Library - Tag
Articles open in this browser tab. Some require sign-in.
ntegrated Security Operations Center (ISOC), now in preview, combines the breadth of SIEM capabilities with the depth of native threat protection, alongside threat intelligence, automation and AI. ISOC gives security teams and agents a shared foundation to see the environment, understand the threat and act with the relevant context and controls.
Sep 23, 2026
The next question after a security finding should be: what can this reach? A finding becomes more useful when you can see the identities, devices and cloud resources connected to it. Those relationships help you decide where to investigate next and which exposure deserves attention first. That is where Hunting graph fits.
Sep 21, 2026
Blocking an AI agent contains the immediate threat. It does not complete the response. Once an alert is confirmed and the agent or affected instance is blocked, the security team needs to answer a harder question: what did the agent do before we stopped it?
Sep 16, 2026
Project Perception's practical value is coordination. Specialized security agents work toward a shared objective, giving customers a clearer path from understanding a threat to deciding what to investigate, detect and fix. Inside Microsoft Defender, six specialized agents work across Red, Blue and Green teams. Their value comes from how their findings help your team decide what to investigate, detect and fix.
Sep 14, 2026
Your organization has one agent estate. So why do the Microsoft portals show different totals? The gap can look like shadow AI, a missing identity or a broken integration. Sometimes, you are simply comparing different populations.
Sep 08, 2026
The riskiest part of an MCP integration is not the connection. It is the authority that crosses it! An approval should describe authority, not only connectivity. The effective authority of an MCP integration is created by six things.
Aug 10, 2026
Security data becomes more valuable when we model the relationships that tables leave scattered❗ Microsoft Sentinel Custom Graph [Preview] makes that possible.
Jul 30, 2026
The workplace is no longer only about people using apps and accessing data. It is becoming AI-powered, Copilot-assisted, and increasingly agent-operated. That shift creates a different governance question: “Can this user, Copilot, or agent access this data, use this tool, take this action, and produce evidence that it stayed within policy?” That is where Microsoft 365 E7 becomes important.
May 19, 2026
Microsoft’s MDASH announcement is impressive, but I do not think the most important takeaway is the number of vulnerabilities found. Those numbers are evidence. The bigger lesson is the operating pattern behind the result.
May 15, 2026
Microsoft Entra ID Governance is bigger than access reviews. It helps organizations govern 3 connected areas: Identity lifecycle, Access lifecycle, and Privileged access lifecycle.
Apr 15, 2026
