Hello and welcome to the Everyday Defender podcast.
I'm Chris Goosen and I'm joined once again by my friend from the Netherlands, Koos.
Hey Chris, good morning.
How are you?
Yeah, doing very well.
Thank you.
Yes, it is evening here in Sydney and it's been very hot.
And I think this is a very weird concept for a lot of folks who are not in our hemisphere.
But when it's 40 degrees Celsius and it's this close to Christmas, it gets really interesting.
It's very much beach weather over here.
Yeah, and it's like a little over 6 p.m. at your end, right?
And it's a little over 8 a.m. in the morning in Amsterdam time.
So while the sun is still shining bright through your blinds there in the back, I'm still here
looking at a pitch black outdoorsy situation here over here.
So that's really weird.
Crazy.
And the wonders of modern technology, right?
So in today's episode, we're going to do a or at least attempt to do a little bit of
a recap of Ignite 2024 that happened just recently in Chicago.
I was lucky enough to be in Chicago for Ignite.
It was interesting to say the least.
The weather was fantastically crazy with snowstorms and things like that, which I am obviously
not used to and built for.
So yeah, exciting times talking about Ignite.
Not a lot in terms of security announcements from Ignite.
You know, I guess everyone probably expects or assumes that Ignite was very much focused
around AI and copilot.
And in fact, really, that was the case.
It was very much a copilot event.
But nonetheless, there were some some interesting things, you know, on the security side of
things that that were announced.
So I'm going to take a look at some of the announcements in Intune and Entra.
And then, Koos, you've got a you've got a few other things that you want to talk about
as well, right?
Yeah, yeah, that's true.
And I actually went through the Ignite book of news once again to refresh my mind what
was actually announced.
And I wanted to share a couple of fun facts first, Chris.
I looked up the terms copilot and AI.
And how many times do you think those words popped up in the book of news?
I'd imagine quite a lot, right?
Well, hundreds of times each one.
So it was really crazy.
It looks like every line was filled with copilot and AI.
And also, those events are quite infamous for their feature or product renames, right?
So we didn't get we didn't went back to Azure AD yet.
We're still hoping for that one, I guess.
Still hoping for that one.
Yeah.
So but we only got two product renames.
I think that's that's a low score, I guess.
Yeah, pretty low score.
They were you know, maybe they're waiting for some of the other conferences or things
next year to drop some more on us.
But what did we what did we get renamed out of interest?
Yeah.
Well, one rename was based around Azure Stack HCI.
So that is running your Azure locally, so to speak.
So Azure, Azure Virtual Desktop for Azure Stack HCI was now renamed to Azure Virtual Desktop
for Azure Local.
So apparently, they're more emphasizing the Azure Local product name instead of Azure
Stack from the past.
And also, there was a rename in the pure purview section.
So Microsoft purview data catalog has been renamed to purview unified catalog.
And I actually heard from two colleagues, which were recording a demo for a session.
And from one day to another, they were like, where is the data catalog?
I cannot find it anymore.
They were looking over it.
And the rename has already been been applied in their tenant.
So they had to figure out that it's now called unified catalog.
Yes.
And it shifted way down from being way at the top with D to way down to the bottom with
you.
Yeah, that's also true.
I'm not familiar with the interface.
I'm not really sure what it would look like.
But yeah, it could be.
Yeah.
So nothing special on that end.
Yeah, fair enough.
Okay.
Well, I guess if we if we get into it, let's take a look at some of the the the intro announcements.
And I think, you know, it should come as no surprise that, you know, some of what was
announced as far as Entra and Intune, in fact, as well, at Ignite is very much to get around
copilot, right.
So really, we're going to start seeing this.
And I expect we're going to see this across the board.
And this is really just the beginning of it.
But we're going to start seeing Microsoft Security Copilot surfacing in more places
within the portals, right, all of the management portals.
And so they've they've made sort of an announcement around Intune.
And we're going to see a lot more of that security copilot stuff being integrated and
surfacing in Intune.
The main parts of the integration, I think, are sort of in the advanced analytics piece.
So being able to use natural language to help with your KQL queries, I think that's it's
pretty powerful stuff, I think, if you're not if you're not natural or you're not super
familiar with KQL and you don't use it on a daily basis, you know, being able to naturally
speak or type a prompt in natural language for something and then have that KQL query
given and generated for you.
