NexlinksField Notes from a CTO & CISOSHARED PRACTICE
Technical walkthroughs and practical decision guides from my work across Microsoft identity, security operations, data protection, and AI.
These are published articles you can use to plan a pilot, structure a review, or test an operating procedure. Their original dates and supporting references remain on each page.
MCP tool definitions and returned content can influence an agent that already has legitimate access. Review the trust boundary, cross-tool interactions, and independent authorization before expanding autonomous actions.
Read article ↗Choose the assessment that answers your security question. Compare Microsoft’s broader configuration review with CISA’s Microsoft 365 baseline validation, and decide when a second assessment adds useful evidence.
Read article ↗Use CISA’s published baselines and ScubaGear to check Microsoft 365 configurations, distinguish failed controls from incomplete coverage, and prioritize remediation. Includes anonymized September 2026 assessment examples.
Read article ↗Use Microsoft’s Zero Trust Assessment to examine supported tenant configurations, interpret gaps, and build a remediation plan around exposure, ownership, and operational dependencies.
Read article ↗Separate identity authority, authentication, device management, and application dependencies before migration. A phased plan should prove access and recovery for each group of users before expanding.
Read article ↗Start with a repeatable investigation or handoff, define the evidence an analyst needs, and measure whether Security Copilot improves the work without taking responsibility away from the team.
Read article ↗Match licensing to the required protection, workload, and users who benefit. A feature appearing in the portal does not establish that the organization has licensed its intended use.
Read article ↗Connect identity, endpoints, cloud workloads, and data to an owned response process. The operating model should establish what is covered, who acts on the evidence, and how controls improve after an incident.
Read article ↗Map ingestion, retention, and query needs before changing how security telemetry is stored.
Read article ↗A phishing alert becomes a different investigation when mailbox rules, sign-in activity, and financial communications show a coordinated pattern.
Read article ↗I also share shorter practitioner observations on LinkedIn. Questions and different implementation experiences help make these discussions useful.
Recordings and code downloads will be added when there is a public resource to share. This collection currently contains written walkthroughs; it does not imply completed webinars or released scripts.
