zero-trust
Lessons from the field. Always landing on my feet.
From Authorization to Action: Operationalizing CISA's Microsoft Cloud Logs Playbook in Sentinel
CISA released the Microsoft Expanded Cloud Logs Implementation Playbook on January 15, 2025. Its implementation guidance remains a practical baseline for deciding which Microsoft cloud audit signals belong in a defensible logging program. That is …
Copy Fail in the Cloud: A Defender, Sentinel, and AKS Response Guide for CVE-2026-31431
A Linux local privilege escalation bug is easy to dismiss if you only think in traditional server terms. An attacker already needs local access, so how bad can it be? In cloud environments, that assumption breaks fast. A compromised container, a …
Block Prompt Injection at the Network Layer with Microsoft Entra Prompt Injection Protection
A while back I built an LLM Firewall with AWS Lambda, an API screening demo that returns an allow/block decision for common prompt-injection patterns. That lab does not connect to an LLM; deploying the pattern in front of a model requires a separate …
March–June 2026 Entra ID Changes: Passkey Profiles and Conditional Access Enforcement
Microsoft made passkey profiles and synced passkeys generally available in March 2026, then adjusted a separate Conditional Access enforcement rollout to begin June 15, 2026. Both changes entered tenants through Microsoft-managed schedules, although …
Just-In-Time Access for AI Agents: Building a ZSP Gateway in Azure
AI coding assistants may need scoped deployment permissions. Backup automation needs Key Vault secrets at 2 AM. Security scanners need Reader access on a schedule. The easy answer is standing permissions—give each service principal what it needs and …
Sentinel MCP Server: Securing Your SOC's New AI Attack Surface
In September 2025, Microsoft announced the Sentinel MCP Server, a Model Context Protocol implementation that lets MCP-compatible AI assistants query your Sentinel data using natural language. Microsoft highlights GitHub Copilot, Copilot Studio, and …
Secure Your Container Supply Chain: SBOM, Signing & Attestation with GitHub Actions
Over the last couple of weeks, I’ve been diving deep into container supply chain security. Between high-profile incidents like SolarWinds, Log4Shell, and the xz Utils backdoor, it’s clear that securing the build pipeline is just as critical as …
Terraform 1.11 Write-Only Arguments: Keep Supported Secrets Out of State
If you’ve worked with Terraform and secrets, you’ve probably wondered: “Wait, is my password actually in that state file?” The answer has historically been: yes. The sensitive = true flag does a great job hiding values from CLI output, but the state …
Securing the Agentic Workforce: Microsoft's Zero Trust for AI Agents
Status update — August 13, 2026: Microsoft Agent 365 is generally available for commercial customers, effective May 1, 2026, and the Microsoft Entra Agent ID platform reached GA in April 2026. The Ignite 2025 rollout history below remains useful …
Welcome to Nine Lives, Zero Trust
If you’ve found your way here, welcome. Pull up a chair. Let me explain what this is all about. Why “Nine Lives”? The old saying goes that cats have nine lives. They fall off things, get into trouble, and somehow always land on their feet. Cloud …