Sourcepass
Overview
Businesses are often held back by lackluster technology vendors that leave them underserved and overcharged for IT services.
An opportunity existed for innovation through leveraging Software-as-a-Service (SaaS) technologies such as Artificial Intelligence (AI) and Robotic Process Automation (RPA) married with premier managed services to provide a revolutionary client experience.
As a result, Sourcepass was born with the vision to provide businesses of all sizes a technology experience that elevates their company.
Sourcepass puts you in control of your digital universe, so you have the power to transform your business.
With Sourcepass, you have a team of guardians that maintains data networks, manages cloud and security monitoring, and guides productivity and digital transformation. The right blend of technologies work seamlessly and powerfully, backed and boosted by our tech smarts and business savvy.
Vulnerability Management for SMBs: A Practical Guide | Sourcepass
Small and midsize businesses rarely have a shortage of vulnerabilities to address. The harder problem is determining which vulnerabilities create meaningful business risk, assigning someone to remediate them, and confirming that the exposure is actually gone. Vulnerability management gives SMBs a structured way to discover weaknesses, prioritize remediation, coordinate SMB patch management, and measure whether the attack surface is shrinking. It goes beyond installing updates. Organizations may need to change configurations, remove outdated software, restrict access, isolate systems, apply c
Small and midsize businesses rarely have a shortage of vulnerabilities to address. The harder problem is determining which vulnerabilities create meaningful business risk, assigning someone to remediate them, and confirming that the exposure is actually gone. Vulnerability management gives SMBs a structured way to discover weaknesses, prioritize remediation, coordinate SMB patch management, and measure whether the attack surface is shrinking. It goes beyond installing updates. Organizations may need to change configurations, remove outdated software, restrict access, isolate systems, apply compensating controls, or eventually replace technology that cannot be adequately secured. defines enterprise patch management as identifying, prioritizing, acquiring, installing, and verifying patches, updates, and upgrades. Its guidance treats patching as preventive maintenance and recommends an enterprise strategy to operationalize the process while reducing risk. Review NIST SP 800-40 Rev. 4. For SMB leaders, the objective should not be eliminating every vulnerability as quickly as possible. It should be establishing a repeatable process that directs limited resources toward the exposures most relevant to the business. Vulnerability Management Starts With Asset Visibility Cybersecurity teams cannot evaluate exposure effectively if they do not understand which technology the business operates. That inventory can be challenging for an SMB because the technology environment may extend well beyond employee laptops. Depending on the organization, vulnerability management may need to account for: Windows endpoints Servers Network infrastructure Internet-facing systems Business-critical applications Cloud workloads Remote devices Vendor-managed technology Unsupported or legacy systems For Microsoft-focused organizations, the broader environment can also include Microsoft 365 identities, Microsoft Azure workloads, Microsoft Intune-managed endpoints, and devices protected through Microsoft Defender. The vulnerability program needs to connect those different environments into an understandable view of the organization's exposure. Asset Context Changes Remediation Priority An inventory becomes more useful when IT can distinguish business-critical technology from lower-impact assets. For each important asset or system, document relevant context such as: Business owner Technical owner Business function External exposure Data sensitivity Security controls Application dependencies Vendor support status Recovery requirements These details give vulnerability findings context. A scanner can identify a technical weakness. It cannot make every business decision associated with remediating it. Vulnerability Management Is Broader Than SMB Patch Management Patching is a central part of vulnerability management, but the terms should not be used interchangeably. NIST's enterprise patch management guidance specifically describes a process of identifying, prioritizing, acquiring, installing, and verifying patches, updates, and upgrades throughout an organization. NIST also frames patching as preventive maintenance and recommends developing an enterprise strategy to simplify and operationalize patching. [csrc.nist.gov] Vulnerability management has a broader decision framework. Depending on the weakness and the system involved, an SMB may decide to: Install a security update Upgrade an application Change an insecure configuration Remove unused software Disable an unnecessary service Restrict network access Isolate a device Apply another mitigating security control Replace unsupported technology Temporarily accept a documented risk This matters because a patch is not always immediately available or operationally appropriate. The business still needs a decision, an owner, and a way to track the remaining exposure. Prioritize Vulnerability Remediation by Business Risk A vulnerability list is not a remediation strategy. SMBs have finite IT resources, limited maintenance windows, application dependencies, vendor constraints, and legitimate concerns about disrupting operations. Treating every finding as equally urgent can direct attention away from more important exposures. A stronger prioritization process combines technical findings with business context. Consider factors such as: Known exploitation Internet exposure Asset importance Data sensitivity Privileges associated with the affected system Existing security controls Business dependencies Availability of remediation The resulting priority should answer a useful operational question: Which vulnerability should we address next, and why does it matter more than the others? Use Known Exploitation to Improve Prioritization Not every vulnerability has the same evidence of real-world exploitation. The CISA Known Exploited Vulnerabilities Catalog is an authoritative source of vulnerabilities known to have been exploited in the wild. CISA specifically recommends using the catalog as an input to vulnerability-management prioritization. Review the CISA Known Exploited Vulnerabilities Catalog. For an SMB, that provides an important additional signal when determining remediation urgency. A vulnerability's technical severity still matters, but organizations should also ask whether there is evidence of active exploitation and whether their affected system is exposed in a way that makes exploitation relevant. Give Critical Business Systems Additional Context Some systems deserve closer review because of the business functions they support. Examples may include: Identity infrastructure Internet-facing applications Backup infrastructure Domain controllers Systems containing sensitive business information Critical line-of-business applications This does not mean every vulnerability affecting these systems automatically receives the highest possible priority. It means their importance should influence the remediation decision. A technically severe issue on an isolated test system and an actively exploited vulnerability on an internet-accessible business system create different operational decisions. Assign Every Material Vulnerability a Decision and Owner A finding should not remain open simply because nobody knows who is responsible for it. For prioritized vulnerabilities, record: Affected asset Business owner Remediation owner Risk being addressed Selected remediation Dependencies Target date Validation method Exception or acceptance rationale when applicable Ownership is particularly important when remediation crosses organizational boundaries. IT may own the endpoint, but a software vendor may need to certify an application update. Operations may need to approve downtime. A department owner may need to validate that an application still works after remediation. The security team's role is to make the risk and required decision clear enough for those groups to act. Coordinate Vulnerability Remediation With Business Operations Applying a security update without considering application dependencies can create unnecessary operational problems. Delaying every update because disruption is possible creates a different problem. The answer is a defined remediation process. emphasizes prioritizing and verifying patch installation as part of enterprise patch management, while also recommending an organizational strategy for operationalizing patching. [csrc.nist.gov] For changes that could materially affect business systems, teams should plan for the operational requirements surrounding remediation. Depending on the system, that can include testing, business-owner coordination, recovery preparation, and post-change validation. The important behavior change is moving from reactive patch installation to owned remediation decisions. Connect Microsoft Security Tools to Vulnerability Operations For organizations operating primarily in Microsoft environments, vulnerability management should not function as a completely separate security program. Microsoft 365 identity controls, endpoint administration, device configuration, cloud workloads, and network security can all provide context when evaluating exposure. For example, vulnerability findings affecting managed Windows endpoints should inform the endpoint-management process. Findings associated with identity infrastructure should be considered alongside identity security. Network exposure should be evaluated together with firewall policy and segmentation. The objective is operational coordination. A managed security program can support this process by combining vulnerability detection, endpoint management, remediation tracking, patch coordination, and reporting. The business still needs to determine how much operational disruption it can accept and which systems matter most. Manage Vulnerability Exceptions as Temporary Risk Decisions Some findings cannot be fixed immediately. A vendor may not have released an update. A critical application may not support the newer software version. An upgrade may require a larger modernization project. Leaving those vulnerabilities indefinitely open is not a strategy. Create an exception that records: Why remediation is not currently feasible Who owns the risk Which systems are affected What compensating control exists What condition would allow remediation When the decision will be reviewed Temporary risk acceptance should remain visible. Otherwise, a short-term operational decision can quietly become a permanent part of the organization's attack surface. Measure Vulnerability Management by Risk Reduction Counting installed patches can show activity. It does not necessarily show whether the organization's most important exposures are declining. A better vulnerability management dashboard combines coverage, remediation, exceptions, and validation. Useful measures can include: Percentage of known assets covered by vulnerability assessment Critical findings past their approved remediation date Open vulnerabilities listed in the CISA Known Exploited Vulnerabilities Catalog Average remediation time by risk tier Age of approved vulnerability exceptions Percentage of completed remediations that have been validated Number of critical assets with unresolved high-priority findings Number of assets no longer reporting to required security tools The CISA KEV Catalog is specifically intended to be used as an input into vulnerability-management prioritization, making open KEV-listed vulnerabilities a particularly useful category to monitor where relevant to the organization's technology. [cisa.gov] The right metrics should help leadership answer three questions: Can we see our material exposure? Are we addressing the most important findings? Can we verify that remediation worked? Do Not Mistake Missing Data for Remediation An asset disappearing from a vulnerability dashboard does not necessarily mean its vulnerabilities were fixed. The device may be offline. An endpoint agent may have stopped functioning. A cloud integration may have failed. The asset may have been replaced without the inventory being updated. This is why asset visibility and vulnerability management need to operate together. Establish internal checks for the systems providing vulnerability and asset information. Investigate assets that unexpectedly stop reporting rather than automatically treating their findings as resolved. The distinction matters for executive reporting. Risk has declined only when the underlying exposure has changed, not simply because a finding no longer appears on a dashboard. Use Recurring Vulnerabilities to Identify Bigger IT Problems Repeated findings can expose weaknesses in the operating model. If the same application repeatedly misses updates, the underlying problem may involve unclear software ownership, difficult maintenance windows, outdated packaging, or limited vendor support. If unsupported systems regularly require exceptions, the larger issue may be lifecycle management. If exposed services repeatedly generate urgent vulnerabilities, the organization may need to reconsider architecture, network segmentation, or how those applications are delivered. If devices frequently fall outside patching standards, endpoint standardization may deserve investment. Vulnerability management should therefore feed the organization's technology roadmap. The findings explain not only where individual vulnerabilities exist, but where broader operational improvements may reduce recurring work. Validate Vulnerability Remediation Before Closing the Finding A completed change request does not prove that a vulnerability has been resolved. explicitly includes verification of patch installation within its definition of enterprise patch management. [csrc.nist.gov] That principle should extend throughout vulnerability remediation. Depending on the finding, validation may involve confirming: The intended update is installed The vulnerable application version is no longer present The affected service has been removed or disabled The insecure configuration has changed The vulnerable asset is no longer exposed The mitigating control is operating as intended The exact test depends on the weakness, but the operating principle stays the same: Remediation is complete when the exposure has been verified as addressed, not simply when someone marks the task complete. Build a Repeatable Vulnerability Management Cycle An effective SMB vulnerability management program should become a normal operating process rather than an occasional cleanup project. A straightforward cycle is: 1. Discover Maintain visibility into the technology that needs to be assessed. 2. Prioritize Evaluate findings using technical risk, exploitation evidence, exposure, asset importance, and business context. 3. Assign Give material vulnerabilities an accountable owner, target, and decision. 4. Remediate Patch, upgrade, reconfigure, restrict, isolate, replace, or apply another approved treatment. 5. Validate Verify that the intended change addressed the exposure. 6. Measure Track coverage, overdue risk, known exploitation, remediation performance, and exceptions. 