Hello, everybody, and welcome to another episode
of Everyday Defender, the podcast with Koos and
Chris. My name is Koos, and I'm joined once again
with my co -host, Chris Goosen. Hi, Chris. How
are you doing? Hey, Koos. How are you doing?
Good to see you, mate. Good to see you as well.
Episode eight already. Time flies, right? It
really does, doesn't it? It's kind of crazy if
you think about how we spent months working on
this before we even published the first episode.
So it's probably been about a year since we first
started. kind of going back and forth and talking
about this. Because I think actually we spoke
about it at MVP Summit 2024, or maybe very shortly
after that. And so it's been a year of kind of
working on this with you, man. And it's been
a really good journey so far. So yeah, super
happy to be back again, recording episode eight.
And I think we have some... I think we have some
interesting topics to talk about today. Yeah,
that's true. And I wanted to say I already learned
a lot in the last couple of episodes, the last
eight episodes, making those episodes with you.
Well, like we said earlier, we want to dive into
new stuff and discover new stuff on our own as
well, because Microsoft security is so broad,
right? And I think especially today, again, we
have some new topics. And especially when I'm
talking for myself, I want to talk about security
co -pilot. It is maybe a bit of a controversial
topic because I think copilot and AI in general
is hyped about a lot. And we as tech guys, we
poke through a lot of the marketing nonsense
most of the times, I guess. But I really wanted
to read. revisit Security Copilot because there
were some new features added. And I think it
is at the stage where I really want to advise
everybody to just try it out. And that's what
I want to touch on. And you dug yourself into
the Entra suite. Yeah, yeah. You know, originally
I was going to do a bit of a deep dive into some
of the components of EntraSuite, looking specifically
at the private access stuff and maybe the internet
access. But then I thought, you know what, EntraSuite
as a concept is a bit new to folks. It's only
really something that's been around for maybe
a year, just a little less than a year. So I
thought, you know what, let's take an episode
to just introduce folks to... EntraSuite, what
actually is EntraSuite, what are the components
of EntraSuite? And then next episode, we'll dive
into some of the, you know, a little bit more
specific use cases and maybe some configuration
tips and things like that on some of the components.
Yeah, sounds good. I think most people know Entra
from EntraID, right? But you're probably touching
on how that's related to EntraSuite. Right, right.
And I think it's very easy because Microsoft
Marketing, they help us with this and don't help
us with this very often, right? So I think a
lot of folks go, Entra Suite, oh, that's just
everything in Entra. Well, no, there are some
specific things and we'll dive into that just
a little bit. And I think I'm really excited
to hear more about Copilot and Security Copilot
from your perspective because I think it's our
job to be a little bit... uh what's what's the
word just to to look at these things a little
bit more skeptically i guess and be skeptical
about some of these things you know obviously
you see folks in the industry everyone just jumps
on these things straight away and and and sort
of pushes the the generic message but i think
i really think it is it is our responsibility
to look at these things through a little bit
of skepticism and and sort of dive into it and
really let folks know where things are mature
enough or where things are lacking. So I'm excited
to see this. I've been having some really interesting
conversations with customers on the security
co -pilot side, especially when it comes to sort
of layering multiple tools together and sort
of this whole agentic AI thing that Microsoft
has been talking about. So I'm excited. I think
it's gonna be another great episode. Yeah, and
to get started right away with the topic, I was
actually, as part of the MVP Summit earlier this
year, there was a post -MVP day, if you will,
an extra day at the end where you were able to
join some workshops Microsoft had provided. And
some of those workshops were regarding EntraSuite,
for example, but they also had a security co
-pilot workshop. And because I was a little bit
skeptical, and that was more or less... based
primarily around the cost aspect, but I'll touch
on that later. I did want to give it another
shot by, well, as you say, we need to be skeptical,
but also we want to be early adopters, right?
So we also want to know what's happening and
what's new, because I think we all agree that
the whole AI stuff and co -pilot, security co
-pilot, is really the future. And we already
saw glimpses of it working in demos. doing some
amazing stuff, which will save you a lot of time
in your day -to -day job. So that's why I, well,
I can remain skeptical, but I also want to give
it a shot whenever things get improved. So during
the workshop, I was actually surprised by all
the capabilities Security Copilot has. When I
started, it was just Security Copilot as a standalone
web portal. And I was like, oh boy, we're going
different portals again. Back to the early days.
