NexCOMMUNITY QUESTIONS
Microsoft 365 & Security: Questions & Answers
Practical answers to questions I have received through LinkedIn, this website, community meetings, and online webinars.
Answers by Phil Kinsley. Collected February 2025 through October 2026.
Contributor names and identifying handles are omitted because permission to publish them was not requested at the time. Questions are edited for clarity.
Answers reviewed October 18, 2026. Submission dates are preserved below.
Licensing, supported platforms, and tenant configuration can change. Check the requirements that apply to your environment before making changes.
Have a question?
Send it privately to Phil. You can choose whether it may be published anonymously.
Ask a question ↗Page 4 of 5 · Questions 46–60 of 69
Questions on this page
- Defining what an outsourced SOC must deliver
- Understanding Defender for Cloud plan coverage
- Managing Windows Server security through Defender and Intune
- Checking identity threat coverage in a hybrid environment
- Turning cloud app discovery into an access decision
- Securing access to Windows 365 Cloud PCs
- Using Power Platform data policies to govern connectors
- Keeping Power Automate flows working after an owner leaves
- Limiting SharePoint access from unmanaged devices
- Using SCuBA alongside Microsoft Secure Score
- Deciding what evidence supports a security assessment
- Reviewing an AI agent before granting business access
- Testing tenant security changes before broad enforcement
- Choosing the first ninety days of Microsoft security work
- Enabling the free Foundational CSPM capabilities
QUESTION 46 · Security operations
Defining what an outsourced SOC must deliver
Submitted May 29, 2026 at 2:46 PM EDT
We are comparing managed SOC providers for our Microsoft environment. Most proposals promise 24-hour monitoring. What would you ask them to demonstrate before signing?
Phil Kinsley:
Ask the provider to demonstrate a compromised identity with suspicious mailbox activity and an affected endpoint. Watch what the analyst sees, who investigates, and who is authorized to contain the account or device.
Clarify the overnight process when your normal contact does not answer. Distinguish acknowledgement time from investigation and containment. Establish responsibility for broken connectors, detection tuning, exclusions, and work requiring an Active Directory or application owner.
Put those responsibilities into the service agreement, along with data access, retention, incident records, reporting, and exit arrangements. Ask to see a sample case and handover. If the provider only opens tickets, make sure the internal team can carry out containment at the times the service claims to cover.
QUESTION 47 · Cloud security
Understanding Defender for Cloud plan coverage
Submitted June 4, 2026 at 11:03 AM EDT
We enabled Defender for Cloud and can see a secure score. Does that mean all Azure workloads now have threat protection, or are there additional plans to check?
Phil Kinsley:
Check plans by subscription, connector, resource type, and individual workload. Recommendations appearing in Defender for Cloud do not prove that every resource has workload threat protection.
Foundational CSPM provides free baseline posture capabilities. The paid Defender CSPM plan adds advanced posture features. Defender for Servers, Storage, databases, and containers are separate workload-protection decisions; enabling the posture plan does not replace them.
Build a resource list containing the chosen plan, onboarding status, health, owner, and charges. Include connected clouds and hybrid servers. Validate a representative workload using that plan's supported test. Use posture recommendations to prioritize configuration work, but check actual sensor and alert coverage before reporting that the workload is protected.
QUESTION 48 · Server and hybrid security
Managing Windows Server security through Defender and Intune
Submitted June 16, 2026 at 3:34 PM EDT
I have seen Windows Servers listed alongside devices in the Intune security experience. Can we now use Intune as the complete management platform for those servers?
Phil Kinsley:
Use Defender for Endpoint security settings management for supported server security policies. It does not enroll Windows Server into full Intune MDM or give the server the complete workstation management feature set.
The tenant needs at least one active Defender for Endpoint user-subscription license for this management capability. Microsoft explicitly says access obtained only through Defender for Servers is insufficient. Each server still needs its appropriate protection entitlement; the tenant prerequisite is not a license for the whole server fleet.