7. Improve Use recurring findings and remediation blockers to inform endpoint management, network architecture, application lifecycle planning, and the broader security roadmap. That operating rhythm matters more than generating another vulnerability report. For SMB leaders, the desired result is an environment where IT can identify material exposures, explain which ones matter most, show who owns remediation, and demonstrate whether the organization's attack surface is actually being reduced. FAQ What is vulnerability management? Vulnerability management is the ongoing process of identifying security weaknesses, evaluating their risk, prioritizing remediation, assigning ownership, addressing the exposure, and validating the outcome. It is broader than patching because remediation can also involve configuration changes, access restrictions, software removal, system replacement, or other mitigating controls. What is the difference between vulnerability management and patch management? Patch management focuses on software patches, updates, and upgrades. NIST SP 800-40 Rev. 4 defines enterprise patch management as identifying, prioritizing, acquiring, installing, and verifying those changes. Read NIST's enterprise patch management guidance. Vulnerability management is broader because not every vulnerability is resolved by installing a patch. How should SMBs prioritize vulnerability remediation? SMBs should consider technical severity alongside factors such as known exploitation, internet exposure, asset importance, data sensitivity, business dependencies, and available security controls. CISA recommends using its Known Exploited Vulnerabilities Catalog as an input into vulnerability-management prioritization. [cisa.gov] What is the CISA Known Exploited Vulnerabilities Catalog? The CISA Known Exploited Vulnerabilities Catalog, commonly called the KEV Catalog, is an authoritative source of vulnerabilities known to have been exploited in the wild. CISA recommends that organizations use it as an input to their vulnerability-management prioritization framework. View the CISA KEV Catalog. Should SMBs patch every vulnerability immediately? Not every vulnerability carries the same risk or has the same remediation requirements. SMBs should prioritize findings using factors such as exploitation evidence, exposure, business importance, and remediation feasibility. Findings that cannot be immediately addressed should remain visible through a documented risk or exception process. What vulnerability management metrics should SMBs track? Useful metrics include asset assessment coverage, overdue high-priority vulnerabilities, open known-exploited vulnerabilities, remediation time by risk tier, exception age, and validated remediation rates. The specific metrics should help leadership determine whether important exposures are being identified and reduced. How does vulnerability management fit into Microsoft 365 security? For Microsoft-focused SMBs, vulnerability management should complement identity, endpoint, device, cloud, and network security. Vulnerability findings can inform endpoint remediation and broader technology decisions, while Microsoft 365 identity security addresses access risks that vulnerability scanning alone does not resolve. Can managed cybersecurity support vulnerability management? Managed cybersecurity can support operational activities such as vulnerability discovery, prioritization, reporting, remediation tracking, endpoint management, and patch coordination. Business and technology owners should still remain accountable for decisions involving critical systems, operational disruption, exceptions, and accepted risk. How do you know whether vulnerability remediation worked? Do not rely only on a completed ticket. Validate that the intended technical change occurred and that the underlying exposure has been addressed. NIST includes verification of patch installation as part of the enterprise patch management process. [csrc.nist.gov]
Read full post on blog.sourcepass.com
SMB Microsoft 365 Modernization | Sourcepass MCOE
Microsoft 365 environments rarely become complicated overnight. Complexity builds gradually as organizations maintain legacy Active Directory infrastructure, connect older applications to newer cloud services, add security tools, adopt AI, and respond to evolving cyber threats. For small and midsize businesses, the challenge is deciding what should be modernized, what still needs to remain in place, and where security gaps require attention. What Microsoft 365 Challenges are Businesses Facing Today? Many organizations find themselves somewhere between traditional on-premises
Microsoft 365 environments rarely become complicated overnight. Complexity builds gradually as organizations maintain legacy Active Directory infrastructure, connect older applications to newer cloud services, add security tools, adopt AI, and respond to evolving cyber threats. For small and midsize businesses, the challenge is deciding what should be modernized, what still needs to remain in place, and where security gaps require attention. What Microsoft 365 Challenges are Businesses Facing Today? Many organizations find themselves somewhere between traditional on-premises IT and a cloud-first environment. Active Directory and legacy applications may still support critical business processes, while Microsoft cloud services increasingly handle identity, devices, collaboration, security, and AI. Navigating that transition requires more than adopting new technology. Businesses need to understand existing dependencies, determine which Microsoft services fit their requirements, and ensure security controls evolve alongside their environment. In this episode of the Demystifying Microsoft podcast, Sourcepass host Nathan Taylor sits down with Client Success Manager Tracy Harper to discuss the Microsoft 365 questions and challenges they are seeing organizations navigate today. Their conversation covers moving away from on-premises Active Directory, managing SMTP relay requirements, evaluating Microsoft 365 Copilot licensing, and strengthening defenses against business email compromise and identity-based attacks. Why are Businesses Moving Away from On-Premises Active Directory? For years, on-premises Active Directory served as the foundation of identity and access management for many businesses. Maintaining that infrastructure, however, requires servers, security, backups, administration, and ongoing maintenance. Moving toward cloud-based management can reduce some of that infrastructure burden while expanding access to modern Microsoft identity and device management capabilities. A cloud-first approach may include technologies such as: Microsoft Entra ID Microsoft Intune Windows Autopilot Cloud-managed devices Modern identity and authentication controls But modernization does not have to mean immediately shutting down every domain controller. The right approach depends on what the business still requires from its existing environment. What Should you Check Before Migrating Away from Active Directory? Before removing Active Directory, organizations need to identify everything that still relies on it. Dependencies may include line-of-business applications, authentication processes, Wi-Fi access, synchronized identities, and legacy systems. An Active Directory modernization assessment should answer questions such as: Which applications still depend on Active Directory? How are identities currently synchronized? Are devices ready for cloud-based management? Which authentication workflows rely on existing infrastructure? Which legacy systems cannot yet be migrated? If some systems still require Active Directory, a phased strategy may be more useful. Endpoints can move toward cloud-based management while limited Active Directory infrastructure remains available for applications or users that still require it. This reduces the legacy footprint without forcing a migration before every application is ready. How can Businesses Modernize SMTP Relay for Microsoft 365? Cloud modernization can uncover less obvious technology dependencies, including systems that still rely on SMTP to send email. Copiers, accounting software, inventory platforms, monitoring tools, and other line-of-business applications may need to send automated messages even after an organization reduces its on-premises infrastructure. Modernizing these workflows requires organizations to consider encryption, ports, authentication, and email authentication controls such as SPF, DKIM, and DMARC. The goal is to maintain reliable email delivery without preserving unnecessary infrastructure solely because an older application depends on it. Should you Use an On-Premises or Third-Party SMTP Relay? There is no single SMTP relay architecture that works for every organization. Businesses sending larger volumes of email may benefit from a dedicated third-party SMTP service. Lower-volume needs, such as a copier or individual business application, may warrant a different approach. Evaluate: Which systems need to send email How much email they generate Whether applications support current requirements How email authentication will be handled Whether additional on-premises infrastructure is justified The right configuration should support the specific application and email volume without introducing unnecessary management or security overhead. How Should Small Businesses Evaluate Microsoft 365 Copilot Licensing? Microsoft licensing can become complicated when enterprise and SMB offerings provide overlapping capabilities under different licensing structures. Small and midsize organizations should evaluate whether business-focused Microsoft licensing better aligns with their environment rather than automatically selecting enterprise products because they appear more comprehensive. Consider factors such as: Number of users Existing Microsoft 365 subscriptions Required security and management capabilities AI requirements Features employees will use Current Microsoft licensing eligibility Microsoft product names, eligibility requirements, promotions, and pricing can change. Licensing should therefore be reviewed periodically, particularly before renewals or major technology deployments. Why is Business Email Compromise a Major Microsoft 365 Security Risk? Cloud adoption changes the security landscape rather than eliminating cyber risk. Business email compromise (BEC) is particularly concerning because compromising one identity can provide an attacker with access to valuable communications and business processes. An attacker with mailbox access may observe legitimate conversations, search for financial information, create mailbox rules, impersonate users, or interfere with payment-related communications. This is why Microsoft 365 security strategies need to treat identities as a critical layer of the organization's defenses. What Microsoft 365 Security Controls can Reduce Identity Risk? Identity security works best as a combination of preventive and detective controls rather than as a single technology. Organizations should evaluate areas such as: Multifactor authentication Phishing-resistant authentication, including passkeys SPF, DKIM, and DMARC Device compliance policies Managed device policies Microsoft Entra ID security controls Monitoring for suspicious identity and mailbox activity Each addresses a different part of the attack path. Email authentication can strengthen email protections, stronger authentication can make account compromise more difficult, device policies can restrict access, and monitoring can identify suspicious activity that gets past preventive controls. That changes the security conversation from simply asking: “Do we have MFA?”, to the more important question: “What happens if an attacker compromises an identity anyway?” What is Identity Threat Detection and Response? Identity Threat Detection and Response (ITDR) focuses on detecting and responding to suspicious activity involving digital identities. For example, an unusual Microsoft 365 sign-in may not provide enough information on its own to determine whether an account is compromised. But that sign-in becomes more concerning when followed by activities such as registering a device, adding an authentication method, or creating mailbox rules. ITDR provides another defensive layer by looking for suspicious identity activity that may indicate an account has been compromised. For SMBs without around-the-clock internal security teams, this type of monitoring can also help address an important operational challenge: suspicious activity does not always occur during normal working hours. Why does 24/7 Identity Monitoring Matter for SMBs? A compromised account can remain active during evenings, weekends, and other periods when internal teams may not be monitoring Microsoft 365 activity. Organizations should therefore consider how their security strategy handles three stages: Prevent identity compromise where possible. Detect suspicious identity behavior quickly. Respond through a defined process when potential compromise is identified. That combination creates a more resilient approach than relying exclusively on preventive controls. What Should SMBs Prioritize in their Microsoft 365 Strategy? Modernizing Microsoft 365 does not require changing everything at once. A more effective strategy is to focus on the areas that reduce unnecessary complexity and address meaningful security risks. 1. Map Legacy Infrastructure Dependencies Document which applications, users, devices, and authentication workflows still require Active Directory or other on-premises infrastructure before beginning a migration. 2. Modernize Identity and Device Management Identify where Microsoft Entra ID, Intune, Windows Autopilot, and modern authentication can provide cloud-based alternatives to traditional management processes. 3. Align Microsoft Licensing with Business Requirements Review licensing based on organizational size, technology requirements, security needs, eligibility, and actual usage rather than assuming enterprise licensing is necessary. 4. Prepare for Identity Compromise Combine authentication, email security, device controls, threat detection, and incident response so security does not depend on one preventive measure succeeding every time. The goal is not simply to move more technology into the cloud. It is to create a Microsoft 365 environment that is easier to manage, appropriately secured, and aligned with how the organization operates. Build a More Secure, Manageable Microsoft 365 Environment Microsoft 365 modernization is not about moving everything to the cloud as quickly as possible. It is about understanding what your organization depends on, removing unnecessary complexity, using the right licensing and management tools, and strengthening security around the identities employees use every day. Whether your organization is evaluating its Active Directory footprint, addressing a legacy SMTP relay, reviewing Microsoft licensing, or strengthening defenses against business email compromise, the Sourcepass MCOE can help assess the current environment and identify a path forward based on your operational and security requirements. Need help evaluating your Microsoft 365 environment? Connect with Sourcepass MCOE to discuss your identity, security, licensing, and cloud modernization priorities. And for more conversations about Microsoft 365, cybersecurity, AI, and the technology decisions businesses face every day, subscribe to the Demystifying Microsoft podcast.