Then they added it into the Defender portal,
the security portal, if you will, and added it
into the Defender XDR stuff. But now they also
integrated it into Entra suite and also Intune.
And I was able to play with it a bit during that
workshop. They had all kinds of exercises in
a lab environment running Security Copilot, and
you were able to dig into the features. And,
well, that's why I said to myself, I need to
play around with it a little bit more when I
get home because there's some good stuff here,
and that's what I wanted to share with everybody
here on this episode. So I said Security Copilot
is a bit... controversial and that's more on
the cost aspect because to run security co -pilot
it works a little bit different than regular
co -pilot for m365 you have to deploy scus so
security compute units, security copilot units.
I'm not sure what the exact acronym is, to be
honest. But the SCUs act as your compute units
to run security copilot. And the weird thing
is you have to deploy those SCUs in your Azure
environment. And then you're built for them accordingly
on your Azure will. And once SCUs are available
in your tenant, Microsoft notices that you have
them. And then all of a sudden in the Intune,
Entra portal and the Defender portal. additional
co -pilot panes and buttons pop up so that you
can actually use and leverage those SUs. Before
you had to deploy SCUs a certain amount of SCUs,
let's say four or eight SCUs, and then you had
to stuck with them. And there were now some recent
changes where you can more freely manipulate
those SCUs. And that's one of the things I wanted
to touch on. But with the SCUs, if you had those
SCUs running, they're running 24 -7 and they're...
consuming a lot of resources an seo costs four
dollars per hour each so if you have four of
them that's already sixteen dollars an hour times
720 hours something in a month that and and then
in a year it quickly adds up right so um and
then when you when you consider that microsoft
wasn't caching any of the output coming from
those seos it really made a worse a really bad
business case i believe so when you go to the
defender portal into the incidents and a summary
of the incident is generated, which is great.
You get a great summary of all the things that
was happening within all the alerts in the incident.
But when you revisit that page, or if another
security analyst visits that same page, the prompt
runs again, SCUs are triggered, you consume compute
units, and then you get probably the same output
or similar output. And that's why I think it
was a little bit too expensive to have it running
24 -7. So when I wanted to revisit this, I had
to work around a bit, if you will. So I thought,
well, if there are Azure resources, I can just
deploy them and remove them afterwards when they
don't need them anymore. You can do that. But
it was surprisingly hard to deploy these with
PowerShell because I thought, well, everybody's
already doing this. I couldn't find an existing
PowerShell script. And ironically, ChatGPT wasn't
able to help me with it. fully working PowerShell
script from the get -go. So a lot of... Parameters
and properties in the JSON were incorrect. It's
not documented in any way. So I had to go in
with API request, deploy it in the portal, and
then look through the API and retrieve some stuff
to see what was actually deployed. Because for
some reason, the Azure portal will not provide
you an export template button, which they do
with all the other resources, but not with SUs
for some reason. So I made a PowerShell script.
And that's one thing I wanted to share in this
podcast. It's in the show notes. as a gist on
my GitHub so everybody can start using it. And
you can just run the PowerShell script, type
in the amount of SCUs you want, it will deploy
it, and then you can remove it with the same
script as well afterwards. And then you're only
charged with the hours that you are actively
using the SCUs in your environment. And that's
why I think you really need to revisit it if
you haven't already. You can deploy those SCUs.
make use of them in Intune, in Entra, in Defender,
and then you can just remove them afterwards.
And you can obviously also script this. There
were some logic apps and other automation things
I found on Google of people who had some automated
process where they spun up SEUs when the SOC
started at the beginning of the day. And then
at the end of the working day, they removed the
resources again. That's one way to do it. Another
thing that's that's new that they now have overage
capacity before. If you deploy two issues and
your capacity is depleted, everything stops working.