Check supported server versions and policy types, onboarding health, and the enforcement scope. Assign an endpoint-security policy to a pilot server and inspect the effective result. Keep patching, applications, backup, and recovery separately owned. Azure Arc and Azure Update Manager can support those operations where configured, but they are not supplied by MDE security settings management.
QUESTION 49 · Identity security
Checking identity threat coverage in a hybrid environment
Submitted June 29, 2026 at 9:51 AM EDT
We have Entra ID Protection and still run Active Directory. What should we verify before assuming Microsoft is also detecting attacks against the on-premises identity infrastructure?
Phil Kinsley:
Entra risk policies do not establish Defender for Identity sensor coverage of your domain controllers. Inventory the supported identity infrastructure and compare it with healthy, reporting sensors and integrations.
For the deployed Defender for Identity sensor version, check supported systems, service-account permissions where required, event configuration, network connectivity, and health alerts. Include new domain controllers and identify gaps left by retired or disconnected systems. Do not assume all sensor versions collect every signal in the same way.
Use the documented validation guidance and confirm the resulting alert reaches the SOC. Agree who maintains sensors and who handles an alert requiring Active Directory changes. Record the domains and critical identity systems that are covered and the ones still missing.
QUESTION 50 · Cloud application security
Turning cloud app discovery into an access decision
Submitted July 7, 2026 at 1:13 PM EDT
Defender for Cloud Apps shows many unsanctioned applications. If we mark them as unsanctioned, are they blocked, and should we block every app with a poor risk score?
Phil Kinsley:
An Unsanctioned tag is a classification until an enforcement integration uses it. In the documented Defender for Endpoint integration, network protection and the required configuration provide a blocking path on supported endpoints. A portal tag does not block every unmanaged device or network route.
Before blocking, check what the application is used for, who uses it, what data leaves, and whether an approved replacement meets the requirement. A low discovery risk score is a reason to investigate, not evidence that every use is malicious.
Pilot the block and inspect the endpoint result. Test shared domains, dependencies, browser behavior, and an unmanaged access path. Where a proxy or firewall provides enforcement, test that route separately. Record any remaining paths and a clear exception process.
QUESTION 51 · Microsoft 365 endpoints
Securing access to Windows 365 Cloud PCs
Submitted July 20, 2026 at 8:29 AM EDT
Our business wants contractors on Windows 365 so company data stays off their personal laptops. Does using a Cloud PC solve that requirement on its own?
Phil Kinsley:
A Cloud PC separates the work environment from the personal device, but its access and data-transfer settings still need configuration. Review clipboard, drive, printer, and other redirection for the clients contractors will use.
Apply Conditional Access and appropriate authentication to the Windows 365 access paths. Secure and patch the Cloud PC itself, limit local administration, and restrict the applications and data the contractor can reach. Check licensing and provisioning requirements for the selected Windows 365 model.
Test from the actual personal-device clients you permit. Try clipboard copying, file transfer, downloads, printing, and any browser-based route the policy intends to restrict. Record the limitations: redirection controls do not prevent a user photographing a displayed document, and unsupported clients may need to be excluded from the allowed design.
QUESTION 52 · Power Platform governance
Using Power Platform data policies to govern connectors
Submitted July 30, 2026 at 4:42 PM EDT
A maker built a flow that reads SharePoint and sends data through a consumer service. Can a Power Platform DLP policy stop that, and is it the same as Purview inspecting the file content?
Phil Kinsley:
Power Platform data policies control connector combinations and supported connector actions or endpoints. They do not generally inspect the business meaning of every payload as Purview DLP can in its supported locations.
Inventory the environment, connectors, connections, and business flow. Put connectors into Business, Non-business, or Blocked groups where supported. Business and Non-business connectors cannot be combined in the same governed app or flow. Multiple applicable policies must all be satisfied.