Read full post on blog.sourcepass.com
Microsoft 365 Guest Access Governance Guide for SMBs | Sourcepass
Microsoft 365 makes external collaboration straightforward, but access can become difficult to govern when contractors, vendors, customers, and partners accumulate permissions across Teams, SharePoint, OneDrive, applications, and Microsoft Entra ID. Effective Microsoft 365 guest access governance is not about eliminating external collaboration. It is about making that collaboration intentional, appropriately limited, and accountable. For SMBs, a useful guest access governance program establishes who can invite external users, what they can access, who owns the relationship, how long access s
Microsoft 365 makes external collaboration straightforward, but access can become difficult to govern when contractors, vendors, customers, and partners accumulate permissions across Teams, SharePoint, OneDrive, applications, and Microsoft Entra ID. Effective Microsoft 365 guest access governance is not about eliminating external collaboration. It is about making that collaboration intentional, appropriately limited, and accountable. For SMBs, a useful guest access governance program establishes who can invite external users, what they can access, who owns the relationship, how long access should remain active, and how the organization verifies that access is still needed. Microsoft Entra B2B collaboration allows organizations to share applications and services with external users while maintaining control over corporate data. External users can use their existing identities, and after accepting an invitation or completing sign-up, they are represented as user objects in the organization's directory. Microsoft explains the B2B collaboration model. The technology enables collaboration. Governance determines whether that access remains appropriate over time. Why Microsoft 365 Guest Access Requires Governance Guest access itself is not the problem. External users are often necessary for customer delivery, legal work, consulting, purchasing, managed services, and other routine business operations. The risk emerges when an external identity or permission no longer reflects a current business need. A contractor may finish a project but remain in a Microsoft 365 Group. A vendor could retain application access after a service relationship changes. A customer collaboration space may contain external users whose access has not been reconsidered as the project evolves. Microsoft identifies this broader access-management challenge in its guidance for Microsoft Entra access reviews. Microsoft notes that users can join groups, invite guests, connect to cloud applications, and work remotely, making continued access something organizations need to review deliberately. Microsoft Entra access reviews are designed to help organizations regularly verify continued access. For an SMB, the objective should be simple: every external identity should have a legitimate reason for access and an accountable relationship with the business. Start Guest Access Governance With Visibility Before changing Microsoft 365 external sharing policies, establish what external access already exists. Organizations should build an inventory that helps answer: Which guest accounts currently exist? What business relationship does each guest support? Which Microsoft 365 resources can external users access? Which internal owner is accountable for the relationship? Are any guests receiving broader access than their work requires? Which access relationships need to be reviewed? This is not simply an IT inventory. Guest access represents a business relationship expressed through technology. Give Every Guest Relationship an Owner IT can administer an identity, but IT may not know whether an outside attorney, consultant, vendor representative, or customer still needs access. That decision belongs with someone who understands the business relationship. Establish an owner for material external access. Depending on the situation, that may be a department leader, project owner, Microsoft 365 Group owner, or application owner. Microsoft specifically identifies guest access as a use case for access reviews. Its guidance notes that group owners can be asked to confirm whether guests still have a legitimate business need for access, particularly when groups provide access to business-sensitive content. [learn.microsoft.com] Governance becomes much more sustainable when business owners make business decisions and IT supplies the controls to enforce them. Design Microsoft 365 Guest Access Around the Business Need Before approving external access, determine what the person actually needs to accomplish. The answer should guide the scope of access. An outside user collaborating on a specific document may not need access to an entire workspace. A long-term service provider may need broader access than a contractor completing a short project. An external administrator requires different controls from a customer viewing shared information. Start with the business use case and work backward toward the technology. Define an External Access Standard A lightweight SMB governance standard can require several pieces of information before significant access is granted: External user's organization Business purpose Internal owner Resource requested Requested permission level Expected duration Sensitive information involved Approval, when required Conditions requiring future review This creates consistency without requiring a lengthy process for routine collaboration. The standard should also define who is permitted to invite guests. Microsoft Entra External ID provides external collaboration settings that can control who is permitted to send B2B guest invitations, including options for restricting invitations to particular roles. [learn.microsoft.com] The right setting depends on the organization's collaboration model. The governance question is whether invitation privileges match the organization's desired level of control. Apply Least Privilege to External Sharing Guest access should provide enough permission for the external user to perform the required work without granting unrelated access. That principle can be applied at several levels: Microsoft 365 Groups Teams workspaces SharePoint resources OneDrive content Enterprise applications Microsoft Entra roles Microsoft Entra B2B collaboration allows administrators to assign guest users to applications and groups. Microsoft also supports integration with SharePoint and OneDrive for sharing resources with external users while using Microsoft Entra B2B for authentication and management. [learn.microsoft.com] For SMBs, the question is not merely whether an external user can receive access. It is whether the scope matches the actual business requirement. Apply Stronger Controls to Sensitive Resources Not every Microsoft 365 workspace needs the same external sharing policy. A general project collaboration area presents a different risk from resources containing employee records, financial information, contracts, intellectual property, or sensitive customer data. Classifying collaboration scenarios by sensitivity can help organizations determine when they need: More restrictive external sharing Additional approval Tighter permissions Stronger authentication requirements More frequent access review Microsoft states that Conditional Access policies, including multifactor authentication requirements, can be applied at tenant, application, or specific guest-user levels to protect corporate applications and data. [learn.microsoft.com] The goal is to apply controls according to access risk rather than introducing identical friction into every external collaboration scenario. Govern Teams, SharePoint, OneDrive, and Entra ID Together Guest governance becomes difficult when individual Microsoft 365 workloads are treated independently. An external relationship can involve identity, group membership, applications, and shared content. Removing one permission does not by itself demonstrate that every other access path associated with the business relationship has been removed. Governance should therefore consider the relationship between: Microsoft Entra guest identities Microsoft 365 Groups Teams collaboration SharePoint sharing OneDrive sharing Enterprise applications Relevant administrative roles Microsoft Entra B2B supports integration with SharePoint and OneDrive, allowing organizations to use B2B authentication and management when sharing resources externally. [learn.microsoft.com] For IT leaders, that interconnected environment reinforces the need to govern external users through an identity lifecycle rather than treating each invitation as an isolated sharing event. Use Microsoft Entra Access Reviews to Revalidate Guest Access External access should not automatically continue because nobody asked for it to be removed. Microsoft Entra access reviews are designed to help organizations review group membership, enterprise application access, and role assignments so the appropriate people continue to have access. Microsoft supports recurring access reviews at weekly, monthly, quarterly, or annual frequencies. [learn.microsoft.com] For an SMB, the appropriate frequency should depend on risk and business need rather than an arbitrary schedule. Access to a sensitive application may justify more frequent review than participation in a lower-risk collaboration group. Ask the Business Owner a Direct Question An access review should produce a decision: Does this external user still have a legitimate business requirement for this access? If the answer is yes, retain the appropriate access. If the answer is no, remove it. If nobody can establish why access remains necessary, that should prompt further investigation rather than indefinite continuation. Microsoft specifically recommends proactively engaging resource owners to review who has access to their resources. [learn.microsoft.com] Consider Licensing When Planning Automated Reviews Licensing should be included in the implementation plan. Microsoft states that the access reviews capability requires Microsoft Entra ID Governance or Microsoft Entra Suite subscriptions for organizational users, while some capabilities may operate with Microsoft Entra ID P2. Specific access-review features can have additional licensing requirements. [learn.microsoft.com] SMBs should validate current licensing and feature requirements before designing a governance process that depends on automated access reviews. Where automation is unavailable or inappropriate, organizations can still establish an owned manual review process rather than allowing access to remain unchecked. Create a Guest Access Lifecycle Strong guest access governance covers the entire relationship, not only the initial invitation. A straightforward lifecycle consists of four stages. 1. Request Document who needs access, what they need, why they need it, and the internal business owner. 2. Approve and Provision Evaluate the requested access according to the sensitivity of the information and the external user's role. Provide only the permissions needed for the approved purpose. 3. Review Reassess whether the business relationship and access requirement are still valid. Higher-risk access should receive greater scrutiny. 4. Remove or Renew Remove access when the business purpose ends. If access must continue, document or certify the continued need according to the organization's governance process. This creates an important shift in employee behavior. Instead of treating external access as a permanent entitlement once approved, teams learn that collaboration has a lifecycle. Document and Review Guest Access Exceptions Some external relationships require long-term access. A managed service provider, attorney, accountant, auditor, strategic partner, or other external organization may have a legitimate ongoing role. Long-term should not mean unmanaged. An exception record should identify: Business purpose Internal owner Approved access Reason an exception is required Relevant safeguards Review date Conditions that require reevaluation Microsoft Entra access reviews can also support governance of policy exception lists. Microsoft identifies maintaining and periodically reviewing access-policy exceptions as a use case for the capability. [learn.microsoft.com] The objective is not to eliminate exceptions. It is to make sure leadership and IT can distinguish an approved exception from forgotten access. Measure Microsoft 365 Guest Access Governance An effective program needs metrics that show whether external collaboration is becoming more controlled. Rather than reporting only the total number of guest accounts, combine inventory measures with lifecycle and accountability measures. Useful KPIs can include: Active guest identities Guests without an identified business owner Pending or overdue access reviews External accounts with elevated access Exceptions awaiting review Temporary access retained beyond its approved period Percentage of required reviews completed Time required to remove access after a business relationship ends Organizations should select measures they can obtain reliably and use them consistently. The most important outcome is not necessarily fewer external users. A growing professional-services business may legitimately add more guests as customer collaboration expands. A better indicator is whether that growth remains governed. Make Secure External Collaboration Easier for Employees Guest access policies fail when employees cannot understand how they are supposed to work with outside parties. Give users an approved method for requesting and managing external collaboration. Explain what information IT or security needs and why it matters. Make the difference between routine collaboration and access to sensitive resources understandable. Employees should know: How to request external access Who approves sensitive access Which collaboration method to use Who owns the external relationship When access should be removed Where to report unusual activity or sharing The desired behavior is not to discourage collaboration. It is to make secure collaboration the easiest approved path. If legitimate work becomes unnecessarily difficult, employees may look for alternatives outside governed Microsoft 365 processes. Governance design should therefore consider usability alongside security. Integrate Guest Governance With Managed Microsoft Security For SMB IT teams, the difficulty is often not defining what good governance looks like. It is maintaining it as collaboration patterns, employees, external partners, and Microsoft 365 configurations change. Managed Microsoft security can support the operational side of guest governance through identity administration, access reviews, Microsoft 365 configuration management, exception tracking, monitoring, and reporting. The business should still own decisions about who needs access and why. The technical operating model should make those decisions visible and enforceable. That division of responsibility creates a sustainable model: Business owners validate the relationship. IT and security govern the access. The outcome is not a locked-down Microsoft 365 environment. It is an environment where the organization can explain who its external users are, what they can access, why they need that access, and how that access will eventually be reviewed or removed. FAQ What is Microsoft 365 guest access? Microsoft 365 guest access allows organizations to collaborate with people outside the organization. Through Microsoft Entra B2B collaboration, external users can use their existing identities to access approved company resources, and after invitation redemption or sign-up they are represented as user objects in the organization's directory. Microsoft explains how B2B guest collaboration works. What is guest access governance? Guest access governance is the process used to control the lifecycle of external access. It establishes who can request and approve access, what resources an external user can use, who owns the business relationship, how continued access is reviewed, and when permissions should be removed. What is Entra ID B2B? Microsoft Entra B2B collaboration is part of Microsoft Entra External ID. It allows organizations to share applications and services with external partners and guests while maintaining control over corporate data. External users can authenticate using their own identities and credentials. [learn.microsoft.com] How should SMBs manage Microsoft 365 guest access? SMBs should establish an external-access lifecycle covering requests, ownership, appropriate permissions, periodic review, exceptions, and removal. The process should be proportional to the sensitivity of the resource and the external user's business role rather than applying identical requirements to every collaboration scenario. What are Microsoft Entra access reviews? Microsoft Entra access reviews help organizations review group memberships, enterprise application access, and role assignments to verify that continued access remains appropriate. Reviews can also be configured to recur at defined frequencies. Microsoft explains access reviews and supported governance scenarios. Can Microsoft Entra require MFA for guest users? Microsoft states that Conditional Access policies, including multifactor authentication requirements, can be enforced at the tenant level, application level, or for specific guest users. The appropriate policy depends on the organization's collaboration and security requirements. [learn.microsoft.com] Can guest users access SharePoint and OneDrive? Yes. Microsoft Entra B2B can integrate with SharePoint and OneDrive for external sharing of resources such as files, folders, document libraries, list items, and sites while using B2B authentication and management. [learn.microsoft.com] How often should guest access be reviewed? The appropriate interval depends on the sensitivity of the resource and the nature of the external relationship. Microsoft Entra access reviews can support recurring reviews at weekly, monthly, quarterly, or annual frequencies. An SMB should use a review frequency that reflects the risk and business purpose of the access rather than treating every guest relationship identically. [learn.microsoft.com] Does Microsoft 365 guest access governance require additional licensing? Some governance capabilities do. Microsoft states that Microsoft Entra access reviews require Microsoft Entra ID Governance or Microsoft Entra Suite subscriptions for organizational users, while some capabilities may operate with Microsoft Entra ID P2. Specific features can have additional licensing requirements. Organizations should validate licensing before building automated access reviews into their governance process. [learn.microsoft.com] What should SMBs measure for external sharing governance? Useful measures include active guests, guests without assigned business owners, overdue access reviews, elevated external access, unresolved exceptions, and temporary access that remains after its approved period. The purpose of these measures is to determine whether external collaboration remains owned, reviewed, and appropriately limited rather than simply reducing the number of guests.
