NexCOMMUNITY QUESTIONS
Microsoft 365 & Security: Questions & Answers
Practical answers to questions I have received through LinkedIn, this website, community meetings, and online webinars.
Answers by Phil Kinsley. Collected February 2025 through October 2026.
Contributor names and identifying handles are omitted because permission to publish them was not requested at the time. Questions are edited for clarity.
Answers reviewed October 18, 2026. Submission dates are preserved below.
Licensing, supported platforms, and tenant configuration can change. Check the requirements that apply to your environment before making changes.
Have a question?
Send it privately to Phil. You can choose whether it may be published anonymously.
Ask a question ↗Page 2 of 5 · Questions 16–30 of 69
Questions on this page
- Requiring phishing resistant authentication for administrators
- Building emergency administrator access that works
- Reviewing application consent requests
- Verifying Defender for Endpoint after onboarding
- Moving attack surface reduction rules from audit to enforcement
- Running Defender alongside another antivirus product
- Designing Windows update deployment rings
- Prioritizing Defender vulnerability recommendations
- Deploying Windows LAPS with Intune
- Verifying BitLocker recovery before an incident
- Completing secure Microsoft 365 offboarding
- Using shared mailboxes without shared passwords
- Choosing Defender for Office 365 Plan 1 or Plan 2
- Responding to a suspected business email compromise
- Separating retention from a tested recovery plan
QUESTION 16 · Identity and access
Requiring phishing resistant authentication for administrators
Submitted July 8, 2025 at 11:16 AM EDT
We use push notifications with number matching. I want our administrators to move to phishing-resistant MFA. What does the rollout look like in Entra ID?
Phil Kinsley:
Number matching reduces push-approval mistakes, but it is not phishing-resistant authentication. Use Conditional Access's phishing-resistant MFA authentication strength with supported FIDO2/passkey credentials, Windows Hello for Business, or multifactor certificate-based authentication.
Register and test the method before enforcing it. Include the actual administration tools and workstations, not just a browser sign-in. Provide a bootstrap and recovery route for a lost credential.
Target the relevant administrators and resources, exclude tested emergency accounts from policies that could block their emergency use, and pilot enforcement. Check the sign-in's authentication details and policy result. A test with a weaker method should fail to satisfy the required strength. Continue protecting the administration workstation because stolen sessions can bypass the need for a new authentication prompt.
QUESTION 17 · Identity and access
Building emergency administrator access that works
Submitted July 18, 2025 at 3:43 PM EDT
We have one break-glass account with a long password in a password manager. Is that sufficient, or should the design be more deliberate?
Phil Kinsley:
Create at least two cloud-only emergency accounts in the tenant's onmicrosoft.com domain. Give them permanently active Global Administrator assignments so recovery does not depend on federation, directory synchronization, or a PIM approver being available.
Use phishing-resistant credentials with different dependencies from everyday administrator sign-in. Microsoft recommends FIDO2 passkeys; certificate-based authentication is another option where the supporting PKI already exists. Store credentials securely in separate locations accessible to authorized administrators.
Exclude the accounts from Conditional Access policies that block or restrict sign-in. This does not exempt them from Microsoft's mandatory MFA requirements. Alert on every sign-in and important account change, prevent expiry or inactivity cleanup, and test sign-in and an administrative task at least every 90 days from a designated secure workstation.
QUESTION 18 · Application security
Reviewing application consent requests
Submitted July 30, 2025 at 9:07 AM EDT
A user approved a meeting tool that requested mailbox access. What should we review before allowing these applications, and can we stop users approving broad permissions themselves?
Phil Kinsley:
Ask the application owner to explain each requested permission against the work the application must perform. A verified publisher identifies the publisher; it does not establish that mailbox or directory access is appropriate.
Separate delegated access, exercised with a signed-in user, from application access that can run unattended. Inspect the app ID, service principal, existing grants, consented users, and requested scope. Check whether the application supports a narrower permission or a resource-specific restriction.
Use tenant consent settings and the admin-consent workflow to route requests for review. Record an owner and a review date for approved grants. Investigate suspicious existing grants through the incident process; removing a grant alone may not revoke every token or session already issued.
QUESTION 19 · Endpoint security
Verifying Defender for Endpoint after onboarding
Submitted August 6, 2025 at 1:52 PM EDT
Our deployment tool says Defender for Endpoint onboarding succeeded on 400 devices. What checks would you use before calling the rollout complete?
Phil Kinsley:
Reconcile the expected devices with Defender inventory, then inspect sensor health, last-seen times, and connectivity. Test devices from different network segments and deployment methods.
On an approved pilot device, run Microsoft's detection test for that operating system. Confirm the alert appears in the Defender portal and reaches the team that investigates it. Microsoft says the test alert can take about ten minutes. An antivirus test file alone is not a substitute for the documented endpoint detection test.
Separately check antivirus mode, protection settings, and management-policy results. Exercise an authorized response action on a designated test device and confirm the help desk or SOC handoff. Record missing, stale, and unhealthy devices so an onboarding success count does not conceal coverage gaps.