So you get all kinds of error messages that copilot
isn't available anymore. And then you had to
go in the measure, increase the issues, and then
you can use it again. But you're probably. spending
too much because you're increasing SCUs, but
you're not using those SCUs every hour of the
day. So now with overage SCUs, you can say, let's
deploy two SCUs and deploy two or four overage
units. So then it can increase up to six and
goes back to two again once they're not used
anymore. And I think the combination of those
things. So almost like auto scaling type of functionality,
right? Yeah, yeah, true. Yeah, true. But still
be cautious with costs because if you keep them
running, if you keep four issues, eight issues
running in your environment, it will still cost
you. So be careful with that. But at least now
I think you have a very low bar to get started
and try it out because I'll touch on it later.
But I think there's some amazing functionality
in there. One thing on the overage is that you
pay a little bit more. for an overage su so if
you have four su's they cost four dollars each
and if you have an overage su they charge six
dollars for an overage su so if you have two
normal and two overage you pay more than just
four regulars but well the four regulars you
pay whenever they're running and the overreach
is scaled back, right? So you have to do a little
bit of math. And what's also new is that they
now finally have a nice dashboard to get insights
in this. So I put in the show notes an example
screenshot where you can see exactly how much
SEUs you used over the day, how much overreach
you had to use, and where they were spent on.
So you see all the individual sessions by users,
not what they did, but that they were doing stuff
in. standalone portal the final portal insurance
entra whatever and then you can see okay so this
much of the compute is going to this or that
um lastly i want to touch on permissions so you
can also uh well you can you can create multiple
seo sets in azure so you can delegate those permissions
so for example you can delegate a couple of seos
to the security operations team but you can also
delegate a separate set to different departments
I'm not sure if that's really something a lot
of companies are doing right away, again, due
to cost. But this lets you have, let's say, the
Intune people responsible for Intune and Entra
have a go with SEUs without them taking away
all the compute units from the security team,
right? Is there a way now to sort of capacity
plan? how many issues you need or is this something
that you would deploy it, see how it's working
for you? And then now that you can come back
and change it, you can you can always tweak it
later. How do you because I know you're very
big on being able to plan stuff ahead of time,
right? And you have some tools for Sentinel on
how to cost plan and stuff like that. Is there
anything like this available yet for for these?
no and and with sentinel i was already wanting
to make the the little bridge uh the the sentinel
thing is also really hard people ask me how much
does it cost but you don't know up front how
many amounts of logs you're going to ingest there
so a lot of the times with customers i just did
a poc a proof of concept i deployed stuff we
connected stuff and then we monitored it for
a week two weeks and then we were able to extrapolate
that into the future right to get a little bit
of a guesstimation on the cost i think the same
applies here regarding the central cost aspect.
I did some stuff with the auto scaling of the
commitment tiers. Indeed, that's right. And that
you can do here with a simple PowerShop script
I made as well. But you can extend into it and
make it an auto scaling script, if you will.
But yeah, again, I'm not sure if you want to
auto scale this up because people can go through
the issues like candy and you won't be happy
with the bill. But yeah, I think just deploy
a couple of them, see how it works for you. I
think is the best approach for now. That makes
sense. So. Regarding the actual usage, once you
have the SCUs running, like I said, you get a
co -pilot button in a couple of portals. And
with Defender, I think there are already a lot
of obvious benefits there. So like I mentioned,
the incident is summarized as well. So you get
a nice summarization of what happened. But you
can also go into and use predefined prompts,
like show me exact command line, which was executed
by the user in the incident or something, or
summarize. which lateral movement techniques
were observed in this incident or something like
that. And you can even branch out to the standalone
security portal, which looks a little bit like
the chat GPT interface where security copilot
will gather, for example, your sign in logs,
your security events from your domain controllers
and will visualize and tell you anomalies and
why stuff happened like it did. And again, this
is really powerful stuff. I really see the benefits
in there. So, yeah, that's why I think people
should get started with it. And with Entra as
well. So, for example, conditional access policies,
I find it very confusing sometimes when customers
have loads of conditional access policies. What
is doing what and what is the actual net sum
of results of all those policies? With Copilot
enabled, it gets much easier. You can just ask
it in natural language what's happening. You
can say, for example, summarize all CA policies
