NexCOMMUNITY QUESTIONS
Microsoft 365 & Security: Questions & Answers
Practical answers to questions I have received through LinkedIn, this website, community meetings, and online webinars.
Answers by Phil Kinsley. Collected February 2025 through October 2026.
Contributor names and identifying handles are omitted because permission to publish them was not requested at the time. Questions are edited for clarity.
Answers reviewed October 18, 2026. Submission dates are preserved below.
Licensing, supported platforms, and tenant configuration can change. Check the requirements that apply to your environment before making changes.
Have a question?
Send it privately to Phil. You can choose whether it may be published anonymously.
Ask a question ↗Page 5 of 5 · Questions 61–69 of 69
Questions on this page
- Understanding Microsoft Purview DSPM
- Reporting an observed authentication issue accurately
- Choosing Zero Trust Assessment SCuBA or both
- Using Copilot Studio in an organization with Okta
- Explaining how Purview and Fabric work together
- Choosing a GRC workspace for a Microsoft environment
- Starting Microsoft Purview Data Lifecycle Management
- Checking the Defender settings most often overlooked
- Helping leadership move from a security score to action
QUESTION 61 · Microsoft Purview
Understanding Microsoft Purview DSPM
Submitted October 10, 2026 at 4:01 PM EDT
What is Microsoft DSPM in Purview, and how does it relate to DLP, sensitivity labels, and Copilot readiness?
Phil Kinsley:
Purview Data Security Posture Management helps locate and prioritize data exposure across the sources and signals configured for the experience available in your tenant. Start with a specific finding, such as sensitive content shared too broadly, and inspect the affected data and permissions.
Use labels, access changes, DLP, and other supported controls to address that finding. Current DSPM can include guided or agent-assisted remediation as well as recommendations; check the proposed action and approval before treating it as completed. Confirm the actual permission or policy result afterward.
Microsoft distinguishes the newer DSPM experience from DSPM (classic) and DSPM for AI (classic). Check roles, licensing, setup, supported sources, and feature availability for the version in use. An empty view may reflect missing setup or coverage rather than an absence of exposure.
QUESTION 62 · Security assessment practice
Reporting an observed authentication issue accurately
Submitted October 13, 2026 at 7:48 AM EDT
I encountered a problem involving passkeys and Windows authentication during assessment work. If I cannot find a documented known issue, how should I describe the experience?
Phil Kinsley:
Record the failing tool version, authentication method, operating system, relevant module versions, error, and access policy. Those details are needed before deciding whether the failure is a tool limitation, an unsupported setup, or a tenant-specific problem.
Compare the observed flow with the tool's published authentication guidance. If a different supported flow succeeds, record exactly what changed and describe it as a workaround for that tested configuration. Do not claim that all passwordless authentication or all tenants are affected from one failed attempt.
Keep Conditional Access and MFA protections in place while investigating. Redact customer and identity details from screenshots, but retain the error and version information needed to reproduce the issue. An unresolved root cause should stay unresolved in the report rather than becoming a product claim.
QUESTION 63 · Security assessment
Choosing Zero Trust Assessment SCuBA or both
Submitted October 13, 2026 at 8:07 AM EDT
When would you use Microsoft's Zero Trust Assessment, CISA SCuBA, or both? What are the practical advantages and limitations of each?
Phil Kinsley:
Use Microsoft's Zero Trust Assessment when you want its supported configuration checks and remediation guidance organized around Microsoft's Zero Trust approach. Use ScubaGear when the requirement is to compare supported Microsoft 365 settings with CISA's SCuBA baselines.
Check each tool's current scope, permissions, versions, and manual evidence requirements before running it. Neither checks every part of an organization's security program, and their scores or pass counts are not interchangeable.
Run both when they answer different stakeholder questions. Reconcile overlapping findings into one remediation list so the same Conditional Access issue does not become two unrelated tasks. Keep the specific evidence and baseline requirement with each finding. A completed assessment is a point-in-time review, not proof of continuous protection or a general compliance certification.
QUESTION 64 · Copilot and identity
Using Copilot Studio in an organization with Okta
Submitted October 13, 2026 at 10:09 AM EDT
Can Copilot Studio agents and blueprints coexist with Okta, or do we have to replace our identity platform before using them?
Phil Kinsley:
Separate three sign-in paths: administration of Copilot Studio, the agent user's sign-in, and authentication to each tool or data source. Okta federation for Microsoft 365 does not remove the Entra tenant or automatically configure all three paths.
For the Teams + Microsoft 365 channel, current Copilot Studio guidance requires Authenticate with Microsoft. Other supported channels can use manual authentication with the supported OAuth configuration. Do not assume an Okta-authenticated website makes every embedded agent and connector operate under that same identity.
Build one representative agent and test permitted and denied access in the intended channel. Inspect whether tools use delegated user access or a shared connection. Connected agents can have authentication compatibility restrictions too. Keep the tested channel and identity design with the deployment instructions rather than making a tenant-wide compatibility claim.