QUESTION 20 · Endpoint security
Moving attack surface reduction rules from audit to enforcement
Submitted August 18, 2025 at 10:24 AM EDT
We enabled attack surface reduction rules in audit mode months ago. Nobody wants to switch them to block because a legacy application might fail. How would you move this forward?
Phil Kinsley:
Review audit events by rule, application, and device group. Ask the application's owner to explain events that would interrupt legitimate work; a raw event count is not enough to decide whether to block a rule.
Check each rule's supported platforms and protection prerequisites, then pilot selected rules in block mode. Keep unrelated rules moving when one legacy application needs more investigation. Where a rule supports exclusions, scope them to the required path or process and set a review date. Some rules do not honor the same exclusions, so test the exception itself.
After enforcement, check the effective endpoint setting and repeat the business workflow. Audit mode records what would happen; it does not provide the blocking protection you are evaluating.
QUESTION 21 · Endpoint security
Running Defender alongside another antivirus product
Submitted August 29, 2025 at 4:38 PM EDT
We still have a third-party antivirus contract. Can we onboard Defender for Endpoint now, and would that mean Microsoft Defender Antivirus is providing full protection too?
Phil Kinsley:
Defender for Endpoint provides detection and response; Defender Antivirus is the antivirus engine. Onboarding a machine to Defender for Endpoint does not, by itself, make Defender Antivirus the active antivirus provider.
On supported Windows clients, Defender Antivirus can run in passive mode alongside another registered antivirus product. Windows Server needs separate attention: installing another antivirus does not automatically put Defender Antivirus into passive mode. Follow the server-specific configuration before migration and account for tamper-protection behavior.
Check the actual mode with Get-MpComputerStatus and its AMRunningMode value. EDR in block mode is a separate capability, with its own licensing and prerequisites; it is not equivalent to active real-time antivirus. Test updates, alert routing, and performance for each device class before changing the primary product.
QUESTION 22 · Intune and endpoints
Designing Windows update deployment rings
Submitted September 4, 2025 at 8:33 AM EDT
We have one Intune update ring for everyone. Updates either arrive too slowly or restart users at a bad time. What would a sensible ring design look like?
Phil Kinsley:
Use a small validation ring with representative hardware and applications, a broader pilot, and then production. Name the person who reviews failures before rollout expands.
Set quality-update deferrals, deadlines, restart grace periods, and user notifications together. For feature updates, use deliberate version targeting; Microsoft's guidance recommends setting the ring's feature-update deferral to zero when feature update policies control the version. Assign the intended feature-update policy and let the service process it before removing ring deferrals, so the transition does not briefly offer an unintended version. Check for conflicting Group Policy or other management settings.
If Autopatch manages the devices, review its policies before creating competing rings. Define an urgent-update route and check which devices remain offline or fail repeatedly. Report overdue updates and pending restarts, not just the percentage that downloaded an update.
QUESTION 23 · Vulnerability management
Prioritizing Defender vulnerability recommendations
Submitted September 16, 2025 at 12:49 PM EDT
Defender Vulnerability Management has produced a large remediation backlog. Our team cannot patch everything this week. What would you prioritize beyond the CVSS score?
Phil Kinsley:
Start with exploitation and exposure, then consider severity and business impact. An actively exploited flaw on a reachable identity system can deserve attention ahead of a higher-scoring flaw on a less exposed device.
Use Defender's affected-device list, software versions, threat context, and available remediation. Add what the product cannot reliably know: whether the service is externally reachable, who owns it, and what will break if it is changed. Choose patching, configuration, removal, or a documented temporary mitigation accordingly.
Assign an owner and due date. After the change, verify the installed version or setting and wait for fresh device reporting before closing the finding. Track overdue exploited vulnerabilities and accepted exceptions separately from the overall exposure score.
QUESTION 24 · Endpoint security
Deploying Windows LAPS with Intune
Submitted September 29, 2025 at 3:17 PM EDT
Our help desk uses the same local administrator password on many laptops. How would you replace that with Windows LAPS through Intune?
Phil Kinsley:
Confirm the Windows version, join state, and password backup directory first. Entra-joined devices back up to Entra; hybrid-joined devices can use a supported Entra or Active Directory design. Do not configure competing backup expectations.
In Intune, create a Windows LAPS policy under Endpoint security > Account protection. If you specify a custom local account, confirm that it exists. Automatic account management on supported newer Windows releases is a separate capability; naming an account in older policies does not create it.
Pilot password backup and rotation. Have an authorized help desk user retrieve the current password, confirm an unauthorized user cannot, and test the post-authentication rotation behavior. Review local Administrators membership too: rotating one password does not remove other unnecessary administrators.
QUESTION 25 · Endpoint security
Verifying BitLocker recovery before an incident
Submitted October 7, 2025 at 9:56 AM EDT
Intune reports that our laptops are encrypted. A recent support ticket showed that we could not find one recovery key. What should we check before declaring BitLocker deployment complete?
Phil Kinsley:
Check encryption and key recovery separately. On a sample device, inspect Get-BitLockerVolume, the protected volumes, and the recovery-key identifier. Match that identifier to the key stored against the correct Entra or Active Directory device object.