that apply to this user and describe their impact
or show me the 10 most recent sign -ins from
this user and summarize all the MFA methods that
user used in those sign -ins. And then you just
get the results gathered from all the individual
log sources. And with Intune as well, you can
list non -compliant devices. devices, missing
disk encryptions just by asking copilot. And
that's so much easier than going through all
the information, of course. So again, powerful
stuff. I advise everybody to revisit it, deploy
a couple of issues. play around with it a bit,
remove them. And I think you're quickly surprised
how powerful it is. And then you can probably
set up maybe a business case to have a couple
of those issues running during business hours
or something like that. Or maybe if you're working
on a project or you're troubleshooting or you
want to minimize your conditional access policies,
for example, deploy a couple of issues, play
around to copilot, get some insights, remove
copilot again, and then get the rest of your
project done. Yeah. Wow. Okay. Well, it definitely
sounds like that's something worth re -looking
at. And my hands -on with this outside of just
labby stuff is limited. But yeah, the concern
has always been around the cost, right? Like
I said, we've had some very interesting customer
conversations, but nothing that's kind of come
to full -scale fruition just yet, right? I think
a lot of folks, a lot of organizations are kind
of dipping their toe here. um so nice to know
that there's a more controlled way to to be able
to see what it can do And I think if you run
it for a couple of hours or maybe one or two
hours and you have a couple of SCUs burned through,
it's not that expensive. It's only a couple of
tens of bucks, right? So you can probably validate
that. But yeah, you still need to be careful
and you're not charged on second or minute like
with some other Azure units, you're charged by
the hour. So even if you use it for one second
within an hour, you're charged for that hour.
But again, with $4 each, and if you keep if you
keep the uptime as low as possible i think it's
manageable and uh probably worth trying yeah
that makes sense yeah and the second topic of
today chris tell us everybody everything about
the interest suite interest suite yeah so you
know as i was saying sort of in the intro here
i was i was really wanting to do a bit of a deep
dive into the global secure access components,
right? Which is really your private access, internet
access. But I thought, you know what? Some folks
may not have heard of IntraSuite or they may
have heard of IntraSuite and may not actually
understand exactly what we're talking about when
we say IntraSuite, right? Because I feel like
the word in the terminology suite could mean
a bunch of things and maybe confuse folks where
they may be thinking, well, we're just talking
about Intra, right? Well, I mean, yes and no,
we are. you know, in a sense, we are talking
about Entra, but it's components of Entra, right?
And I think Entra has, you know, I'm sure we're
all kind of familiar with Entra, has grown into
this platform now that is more than just what
used to be called Azure AD, right? It's, you
know, we have Entra ID, but it's just one component
of a lot of different things. And so what Entra
Suite is, is it's actually a sort of a separate,
if you will, like... uh how do we call it we'll
call it a skew if you will right because I think
calling it a skew might actually help folks understand
what we're talking about so when you think his
um traditionally not fcu right Yeah, yeah, yeah.
Traditionally, when you think of Entra, you think
of Entra IDP1 or Entra IDP2, and those things
still exist, right? So I would imagine most folks,
unless you have a very basic and very small environment,
you probably have some Entra IDP1. bits or licenses
in your environment and that you know you can
buy those obviously as standalone but if you
if you have business premium or if you have um
m365e3 then you know you get um enter idp1 right
so it's a licensing model um and then you know
the next one up from that is enter idp2 which
again you know if you have m365e5 you'll be familiar
with p2 it kind of layers on um some some advanced
capabilities and advanced features um and so
we can think of uh enter suite as sort of something
similar where it's a a combination of multiple
products that you could go off and buy these
individually but you're better off if you license
them together from a cost perspective. Right.
So, for example, I think U .S. dollars, if you
were to buy the interest rate, it's I think about
12 bucks or $12 U .S. per per user per month.
But what that gives you, though, is is, you know,
a lot of capability. Right. So so the things
that make up intro are what we would refer to
as global secure access. So you may have also
heard in the early days of this, it be referred
to as SEC, the secure service edge, which is.
um sort of microsoft solution for for zero trust
network access so uh we have uh enter private
access um which is really is is meant for providing
secure access to applications that you own right
if you think about um maybe you have some applications
in your data center Historically, maybe those
were published through a firewall or something.
It's applications that you own that are in your
data center that you now want to provide access
to folks that are outside of the organization.