I could see that being really useful for folks.
So I think that really works well as well.
I think of it a little bit when when security copilot or copilot for security when it was
called back then, another rename, by the way, was in early days.
And the results were not that good.
But I read did some tests lately and it was really good, actually.
And it's also good to help you understand what data lives in what table.
Right.
So there are so many tables in the vendor.
I mean, you ask copilot, but also chat GPT, for example, it knows which tables to search
for certain data, which is already very useful to start with.
That's and that's that's one of the biggest barriers to entry, right, to get in to writing
these queries is just knowing what you're growing.
So so I think that's that's pretty awesome.
That's something that got announced.
There's some some sort of copilot insights coming into the input privilege management
stuff that you PM.
Again, I think this is kind of useful.
You know, if you're if you're using input privilege management, and I'll be honest,
I don't have a lot of customers who've kind of gone down this route just yet.
But essentially what it is for those folks who don't know is if you have, you know, elevated
prompts, you know, you're trying to install software, for example, within on Windows 10
or Windows 11, and you get that prompt for elevation for the software that goes into
like a workflow, an admin workflow where an administrator can take a look at, you know,
the application that's being installed and decide to grant you access to to to that elevation.
And copilot is now sort of enriching that that prompt, right.
So we cannot take the hash of the of the the application that's being installed and go
and have a look and see whether there's some, you know, malware or something that is known
to exist in this.
And again, I think this can be really useful for large orgs where you may already have
this workflow and then building this sort of copilot enhanced capability onto that,
I think will be really handy for some policy management is another area where we're going
to see copilot surface.
Again, I think this is kind of useful.
You know, I build a lot of interesting policies and I spend a lot of time in the policy editor.
And you know, how I how I normally do it is I have policy editor opening one tab and I
have another tab open to the Intune documentation on learn.
And then if I'm if I'm trying to figure out an exact, you know, setting that, you know,
I'm looking that up on learning to make sure that I've got the right thing and I'm able
to like configure the right thing and making sure that I'm configuring it in the right
way.
Right.
Well, with this sort of Intune surfacing in there now, you can actually get better insights,
I think, into what a specific policy does by just clicking the little into sorry, copilot
button in Intune.
I think that can be really useful, especially if you've got a lot of policies and it's contextual.
So it'll tell you if you have the setting configured in a different policy or if there's
likely to be a conflict or or anything like that.
So you know, yeah, I think that's cool.
I think it's going to be, you know, make folks lives a little easier.
And then the last area, I think, where we're going to see some some or whatever announced
some some sort of integrations is on auto patch.
So again, if you auto patching or using auto patch to update your Windows 10 or Windows
11 machines, you're now going to be able to get that sort of copilot sort of insights,
if you will, into that process where you can if you wanted to go and find out which machines
don't have a specific update applied yet or figure out why there are issues with a specific
update applying to some of your fleet or stuff like that.
Right.
It can be very sort of contextual to you.
So, you know, all in all, I think it's going to be useful for a lot of folks.
I think it's going to take a little bit of getting used to for a lot of people as well.
You know, if you're not used to doing this daily.
But I think as you start seeing this as an easy button, probably going to be be quite
useful.
So maybe we should spend a separate episode on this, Chris.
But does everyone with an M365 copilot license automatically receives these abilities in
their tenants?
You know what, that is a very good question.
You know, you have to have security copilot enabled in your tenant services.
Yeah, that's a separate service.
So for people looking in Microsoft 365 copilot is your copilot for Word, Excel, Teams, Outlook,
all that stuff, even power apps and such.
But for all the security stuff, you have to deploy an Azure resource, in fact, which is
a security copilot, SCU.
That's a security compute unit or something like that.
And you have to pay for that separately, depending on how much you use it, how much you prompt
it, how much you make it to make it to work.
And that's also the element you need for the vendor.
But it's also the same resource that is utilized for the Entra and Intune integrations.
Right.
Yeah.
So that's a good call out, right?
Is it obviously with all of these cool features comes additional licensing in some instances,
right?
And again, we talked about sort of the employee privilege management and the Entune advanced
analytics stuff.
That's all part of Entune Suite, which is not Entune, but it is available as an add-on or
as Entune Suite if you wanted to.
