Skip to content

Endpoint Security

CIS benchmarks, LAPS, Defender for Endpoint, BitLocker, Conditional Access

All Endpoint Security articles

senior 10 min read

Fix Register Security Information Lockouts Before July 6, 2026 for Windows Hello for Business and macOS Platform SSO

Audit Entra Conditional Access policies targeting Register security information before July 6, 2026 to avoid WHfB and macOS Platform SSO enrollment lockouts.

senior 10 min read

Fix Secure Boot Certificate Update Failures Before the June 2026 UEFI Deadline

Use Event ID 1795, Event ID 1801, and UEFICA2023Status to find Windows devices that still need the 2023 Secure Boot certificate update before June 2026.

mid 7 min read

Security Copilot agents in Intune: status, setup and SCUs

Which Security Copilot agents remain in Intune after the 2026 retirements, how to set up the Vulnerability Remediation Agent, SCU billing and Agent 365 context.

mid 13 min read

Blocking Shadow AI on Windows Endpoints: A Practical Guide to the Agent 365 Shadow AI Page

Detect and block shadow AI agents like OpenClaw on Intune-managed Windows devices with the Agent 365 Shadow AI page, Defender discovery and Entra controls.

mid 9 min read

Replacing Your Corporate VPN with Microsoft Entra Private Access: A Practical Guide

A step-by-step guide to replacing traditional VPN infrastructure with Microsoft Entra Private Access and Global Secure Access. Covers Quick Access setup, Private Network Connector deployment, Conditional Access integration, and the real gotchas that MS Learn doesn't warn you about.

senior 9 min read

Conditional Access 'All Resources' Enforcement Change (MC1223829): What Desktop Engineers Must Audit Before May 13, 2026

Microsoft is closing a long-standing Conditional Access loophole on May 13, 2026. Here's a practical audit workflow for desktop engineers to find affected policies, excluded apps, and custom clients before enforcement begins.

mid 9 min read

Endpoint Privilege Management in Intune: Setting Up Support-Approved Elevations

How to configure Endpoint Privilege Management's support-approved workflow in Intune so standard users can request elevation on demand without permanent admin rights.

mid 4 min read

Endpoint Privilege Manager Part 1: Introduction & Setup

Learn what Intune Endpoint Privilege Manager is and how to set it up in your environment.

mid 6 min read

Endpoint Privilege Manager Part 2: Creating Policies & Rules

Step-by-step guide to creating and configuring Endpoint Privilege Manager policies.

mid 5 min read

Endpoint Privilege Manager Part 3: Management & Troubleshooting

Monitor EPM activity, generate reports, and fix common issues.

mid 7 min read

BitLocker recovery keys in Intune, Entra ID and AD DS

Find, view and rotate BitLocker recovery keys stored in Entra ID, Intune and AD DS: key IDs, admin roles, self-service, Graph PowerShell and rotation steps.

mid 1 min read

Certificate Management in Windows

Managing certificates in Windows. SSL, code signing, and enterprise PKI. PowerShell certificate operations.

senior 1 min read

CIS Benchmark Hardening for Windows

Apply CIS Microsoft Windows 10/11 Enterprise Benchmark. Secure your Windows devices with proven security settings.

mid 2 min read

Intune Compliance Policies Explained

Configure Intune device compliance policies. Set up conditions for access, conditional access, and device health.

junior 2 min read

Intune Device Restriction Profiles Explained

Complete guide to Intune device restriction profiles. Configure Windows security settings, firewall, and more.