362 - Sentinel isn’t just a SIEM anymore

We've talked about Microsoft Sentinel a few years ago, and realized it's time to brush up our understanding of the new and interesting capabilities it has to offer. In this episode, we talked about where Sentinel is today, the retirement of the Azure Portal side, new AI-related capabilities, as well as the recently announced ISOC.(00:00) - Intro and catching up.(04:34) - Show content starts.Show links- What is Microsoft Sentinel data lake? (Microsoft Learn)- Microsoft Sentinel pricing- Plan costs and understand pricing and billing (Microsoft Learn)- What’s new in Microsoft Sentinel (Microsoft Learn)- What’s new in Microsoft Sentinel: August 2026- What’s new in Microsoft Sentinel: June 2026- What’s new in Microsoft Sentinel: RSAC 2026- UPDATE: New timeline for transitioning Sentinel experience to Defender portal- Onboard to Microsoft Sentinel data lake and graph (Microsoft Learn)- ISOC- Give us feedback!

We quite often talk about amazing enterprise-grade capabilities, like Azure Landing Zones, Data Lakes and clusters of super smart AI agents. But what about the small businesses? What do they need to get starting from scratch? In this episode we dissect the needs, the capabilities, the licenses, and security for anyone to get started in Azure and Microsoft 365!(00:00) - Intro and catching up.(03:00) - Show content starts.Show links- Microsoft 365 business plans and pricing- Azure Files Entra-only identities- Plan your Microsoft Entra join deployment - Windows Autopilot device preparation, user-driven Entra join - Plan for mandatory Microsoft Entra multifactor authentication- Give us feedback!

This week, we take a look at GitHub Enterprise, and why you should care. We talk about features, compliance, licensing, total cost, and preferred setups whether you're a small or large organization. Join us this week to level up your GitHub setup!(00:00) - Intro and catching up.(03:45) - Show content starts.Show links- GitHub pricing- Configuring SAML single sign-on for your enterprise (personal accounts mode)- About Enterprise Managed Users (SAML/OIDC/SCIM partner matrix)- Choosing an enterprise type (personal accounts vs EMU)- Entra ID SSO tutorial - GitHub Enterprise Cloud Organization- Entra ID SSO tutorial - GitHub Enterprise Cloud Enterprise Account- Give us feedback!

In this week's episode, we look at recent Microsoft Tech updates. By popular request, we're expanding our scope beyond Azure to include Microsoft 365, Power Platform, and related Microsoft platforms and capabilities. What's new? What's interesting? What's retiring? (00:00) - Intro and catching up.(05:35) - Show content starts.Show links- What's new in Microsoft Security: August 2026- Microsoft Foundry docs: What's new for August 2026- Resilience for long-running Microsoft Foundry hosted agents (preview)- Microsoft Entra Tenant Governance is now generally available- Copilot Code Review Reaches Azure Repos (InfoQ)- Announcing General Availability of Managed Instance on Azure App Service- Managed Instance on Azure App Service Reaches GA for Legacy Windows Apps- MCP Firewall in Global Secure Access- Microsoft Sentinel in Azure Portal will be retired March 31, 2027- Project HydraFusion- Azure Multicloud Interconnect with AWS- Agent 365 license clarification - Conditional Access Policies, Licensing in general- Give us feedback!

This week we take a look at Microsoft Security Exposure Management, and what has changed since the last time we looked at it. Among these findings we can see containment capabilities for AI agents, and several capabilities converging into MSEM. Join us for a fun discussion on the latest and great security capabilities!(00:00) - Intro and catching up.(03:42) - Show content starts.Show links- Secure Now- Containment strategies for AI in Secure Now- What's new in Microsoft Security Exposure Management- Overview of attack paths- Predefined classifications for critical assets- Agentic code security overview (Codename MDASH)- AI-powered defense for an AI-accelerated threat landscape- Our earlier take: episode 231- Give us feedback!

This week we focus on licensing with Microsoft 365 E7. What's included in the bundle, and which ones are relevant and when? We reflect on the upgrade path from Microsoft 365 E5, as well as E3 + Defender Suite, and reflect on the options and pricing.(00:00) - Intro and catching up.(02:50) - Show content starts.Show links- Microsoft 365 E7 announcement- Microsoft Agent 365 overview- Microsoft licensing FAQ, Agent 365- Purview data security and compliance for Agent 365- Independent E7 licensing analysis (SAMexpert)- Our earlier take on Agent 365 and Entra Agent ID: Episode 336- Give us feedback!

This week we take a look at Microsoft Global Secure Access (GSA). It's been a few years since it was announced, and it's time to refresh our thinking on what GSA is today, how companies can use it, and what a rollout in 2026 would look like. Join us in discussing GPUs, VPNs, and what a delivery project would include!(00:00) - Intro and catching up.(03:56) - Show content starts.Show links- Global Secure Access deployment guide- Private Access deployment plan- Global Secure Access operations guide- Enable Intelligent Local Access- Configure Private Access for Active Directory domain controllers (preview)- What is Global Secure Access (licensing overview)- Break-glass script for compliant network policies- Our previous take: Episode 201- Give us feedback!

In this week's episode, we look at recent Microsoft Tech updates. By popular request, we're expanding our scope beyond Azure to include Microsoft 365, Power Platform, and related Microsoft platforms and capabilities. What's new? What's interesting? What's retiring? (00:00) - Intro and catching up.(02:18) - Show content starts.Show links- Microsoft Entra Backup and Recovery- Agent identities in Conditional Access policies- Project Perception and Microsoft Learn documentation- Azure Firewall Explicit Proxy- Microsoft Agent Framework – multi-agent orchestration SDK (GA)- Public Preview: AI Gateway in APIM- Public Preview: Protect sensitive generative AI telemetry in Application Insights- Foundational CSPM becomes opt-in for new subscriptions- Give us feedback!

Azure Front Door just got programmable. Edge actions run your own JavaScript at Microsoft's edge, so A/B splits, token checks and origin routing happen before requests hit your backend. We cover what they do, where static rules run out, how they compare to Cloudflare Workers, and how to try them. (00:00) - Intro and catching up.(03:56) - Show content starts.Show links- Edge Actions - Azure Front Door | Microsoft Learn - Introducing Azure Front Door edge actions | Microsoft Community Hub- Give us feedback!

Microsoft has put the Active Directory Tier Model on GitHub, MIT-licensed, with a deployment engine, a drift auditor, and around 1,700 tests. This used to be consulting material that Microsoft deployed to you as a paid engagement, so the obvious question is: why now? We start with that question, and also consider whether Active Directory is still worth your attention.(00:00) - Intro and catching up.(03:55) - Show content starts.Show links- Repository- FAQ- What's new in Windows Server 2025 (the AD DS section)- Microsoft Learn - Enterprise access model- Microsoft Digital Defense Report 2025- Give us feedback!