Yeah.
And it might be a bit confusing that Entune has its own portal, the vendor has its own
portal, Entra ID has its own portal, but still the security copilot that's managed in a completely
different portal, the Azure portal.
So that's a good to know.
Yeah.
And I think that's what they're doing here, right?
Is with a lot of these integrations is they're starting to bring some of that stuff from
the security copilot portal, if you will, and just sort of surfacing that into the admin
panels that folks are already using, right?
So because I think one of the challenges here is if you take aside the licensing implications
and the costs, right?
Because sometimes as techies, we don't care about the costs.
Like we're not directly paying them, right?
But what we do care about is having to have six portals open to do one thing.
And so now if they start surfacing some of this sort of goodness, I guess, if you will,
into the portals that we already use, hey, we're so much more likely to start using it
now because we're not jumping to yet another portal.
So yeah, that's true.
And you're actually building a great bridge there, Chris, to my subject of the day.
So I wanted to talk a little bit more about the defender XDR and everything that's new.
Well, a couple of things that are new, at least.
And I think it's funny.
I think most people, especially outside the Microsoft security space, when you think about
the defender, some might still think about the end point only, right?
But XDR, as most people probably know, stands for cross detection and response.
And the defender XDR is actually the whole defense suite with quote unquote, all the
defenders, right?
So the front of the endpoint, the front of Office 365, identity, cloud apps, and try
the identity protection.
Everything is now finally integrated into one portal because not long ago we had several
separate portals for all of those products as well, right?
Defender identity and Azure Security Center, which is still there.
But everything is now at least integrated in a single portal.
And last year, Microsoft already made some effort in unification of all those portals.
And then they actually rebranded it the Unified Security Operations Platform, which is a fancy
name of security.microsoft.com, for which we probably most of us know it.
And last year also Sentinel was added at the same time together with that rename.
So Sentinel, as you know, is an Azure resource, a log analytics workspace living in Azure.
But it's now also integrated in the Unified Security Operations Platform as well.
And I think that's great because now you have one place where you can find all your incidents.
You have one place where you can do that advanced hunting you were mentioning as well, the KQL
stuff.
And now you can look through all the tables from Defender and Sentinel.
But a couple of things were still missing there.
And it was not really an actual Ignite launch.
It was a couple of weeks later, I guess.
But now finally, workbooks are also available there in the Defender portal.
So Azure workbooks is actually an Azure resource, but it's quite relevant to log analytics and
also Sentinel to build dashboards.
And so Microsoft has plenty of templates for you to visualize how many users are using MFA
or how many incidents you got in the last year on a daily basis or a lot of useful stuff
there.
And I think it's great that you don't need to branch back to the Azure portal to see
those dashboards and you now have them in the Defender portal.
Another thing that was announced during Ignite is that now Sentinel will also be available
to customers who do not use Defender XDR, but it will still be available for them in
the Unified Security Operations Platform portal.
And at first I was like, why do you want to do that?
If users are only using Sentinel and had nothing to do with the Defender stuff, why do you
want to force them to use the quote unquote Defender portal to use Sentinel?
Well, the big reason is a copilot.
Obviously, the security copilot experience with all the Sentinel integration is not available
in the Azure portal.
You have to use the Defender portal for that.
So at least it's...
I'm not sure how I feel about this on one hand, and I think it's good that you have
the security copilot integration.
But I think if you're only using Sentinel and are not using any of the other Defender
products, in my opinion, I think you should reevaluate to probably onboard those products
instead of paying for security copilot right away.
Right?
Do you think that part of that as well is to get folks familiar or to give them a little
bit of a taste of what it could look like if they use the other products?
So we give you the portal, but none of that stuff's active for you if you don't have a
license, right?
So you can click on it.
No.
That's why I don't think it's...
How do you say that?
It could be a smart upsell from Microsoft parts, right?
But you don't have the data there when you're not paying for it.
So all the tables are not visible.
You don't have the full kill chain coverage of your detections, right?
You don't have the great investigation graph covering all the different attack parts.
So I'm not really sure.
I think people only using Sentinel should really look into the other Defender stuff
as well.
But yeah, well, at least it's there.
So not much announcement from that.
I also see the role of Sentinel becoming a little bit different.