Some connectors cannot be blocked, and custom connectors or HTTP endpoints need their specific controls. Test an existing flow that should stop and an approved flow that should continue. If the requirement is to stop a particular sensitive value leaving through an otherwise approved connector, confirm which additional control can actually inspect or restrict that transfer.
QUESTION 53 · Microsoft 365 automation
Keeping Power Automate flows working after an owner leaves
Submitted August 11, 2026 at 10:46 AM EDT
An employee built a critical approval flow using their own connections and is leaving. If we add another owner, will the flow continue after their account is disabled?
Phil Kinsley:
Adding a co-owner does not replace the departing employee's connections. Inventory triggers, connectors, connection references, gateways, approvals, environment roles, and license dependencies before disabling the account.
For a solution-aware cloud flow, use the supported ownership-change process. A non-solution flow cannot use the same in-place ownership change; moving it into a solution or making an appropriately managed copy may be necessary. Check the new owner's entitlements.
Replace personal connections with approved operational connections that the connector supports. Test the trigger, approvals, failure handling, and final action after the old identity is disabled in a controlled scenario. If you copy a flow, ensure only the intended trigger remains active. Name both a business owner and the person who receives failure notifications.
QUESTION 54 · SharePoint security
Limiting SharePoint access from unmanaged devices
Submitted August 27, 2026 at 2:03 PM EDT
We need staff to view certain SharePoint documents from personal computers but stop downloads and sync. How would you implement and test that without blocking managed laptops?
Phil Kinsley:
Use SharePoint's unmanaged-device controls with Conditional Access app-enforced restrictions for the supported scenario. Check Entra licensing and device identification before rollout.
Decide whether unmanaged users may view only or also edit in the browser. Review whether the SharePoint administration workflow will create a tenant-level Conditional Access policy; an unintended tenant-wide change can affect more than the pilot site.
Test managed and unmanaged devices in separate sessions. Check download, print, sync, desktop-app access, supported file types, and Teams files that use SharePoint. Confirm the matching sign-in policy result. Limited web access reduces specific transfer paths; it is not protection against screenshots or photographs. For information that cannot be exposed on a personal device, deny that access rather than relying on a no-download setting.
QUESTION 55 · Security assessment
Using SCuBA alongside Microsoft Secure Score
Submitted September 9, 2026 at 9:37 AM EDT
Our Microsoft Secure Score is improving. A customer has asked for a CISA SCuBA assessment as well. What additional value would that provide, and does passing mean we are compliant?
Phil Kinsley:
Secure Score tracks Microsoft's supported improvement actions. CISA publishes SCuBA configuration baselines, and ScubaGear assesses supported Microsoft 365 settings against those baseline requirements.
Use the SCuBA findings to review explicit settings, including checks that require manual evidence or could not be completed. Record the tool version, baseline version, permissions, and services assessed. Do not count a collection failure as a passed control.
Compare findings with the customer's actual assurance requirement and current configuration. A Secure Score increase or a passing ScubaGear check is not a general compliance certification. Keep a remediation list with the affected setting, owner, and a retest result. Preserve the original evidence so the next review can show which changes produced the result.
QUESTION 56 · Audit and evidence
Deciding what evidence supports a security assessment
Submitted September 23, 2026 at 1:25 PM EDT
A consultant gave us a green assessment based mostly on screenshots. What evidence would you expect before accepting that our Microsoft 365 security controls are operating effectively?
Phil Kinsley:
Ask for the scope, criteria, assessment date, and evidence behind each conclusion. A screenshot of a policy is useful, but does not prove it covered every intended user or produced the intended access decision.
For Conditional Access, inspect policy scope and matching sign-in results. For Intune, compare assignments with recent per-setting status and missing devices. For Defender, check sensor health and an alert test. For Purview, test the specific sharing or data movement the rule should control.