The second component of that is... internet access,
which is the other way around, right? If you
think about it, it's providing and controlling
access to resources and maybe applications that
you don't own. You may own them, but they are
not in your data center. There may be SaaS platforms
or SaaS products, or it could just be web traffic
in general, right? So you could think of things
like that. In that way, it's a little bit similar,
I think, compared to Zscaler, for example. You're
just tunneling out all the outbound internet
access. 100%, yes. It is definitely similar to
what you would think of traditionally maybe as
a proxy server or a more modern version of that,
which is Zscaler. It's a way to control that
sort of outbound internet access. on networks
that you don't own right and i think that's where
zscaler has become so um popular is that uh a
lot of folks are working on remote networks home
networks things like that grandma's house is
the scenario that we use very often when we talk
to customers um because you're working on a network
that you have no control over but you're still
accessing resources that you want to be you know
certain about the security of the connection
so so Perfectly summarized there. And then there
are a few other things that sort of form part
of the Entra suite, which is your identity governance
stuff. So if you think about identity lifecycle
management and onboarding, that type of thing,
you have identity protection, which is... risk
-based access. So if you think about, you know,
conditional access, if you use conditional access,
you can enable risk -based conditional access
where dynamically, whether there's a, you know,
based on user sign -in risk or things like that,
right? That stuff is part of Entra Sweden. I'm
pretty sure that's also something that is part
of Entra IDP2 as well. And then... something
called verified ID or verified ID premium. And
this is the concept of decentralized IDs or DIDs,
which you may have heard about. It's been a lot
of talk about that in the past and recently.
And in fact, a fellow MVP, Michael Van Horenbeek.
recently launched his own podcast um and i think
he's calling it uh uh the zero trust zone podcast
and um one of the first episodes of the first
episode was very much covering this topic of
decentralized ids and and why we need them right
and um verified id uh premium is that sort of
um validation and face ID type stuff that Entra
provides, right? So you've got those sort of
five things, private access, internet access,
governance protection, and then the verified
ID bits, right? And like I said, from a licensing
perspective, those are sort of bundled into a
bundle that we call Entra Suite. And you could
kind of buy those as a sort of set of functionalities,
right? Instead of buying them one at a time.
And I think, again, you know, from a cost perspective,
I think to get private access by itself, I think
it's about half the price of what you would pay
for the whole suite, right? Where you get all
of the capabilities. So it almost is a, you know,
I don't carry the organization's checkbook, but
it is almost a bit of a no -brainer when you
think about it in those terms. So to look at
some of these from like a real world use case
perspective, right? You know, I think... um to
tackle the the internet access one as you said
coast very much a z scalar play and you know
what we'll find is that it's probably never going
to be z scalar but it's probably going to be
what most organizations need from that perspective
so you know you're looking at your sort of um
web content filtering right being able to create
policies that um restrict or block access to
uh websites and things like that um for for your
users what i really like about this is is is
a couple of things the way you would actually
deploy this is um there's a global secure access
client that you can run on devices so if you
think about um maybe you have a fleet of um you
know Surface laptops or devices or things like
that that you manage through Intune, you can
push the client down to those devices. And wherever
those users go, whether they're at Starbucks
or grandma's house or wherever, you can push
the same policies and enforce the same policies
on what they're connecting to and how they connect.
And this layers in with conditional access. So
it can be really powerful as far as restricting.