QUESTION 65 · Microsoft Purview and Fabric
Explaining how Purview and Fabric work together
Submitted October 14, 2026 at 2:16 PM EDT
What is the practical summary of how Microsoft Purview integrates with Microsoft Fabric? Which platform owns governance, and where do protection and compliance fit?
Phil Kinsley:
Use Fabric's OneLake catalog for its built-in discovery and governance experience. Purview adds supported information protection, DLP, audit, risk, and compliance capabilities. Connecting the products does not apply every Purview capability to every Fabric item.
Choose a concrete requirement, such as labeling supported content, inspecting a supported DLP event, or investigating an activity. Check the item types, permissions, configuration, and license or consumption charges for that feature. Test export behavior separately from behavior inside Fabric.
Assign owners for both the data and the protection settings. A sensitivity label on an item is not evidence that every downstream copy is protected. Price the capabilities you intend to deploy; do not estimate all Purview charges solely from the total size of the Fabric estate.
QUESTION 66 · Governance and compliance
Choosing a GRC workspace for a Microsoft environment
Submitted October 14, 2026 at 2:29 PM EDT
We want a GRC portal instead of scattered documents. Should we use Microsoft Purview Compliance Manager, build something with SharePoint and Power Apps, or evaluate a dedicated GRC platform?
Phil Kinsley:
List the process you need the system to support: control ownership, evidence collection, exceptions, approvals, remediation, and an audit trail. Then ask each candidate to demonstrate that same process.
Purview Compliance Manager supports assessments and improvement actions, including responsibilities and evidence-related work. Confirm the required templates and licenses. It may fit a Microsoft-centered assurance process, but that does not automatically make it a complete enterprise GRC platform.
SharePoint and Power Apps can support a smaller register and document-approval workflow if somebody owns its maintenance, permissions, and support. A dedicated GRC product is more relevant when enterprise risk, internal audit, or complex relationships between controls and assurance programs dominate the requirement. Compare the demonstrated workflow and ongoing support cost rather than choosing from product names alone.
QUESTION 67 · Microsoft Purview
Starting Microsoft Purview Data Lifecycle Management
Submitted October 14, 2026 at 3:38 PM EDT
What is Purview Data Lifecycle Management, and how should we start using it across Microsoft 365?
Phil Kinsley:
Start with the approved retention schedule: the content, the required period, the date or event that starts it, and who authorizes disposal. Data Lifecycle Management implements retention and deletion for supported workloads; it cannot decide those obligations for you.
Choose a location-scoped retention policy or item-level retention labeling as appropriate. Check licensing and roles for the selected features. More advanced records-management requirements can involve separate capabilities and entitlements.
Review existing policies and holds before enabling deletion. Pilot representative content and allow for service processing. Teams messages, SharePoint files, and OneDrive files need their correct locations covered. Keep sensitivity classification and recovery requirements separate: retaining a compliance copy is not a tested restore process, and a Confidential label does not establish a retention period.
QUESTION 68 · Endpoint security
Checking the Defender settings most often overlooked
Submitted October 14, 2026 at 7:06 PM EDT
What should a Defender for Endpoint deployment cover beyond onboarding, particularly settings that can be dangerous when configured incorrectly or are commonly overlooked?
Phil Kinsley:
After onboarding, I would check cloud-delivered protection, tamper protection, security-intelligence updates, exclusions, and the actual antivirus mode. Confirm the owner and effective setting, not just the configuration assigned in Intune.
Review ASR rule status and prerequisites, network protection where required, and sensor health. Check for conflicting Group Policy, Configuration Manager, or other management settings. Investigate broad folder or process exclusions before accepting them as an application requirement.
Run the supported detection test on an approved device and confirm the alert reaches the SOC or internal analyst. Test an authorized response action and agree who handles failures. Keep the missing and unhealthy devices visible; a successful onboarding job does not prove that the whole fleet has the intended protection.
QUESTION 69 · Security assessment reporting
Helping leadership move from a security score to action
Submitted October 15, 2026 at 8:24 AM EDT
How should a readiness report connect the executive summary with the detailed findings, so leadership can understand the priorities without reading every technical section?
Phil Kinsley:
Give leadership a short list of decisions and actions, with links to the evidence behind them. Each entry should show the affected scope, consequence, recommended action, priority, current status, and responsible team where known.
For example, distinguish an urgent administrator-MFA gap from an incomplete device export. The first may need immediate enforcement work; the second needs additional evidence before you can make a coverage claim. Neither should disappear inside one overall percentage.
Keep stable finding identifiers between the summary and the technical detail. Separate completed remediation from accepted exceptions and unassessed areas. Leadership should be able to see what needs funding or approval, while the technical owner can identify the setting to change and the test that will demonstrate it worked.