When I started in Microsoft security almost six years ago, Sentinel just went general
available.
But back then we still had all the different portals from all the different Defender products.
So Sentinel acted as an orchestrator, if you will, between all those different Defender
products, pulling in all the alerts from all the products and visualizing them in a Sentinel
UI.
Now that everything has shifted to the Defender portal, which arguably be a much better UI
and nicer UI, Sentinel is hanging in there probably for your custom logs and getting
some logs in the Defender, like your EntryD signing logs, for example, or perhaps Azure
platform logs.
But the whole UI of Sentinel, I think, will be less and less used over time.
And people are switching to the Defender instead.
Interesting.
So some other newer integrations in the portal are Purview Insider Risk Management that is
now integrated in the incident page in Defender.
And it appears based on all the announcements we saw that this is going to be a big year
for data security.
Don't you agree?
So Purview and data security is a hot topic right now.
I think so.
And I think that it's time that the rubber meets the road when it comes to this stuff,
right?
Because everyone's been saying, when Co-Pilot first came out, it was go use Co-Pilot, go
use Co-Pilot.
And then people sort of said, hang on.
In order for us to use Co-Pilot, we have to have our data estate in order, right?
And so that became the catchphrase of the last 18 months is get your data estate in
order.
But no one really kind of defined what that actually means, because it's a difficult problem
to solve.
When you actually start digging into what does that actually mean?
Yeah, it's hard.
Data security is a difficult problem.
So I agree with you.
I think there's going to be continued focus, because I think it is a barrier to entry.
People are organizations are not going to jump on the Co-Pilot.
Not every organization is going to jump on the Co-Pilot bandwagon until they have these
data bits in their data estate in order, if you will.
Yeah.
And to be honest, I also struggle a bit with the onboarding part for my customers, because
I'm 100% technical, right?
So I like to build scripts and deploy and build stuff.
And when it comes to purview, you also have to embrace a lot of the business aspect of
the product, right?
So you have to go and have some decent discussions about how data is being used and what data
lives where.
And it's a completely different onboarding aspect compared to all the other Defender
products, I would say.
Yeah.
And again, those discussions are difficult because a lot of organizations don't actually
know.
So you get all of the business decision makers in a room or the business owners in a room
and everyone wants to go away and figure it out.
No one can give you the answers straight away, right?
That's quite common.
So it's a very difficult problem to solve, for sure.
Well, Microsoft does help you a little bit with it, but more on that later.
I have another announcement on my list.
But first, I want to touch on, I think, probably the most notable product becoming a general
available during Ignite, and that's Microsoft Security Exposure Management.
And before I explain what it is, I think it's good to understand the different way attackers
and Defenders generally operate.
Have you heard about the name John Lambert, Chris?
I've seen some of his stuff floating about, yes.
But I don't know him personally.
No.
So he's at Microsoft for over 24 years already.
He started in the Windows Security team, and later he led the Microsoft Threat Intelligence
Center known as Mystic.
So he's really a big name when it comes to Microsoft Security, and he has some great
ideas on that.
And he famously quoted once, defenders think in lists and attackers think in graphs.
As long as this is true, attackers win.
And what he was actually saying with that is that defenders are mostly relying on a
lot of lists.
They have Excel sheets of all their resources.
They have content management systems, the CMDBs, all that kind of stuff with lists of
resources they have and they need to maintain.
But attackers don't have any access to those lists.
They just breach your network.
They land somewhere in the graph, as John called it.
And the graph is actually a mesh network, representing your network, your applications,
your identities.
And they just start to hack into the next point in that mesh network and laterally move
and traverse across your networks and come by your crown jewels while they're at it.
So that's why John was emphasizing the fact that you have to think as an attacker as well.
And you also have to make sure that you are aware of those graphs and what your environment
looks like.
And that is actually what Microsoft Security Exposure Management will do for you.
So it will help you understand your attack surface better.
It will help you think like an attacker.
And it will help you also prioritize actions to protect your most critical assets.
And it does this by consolidating a lot of posture data, data from your endpoints, data
from cloud, your identities, but also data, some vulnerabilities that might be there on
your systems.
What's also great is that Microsoft is not only leveraging on their own products in this
case, they're also using embracing third party solutions.