access to applications from only certain networks
and all that type of thing. If you think about
how granular conditional access can be, it's
really, really powerful stuff. If we look at
the private access piece, I really like this
because I think this solves a lot of challenges
for businesses who have applications in their
environment that are old, right? If you think
about all of those crusty button. and everyone
has those yes those exactly now you may be thinking
if you listen to this and you've been around
for a while you might be going well this sounds
very much like something called azure app proxy
right and and you'd be right in that it is very
much built on on that technology of azure app
proxy where you know you could essentially take
any web service in azure and you could publish
that through azure as a front door and then you're
layering in modern security on top of that. Now
with this, this kind of extends it where it's
no longer just limited to applications that are
web apps, right? You can take this a little bit
more granular. And like I said, we'll dig into
some of these in future episodes, but it really
does buy you time. And I want to stress that
if you're an organization that has legacy applications
that don't support MFA and things like that,
this will buy you time to fix those applications
because you can... provide access to your workforce
through, again, the beauty of conditional access
and, you know, conditional access policies and
layer in multifactor authentication and all of
that step up stuff that you want to do onto an
old application that isn't necessarily aware
of. of of of those modern protocols um the connection
is is outbound only so you're not punching all
these holes in your firewall um and it buys you
time to be able to then start working on refactoring
those applications and being able to turn those
things into things that are a little bit more
modern and maybe support modern uh modern protocols
so those two things also a great vpn replacement
but we we i think we should devote a separate
episode on this but uh people would say i already
have a vpn but i think this is in much aspects
much better. Yes, 100%. Because again, your VPN
is that once you're connected to the VPN, generally
you have access to whatever's on the network,
right? Whereas with this, you're publishing those
applications one at a time, you're layering conditional
access onto each application, and it can be targeted
to completely different groups. So you've got
that segmentation going on as well. So if you
believe in sort of zero trust and zero trust
principles, this really is something that should
excite you. And then we're not even touching
on admins not upgrading the VPN appliance firmware
or forgetting that they still have an account
called Cisco with a password Cisco on it and
granting everybody access. Yes, I think that
sounds very familiar, Colonial Pipeline, or any
number of other hacks that have happened in the
last few years. But you're absolutely right.
The security risks with the older technologies
is fraught, right? Look, I don't know about you.
I work with lots of different... customers and
every customer i work with has a different vpn
solution so i end up you know now fortunately
i don't i i don't often work on multiple engagements
at the same time so usually i you know i have
the any connect client installed and then when
the next customer rolls around that gets removed
and the next thing gets put on and the palo alto
client goes on but i've always got some client
uh vpn client on my on my devices because that's
how we we get access on remote access um so yeah
Very, very good VPN replacement. So just to kind
of patch off and finish off on the other parts
of the suite, which I think are just as important
to think about is, so ID governance or intra
-ID governance. Think about that sort of lifecycle
management piece. How do we automate our onboarding?
How do we deal with role transitions when folks
have had... a particular set of permissions they
move into a different role and they need to now
sort of assume um you know permissions for whatever
that new role is right right through to off -boarding
those folks right oftentimes um one or all of
these steps uh are kind of missing in a in an
organization's process right it's really easy
for them to find um to onboard they onboard stuff
they have scripts that pull you know, user info
out of the HR system and they PowerShell stuff
and they create user accounts with passwords
and off you go. But the cleanup and the operational
management of that is often left behind. So that's
where sort of ID governance comes in. If you
think about things like access reviews and managing
access for guests, you know, guests into your
environment, probably identity management is
another part of that, which obviously we've talked
about that a lot in the past. And I think, again,
to me, PIM is a no -brainer for any business,
right? Your administrators and your privileged
users absolutely should have PIM. Yes, you've
deployed MFA. This is the next thing for you
to go do is PIM. And that's part of the enter
ID governance piece. Enter ID protection, which
I mentioned is very much around sort of risk
-based conditional access, being able to determine
based on the users. um uh whether they can access
data based on on on their user identity or um
based on their device um and so being able to
do that type of some sort of threat detection
piece right um and many instances it can be auto
uh automatically remediated right so you know
if you think about a conditional access policy
where um If you see a sign in that doesn't look
right, or maybe it's, you know, Coase is usually
signing in from the Netherlands, but all of a
sudden Coase is now signing in from Australia.
Maybe we want to just do another multi -factor
check on to make sure that this is actually Coase
and not, you know, someone who might have. stolen
Coase's identity or what have you right but then
security co -pilots will just tell the security
analyst that Coase is probably having fun at
Chris's place finally he made the trip over that's
right that's right but yeah so really the anti
-ID protection stuff really really cool from
that perspective if you think about risk -based
access and things like that and then you know
I had mentioned the verified ID stuff this is
an area where I think we're going to hear and
see a lot of a lot more noise this is going to
really be a sort of a it's it's a um evolving
area right because the whole concept of decentralized
identities and and identity validation um is
is is a big one right and and your scenarios
here are thinking thinking about uh how do you
validate that someone is who they say they are
without having to maintain um you know all of
their information right so uh if you take the
the scenario where let's say you're starting
a new job And as part of your onboarding process,
your employer needs to see that. So here in Australia,
you can't work unless you have something called
work authorization, which means you're legally
allowed to work in Australia. Or in order for
me to prove that when I join a company, will
I have to give them my passport or my birth certificate?
