Blog
Cloud security lessons, Zero Trust insights, and the occasional cat joke.
Investigate Hidden Privilege Paths with Microsoft Sentinel Data Federation and Custom Graphs
Review update (September 25, 2026): Modeling, persistence and query permissions differ. Review the current graph requirements before granting tenant-wide Security Operator or Administrator solely to persist a graph. An on-demand graph job and a …
Block Prompt Injection at the Network Layer with Microsoft Entra Prompt Injection Protection
Review update (September 25, 2026): Generative AI Insights remains preview and can retain full prompts with user identity. Set access, retention and user-notice policy before enabling it. Portal screenshots below are retained from the March 2026 …
Building Custom Sentinel Connectors with CCF Push
Review update (September 25, 2026): The repaired sender treats a genuine empty upstream list as a successful zero-record poll without authentication or ingestion; a nonempty all-invalid list still fails. Rule enablement is a second phase after …
AKS Runtime Security: Binary Drift, Anti-Malware & Gated Deployment with Defender for Cloud
Review update (September 25, 2026): The merged September 25 source resolves and records an exact regional GA Kubernetes patch on first deployment and refuses implicit version changes on owned reruns. Pricing restoration is bound to the captured …
Detecting OAuth Redirect Abuse with Microsoft Sentinel and Entra ID
Review update (September 26, 2026): The merged source preserves an already-disabled user-consent policy and refuses unrecognized custom self-consent policy replacement for manual review. Reports, manifest staging and request-body files are …
The February 2026 Microsoft Sentinel Drop: UEBA Essentials, Copilot Connector, and 9 New GA Connectors
Review update (September 25, 2026): The diagram and measured results describe February evidence. For current use, Defender-portal onboarding replaces Fusion incident correlation with the Defender XDR engine. Connector descriptions refer to what is …
March–June 2026 Entra ID Changes: Passkey Profiles and Conditional Access Enforcement
Review update (September 25, 2026): Resource links to older third-party rollout summaries are historical background. Use current Microsoft guidance and the actual tenant Message Center notice for dates/cloud scope. The Baseline scopes settings link …
Just-In-Time Access for AI Agents: Building a ZSP Gateway in Azure
Review update (September 25, 2026): The merged September 25 source rejects ambiguous/dot-segment scopes and mismatched ARM response identities, uses explicit managed identity with closed SDK clients, and moves synchronous operations off the async …
Building an LLM Prompt Injection Firewall with AWS Lambda
Review update (September 25, 2026): The September 25 merged source uses documented metric-filter IS TRUE/IS FALSE operators while retaining the distinct Logs Insights grammar. Metrics, alarm and dashboard share a project-specific namespace. New …
Sentinel MCP Server: Securing Your SOC's New AI Attack Surface
Review update (September 25, 2026): The walkthrough captures show January 6, 2026 evidence and an earlier tool inventory. The related detection lab is a source-reviewed identity/activity lab; it does not by itself prove ingestion or coverage of …