So you can connect ServiceNow, for example, where you might have your CMDB and pull in
that data as well to give you some kind of awareness and to build that graph.
Also Qualus, Rapid7 are supported, Tenable.
And I noticed that Wiz and Palo Alto are coming soon.
So they will integrate that along the way.
And then to present the data to you, it actually consists of three key components.
So they have the attack surface management.
This will visualize that graph.
And this is what gives you the attacker's perspective of your organization.
So you see the nice mesh network with all your applications, identities, endpoint, servers,
and whatnot.
And then the second thing is the attack path analysis.
And this will highlight how attackers could potentially abuse your exposures and security
gaps.
And it will show you how an attacker could potentially traverse their way through your
organization and find your most critical assets.
And then you have the unified exposure insights.
And this will get you some metrics and scores.
And it will score you based on some security initiatives like the cloud endpoint security,
ransomware protection, and zero trust.
So this will help you prioritize a list.
So these are the things I get to start working on right away to close a couple of those traversal
points.
So Microsoft Security Exposure Manager not only went GA, but it also got a couple of
updates during Ignite along the way.
So apparently, DACL support was now added.
I had to look that up.
It was a long time when I was using Windows permissions, Chris.
Yes.
You're aware of those?
I am.
Yes.
I'm in the middle of a project at the moment where I'm doing some work on DACLs and ACLs
and all the rest of it.
Okay.
Well, the DACLs are now also supported and they can pull them into the security exposure
management.
And also hybrid attack paths are now added.
So now Microsoft will try and capture routes that originate from on-premises networks as
well.
And I think this is a really great addition to the Defender Suite.
It will really help customers if they pay attention to it, of course, to pinpoint their
most critical failures, if you will.
This is interesting because this is also Microsoft admitting that not everyone is going to be
cloud native right away.
We've been on this hybrid journey now for a decade and there are some organizations
that are going to continue on being hybrid and using hybrid.
So I like that they are looking at this because the reality is as well is that most of our
cloud infrastructures are secured in some way.
Active Directory, on the other hand, and some of the on-premises stuff is 20-year-old, 24-year-old
attack surface.
It's not as good.
So yeah, good to see that.
I like the attack path analysis stuff.
It reminds me very much of what Bloodhound does.
You know what I mean?
It builds out that graph for you and it shows you what that path to exposure looks like.
So very cool that Microsoft's kind of working on this.
And I also think it's a great place to make customers aware of security gaps in the sense
of vulnerabilities, for example.
Although customers are trying to embrace cloud and all the security products, I still see
in practice a lot of servers running old applications, old plugins.
I even saw the customer lately, Firefox 1.0 installed on most of their endpoints because
some kind of printer driver came with it or something like that.
And those come with obviously a lot of critical vulnerabilities.
And I think this will give you some proper insight in how big the holes are in your security
and what needs to be done first.
Yeah, very good.
I'm glad you brought that one up.
Yeah, well, to close off, I actually cobbled together a lot of other new updates.
But it's obviously the book of Ignite.
The book of news Ignite book of news is actually quite long.
So we couldn't state every single update in here.
But I want to go through some a couple of other updates still.
So apparently, Defender for Office 365 got a new AI powered LLM based detection thingy.
I'm not sure if you've seen that.
This is something you don't need security copilot for security for as far as I could
find.
It's a big in the product.
And Microsoft actually promises well promises not they have seen quite impressive results
up to 99.995% of malicious emails being able to be filtered with this new LLM based.
This is very important.
And I think because honestly, I've been what I've been seeing in the you know, in the last
six months or nine months or so is that defender for Office 365 by itself is not enough anymore.
Right.
I've definitely seen you know, we've gone through this sort of phase where where customers
were using third party mail filtering and and and and EOP defender all of that stuff
was really good.
And we were saying, why don't you reuse this investment that you have in Microsoft technology
and bring that stuff in and get rid of the third party and invest that money elsewhere.
And customers have done that.
But the reality is, is that it's by itself, you know, it was struggling, right?
We've seen other technologies, you know, the the the sort of AI or sort of API integration.
Sublime technology.
Sublime is one of them.
You know, needed to sort of layer on top of what defender was doing.
So I'm really pleased to see this.
And especially if they're seeing really good results.
I think that's great.
Yeah.