One of those things to prove that I actually
am an Australian citizen, right? Now, instead
of organizations having to keep... a photocopy
or a picture or what have you of your passport.
This scenario really is where you go to a third
party and you say, hey, you guys are a third
party that validates and verifies that people
are who they say they are. You keep all of the
passport stuff. You do passport checks. You know,
just like you could see, use a third party that
can do a background check for you, right? I'm
not sure how in Europe, how often that's done.
Here in Australia, we don't do background checks
all that often, I guess. No, really? In the US,
yeah, in the US, every single job you apply for,
every single job, you know, they will always
background check you. And in fact, when I worked
over there, there were many industries where...
um if you if you worked you know utilities oil
and gas they would do another background check
just before you before you could run with a project
even even though you know your employer might
have done one so different countries i think
do different things but similar to how you would
trust that the company doing the background check
has done their their job properly you know you
would similarly you would trust that uh you know
third party would be able to validate that chris
is in fact uh an australian citizen can and is
allowed to work uh in australia and and so because
of by virtue of that um you know you you you
don't need to submit all these other things so
it's a very interesting space i think it's evolving
as i said um i think right now um intro will
support i think 11 or 12 different you know third
-party providers for these so if you think about
uh again if you're in the US you might have seen
might be familiar with clear who um you know
if you go to any airport you can you can do the
sort of um fast boarding or fast um uh passport
check thing with with clear they're one of the
the providers for example and I think they're
10 or 12 other ones but it really anyone who
has an api um you can kind of tie into that workflow
right so um this sort of verified id thing is
going to become i think um you know it's gonna
it's gonna become more heavily used in in um
in future hey in europe a lot of folks want sort
of independence of stored identities and stuff
like that right there's this real push at the
moment um uh to get away from centralized uh
databases of stuff right so yeah great he's a
big concern and uh and also saw some great demos
with verified id you can integrate it for example
with uh i don't know if you want to provide your
employers to have a discount on a with a local
laptop shop or something like that you can actually
have them use verified to verify that they're
working for your company stuff like that that's
right and i think the key the key thing here
is because um your identity is so much the parameters
that make up your identity can differ depending
on the requirement right so like if you if you're
going to um in that instance you're buying a
laptop um and all you need to do is prove that
you work for you know abc .com or abc you know
inc um that's all that's the only piece of of
your identity that they need to verify they don't
also need to give them um you know your date
of birth and and and all of these other things
because those things may not be needed right
similarly if you're going to the liquor store
to buy you know a bottle of whiskey like you
you only need to prove that you're over 21 or
over 18 whatever your your drinking age is you
don't also need to give them your financial statements
and um you know your home address and all of
those things so this is a really beautiful thing
where you know being able to just provide the
information that is needed um and it's not you
know stored in you know by every organization
out there that you interact with. So I think
watch the space. It's going to be really good.
And like I said, I think, you know, if you're
interested in the verified ID stuff, definitely
check out MBH's podcast. Maybe I'll put a link
in the show notes. His episode on this is really,
really great. Definitely. And outside of that,
I think, you know, yeah, we'll definitely be
doing some deeper dives into some of these in
our next episode where, you know, we'll look
at internet access and we'll look at private
access as well. Yeah, I think we can fill individual
episodes with each of those features. Absolutely.
We can. Yeah. And maybe good to summarize again
for the listeners that a lot of this stuff you
touched on, they probably already have it available
in their environment. Because if you have P1
or P2, some of those features like identity protection,
verified ID are already available. Some specific
features and the private access is exclusive
to the Entra suite license. But a lot of the
stuff is already covered. p1 p2 yeah absolutely
it is yeah and i think you know to really the
only thing additional thing to call out there
is that you know to get started with um enter
id or the sorry the enter suite uh you need a
intra idp one license that's your sort of minimum
baseline but other than that um you may already
have some of these things verify id i think is
there is a free tier which i think does something
like fifty thousand um uh fifty thousand what's
the, is it lookups or validations per year or
something like that? It's a very generous free
tier. And I think the only thing that it doesn't
include is the face check. So there's a, you
know, the face check or face authentication piece
that uses Azure Cognitive Services is part of
the premium verified ID SKU. But the rest of
that stuff. Yeah, very good call out. It's already
probably available in your tenant. So have a
look at it and see what sort of fantastic. We'll
add a link to the show notes. Microsoft obviously
has a nice table where it shows what feature
is in which specific tier. Yes, and I have included
a picture to the M365 maps sort of breakdown
for this as well, just to kind of help. wrap
your brain around it. Licensing is hard, man.