Test retrieval with the actual support role. An administrator being able to find a key does not prove the help desk has the intended access. Review user self-service access as well before deciding who should be able to retrieve recovery material.
Exercise recovery on a designated test machine, then test supported key rotation after use or exposure. Do not force production laptops into recovery merely to demonstrate the process. Across the fleet, investigate devices reporting encryption without a recoverable key in the expected directory.
QUESTION 26 · Microsoft 365 operations
Completing secure Microsoft 365 offboarding
Submitted October 20, 2025 at 2:28 PM EDT
Our offboarding checklist says reset password and remove licenses. What important access and data steps are missing when someone leaves the business?
Phil Kinsley:
Block access at the agreed departure time, while preserving the required data. For synchronized identities, coordinate the on-premises account and Entra actions so synchronization does not reverse a cloud-only change.
Block sign-in, revoke sessions, and review privileged roles, separate accounts, authentication methods, devices, mailbox delegation, and application access. Transfer Teams, SharePoint, flow, and application ownership before disabling the identities or connections those services depend on.
Check holds, mailbox conversion, OneDrive handover, and license consequences before deleting accounts or removing entitlements. Session revocation is not instant logout from every application: access tokens and application-owned sessions can need separate containment. Verify denial at the important services and have the receiving owner open the retained information before completing the departure record.
QUESTION 27 · Exchange Online
Using shared mailboxes without shared passwords
Submitted October 30, 2025 at 11:41 AM EDT
The accounts team wants a password for accounts@ so everyone can sign in directly. They say delegation is inconvenient. Is a shared mailbox login a reasonable workaround?
Phil Kinsley:
Use each employee's own licensed Exchange Online account with delegated access. Block direct sign-in to the shared mailbox's account rather than issuing a shared password.
Full Access lets a delegate open the mailbox. Send As and Send on behalf control how they send messages and must be considered separately. Test the actual Outlook and mobile workflows before granting broader permissions to fix a client problem.
An unlicensed shared mailbox is generally limited to 50 GB. Increasing the limit to 100 GB requires Exchange Online Plan 2. Archiving, litigation hold, and advanced protection or compliance capabilities have additional licensing rules. Check those requirements before removing a license from a converted mailbox, especially if it already exceeds the unlicensed limit.
QUESTION 28 · Email security
Choosing Defender for Office 365 Plan 1 or Plan 2
Submitted November 5, 2025 at 4:04 PM EST
We have Business Premium and have been told we need Defender for Office 365 Plan 2. What questions should I ask before agreeing to another security upgrade?
Phil Kinsley:
Plan 1 provides protections such as Safe Links, Safe Attachments, and anti-phishing features. Business Premium includes Plan 1. Plan 2 adds investigation and response capabilities, including Threat Explorer, automated investigation and response, and Attack Simulation Training.
Walk through a phishing incident using the team's current licenses. Can analysts find all recipients, investigate interactions, identify related messages, and take the response actions you require? List the steps that are unavailable or too slow, then test whether Plan 2 closes those gaps.
Include the users who benefit from the service in the licensing review. Also decide who will review investigations and approve actions. Buying Plan 2 will not correct missing recipient assignments or unattended alerts.
QUESTION 29 · Incident response
Responding to a suspected business email compromise
Submitted November 17, 2025 at 8:51 AM EST
A finance user clicked a phishing link and a supplier received changed bank details from their mailbox. What should the response team do immediately beyond resetting the password?
Phil Kinsley:
Pause disputed payment activity and verify bank details through a known phone number or other trusted channel. If money has already moved, involve the bank's fraud team immediately alongside the technical response.
Contain the affected account, revoke sessions, and preserve sign-in, mailbox, message, and audit evidence as the response proceeds. Review forwarding, inbox rules, delegates, authentication methods, suspicious consent grants, and related application access. Investigate the endpoint and any other identities the attacker touched.
Find fraudulent messages and affected recipients using the licensed investigation tools. Remove unauthorized access and persistence, then verify clean sign-in and mailbox behavior before restoring normal access. Finance, incident leadership, and the relevant legal or notification owners need the same timeline; a password reset does not settle the financial or technical incident.
QUESTION 30 · Microsoft 365 resilience
Separating retention from a tested recovery plan
Submitted November 28, 2025 at 1:26 PM EST
We have retention policies, version history, and recycle bins. Do we still need to evaluate Microsoft 365 backup, or would that duplicate capabilities we already have?
Phil Kinsley:
Write down the recovery requirement first: which workloads, how much data can be lost, and how quickly the business needs access restored. Retention for legal preservation does not necessarily provide a practical restore process.
Test a deleted file, a departed user's data, and a larger mailbox or SharePoint recovery. Include permissions, versions, metadata, and the time needed for staff to resume work. Check whether the same compromised identity could alter both production data and the recovery configuration.
Compare those results with Microsoft 365 Backup or another proposed service. Verify supported workloads, restore points, retention, charges, and administrator access for the selected offering. Record the timed restore result rather than accepting a general statement that cloud data is already backed up.