And this also had to do apparently with obviously attackers using LLM's AI to generate these
phishing emails as well so that they became much better and they're not in the janky English
format anymore.
So, yeah.
Yeah, I think it's great.
So another thing that got updated is Defender Cloud Security Posture Management.
That's a whole mouthful of words, but it will give you some insights in your cloud security
posture, not only Microsoft, Azure, but also Azure Cloud, sorry, AWS and Google Cloud Platform
as well.
And it got some new additions like API Security Posture.
So it will actually map the APIs from your API management back to the actual servers
and applications and even storage and compute.
So that's great.
Container Security got an update.
So now on all Azure, AWS and Google, it will scan for your container registries when you
build container instances.
And also AI Security Posture was added.
So even if you use your own open AI service or Azure machine learning, but also Amazon
Bedrock, I'm not familiar with that, but apparently that's Amazon's AI Studio solution can be
monitored by the cloud security posture management nowadays.
Microsoft also launched their Zero Day Quest.
Have you seen that, Chris?
No, I haven't actually.
I missed this one.
Okay.
So apparently they created a big pot with $4 million in it and they actually started
right at Ignite and up until the January 19th, which is actually my birthday, by the way,
they have a hacking event and according to Microsoft, it's the largest in its kind.
So you can submit bugs in all kinds of products, not only AI, also Microsoft 365 and Defenders,
and you can earn bug bounties up to, well, the $4 million is not one single bug bounty,
of course, but they have a whole document on it.
So if Red Teamers are listening to this, they should probably definitely check it out.
Wow.
It's like prone to odour on steroids, right?
If it lasts for two months.
And they actually invite the, I believe the top 10 or something, they invite them to Redmond
to come to an actual in-person hacking event as well.
So that's nice.
So Purview will receive an ability, new capabilities to prevent oversharing of sensitive information.
Again, this is a data security thing.
Purview data security posture management is now in preview.
And again, another posture management, but focused on data security.
And this is what I mentioned earlier in the podcast.
This will provide you a visibility across all the Purview data security solutions in
one piece.
And it can tell you if you probably have that G drive somewhere on a file server, which
you probably need to label and migrate elsewhere.
Well, you already touched on a couple of co-pilot things which were new and also co-pilot, obviously
in more products.
You already touched on Entra and Intune and also Purview got its own co-pilot now.
Lastly, I want to touch on a couple of things from security co-pilot perspective for the
defenders.
I think it's really nice that when you have a security incident in the defender and some
kind of script was involved in there, that co-pilot will automatically detail for you
to the security analyst what the script is actually trying to do.
And so if it's PowerShell or Python or whatever, it will actually explain to you what it tries
to do.
Incident reports will now also compile all of these response activities in a detailed
report for you.
And it also comes with integration service now.
So it can write back the report to service now, if you will.
And also there's a way to use a guided response.
So security analysts have to communicate with end users sometime and the guided response
will help them communicate more easily by dynamically generating some text for them
they can send out to the user, for example.
I don't have any experience with it yet.
These are all new, but I saw some demos on it and could be useful.
When it comes to security co-pilot, I do have a little bit of mixed feeling still, and that
mostly comes down to the pricing.
Well, you mentioned that you don't have much experience with it yet, but I've seen a lot
of very expensive SEOs being deployed.
And even when companies started to use it, it's difficult to know beforehand how much
compute units you will be using, needing actually.
If it has some documentation on that, they will probably advise you to start with a certain
number and you can scale up and down, of course.
But the amount of prompts and the amount of compute that go through it, especially because
it's so integrated so much now, the compute units are all the time working for you, even
if you don't know it.
If you open up a pane, there comes a summary.
When you open up an incident, another summary pops up and there are all prompts, of course,
being computed for you.
And I see customers really struggling with the cost perspective of it.
I think it's an important call out, because I think we all get caught up in the demos
of the stuff where it's seamless and the person demoing this is writing this prompt out and
he's right clicking on this thing and he's asking for more information there.
And like you said, the backend work on all of these prompts is enormous.
And there's a lot going on, especially as we start seeing the security copilot stuff
get integrated into the admin centers that we already use.
It's very easy to get carried away and just go crazy with this without actually understanding
the cost implications under the covers.
And like I said, I mentioned earlier, as techies, we don't always consider the cost of this.