It's difficult, isn't it? I wanted to say I want
to stay away as much from that as possible because
it's really complex. That's right. That's right.
But that's Intro Suite. We'll look forward to
diving into some of the other ones in future
episodes. But yeah, before we sign off, tell
us about our community project. Yeah, for this
month's community project, I wanted to put fellow
MVP Morten Knudsen in the spotlight. Or perhaps
I'm butchering his name a bit. I was just going
to say that I'm really glad you pronounced that
and not me because I would have butchered it.
Well, Morten is from Denmark, and he's all over
the place. He's speaking at events. He's writing
blogs. He's organizing Express Live Denmark as
well, for example. So he's a big contribution
to the community. But he actually demoed something
on Express Live in the Netherlands a couple of
weeks ago, and I really wanted to put this in
the spotlight since I was talking about security
co -pilot. And the fact that AI can be very expensive.
Morten did the other way around. He showed us.
how you can run your own AI in Azure AI Foundry
and keep the cost as low as possible if you want
and integrate it into PowerShell. And I think
it was a nice project of him. He shared everything,
obviously, online, the scripts and everything.
And the thing that he did, he integrated AI in
PowerShell and he made a, what was it called,
a PIM role advisor. You touched on PIM, but you
also remember that it sometimes can be hard to
determine. what role you need as least privilege,
right? To do something. You don't want to activate
global admin whenever you're just doing some
simple stuff. So the PIM role advisor script
in PowerShell, you can just ask a natural language
in PowerShell. I just want to do this or that,
create an app or register this or make this change
or whatever. And then the AI will look in your
environment, see what roles you have, custom
roles, which groups you assign to them. And then
it will just come back with a result. Well, you
need to... might have pimped this or that group
and this one's least privileged. This is obviously
just a bit of a tech demo, but it did trigger
me that integrating AI and PowerShell can be
really powerful because normally you have to
go to a website, chat GPT or copilot, whatever,
type your question in there. And I have a terminal
open all day anyway, so why not just integrate
it there and type in my questions there? Right.
So I'm definitely going to take a look at this.
What's great about this, it sounds very complex,
setting up Azure AI Foundry and whatnot. He has
guides on his blog, obviously, and he also showed
the cost aspect. He did 77 requests in his demo.
He burned through 2 million tokens, but he paid
only 23 cents for all of that. So AI doesn't
necessarily need to be expensive. That's awesome.
yeah i must say this is awesome i'm gonna have
a play with this i um i i met morton last year
he came to australia for the experts live australia
show and man he is he is a force he's a he's
a great guy um i've never seen him not have a
smile either which is also you know it says a
lot right um no he's awesome so yeah folks go
go check this out perm advisor uh enroll advisor
very very cool like we said he's probably the
most hard hard -working community member i've
ever met he's also running his own business i
don't know how much probably more hours in his
day than in mine and your script. That's probably
true. Denmark probably has a couple of extra
hours in the day. Perhaps he's letting AI working
for him. Well, I don't know. We'll ask him. Let's
round off, Chris. Thank you so much again for
your insights in EntraSuite. This concludes our
eighth episode. And, well, I'm already looking
for the next one. We have to figure out what
the topics will be for the next one. Hey, it's
always fun chatting to you. I really enjoy these
chats. So thanks again, Kost, for everything.
And thank you folks for listening. Make sure
you like and subscribe if you like what we're
doing. It really does help us out because we
know that we can and should keep going. And also,
if there's anything that you'd like for us to
cover or dive into in the show, please reach
out to us on the socials and we'll be sure to
see what we can do. Yeah, please let us know.
Thanks for listening. Thank you, Chris. Thanks
a lot. Bye -bye.