Read full post on blog.sourcepass.com
Firewall Modernization for Hybrid SMB Network Security | Sourcepass
Hybrid work has changed what an SMB firewall needs to protect. Employees connect from offices, homes, and branch locations. Business applications increasingly run in Microsoft 365, Azure, and other cloud platforms. Vendors may require controlled access to internal resources, while employee devices, guest networks, servers, voice systems, and other technology can operate across the same physical locations. A firewall modernization strategy should account for this distributed environment. For SMB network security, that means looking beyond a hardware replacement and reconsidering network segme
Hybrid work has changed what an SMB firewall needs to protect. Employees connect from offices, homes, and branch locations. Business applications increasingly run in Microsoft 365, Azure, and other cloud platforms. Vendors may require controlled access to internal resources, while employee devices, guest networks, servers, voice systems, and other technology can operate across the same physical locations. A firewall modernization strategy should account for this distributed environment. For SMB network security, that means looking beyond a hardware replacement and reconsidering network segmentation, remote access, traffic visibility, cloud connectivity, resilience, and operational ownership. A newer firewall running an old rule set across a flat network may increase capacity without addressing the organization's most important network risks. Modernization should instead result in clearer trust boundaries, fewer unnecessary access paths, stronger oversight of network changes, and better information for investigating suspicious activity. Why Hybrid Work Requires a Different Firewall Modernization Strategy Traditional perimeter security assumed there was a clearly defined internal network that could be separated from the internet. That model is less useful when important users, applications, devices, and data regularly operate outside the office. Microsoft 365 applications may be cloud-hosted. Remote employees may rarely connect from a corporate location. Branch offices require consistent connectivity. Business systems may span on-premises infrastructure and Azure. Third parties may need limited access to specific applications or environments. The firewall remains an important control, but it is one layer within that larger architecture. For Microsoft-focused SMBs, network security should operate alongside Microsoft Entra identity controls, endpoint management, email security, vulnerability management, detection and response, backup, and other safeguards. Azure environments introduce additional network considerations. For example, Microsoft describes Azure Firewall as a stateful cloud firewall service that can inspect both east-west and north-south traffic for Azure workloads. [learn.microsoft.com] The important question is not whether the organization still needs a firewall. It is what the firewall should control now that the users, applications, devices, and data it supports are distributed across a much larger environment. How to Know When an SMB Firewall Needs Modernization An older firewall is not automatically an ineffective firewall. Age should prompt a review, but architecture and operational condition matter more. A firewall assessment should examine whether the existing environment still supports the organization's security and business requirements. Common reasons to consider modernization include: Unsupported or difficult-to-maintain hardware Outdated firmware or security subscriptions Limited visibility into network activity A flat internal network with minimal segmentation Broad or poorly documented firewall rules Remote-access requirements that have changed New office or branch connectivity needs Increasing dependence on cloud applications Unclear administrative ownership Weak change-management processes Inadequate resilience or recovery procedures The purpose of the assessment is to determine whether the firewall architecture still matches the business, not simply whether a newer appliance is available. A company that has moved significant workloads to Microsoft 365 and Azure, expanded remote work, and added several branch locations may have very different network requirements than it did when its existing firewall was deployed. Build an SMB Network Security Architecture Around Trust Boundaries Firewall selection should come after understanding the traffic. Before designing the new environment, map the users, devices, applications, locations, systems, and external connections that depend on the network. That inventory should consider: Corporate offices and branches Remote employees Managed endpoints Guest and unmanaged devices Servers and business applications Cloud environments Microsoft 365 and Azure services Voice systems Printers and connected devices Backup infrastructure Administrative systems Vendors and third parties Publicly accessible services The next question is what those systems actually need to communicate with. If an employee device needs access to one business application, that does not necessarily mean it needs unrestricted connectivity to every server. If a vendor supports one system, the vendor should not automatically receive broad access to the rest of the environment. Firewall modernization provides an opportunity to replace inherited access with intentional access. Use Network Segmentation to Reduce Unnecessary Access Network segmentation separates systems into logical security zones and controls communication between them. For an SMB, segmentation does not need to become unnecessarily complicated. The objective is to identify systems with meaningfully different risk and access requirements and establish appropriate boundaries between them. Depending on the environment, separate segments could be considered for: Employee devices Guest access Servers Backup infrastructure Voice systems Administrative systems Sensitive business applications Internet-connected devices Vendor-accessible systems The appropriate segmentation model depends on the organization's actual architecture and business requirements. The security value comes from controlling movement between those segments. Instead of allowing broad internal connectivity by default, rules can be based on the applications and services that users and systems need. Avoid Recreating the Old Network on New Hardware One of the most important parts of firewall modernization happens before migration. Existing firewall rules should be reviewed rather than automatically copied to the new platform. Over time, firewall policies can accumulate temporary access, former vendor connections, obsolete application rules, duplicate objects, and exceptions whose original business purpose is no longer clear. Treat migration as an opportunity to ask: Who owns this rule? What business requirement does it support? Which systems require the access? Can the scope be reduced? Is the application still in use? Is the vendor relationship still active? Should the rule have an expiration date? How will the organization verify that the rule is still required? If nobody can explain why a significant access rule exists, that is a governance problem worth investigating before the rule moves into the new environment. Align Firewall Modernization With Microsoft 365 and Identity Security Network security and identity security solve different problems. A firewall can govern network communication, but it cannot independently determine whether a Microsoft 365 account has excessive permissions, whether a user should have an administrative role, or whether a compromised identity is being used from an otherwise legitimate device. For Microsoft-first SMBs, firewall modernization should therefore be considered alongside Microsoft Entra identity security and endpoint management. The design can ask several questions: Who is requesting access? Is the device managed? What application does the user need? Does the user need access to an entire network or only a specific resource? Is the connection coming through an approved access method? How will network activity be correlated with endpoint and identity information during an investigation? This creates a more useful security model than assuming network location alone determines trust. Reevaluate Remote Access Instead of Automatically Rebuilding the VPN Remote access requirements should receive their own design review. A traditional VPN may still be appropriate for users who genuinely need network-level access to internal resources. Other users may primarily need Microsoft 365 or individual cloud applications and therefore have a different access requirement. Start by identifying which resources each group actually needs. Define Different Remote-Access Use Cases A useful assessment separates: Microsoft 365 users: Employees primarily accessing cloud services such as Exchange Online, SharePoint, Teams, and other SaaS applications. Internal application users: Employees requiring controlled access to applications that remain within private networks. Administrators: IT personnel requiring elevated access to infrastructure or management interfaces. Third parties: Vendors or partners that require limited access to specific business systems. These groups do not necessarily require identical network access. The objective should be to provide enough access for the business function while limiting unnecessary connectivity. Understand Where Azure Firewall Fits Into a Hybrid Architecture Organizations operating workloads in Azure may also need to evaluate cloud-native network controls rather than assuming an office firewall should govern every workload. Microsoft's Azure Firewall overview describes Azure Firewall as a cloud-native, stateful firewall service for Azure workloads with built-in high availability and inspection of east-west and north-south traffic. Microsoft offers Basic, Standard, and Premium configurations with different capabilities. Review Microsoft's Azure Firewall overview. Microsoft also describes Azure Firewall Manager as a centralized location for managing Azure Firewalls across multiple subscriptions using firewall policies that can apply common network and application rules. That does not mean Azure Firewall should automatically replace an SMB's branch or office firewall. The appropriate architecture depends on where workloads run, how sites connect, which traffic requires inspection, performance requirements, and how the organization's administrators support the environment. Cloud firewall strategy and physical network firewall strategy should be coordinated rather than treated as unrelated projects. Treat Firewall Operations as Part of the Security Control Firewall modernization does not end when the new environment goes live. Its long-term value depends on how access rules, software updates, administrative privileges, monitoring, configuration backups, and exceptions are managed afterward. Define ownership for: Firewall rule requests Rule approvals Emergency changes Administrative access Software and firmware maintenance Certificate management Logging and monitoring Configuration backups Vendor access Security exceptions Incident response Recovery procedures This is where a managed firewall model can be useful for SMBs with limited internal IT resources. The value is not simply having someone available to make firewall changes. Managed firewall operations should create consistency around review, approval, monitoring, documentation, maintenance, and escalation. Establish Firewall Rule Governance Firewall rules should have business context. For significant rules, record: Requester Business owner Security purpose Source and destination Required ports or applications Approval Implementation date Expiration date when applicable Exception rationale Validation result Temporary firewall rules should be treated as temporary. Vendor access should be reviewed when the relationship or engagement changes. A useful internal standard is that a material firewall rule should have an identifiable owner and an explainable business purpose. That discipline reduces the chance that temporary exceptions become permanent architecture. Measure Firewall Security Outcomes, Not Just Blocked Traffic A large number of blocked connections does not necessarily tell leadership whether the network is becoming safer or easier to operate. Firewall modernization metrics should instead help answer whether access is controlled, policies remain current, abnormalities can be investigated, and critical network services can recover from disruption. Useful operational measures can include: Percentage of critical systems covered by appropriate segmentation Firewall rules reviewed according to the organization's defined schedule Number of open high-risk exceptions Number of internet-exposed services Number of rules without an identified owner Expired temporary rules still enabled Configuration changes outside the approved process Remote-access authentication failures Time required to investigate significant network alerts Successful configuration recovery tests Not every SMB needs every metric. Select measures that leadership can connect to risk reduction and that IT can collect consistently. Test Firewall Resilience and Recovery Security architecture also needs to account for availability. A firewall can become a critical dependency for internet connectivity, inter-office communications, remote access, and access to important applications. An equipment failure, ISP outage, configuration error, or administrative mistake can therefore become a business interruption. The