sure you have patched software and patched operating systems in the first place if those processes are aligned you don't need to get into vulnerability management and sure and you you can have things like look for a chair or something like that where you need to patch software and applications and yeah as soon as possible but that's not in my opinion that's a vulnerability management that's you're reacting to something which happens but it can happen to any other software as well not just those who are using some some libraries which are affected so yeah so yeah I think that's also a good overview and let's jump to the third big security tool Microsoft EntryD why has identity become the new security parameter and what role do us play AI actually yeah it's I think especially we have especially since Microsoft enabled or or yeah made it possible to move the source of authority from yeah active directory objects into EntryD it got on the radar of a lot of organizations again because the most organizations saying yeah why I will be able to replace my active directory in in in 100 years and it just Microsoft made it just now again possible to just getting into moving into cloud first things and that's a really big one and I think a really big opportunity for a lot of organizations sure and it depending on the infrastructure you can have so much legacy of things in your infrastructure that it won't be possible to going cloud native or moving your object or zone of authority into the cloud into EntryD but yeah I think that's a good good opportunity Microsoft gives you and yeah AI is is especially yeah it's important for any other it's like at any other topic it's important as well and so you need to try I think a lot of organizations are missing out educating the internal IT team about AI because you can just educate your users if your internal IT is educated on how react to those things the most of the time the organizations even they don't even know that different for cloud abscesses for just minimizing shadow IT and yeah knowing what is going in which AI and all that stuff so I think there yeah there needs to be an investment into the internal IT of into the internal IT of organizations being able to use if you're looking into just cloud first to use cloud first but a part of AI and cloud first and EntryD all that stuff in educating them and giving them a clear vision how are we going to proceed into the next few years and what's our goal with this infrastructure if you don't I think in my opinion if you don't have a vision for for your IT infrastructure you're just yeah you're like a fireman just looking around and if anywhere starts a fire you're you're there with water and trying to that not your whole infrastructure is beginning to burn so yeah yeah is there one entrap ID protection feature you you prefer cloud all on level yeah apart from with the cell on efficient resistive NFA here so I think if you have if you have EntryD P2 licenses I see a lot of the time that those conditional identity protection conditional X policies aren't being used and I think that's one of them more I like that feature a lot because you aren't in the need of yeah getting thing or like revoking essentially immediately because additional access will take care of this user with medium risk for example and yeah lock him out until you had the time to look at this particular case is it now fish was it fishing was it just for false positive or something like that yeah I think that's that's that's a real cool feature and how did conditional like access policies evolved over this time a lot a lot but to be honest we see a lot of organizations even big ones just with like one or two or three conditional X policies were they enforce MFA and yeah on a group and not on all users and with some exclusions where none of the i-tests know why those exclusions have been made and you need you need as well as stretched it there to use conditional Xs and over the use it evolved a lot because for example it's a token protection which which is a really cool feature and and does help you protect the token which is yet I think a really really big attack surface for attackers when they have the opportunity to steal it they will try to steal those tokens and you need to protect them and what did you think about password authentication is that final ready so in my opinion if you're if you're adopting or you need to think about this in two cases so the first case is for a user and it's the only one you should go with and not just password less but fishy resistance as well so you need windows hello for business or pass keys and there should you you should be in the face of the transition from if you had just number number matching and multi-factor authentication where you just need to type in the number you should be in the face in transitioning to pass keys and but for an admin it was a little bit harder because android connect for example wasn't able to yeah to accept phishing resist nemaphay and until now now with the newest I will think with the newest release no I'm sure yeah it's with the newest release you can use android connect with phishing resistance amphay and yeah in my opinion you need first you need as net menus you need not just password less you need phishing resistant pass to less authentication and for users yeah you should be in a phase where you either are transitioning to pass keys or you are looking at the strategy for migrating into pass keys and with the with the with the registration campaign which you can use by now for a fish resistant yeah amphay or for pass keys you can even enforce your user to registering the pass key and I think the most the most thing or the most common thing we see at internal IT teams or organization is that some of the users have old phones and which which not supports pass keys and so yeah then you you need to either say tell the user you know you need to get a new phone or or you giving them a physical token to or you be key for doing issue resistant amphay but yeah it's a really big topic and you you need to you need to be in some sort of transition by now into vision resistant amphay yeah can you tag a phishing but what does phishing resistance? phishing resistant amphay is basically as as it tells us from the name it's phishing resistant so if you are doing for example number matching some attacker could play man in the middle and getting you into a fake Microsoft login site and yeah like stealing you the the the the the the token and after that he can take this token which is basically