We look at the benefit and we go, this is fantastic, but hey, someone's got to pay the
bill for this.
So I think it's an important call out that, I think two things.
One, you really have to understand what you're getting into, or at least try and best understand
what you're getting into when you jump into the stuff.
But two, you can't go from zero to hero with this.
You can't have an organization where you're struggling with basic security concepts and
then jump into a AI assisted security workflow where all your folks are all of a sudden now
have the magic of AI.
But there has to be a maturity that comes with it, right?
And that takes time and it is a journey.
And I think that's important.
I do want to advise people listening, wanting to try out security copilot, what is actually
great since it's an Azure resource, you can deploy it and remove it right after you don't
use it anymore.
So there are a couple of examples online of pipeline deployments, automated deployments
where you could deploy, for example, a couple of SCUs to try them out and automatically
remove them at the end of your working day.
And at least you're not paying for it 24 seven, right?
Or just deploy it and remove it by hand after you finished tinkering with it.
At least then you can get a feel of what it can give you.
I think that's a really good call out.
Really good.
So lastly, I think we want to touch on a community project of this episode, right?
We always like to highlight something else in the community, which is worth mentioning.
And since I was already touching on workbooks a little bit earlier, the first thing that
came to my mind was the Entra ID security config analyzer.
And this was actually made by three guys, Sami, Thomas and Marcus.
Sami and Marcus are from Finland and Thomas is operating out of Germany.
I'm following Sami for a long time already.
He's a security MVP as well and he's bringing some great contributions to the community.
And those three guys have created the Entra ID security config analyzer, which is a project
with a lot of stuff, a lot of to set up the best practices.
But one of which is a workbook, actually, which you can deploy and it will give you
insights and it will evaluate your Entra ID tenant settings with several best practices.
Think about things like MFA and the things we touched on earlier.
But yeah, I think it's a great starting point to get into optimizing your Entra ID settings
to get them more secure.
Awesome.
Yeah, I think I have not seen this before and I think this is really, really useful.
So I'm definitely going to be having a little bit of a play around with this this week.
See what I can do.
We'll make sure that the links end up in the show notes, of course.
Fantastic.
Thanks for bringing that up, Post.
That's really, really, really helpful.
Well, that's a lot there, right?
Even though you think that there wasn't all that much in security space at Ignite.
We've really just scratched the surface.
We will put a link to the Ignite book of news.
That book of news has also just grown a lot over the years, hasn't it?
I remember when it was just a PDF and you could download it as a PDF and you could see
through it in a few minutes.
Now it's a whole sort of encompassing book of news for Ignite.
So it's fantastic.
And also, each section will link to blog posts about the announcement.
It'll link to relevant sessions for the announcements.
You go and actually follow up on videos and recordings, on-demand recordings of those
announcements and things.
It's really worth looking at.
If you weren't at Ignite, obviously, but even if you were at Ignite, it's a great way to
refresh or see some of the things that you maybe missed out on because you were in other
sessions right there.
Yeah, another fun fact I want to touch on, Chris.
So Microsoft yearly releases the digital defense report.
It came out at the end of October, again this year.
One of the facts I noticed there that Microsoft has now 34,000 security engineers working
in the company to build and work on these security products.
So if you think they're slowing down on developing security products, you're wrong.
Yeah, no, I agree.
I've said for a long time, I think Microsoft is the biggest security vendor in the world.
I just don't think everyone wants to acknowledge that.
But I really do think it's true given the investment that they're putting into this.
Yeah, certainly.
Absolutely.
Okay.
All right, folks.
Well, thank you for joining us for another episode.
As always, please feel free to reach out to us on the socials if you have any burning
questions or if you'd just like to get in touch.
We really do put this together for you.
So we appreciate you following us on this journey.
And I'm sure you will see us or hear from us again soon with another episode.
In the next year, I guess.
So happy holidays, everybody.
That's right.
Happy holidays.
I'm not sure when exactly this one will be published, but it'll be around just after
Christmas time.
So for those of you, I hope you enjoy your time with family and downtime.
I think downtime is very important for the mental health.
So take care about that.
Take care.
And yeah, great to see you again, as always.
Thank you for joining me.
And we'll talk to you all.
We'll see you all again later.
Nice holidays, Chris.
See you later.
Bye bye.