modernization project should identify those dependencies and define the expected recovery process. Testing should reflect the actual architecture and could include: Device or service failure ISP connectivity loss Configuration recovery Administrative lockout Certificate problems Site-to-site connectivity failure Loss of remote access Isolation of a compromised network segment The goal is not simply to document that recovery is possible. Teams responsible for the environment should understand who makes decisions, where required configurations are stored, what alternative connectivity exists, and how normal operations will be restored. Build Firewall Modernization Into Ongoing SMB Network Security Hybrid environments do not stay static. New SaaS applications are introduced. Offices move. Vendors change. Companies acquire other businesses. Employees adopt new working patterns. Azure workloads expand. Old applications are retired. Firewall policy must move with those changes. A sustainable process should connect network security to IT change management. When a new system is introduced, its connectivity requirements should be intentionally defined. When an application is retired, associated firewall rules should be reviewed. When a vendor relationship ends, its access should be removed. This is also where managed IT and managed firewall services can contribute operational value. For SMBs without dedicated network security personnel, ongoing support can provide structured administration, change control, monitoring, maintenance, documentation, and escalation. The objective is not a firewall that remains unchanged. It is a network security architecture that can change without losing control of who and what is allowed to communicate. What Successful Firewall Modernization Should Deliver A successful firewall modernization project does more than replace hardware. It should leave an SMB with: Clearly defined network trust boundaries Better separation of systems with different risk levels Access based on documented business requirements A remote-access model matched to actual user needs Defined administrative ownership More useful logging and monitoring A repeatable rule-change process Documented exceptions Tested recovery procedures An architecture that accounts for offices, remote users, cloud services, and Microsoft environments For SMB executives, those outcomes are more meaningful than appliance specifications alone. For IT leaders, they provide a clearer operating model. The team knows what the firewall is expected to protect, who owns significant access decisions, how changes are approved, and what happens when the network architecture needs to evolve. That is the real objective of firewall modernization: reducing unnecessary access while making hybrid network security more understandable, measurable, and maintainable. FAQ What is firewall modernization? Firewall modernization is the process of redesigning firewall and network security controls around current users, applications, locations, cloud services, and trust boundaries. It goes beyond replacing an older device and can include network segmentation, remote-access redesign, logging, resilience planning, policy cleanup, and operational governance. Why do SMBs need firewall modernization for hybrid work? Hybrid SMBs may have employees, applications, devices, branches, vendors, and cloud environments operating outside a traditional office perimeter. Firewall modernization helps align network access controls with that distributed architecture instead of relying primarily on assumptions about who is inside or outside an office network. What is network segmentation? Network segmentation separates systems into logical network zones and controls the communication allowed between them. An SMB might use different segments for employees, guests, servers, administrative systems, backups, voice systems, or other workloads depending on its security requirements. Does Microsoft 365 eliminate the need for a firewall? No. Microsoft 365 moves many applications and services to the cloud, but SMBs may still operate offices, internal systems, branch networks, servers, connected devices, and other infrastructure requiring network security controls. Firewall security should work alongside Microsoft identity, endpoint, email, and cloud protections rather than being treated as a substitute for them. What is a managed firewall? A managed firewall is an operating model in which ongoing firewall administration and security responsibilities are supported by a managed service provider. Depending on the service agreement, that can include activities such as configuration management, policy changes, monitoring, maintenance, documentation, and escalation. Organizations should clearly define those responsibilities before selecting a managed firewall service. How does Azure Firewall fit into an SMB network security strategy? Azure Firewall is Microsoft's cloud-native firewall service for protecting Azure workloads. Microsoft states that it is a stateful firewall service that can inspect east-west and north-south traffic. Microsoft provides details about Azure Firewall configurations and capabilities. Whether it belongs in an SMB architecture depends on the organization's Azure workloads, connectivity design, security requirements, and support model. [learn.microsoft.com] Should SMBs use network segmentation? Network segmentation can be valuable when an SMB has systems with different access and security requirements. The specific design should reflect the organization's architecture. The objective is to reduce unnecessary connectivity between systems while preserving the communication required for legitimate operations. Should an SMB replace its VPN during firewall modernization? Not automatically. The better approach is to assess which users genuinely require network-level access and which primarily use Microsoft 365 or individual cloud applications. Administrators, remote employees, application users, and vendors can have different access requirements, so the remote-access architecture should be based on business need rather than copying the previous VPN configuration. What should an SMB measure after a firewall upgrade? Useful measurements can include network segmentation coverage, firewall policy reviews, high-risk exceptions, exposed services, unauthorized configuration changes, rule ownership, remote-access failures, investigation time, and recovery testing. The best metrics are those the organization can measure consistently and connect to specific network risks.
Read full post on blog.sourcepass.com
Microsoft is Retiring SMS MFA and Moving to Passkeys | Sourcepass MCOE
What happens to a user whose only sign-in method is a text message code on the day Microsoft stops supporting it? Without a plan, they will be stuck at a registration prompt instead of doing their work. Microsoft is retiring Microsoft-hosted SMS and voice multifactor authentication in Microsoft Entra ID and making passkeys the default way to sign in. The change affects how users authenticate to Microsoft 365, Azure and other business applications, and it sets firm 2027 deadlines for moving away from phone based methods. For IT teams, this means tracking the retirement dates, understanding ho
What happens to a user whose only sign-in method is a text message code on the day Microsoft stops supporting it? Without a plan, they will be stuck at a registration prompt instead of doing their work. Microsoft is retiring Microsoft-hosted SMS and voice multifactor authentication in Microsoft Entra ID and making passkeys the default way to sign in. The change affects how users authenticate to Microsoft 365, Azure and other business applications, and it sets firm 2027 deadlines for moving away from phone based methods. For IT teams, this means tracking the retirement dates, understanding how passkeys work, and moving every user off SMS and voice MFA before Microsoft does it for them. Why Microsoft Entra ID is Replacing SMS and Voice MFA with Passkeys Microsoft is replacing SMS and voice MFA because one time code can be intercepted or stolen, while passkeys use cryptographic keys that cannot be phished. On this episode of the Demystifying Microsoft podcast, Austin Kelly, Client Success Manager at Sourcepass MCOE, walks through the dates every IT team should have on their calendar and why phone based authentication no longer holds up against modern phishing. He also shares the phased approach his team uses to move users to passkeys before Microsoft makes the switch for them. Microsoft Entra ID SMS and Voice MFA Retirement Dates Microsoft hosted SMS and voice MFA in Entra ID retires for all users on February 1, 2027. Global administrators and external users with an extended timeline have until July 1, 2027. The rollout started earlier, though, and the first milestone has already passed. Date What Happens September 1, 2026 Users enabled for SMS or voice MFA became candidates for passkey registration and started seeing prompts to register during sign in February 1, 2027 Microsoft-hosted SMS and voice MFA is retired for all users July 1, 2027 Final retirement milestone for global administrators and external users who received an extended timeline If you start planning now, the change can happen on your schedule and not at the deadline. Why SMS and Voice MFA No Longer Stop Phishing Attacks SMS and voice MFA no longer stop phishing because the code itself can be stolen. Modern phishing attacks routinely intercept authentication sessions, capture tokens and bypass traditional MFA, even though organizations treated these methods as a strong control for years. Phone-based authentication has three main weaknesses. In SIM swapping, an attacker takes over a user's phone number. In social engineering, users are tricked into handing over codes. Message interception lets attackers capture codes in transit. Microsoft's position is that authentication must be phishing resistant by design. Passkeys remove the code that attackers try to steal, which shrinks the attack surface and shuts down entire categories of phishing attacks. This may be the most important identity improvement Microsoft has made since modern MFA was introduced. What is a Passkey in Microsoft Entra ID? A passkey is a phishing resistant sign in method that replaces passwords, SMS codes and voice verification with cryptographic keys tied to a trusted device. Users can register a passkey on Microsoft Authenticator, Windows Hello for Business, a mobile device or a FIDO2 security key. How does Passkey Sign-In Work? When a user signs in, Microsoft sends a challenge to the registered device. The user confirms their identity with a fingerprint, face recognition or the device PIN. The private key never leaves the device, so there is nothing for an attacker to intercept or phish. Are Passkeys Easier for Users than SMS Codes? Yes. Users no longer have to type a password, wait for a text, switch apps and copy a code. It is uncommon for a security upgrade to also make life easier for users, but passkeys do both. What Will Users See When Microsoft Prompts Them to Register a Passkey? Users who complete MFA will see a prompt asking them to register a passkey during their normal sign-in. These prompts started in September, and the registration process is simple and usually takes a couple of minutes. Microsoft is handling most of this experience, which helps the user adoption, usually the biggest worry with any authentication change. The prompts become harder to ignore once the deadline pass. If a user reaches a retirement milestone and SMS or voice is their only registered method, Microsoft can require them to register a passkey before they can continue signing in. Users who skip the prompt now will get stopped at the worst possible moment later, so talk with them early. How Should you Move Users from SMS MFA to Passkeys? Move users in four phases: discover, pilot, expand and remove the risk. Discover. Identify which users are actively using SMS and voice authentication today. Pilot. Start with IT administrators, executives and high risk users. These groups benefit most from phishing resistant authentication, and security assessments typically prioritize FIDO2 and passkey adoption for them. Expand. Roll out passkeys department by department while you monitor adoption and help desk requests. Remove the risk. Before the deadlines arrive, make sure every employee has at least one phishing resistant method registered. What if your Organization Still Needs SMS or Voice MFA? Organizations that still need SMS or voice MFA can use Microsoft's Bring Your Own Telephony Provider model. It is designed for organizations with legitimate business, regulatory or operational requirements, and it lets them buy SMS and voice delivery through an approved telephony provider instead of relying on Microsoft hosted delivery. During the initial rollout, Soprano and Telesign are the only approved providers, and Microsoft expects to add more over time. Either way, Microsoft now treats SMS and voice as exceptions, not as a primary authentication method. Plan your Passkey Rollout Before SMS MFA Retires in 2027 Microsoft's direction is clear. Passkeys are the future of authentication in Entra ID, and organizations that start early will improve security, reduce phishing risk and avoid disrupting users. Every week before February 2027 is time to work through the rollout on your terms instead of under a deadline. If you need help planning your transition or reviewing your authentication methods, contact our Microsoft experts. Subscribe to Demystifying Microsoft to stay current on Microsoft security, licensing and Entra ID changes.