Mark passed, failed, and not assessed separately. A permissions error, expired log, or inaccessible device is missing evidence, not a clean result. The report should identify the additional check needed to resolve each gap, without exposing unnecessary user or customer data in the evidence pack.
QUESTION 57 · Copilot and AI governance
Reviewing an AI agent before granting business access
Submitted October 2, 2026 at 11:11 AM EDT
A department built a Copilot Studio agent that can search documents and call business tools. What would you review before allowing it to reach production information?
Phil Kinsley:
Review the agent's identity and every connection it can use. Record the owner, permitted users, knowledge sources, tools, and whether each action runs as the current user or through a shared connection.
Test a permitted user and someone who should be denied. Check both retrieved content and actions: an answer can respect document access while a tool executes with broader authority. Apply the appropriate environment and connector policies, and review external services' data handling.
Treat instructions in retrieved documents and tool results as untrusted. For consequential actions, enforce authorization in the connected service and use confirmation where the business process needs it; a prompt alone is not that authorization control. Test how to disable the agent and revoke its connections, and confirm which logs support an investigation.
QUESTION 58 · Microsoft 365 operations
Testing tenant security changes before broad enforcement
Submitted October 12, 2026 at 3:32 PM EDT
We have a long list of security recommendations and pressure to enable them quickly. What does a practical change process look like for controls that could affect every user?
Phil Kinsley:
Write the allowed and denied cases before changing the policy. For example, the managed finance laptop should open the application, while the test device without the required compliance state should be denied.
Capture the current setting, affected population, proposed configuration, and rollback steps. Use report-only for Conditional Access, audit mode for ASR, or simulation for DLP where the control supports it. These modes collect different evidence and do not substitute for testing enforcement.
Pilot the enforced change with support staff available. Inspect the actual access or blocking result and run the business workflow. Expand after resolving material failures. Record the final configuration and set expiry dates on temporary exceptions so the pilot's workaround does not quietly become the production design.
QUESTION 59 · Security strategy
Choosing the first ninety days of Microsoft security work
Submitted October 18, 2026 at 12:05 AM EDT
I have inherited Microsoft 365, Intune, Defender, and some E5 capabilities with very little documentation. What would you prioritize in the first 90 days before buying more products?
Phil Kinsley:
In the first month, establish which identities and systems could cause the greatest disruption. Confirm administrator protection, emergency access, MFA enforcement, endpoint health, email policies, and who actually receives alerts. Fix urgent exposure as it is found.
During the second month, work through the highest-risk gaps: missing patches, unmanaged devices, unnecessary sharing, stale guests, application consent, and recovery. Give each item an owner and test the change. Exercise a compromised account and a lost or encrypted business-data scenario with the people who would respond.
By day 90, produce a short operating plan showing coverage, unresolved risks, response responsibilities, and tested recovery. Compare proposed purchases against those remaining gaps and the team's capacity to operate them. Do not spend the whole period improving a score while privileged accounts or critical devices remain unprotected.
QUESTION 60 · Cloud security
Enabling the free Foundational CSPM capabilities
Submitted March 26, 2026 at 9:44 AM EDT
Can you give me validated, step-by-step instructions for enabling the free CSPM capabilities in Defender for Cloud? I need to walk a client through it and avoid enabling the paid plan by mistake.
Phil Kinsley:
Foundational CSPM is the free baseline posture capability. The Defender CSPM plan is a separate paid option; turning on that paid plan is not necessary just to obtain the foundational assessment.
Open Defender for Cloud in the intended Azure tenant and subscription and follow the onboarding workflow. Check Recommendations and Asset inventory after assessment data appears. Confirm the resource population, not just the presence of a score.
Inspect Environment settings and each enabled plan before leaving the setup. Onboarding or a trial can enable paid protection options, and some features have separate charges or limits. Record those choices and confirm who will review them before a trial ends. Recommendations appearing later do not mean workload threat protection has also been enabled.