a cookie and can create important into his browser and is yeah after that he's logged in your account and to yeah to get rid of this problem we are using or Microsoft released some time ago yeah pass keys and with pass keys you can yeah do phishing resistant authentication so what basically it's it will have it will look on which domain or you will registering your amphay phishing resistant it will look from which domain or which domain is linked to this pass key and when you are on a phishing side and want to authenticate with the pass key it won't work because the domain is not matching and this this thing basically saves you from getting phished and this also helps on on the ransomware and so ransomware is just I think ransomware can it can so ransomware it does not protect you and ride away from from ransomware because ransomware you can for example you have an excel with some macros behind it and your IT team did not disable macros you can if you don't have an EDR or just have an antivirus it won't maybe it won't detect it and ransomware could start but I think a lot of I think ransomware it can start with with with the identity which is being hacked so it won't save you but it pass keys will I think you can say pass keys will make sure that your identity is saved and it can go just it can start with an identity theft for example okay interesting interesting and so I think there are a lot of people talk about automation how much security can realistically be automated so security is something there are some things where like you can automate it with different XDR for example or T9Frame point where auto remediation is on you can automate that it block automatically threats or it blocks automatically hashes or applications or certificates or something like that you can automate a lot around security but I think in my opinion you shouldn't automate just everything you even if you have an incident alert and it gets auto remedied you need to have a look on it because you need to know where this alert started do you need to take some action or is it something yeah you you you can't take action or take care of but yeah you can surely you can automate a lot of things especially with grad API you have a lot of awesome community tools which yeah enables your your enables or helps you be more efficient or enables you to import policies for example in tune is into management an awesome tool where you can export and import configuration policies compliance policies and all that stuff so yeah you you should automate and I'm yeah I'm as well a really big fan of it but there are things especially around security and you should have someone looking into those things when something yeah yeah I remember think about I say this two or or other yeah what is the framework framework law I don't know what's the right work for it a lot of I say leadership or or CO say give away the the responsibility for for this topic I say okay the stretch you handle our printers now he is for yeah he is responsible for for the security but they can no longer give away the yeah the yeah the responsibility basically it's it will be the therefore that the end if something happens yeah and how do you convince leadership into the invest in yeah into the security topic so I think if you need to yeah if you need to to talk to leadership today or talk them into cybersecurity and that they need to take responsibility of they have done something wrong in the last years because this topic should be seal-ever stuff and they need to take responsibility but if I would need to take or to talk to to to leadership or to talk them into taking the responsibility and take care of security you need to start with just showing them the vulnerabilities which which are yeah pretty big red in the defender part of for example just showing them that we should need to close those vulnerabilities we should need to patch those things and just showing them those dashboards I think box office doing a really really good job into yeah making it more simple for sea level to understand those metrics and I would start with with with metrics I would really start with showing them look at those vulnerabilities look at those softwares we were which which aren't patched and I think this is a good a good starting point I think that's interesting what's the security matter the metrics actually matters yeah that's that's a really good question so I think there isn't sure you have the tenant security score you have the identity secure score and you could use those metrics but it's it depends a little bit or it depends as well of your license because for example business premium which MSPs should be standardizing on and not using just business standard or exchange on one p1 or something like that or just standalone and you should you you should you can't close every gap for example the identity risk conditional access policy which we talked about earlier or behind entropy two for example so you can't take the that box but I think if you are talking to your CEO or to your security officer I would would start certainly with the identity secure score because I think that's the the biggest the biggest attack surface apart from your end points which can be attacked if your users are either cloud native or synced from your active directory but that would be the the biggest yeah in my opinion it's the biggest attack surface because it's only username it's only password and if you haven't or if you haven't been using MFA till now you missed out something clearly but apart from that yeah those that's three things which which can decide if some attacker gained access to your account or not yeah now we have yeah we on the age of AI and Microsoft has everywhere a co-pilot and also the Microsoft security co-pilot what did you think about the Microsoft security co-pilot and it's so I I am yeah I had the privilege to to use it earlier on and it was or in the early stages and it evolved a lot it evolved a lot and with the with the opportunity that it's yeah now involved in your e5 or in M365 e5 licensing that you can use it without paying additionally or just on every user adds up to your to your consumption that you can use and it's really really cool because it enables the organizations not just working with a co-pilot AI and creating agents but it enables you getting insights about your configuration getting insights about where conditional access policies are are yeah where is maybe a hole in your conditional access strategy or something like that and it's good but there are some things