Read full post on blog.sourcepass.com
Microsoft Secure Score Roadmap for SMBs | Microsoft 365 | Sourcepass
For small and midsize businesses, the challenge with Microsoft 365 security is rarely a lack of recommendations. The harder question is deciding what to fix first. Microsoft Secure Score can help by measuring an organization's security posture and presenting recommended actions across areas including identity, devices, applications, and data. Microsoft also provides historical trends, benchmarking, and recommended actions to help organizations understand where security improvements can be made. Microsoft describes Secure Score as a way to assess and improve an organization's security posture
For small and midsize businesses, the challenge with Microsoft 365 security is rarely a lack of recommendations. The harder question is deciding what to fix first. Microsoft Secure Score can help by measuring an organization's security posture and presenting recommended actions across areas including identity, devices, applications, and data. Microsoft also provides historical trends, benchmarking, and recommended actions to help organizations understand where security improvements can be made. Microsoft describes Secure Score as a way to assess and improve an organization's security posture. [learn.microsoft.com], [learn.microsoft.com] But a higher Microsoft Secure Score should not be the objective by itself. For SMB executives and IT leaders, the better objective is measurable risk reduction. That means using Secure Score as one input into a Microsoft 365 security assessment, identifying the improvements that matter most to the business, assigning ownership, managing licensing and operational dependencies, and verifying that implemented controls work as intended. What Is Microsoft Secure Score and How Should SMBs Use It? Microsoft Secure Score provides a centralized view of security posture within the Microsoft Defender portal. Organizations can use it to report on their existing posture, identify opportunities for improvement, compare their environment with benchmarks, and establish security KPIs. [learn.microsoft.com] Microsoft organizes recommended actions across several categories: Identity: Microsoft Entra accounts and roles Devices: Security associated with managed endpoints Apps: Email and cloud applications, including Microsoft 365 Data: Protection associated with Microsoft Information Protection The Secure Score dashboard can also show the current score, historical trends, benchmark comparisons, and prioritized recommended actions. [learn.microsoft.com] That visibility gives SMBs a useful starting point. It does not mean every recommendation deserves the same priority. Secure Score Is a Security Indicator, Not the Entire Risk Assessment A Microsoft Secure Score reflects security controls evaluated within Microsoft's scoring model. It should therefore be treated as an important data point within a broader security program, rather than a complete measure of organizational risk. Microsoft itself notes that security needs to be balanced with usability and that not every Secure Score recommendation will work for every environment. Organizations can also designate recommendations as risk accepted or addressed through alternative mitigation. [learn.microsoft.com] This creates an important distinction for SMB leaders. Do not ask only, "How do we increase our score?" Ask: "Which security improvements will materially reduce our exposure, and how do we know they are working?" That question changes Secure Score from a dashboard metric into a decision-making tool. Turn Microsoft Secure Score Into a Security Improvement Roadmap A recommendation becomes valuable when it turns into an action with an owner, priority, implementation plan, and measurable result. Rather than working down the Secure Score list based solely on available points, group recommendations into security workstreams and evaluate them against your business environment. A useful structure includes: Identity and access Devices and endpoints Email and collaboration Applications Data protection Administrative controls Microsoft's Secure Score recommended actions can be searched, filtered, and grouped. Microsoft states that its ranking considers factors including available points, implementation difficulty, user impact, and complexity. [learn.microsoft.com] Your internal roadmap should add business context to those factors. Prioritize Recommendations by Risk and Business Impact A practical prioritization model should consider: Security risk being addressed Accounts, users, devices, or information affected Business importance of the affected systems Existing compensating controls Implementation complexity User impact Application compatibility Licensing requirements Dependencies on other technology projects Ability to validate the result This prevents Secure Score from becoming an unprioritized list of configuration tasks. For example, a recommendation affecting privileged Microsoft Entra identities may warrant attention before a lower-impact configuration change. That prioritization is an organizational risk decision, not something that should be made solely by comparing available Secure Score points. Prioritize Microsoft 365 Identity Security Identity deserves focused consideration in a Microsoft-first security roadmap because modern businesses use Microsoft Entra identities to access Microsoft 365 and connected resources. Microsoft's Identity Secure Score recommendations include controls addressing areas such as multifactor authentication for administrative roles, legacy authentication, least-privileged administrative roles, dormant accounts in sensitive groups, and other identity configurations. Microsoft documents the identity controls evaluated through Identity Secure Score. [learn.microsoft.com] That gives SMBs several concrete areas to examine. Rather than simply recording whether an identity recommendation is "complete," measure coverage. Determine whether the intended population is protected, whether privileged roles remain necessary, and whether exceptions have documented owners. This moves the conversation from configuration to control effectiveness. Account for Licensing Before Building the Roadmap One of the easiest ways to create an unrealistic security roadmap is to ignore licensing dependencies. Microsoft states that Secure Score displays the full set of recommendations for a supported product regardless of the organization's specific license edition, subscription, or plan. Microsoft also provides views that show a current license score, representing what can be achieved with existing Microsoft licensing, and an achievable score, which accounts for current licenses and risk acceptance. [learn.microsoft.com], [learn.microsoft.com] That distinction should be part of roadmap planning. For each proposed improvement, determine: Whether the necessary Microsoft capability is already licensed Whether additional licensing is required Whether a third-party or alternate mitigation already addresses the action Whether the improvement depends on another technology project Whether the business value justifies additional cost or complexity Licensing should be treated as a dependency, not an afterthought. If a recommendation requires capabilities the organization does not currently own, keep the security need visible while evaluating alternative mitigation or future investment. Assign Ownership to Every Security Improvement Security recommendations frequently stall because responsibility is unclear. Each prioritized Secure Score action should become a tracked work item containing, at minimum: Business risk: What problem does this control address? Owner: Who is responsible for implementation? Scope: Which users, devices, identities, or workloads are affected? Dependency: What licensing, application, or infrastructure requirement must be addressed first? Target: What represents successful implementation? Validation: How will IT verify that the control works? Exception: Why is the action deferred or excluded, if applicable? Review: When should the decision be reconsidered? Microsoft Secure Score supports recommendation states including planned, risk accepted, resolved through a third party, resolved through alternate mitigation, and completed. [learn.microsoft.com] Those states become more useful when the business has governance behind them. "Risk accepted," for example, should represent an informed decision rather than an easy way to remove an inconvenient recommendation from the queue. Test Microsoft 365 Security Changes Before Broad Enforcement Some security changes can affect how employees sign in, access applications, use devices, or collaborate. For those controls, careful implementation matters as much as the recommendation itself. A sensible internal change process is to define the affected users and applications, test the control with a representative pilot group, document problems, prepare support procedures, and expand enforcement once the organization understands the operational impact. Include people who reflect the real environment. Depending on the organization, that could include remote employees, executives, administrators, users of business-critical applications, and teams with specialized device or collaboration requirements. This is especially important when changes touch identity, device management, or access policies. A technically correct configuration that causes employees to adopt unmanaged workarounds can introduce a different form of risk. The intended behavior change should therefore be defined alongside the technical control. Measure Microsoft Secure Score Progress Without Chasing Points Secure Score is most valuable when its trend is analyzed alongside evidence that security controls are improving. Microsoft provides historical Secure Score information, including score changes, regressions, and risk acceptance trends. Organizations can also compare their score with similar organizations using anonymized comparison information. Microsoft documents Secure Score history, metrics, and trend capabilities. [learn.microsoft.com] These measures can support useful reporting, but executives should look beyond the percentage alone. Track Security Outcomes Alongside Secure Score A Microsoft 365 security improvement roadmap could track: Secure Score trend High-priority actions completed High-priority actions still open Critical identity improvements completed Endpoint security coverage Accepted-risk items Alternate mitigations Regressed controls Implementation issues affecting users Average time to remediate prioritized findings The exact KPIs should reflect the organization's risk profile and available data. If Secure Score increases while important exceptions remain unresolved, the percentage alone does not tell leadership enough. Conversely, an organization may make a meaningful risk reduction decision that does not produce the largest possible increase in points. The roadmap should explain both.t Connect Vulnerability Management to the Security Roadmap Microsoft Secure Score should not operate independently from endpoint and vulnerability management. Microsoft Defender Vulnerability Management maps identified weaknesses to actionable security recommendations and prioritizes recommendations based on their impact. Microsoft's recommendation model considers factors including threat characteristics, vulnerabilities and exploits, and elements associated with breach likelihood. Microsoft explains its security recommendation approach in Defender Vulnerability Management. [learn.microsoft.com] Microsoft also supports remediation workflows that help connect security and IT administrators. Where the applicable Microsoft Intune integration is enabled, remediation requests can be associated with Intune security tasks. Microsoft documents the Defender Vulnerability Management remediation workflow. [learn.microsoft.com] For SMBs, the broader lesson is important: dashboards should feed accountable remediation processes. The same discipline should apply whether an issue originates in Microsoft Secure Score, vulnerability management, an identity review, an endpoint assessment, or another part of the security program. Document Security Exceptions and Compensating Controls Not every Microsoft recommendation will be appropriate or immediately feasible. A legacy application may create a dependency. Licensing may not yet support the desired control. A business process may require remediation before a security setting can be enforced. Do not hide those constraints. Instead, document: Why the recommendation cannot currently be implemented Who approved the exception What systems or users are affected Whether another control reduces the risk What remediation dependency remains When the exception will be reviewed That creates accountability without pretending every risk can be removed immediately. This approach aligns with the broader Microsoft security model. Secure Score recognizes risk acceptance and alternative mitigation, while Microsoft Defender Vulnerability Management also supports security recommendation exceptions. Microsoft advises documenting the rationale for vulnerability-management exceptions and monitoring for changes in the environment. [learn.microsoft.com], [learn.microsoft.com] The business benefit is better governance. Leadership can see not only what has been fixed, but what remains unresolved and why. Build a Repeatable Microsoft 365 Security Assessment Process The strongest Microsoft Secure Score program is not a one-time cleanup project. It is a repeatable operating process. Microsoft Secure Score changes as controls and configurations change. Microsoft provides historical reporting that can identify points that have regressed because of configuration, user, or device changes. [learn.microsoft.com] That makes regression something IT leaders should plan to monitor. A useful operating cycle is: Assess: Review Secure Score and other security findings. Prioritize: Rank improvements by risk, business impact, effort, licensing, and dependencies. Assign: Give each material action an accountable owner. Implement: Deploy the control using appropriate change management and testing. Validate: Confirm that the control operates as intended. Measure: Track control coverage, exceptions, regressions, and relevant security outcomes. Review: Reassess priorities as the Microsoft 365 environment and business change. For lean SMB teams, managed Microsoft security support can help provide the administration, monitoring, remediation coordination, and reporting needed to keep that cycle operating. The objective should not be outsourcing responsibility for the score. It should be creating enough operational structure to move security improvements from recommendations to verified controls. A Better Microsoft Secure Score Is the Result, Not the Goal Microsoft Secure Score gives SMB leaders a useful way to understand security posture, identify recommended improvements, establish KPIs, and monitor progress. [learn.microsoft.com] Its value, however, depends on what happens after a recommendation appears. A mature Microsoft 365 security roadmap prioritizes controls according to business risk, accounts for licensing and operational dependencies, assigns ownership, tests significant changes, records justified exceptions, and measures whether controls continue to work. A rising Secure Score can be evidence of that progress. It should not be mistaken for the progress itself. The more meaningful result is an environment where executives can see which risks are being addressed, IT can explain why priorities were selected, employees understand security changes that affect their work, and unresolved exceptions remain visible until they are addressed or formally accepted. FAQ What is Microsoft Secure Score? Microsoft Secure Score is a measurement of an organization's security posture within the Microsoft Defender portal. It provides recommended security actions and can help organizations report on posture, identify improvements, establish KPIs, and compare their position with benchmarks. Microsoft provides additional details in its Secure Score documentation. [learn.microsoft.com] Is Microsoft Secure Score the same as a Microsoft 365 security assessment? No. Microsoft Secure Score measures security posture using Microsoft's scoring model and recommended actions. An effective Microsoft 365 security assessment should use that information alongside broader business risk, implementation dependencies, exceptions, operational requirements, and other relevant security findings. What is a good Microsoft Secure Score? There is no single percentage that every SMB should treat as its required target. Microsoft provides benchmark comparisons and notes that security must be balanced against usability because not every recommendation works for every environment. A useful target should therefore be based on the organization's risk profile, available capabilities, business requirements, and documented exceptions. [learn.microsoft.com] How can an SMB improve Microsoft Secure Score? Start by reviewing Secure Score recommended actions and grouping them into security areas such as identity, devices, applications, and data. Microsoft allows organizations to search, filter, and group recommended actions and provides prioritization information that considers factors such as implementation difficulty, user impact, and complexity. The business should then add its own risk, licensing, operational, and ownership considerations before implementation. [learn.microsoft.com] Should an SMB try to reach a 100% Microsoft Secure Score? A perfect score should not automatically be the objective. Microsoft states that security should be balanced with usability and acknowledges that not every recommendation works for every environment. SMBs should prioritize meaningful risk reduction and document recommendations addressed through alternative mitigation or formal risk acceptance. [learn.microsoft.com] Does Microsoft Secure Score account for Microsoft 365 licensing? Microsoft states that it shows the full set of possible recommendations for a supported product regardless of the organization's specific license edition, subscription, or plan. Secure Score also provides a current license score showing what can be achieved with existing licensing. This makes licensing analysis an important part of building a realistic security improvement roadmap. [learn.microsoft.com], [learn.microsoft.com] How often should Microsoft Secure Score be reviewed? Rather than relying on the score only during annual assessments, SMBs should make Secure Score part of their recurring security governance process. Microsoft provides historical score reporting, regression information, and metrics and trends that organizations can use to monitor changes over time. The appropriate internal review cadence should be determined by the organization's risk, rate of technology change, and available resources. [learn.microsoft.com] Can Microsoft Secure Score go down after security improvements? Yes. Microsoft Secure Score history can show points that have regressed because of configuration, user, or device changes. That is why organizations should validate that important controls remain implemented instead of treating completion as a one-time event. [learn.microsoft.com] How does managed Microsoft security support Secure Score improvement? Managed Microsoft security services can support the operational work around a Secure Score roadmap, including assessment, prioritization, Microsoft 365 administration, remediation coordination, validation, exception tracking, and reporting. The goal should be to translate recommended improvements into controlled security changes with accountable owners and measurable outcomes, rather than simply increasing the score.
