Learn
Guides to workspace posture, in plain language.
Practical steps for hardening Microsoft 365, Google Workspace, and third-party OAuth permissions.
6 min read
Hardening Microsoft 365 without breaking sign-in
A practical sequence for enabling phishing-resistant MFA, blocking legacy authentication, and restricting external forwarding in Entra ID and Exchange Online.
5 min read
The practical Google Workspace security checklist
How to lock down Google Admin Console: Super Admin limits, 2-Step Verification with security keys, external Drive sharing, and API controls.
6 min read
Taming risky third-party OAuth app grants
How "Sign in with Microsoft" and "Sign in with Google" create shadow-IT backdoors—and how to audit and restrict high-risk OAuth scopes.
5 min read
How to block legacy authentication in Entra ID without breaking scanners
Audit sign-in logs for IMAP, POP3, and SMTP Basic Auth, migrate multifunction printers to High Volume Email or OAuth, and block legacy protocols.
6 min read
Rolling out phishing-resistant MFA (FIDO2 & passkeys) for cloud admins
Why SMS and standard push MFA fail against modern reverse-proxy phishing kits, and how to require WebAuthn/FIDO2 passkeys for privileged roles.
5 min read
Stopping silent external mail forwarding in Exchange Online and Gmail
Business Email Compromise (BEC) attackers hide inbox forwarding rules to exfiltrate invoices and password resets. Here is how to block them at the tenant level.
5 min read
Locking down anonymous "Anyone with the link" file sharing
Prevent accidental public exposure of customer data and internal spreadsheets in SharePoint Online, OneDrive, and Google Drive.
6 min read
How to run quarterly user and admin access reviews for SOC 2 & ISO 27001
Replace manual CSV exports with a structured quarterly review of Global Admins, Super Admins, dormant accounts, external guests, and OAuth grants.
5 min read
Right-sizing Global Administrators and Google Super Admins
Why standing Global Admin and Super Admin counts should stay between 2 and 4 accounts—and which delegated roles to use for daily IT work.
7 min read
Mapping CIS M365 & Google Workspace benchmarks to SOC 2, ISO 27001 & NIST CSF 2.0
How a single hardened cloud baseline satisfies CIS v3.1, SOC 2 Type II, ISO/IEC 27001:2022, NIST CSF 2.0, and NIST SP 800-171 simultaneously.