which yeah we need yeah we need to maybe wait a little bit longer till it's it's fully fully integrated and yeah because I there are cases you will see something which security co-pilot won't see and we need to maybe iterate or it will evolve over time but it's a good starting point if you if you have a Microsoft 365 e5 licensing you should definitely have a look on it and when it's integrating your license it doesn't cost you anything additionally so you can use it and if it just tells you something you didn't know you gained some value out of it so I'm a really big fan of just even if products are not perfect and just looking into how you can gain a little value out of it if surely if they if it doesn't take just three sources of like 40 hours or something like that but if you can easily gain value out of tools or out of the of out of the technology in the market out of eight technology in the Microsoft ecosystem you should definitely have a look on it and yeah looking into it does it can you gain value out of it or can it help you with securing your infrastructure or something like that and yeah a question I often say for five years the data analyst was the sexiest job in the IT and now I think it's the security engineer how do you hire great security engineers what did you look yeah that's that's a it's a really great question as well it's it's really really hard because you mostly you are looking into some engineers or analysts were and the experience where they they have gained a lot of experience I think the era where you had just only look or the HR only looking into the race of mace and all the the trees yeah so basically I think this era is yeah I don't think it is this era is a era is gone so you need people and in interviews you can pretty good talk about security with those guys in interviews and having them telling I for me personally I asked them what were your challenges what what solutions do you have or how did you threat hunt what what did you use when you have done threat hunting what do you what what what was your biggest challenge and how you solved it and then you will really see does someone had yeah has the knowledge to answer the question or is it something more basic level stuff which they are are telling you but it's really really a a a tough topic because you in IT you won't find just some security engineers looking for a job you you need to you need to make sure they see you as a company and they want to work at your company because just giving them some free apples and bananas every day won't convince them to join you so you need to disappear yeah exactly I think another topic is it's a little bit change in in in in in in the in the IT world and we are not only speaking about technique we also speaking about culture how do you build a security culture and yeah that's I think and everyone that started at AdVision we for him was was pretty clear we are a security minded and we are and and it's it's easy to say but you just have to make sure and first technically that they can't just make that not everyone can just make exclusions in the different portal for example that's the first thing but the second next thing is just getting and getting know how to your engineers to your operations engineers to your analysts just having them into see okay yeah it's like educating them just real world examples which were use cases where you discussed them internally which you warn everyone about it's it's not like just telling them hey don't click on things especially not at the company like like ours or an msp or msp but yeah it's it's it's it's it's a hard thing you if you do just traditionally that's that's you need to you need to yeah you need to educate them surely but I think you can educate them on real world things the best okay yeah and every session I have a rapid fire round that's one word or one sentence answers only I ask a short questions and fast answer okay coffee tea or energy thing through such hunting oh energy drinks surely windows or make a whereas what say for oh it depends on the configuration I would say but so I'm doing I'm a big fan of windows so I would say it depends on the configuration configuration manager it's you clearly defender our third party security defender hybrid join or enter a join that's easy one intro joint a partial log we or a partial partial is there anyone yeah it's a absolutely partial what's the best michael's of conference what that's that's a hard question I like all I think I like all of them I I I wasn't a conference where I thought I shouldn't have bought the ticket or I shouldn't have take this flight but I think the workplace in transfer's land this is one of the the main things I I just look forward every year um what's your favorite keyboard shortcut um a windows lock a windows L first thing you're doing after setting up a new tenant first thing I'm setting up a new tenant um had to go with question I never took that into my mind yeah checking if if those configurations even work yeah if a Microsoft such a little bit come to you and say hey I mean you get all the resources money you need what fit security feature will you develop um that's your very great question as well uh I would definitely uh invest in more into uh I think in in in protect I would make token protection more more available to to to other apps not just the Microsoft apps yeah good so then my my closing question is um if listeners could implement one security improvement tomorrow what should it be um I secured feature tomorrow uh that's a good good you have a lot of good question where I didn't I never thought about those one it that so I think it's similar to the last one so I would I would yeah token product token theft is such a big thing uh at the moment I would invest invest in those and and and and to make it more uh yeah make it smarter and and and broader yeah so yeah I've been thank you so much for joining us today uh me today uh this has been a fantastic conversation covering everything from building Microsoft first management service provider to security thing endpoints both iTunes, Defender and n3ds yeah enterprise and scale I especially appreciate how practical your advice was and how much uh of it comes from a real yeah customer experience around the theory and if you yeah if the listeners enjoy this episode make sure to subscribe the podcast and uh send it to your uh to all your friends and colleagues and yeah um thank you for listening and I see you in the next episode so thank you so much for staying here with me bye White. [sad music]