Read full post on blog.sourcepass.com
How to Detect a Compromised Microsoft 365 Account | Sourcepass MCOE
An attacker may already be inside your Microsoft 365 tenant, and nothing in your alerts would tell you. A user who only ever logs in from Utah signs in from New Jersey. Nobody notices for two days. Then a phishing blast goes out from their mailbox, and the logs show the attacker spent those two days searching for invoices and ACH details. For many IT teams, the question is not whether a Microsoft 365 account will be compromised. It is how long the compromise goes unnoticed. Business email compromise (BEC) drove an estimated $3 billion in reported losses in 2025, and the real number is l
An attacker may already be inside your Microsoft 365 tenant, and nothing in your alerts would tell you. A user who only ever logs in from Utah signs in from New Jersey. Nobody notices for two days. Then a phishing blast goes out from their mailbox, and the logs show the attacker spent those two days searching for invoices and ACH details. For many IT teams, the question is not whether a Microsoft 365 account will be compromised. It is how long the compromise goes unnoticed. Business email compromise (BEC) drove an estimated $3 billion in reported losses in 2025, and the real number is likely far higher. Today's attackers blend in with normal sign in activity, which makes them easy to miss. Catching these attacks starts with understanding how account takeover works today, which signals reveal it, and which hardening steps reduce your exposure in Microsoft 365. Why Microsoft 365 Security Alerts Miss Compromised Accounts Compromised Microsoft 365 accounts often go undetected because attackers use stolen tokens, register devices that pass compliance checks, and sign-in from the same city as the real user. Most alerts focus on the sign-in itself, while the real warning signs appear in what the attacker does next. Nathan Taylor, host of Demystifying Microsoft, sat down with Nathan Ostrowski, cofounder of Petra Security, to talk through how identity attacks have changed. They cover residential proxies, SEO phishing, forensic investigation after a breach, and the hardening steps that make the biggest difference. What is Identity Threat Detection and Response (ITDR)? Identity threat detection and response (ITDR) is a security approach that monitors user identities for signs of account takeover and responds when an attacker gains access. In Microsoft 365, that means watching for session theft, credential theft, and malicious activity inside a mailbox, SharePoint, or Teams. ITDR matters because identity is now the main target. According to the FBI's crime report, BEC is the costliest type of cyberattack after investment scams, and around 90% of successful attacks today involve BEC. Once inside an account, attackers usually go after one of three things: Reputational harm by sending phishing emails to every contact Data theft by pulling files and emails from Exchange and SharePoint Financial fraud such as payroll theft, fake invoices, or changed payment details Financial fraud is the most common of the three, which is why attackers often go straight for payment related emails and documents. Why Geoblocking in Conditional Access No Longer Stops Attackers Geoblocking in Conditional Access no longer stops most attackers because the majority of Microsoft 365 attacks now come from inside the United States. Blocking logins from outside the country or flagging known VPNs worked when attacks came from obviously foreign IP addresses, but today those rules miss most account takeover attempts. What are Residential Proxies? Residential proxies route traffic through real consumer devices, such as phones, smart TVs, and home routers. Many free apps and smart TV apps include software that sells the device's bandwidth while the app is open. Anyone who rents access to these network can choose from millions of normal looking home IP addresses. To Microsoft, a login through a residential proxy looks like it came from T Mobile or Verizon in the user's own city. It does not get flagged as a VPN or proxy. Even organizations with multiple overlapping security tools can miss these logins, because they look just like the real user signing in from home. Can Compliant Device Policies Prevent Account Takeover? Requiring compliant devices helps, but it is not airtight. Attackers have exploited weaknesses in the Microsoft Authentication Broker to register new devices that then count as compliant, which gives them access even in tenants restricted to managed devices. Should you Block Logins From Outside the US? For most organizations, the answer is not as a default policy. Country blocks mostly catch attackers who are noisy enough to be spotted in other ways, while every traveling employee who gets locked out loses a little trust in the security program. A middle ground is to block only a short list of high risk countries your users are unlikely to visit. How are Attackers Getting Into Microsoft 365 Accounts? Attackers rarely build their own tools anymore. They buy phishing toolkits from a small, competitive marketplace. When one toolkit releases an update, tens of thousands of attackers get the new capability at once. AI has also improved phishing emails, which no longer carry the obvious spelling and grammar mistakes users were trained to spot. These are some of the most common ways attackers get into Microsoft 365 accounts today: Attack Method How It Works Token theft (adversary in the middle) A phishing page steals the session token after the user signs in, so the attacker skips MFA Device code flow phishing The user is tricked into entering a code that grants the attacker access Direct Send phishing Emails appear to come from inside your own domain SEO phishing Poisoned search ads and results for "Microsoft password reset" send users to fake login pages What is SEO Phishing? SEO phishing uses paid ads and poisoned search results to put fake login pages in front of users who are actively looking for help. A locked out user searches for how to reset their Microsoft password, or asks an AI assistant, and lands on a fake page. SEO phishing is estimated to account for 20% to 30% of attacks. Warnings Signs of a Compromised Microsoft 365 Account The clearest signs of a compromised Microsoft 365 account come from several unusual events happening within a short window, not from a single login. Watch for these patterns: A login from an unusual city followed by a new inbox rule A new device registered within minutes of that login Mailbox searches for financial terms like invoice, ACH, or wire Unusual Graph API activity or mass access to old emails and files File access patterns that don't match how the user normally works Many security tools rely on simple rules, such as impossible travel or VPN detection. A login from a new state alone might not trigger an alert. A login from a new state, a new mailbox rule, and a new device registration within three minutes of each other should. Why are Microsoft 365 Audit Logs so Hard to Investigate? Investigating a breach by hand is slow and easy to get wrong. The Entra ID sign in logs portal is slow, and Exchange, SharePoint, and Teams activity logs do not have a simple interface for searching. These workloads also produce roughly 30 times more activity than sign ins alone. Even a small tenant can create millions of log entries over six months. How Often do Microsoft 365 Accounts Get Compromised? One estimate puts the rate at roughly one successful compromise per 500 identities each month. At that rate, a 100 user organization can expect at least one compromise every five months or so, and a 1,000 user organization about two per month. If you are not seeing compromises at that rate, the access may still be there and just not used yet. Stolen sessions are often bought and sold. An attacker may get in, read about a hundred financial emails, and then wait until the access is sold to someone who acts on it. Why does Response Time Matter After an Account Compromise? Automated toolkits are designed to do their most valuable work within the first ten minutes of access. Detecting and shutting down a compromised session in about a minute, instead of ten, can device whether sensitive emails and documents leave the tenant. What to Do After a Microsoft 365 Account Is Compromised The first steps after a Microsoft 365 account is compromised are to reset the password, revoke all active sessions, and remove any inbox rules or devices the attacker created. From there, the investigation needs to confirm how the attacker got in, how long they were there, and what they accessed or sent. Manual triage often misses details, like a hidden mailbox rule or an extra registered device. A complete forensic investigation should cover the following: The initial access method and timeline Every device the attacker registered All inbox rules created or changed Emails and files the attacker accessed Messages sent from the account and who received them That full picture tells you which customers or partners to contact and which financial risks to follow up on. How to Harden Microsoft 365 Against Account Takeover Hardening Microsoft 365 against account takeover means closing the entry points attackers use most, from email spoofing to weak MFA. Many of the most effective changes are not disruptive. They just need to be planned and rolled out. Configure SPF, DKIM, and DMARC so attackers cannot easily spoof your domain. Turn on Microsoft's built in email filtering, which is available to all tenants. Disable Direct Send if you do not need it, since it accounts for a meaningful share of email based attacks. Block device code flow with Conditional Access for users who do not need it. Strengthen MFA by moving away from push notifications and toward passkeys. Require compliant devices to make stolen credentials harder to use. Microsoft's default settings have not always been secure, and many tenants still run on defaults that worked fine for a decade. As attackers get faster, those defaults leave gaps. Even a well hardened tenant still needs detection and response. may be incorrect Closing the Gaps Attackers Use to Stay Hidden in Microsoft 365 Location rules and basic risk alerts no longer catch account takeover. Finding it now depends on correlating behavior across sign-ins, mailboxes, devices, and files, and on hardening the entry points attackers rely on most. If you want help reviewing your tenant's identity security, hardening settings, or response plan for a compromised account,the Sourcepass MCOE team can walk through your environment with you. For more conversations on Microsoft security, licensing, and Copilot, subscribe to Demystifying Microsoft.
Read full post on blog.sourcepass.com
DMARC Email Security for SMBs Using Microsoft 365 | Sourcepass
Email impersonation creates a specific security problem for small and midsize businesses: an attacker does not necessarily need access to an employee's Microsoft 365 account to send a message that appears to come from the company's domain. Because internet email was not designed to validate that senders are who they claim to be, a forged From address can make a fraudulent message look more credible. Microsoft identifies SPF, DKIM, and DMARC as interdependent email authentication standards used to address sender spoofing. DMARC email security addresses this problem by helping receiving mail s
Email impersonation creates a specific security problem for small and midsize businesses: an attacker does not necessarily need access to an employee's Microsoft 365 account to send a message that appears to come from the company's domain. Because internet email was not designed to validate that senders are who they claim to be, a forged From address can make a fraudulent message look more credible. Microsoft identifies SPF, DKIM, and DMARC as interdependent email authentication standards used to address sender spoofing. DMARC email security addresses this problem by helping receiving mail systems determine whether messages using your domain are authorized. DMARC, which stands for Domain-based Message Authentication, Reporting, and Conformance, uses SPF and DKIM results, verifies alignment with the domain visible to the recipient, provides reporting, and defines how receiving systems should handle messages that fail authentication. Microsoft explains that SPF, DKIM, and DMARC work together to authenticate email senders and protect against spoofing and phishing. For SMBs using Microsoft 365, the objective should not simply be to publish another DNS record. A well-managed DMARC program gives IT greater visibility into who is sending email using company domains, helps reduce opportunities for direct domain spoofing, and establishes a repeatable governance process for legitimate email services. How DMARC Email Security Protects Your Business Domain DMARC is easier to understand when SPF, DKIM, and DMARC are treated as connected controls rather than three independent settings. What Does SPF Do? Sender Policy Framework, or SPF, identifies which mail sources are authorized to send email for a domain through a DNS TXT record. However, SPF alone does not verify that the domain used in the underlying MAIL FROM address matches the From address the recipient sees. SPF can also fail after server-based forwarding because forwarding changes the source server. Microsoft documents these limitations in its email authentication guidance. That distinction matters for SMBs because Microsoft 365 may be only one of many systems sending email. CRM platforms, marketing applications, billing tools, support platforms, payroll systems, and other services may also send messages associated with the company. Your SPF configuration needs to account for approved sending infrastructure without becoming a catch-all authorization mechanism. What Does DKIM Do? DomainKeys Identified Mail, or DKIM, digitally signs important elements of an email. The receiving mail server validates the signature to determine whether those signed elements were altered during transit. DKIM also addresses some scenarios where SPF is less reliable. For example, Microsoft notes that DKIM can continue validating certain messages affected by email forwarding because the DKIM signature is generally not changed simply because the message passed through a forwarding server. Microsoft provides additional details on the relationship between SPF and DKIM in its email authentication documentation. DKIM by itself, however, does not require the signing domain to match the From domain displayed to the recipient. That is where DMARC becomes important. What Does DMARC Add to SPF and DKIM? DMARC evaluates SPF and DKIM in relation to the visible From domain. Microsoft explains that a message passes DMARC when at least one qualifying SPF or DKIM check passes with the required domain alignment. If both fail to produce an aligned authentication result, DMARC fails. The domain owner can then publish a policy instructing the receiving system how to handle those failures. Microsoft's DMARC configuration guidance explains the alignment process in detail. The three primary DMARC policies are: p=none: Provides no requested enforcement action and is useful for testing and tuning. p=quarantine: Requests that DMARC failures be accepted but marked or otherwise handled according to the receiving system. p=reject: Requests rejection of messages that fail DMARC. DMARC can also specify where authentication reports should be sent, giving organizations visibility into systems sending email using their domains. [learn.microsoft.com] For business leaders, this turns email authentication from a collection of technical records into a manageable digital identity control. Why DMARC Matters for Microsoft 365 Email Security Microsoft 365 already performs extensive inbound email authentication and filtering. Microsoft says its cloud email services combine conventional SPF, DKIM, and DMARC checks with other signals through implicit and composite authentication. [learn.microsoft.com] That does not make DMARC unnecessary. DMARC serves a different purpose when configured for domains your business owns. It establishes how messages claiming to originate from those domains should authenticate, including messages sent to recipients outside your organization. This distinction makes DMARC part of a broader Microsoft 365 email security strategy rather than a substitute for it. Microsoft 365 environments should combine email authentication with appropriate anti-phishing controls. Microsoft states that its anti-phishing policies can detect spoofed senders and other deceptive email techniques. Defender for Office 365 adds capabilities including user and domain impersonation protection and configurable phishing thresholds. Microsoft documents these capabilities in its anti-phishing policy guidance. The security model is therefore layered: SPF identifies authorized sending infrastructure. DKIM verifies digitally signed message elements. DMARC validates alignment and establishes handling policies. Microsoft 365 anti-phishing controls evaluate inbound threats. Identity security protects the Microsoft 365 accounts behind legitimate email. Employee reporting and payment-verification procedures address risks that technical authentication alone cannot resolve. Changing one DNS record should not be treated as the complete email security strategy. How to Implement DMARC in Microsoft 365 Without Disrupting Email The safest DMARC implementation is a controlled rollout driven by visibility rather than an immediate move to enforcement. Microsoft specifically recommends a gradual approach for active custom domains, with the goal of ultimately reaching p=reject after testing and verification. [learn.microsoft.com] Step 1: Inventory Every Legitimate Email Sender Before changing DMARC policy, identify the systems authorized to send email using each business domain. Microsoft 365 is an obvious source, but the inventory should extend across the business. Review systems used by: Marketing Sales Finance and accounting Human resources Customer support Operations Automated applications Third-party vendors A marketing automation system or invoice platform may be sending essential messages even though nobody on the IT team manages it directly. Assign a business owner to each approved sending service and record the domain or subdomain it uses. This creates an approval process for future services instead of forcing IT to rediscover the environment each time authentication failures appear. Step 2: Verify SPF and DKIM Before Enforcing DMARC For custom Microsoft 365 domains used to send email, Microsoft advises organizations to configure SPF and DKIM before implementing DMARC. [learn.microsoft.com] Review each legitimate sender to determine how it authenticates. Do not assume that a service is correctly configured simply because its messages currently arrive. This is also an opportunity to address unnecessary complexity. Microsoft recommends using a subdomain for email services that are not under your direct control, such as bulk email services, rather than exposing the reputation of the primary email domain to problems associated with those services. [learn.microsoft.com] Step 3: Start DMARC in Monitoring Mode A common starting point is: p=none This policy allows the organization to observe DMARC results before requesting quarantine or rejection of failures. Microsoft recommends beginning with p=none, reviewing results, and troubleshooting legitimate mail that is not properly authenticated. DMARC aggregate reports can reveal the IP addresses of services sending mail using your domain, whether the sources pass or fail DMARC authentication, and what actions are being applied based on your policy. Microsoft recommends regularly reviewing these reports to identify sending sources and unintended authentication failures. [learn.microsoft.com] The goal during monitoring is straightforward: distinguish approved business email from systems that should not be using the domain. Step 4: Correct Legitimate Authentication Failures A DMARC failure should trigger investigation, not an automatic conclusion that the message is malicious. Legitimate failures can occur when messages are forwarded or modified in transit. Microsoft specifically documents forwarding as a scenario that can break SPF and potentially DMARC alignment. [learn.microsoft.com] When an approved sender fails authentication, determine why. Depending on the cause, remediation may require correcting SPF authorization, configuring DKIM properly, changing how a vendor handles the From domain, or separating a service onto an appropriate subdomain. Document the resulting configuration and business owner. The process should leave the email environment more understandable than it was before the issue appeared. Step 5: Move From Monitoring to Enforcement Once legitimate sending sources have been validated, increase enforcement gradually. Microsoft's recommended rollout progresses from p=none to p=quarantine and ultimately p=reject, while monitoring the results at each stage. Microsoft's guidance also describes using the DMARC pct value to apply enforcement incrementally during testing and tuning. [learn.microsoft.com] This progression matters because an immediate move to rejection can expose configuration problems only after legitimate messages stop reaching their recipients. The decision to increase enforcement should instead be based on evidence. IT should understand its sending systems, remaining failures should have identifiable causes, and the organization should have a defined process for addressing exceptions. How to Measure Whether DMARC Is Improving Email Security DMARC should produce observable security and operational outcomes. Rather than treating the existence of a DMARC record as the success metric, IT leaders should monitor indicators such as: Percentage of known legitimate sending sources authenticating correctly Number of unknown or unauthorized sending sources identified Percentage of active business domains under an enforced DMARC policy Authentication failures associated with approved services Quarantine and rejection trends Time required to investigate an unfamiliar sending source Number of legitimate services without an identified business owner These measurements help determine whether email authentication is actually becoming more controlled. For example, moving to p=reject is less meaningful if IT continues discovering business-critical services that nobody knew were using the domain. A healthier environment is one in which approved senders are documented, authentication failures are explainable, and new platforms cannot begin sending company-branded email without an ownership and configuration review. That is the behavior change SMB leaders should expect from a mature DMARC program. How DMARC Fits Into a Broader Microsoft 365 Security Strategy DMARC protects a domain's email identity. It does not secure every part of the email ecosystem. A convincing phishing email can originate from a legitimate external account. An attacker who compromises a real Microsoft 365 identity introduces a different problem than direct domain spoofing. Social engineering can also succeed even when every technical authentication check works correctly. For that reason, organizations should connect DMARC with Microsoft 365 identity and email protections instead of evaluating it on its own. Microsoft's anti-phishing capabilities include spoof detection, unauthenticated sender indicators, and first-contact safety tips for cloud mailboxes. Defender for Office 365 provides additional impersonation protections. [learn.microsoft.com] At the business-process level, employees still need a clear method for reporting suspicious messages. Finance teams should maintain separate verification procedures for sensitive payment or account changes. Administrators should also review the organization's Microsoft 365 identity controls alongside its mail security configuration. The combination reduces reliance on any single control. Build DMARC Into Ongoing Email Security Governance DMARC is not finished when a domain reaches an enforcement policy. Email environments change. Organizations adopt new SaaS platforms, replace marketing tools, add business applications, register domains, and retire old infrastructure. Each change can affect email authentication. Make DMARC review part of normal technology governance. Revisit sending sources when the business: Adds a service that sends external email Changes marketing or CRM platforms Acquires or registers a domain Integrates another business Changes mail infrastructure Retires a business application Changes ownership of a key platform Unused domains deserve attention as well. Microsoft recommends configuring DMARC for registered domains that are not used for email so they indicate that email should not originate from those domains. [learn.microsoft.com] For resource-constrained SMB IT teams, this is also where managed security support can be useful. The value is not simply outsourcing a DNS change. It is maintaining an accurate inventory of sending systems, monitoring authentication results, investigating anomalies, coordinating third-party configurations, and keeping email security aligned with changes across Microsoft 365 and the broader application environment. The long-term objective is a controlled email identity: legitimate senders are known, authentication is measurable, exceptions have owners, and unauthorized use of company domains faces progressively stronger enforcement. FAQ What is DMARC email security? DMARC, or Domain-based Message Authentication, Reporting, and Conformance, is an email authentication standard that uses SPF and DKIM results to determine whether the sending domain aligns with the From domain displayed to the recipient. It also allows domain owners to publish a policy for handling authentication failures and identify where DMARC reports should be sent. Microsoft explains the underlying DMARC authentication and alignment process here. What is the difference between SPF, DKIM, and DMARC? SPF identifies authorized mail sources for a domain. DKIM digitally signs important elements of a message so the receiving system can validate them. DMARC uses SPF and DKIM results and checks domain alignment with the visible From address. Microsoft describes these technologies as interdependent components of email authentication. [learn.microsoft.com] Does Microsoft 365 support DMARC? Yes. Microsoft documents DMARC configuration for both Microsoft Online Email Routing Address domains and custom domains used with Microsoft 365. For custom domains, DMARC TXT records are managed through the domain's DNS hosting provider rather than through a Microsoft 365 PowerShell cmdlet or portal control. [learn.microsoft.com] What DMARC policy should an SMB start with? For active custom domains, Microsoft recommends a gradual rollout beginning with p=none for monitoring, progressing to p=quarantine, and ultimately moving to p=reject after testing and verification. This approach helps organizations identify legitimate authentication problems before stronger enforcement affects mail delivery. [learn.microsoft.com] Can DMARC stop phishing? DMARC addresses a specific part of the phishing problem by helping prevent unauthorized sources from successfully spoofing domains protected by appropriate authentication and policy. It does not prevent every phishing technique. Microsoft 365 organizations should use email authentication alongside anti-phishing controls and other security measures. [learn.microsoft.com], [learn.microsoft.com] Does DMARC replace Microsoft Defender for Office 365? No. DMARC and Microsoft Defender for Office 365 address different aspects of email security. DMARC provides standards-based email authentication and domain alignment, while Defender for Office 365 includes additional capabilities such as user and domain impersonation protection and configurable phishing thresholds. [learn.microsoft.com], [learn.microsoft.com] How do I know if DMARC is working? Review DMARC aggregate reports and track whether approved email sources authenticate correctly. Microsoft states that aggregate reports can identify sending IP addresses, indicate whether sources passed or failed DMARC authentication, and show actions applied according to the DMARC policy. Microsoft recommends regularly reviewing these reports for sending activity and unintended authentication failures. [learn.microsoft.com] Should unused business domains have DMARC? Yes. Microsoft's Microsoft 365 DMARC guidance recommends configuring DMARC records for registered domains that are not used for email to specify that mail should not originate from those domains. [learn.microsoft.com]
Read full post on blog.sourcepass.com
Security Awareness Training for SMB Cybersecurity | Sourcepass
Technology can prevent many cyber threats, but employees still make decisions that influence whether an attack succeeds. An employee may approve an unexpected multifactor authentication request, open a convincing invoice attachment, share a sensitive file with the wrong recipient, or trust a message that appears to come from an executive. These actions are rarely the result of negligence. Modern attacks are designed to look like routine business activity. Employees work across Microsoft 365, email, mobile devices, cloud applications, collaboration platforms, and vendor portals, often under s
Technology can prevent many cyber threats, but employees still make decisions that influence whether an attack succeeds. An employee may approve an unexpected multifactor authentication request, open a convincing invoice attachment, share a sensitive file with the wrong recipient, or trust a message that appears to come from an executive. These actions are rarely the result of negligence. Modern attacks are designed to look like routine business activity. Employees work across Microsoft 365, email, mobile devices, cloud applications, collaboration platforms, and vendor portals, often under significant time pressure. As a result, security awareness training remains one of the most important layers of a cybersecurity program. A practical security awareness training program helps employees recognize suspicious activity, verify unusual requests, and report concerns before they become incidents. For SMBs, effective cybersecurity training can reduce exposure to phishing, business email compromise, credential theft, malware delivery, data exposure, and social engineering attacks. The strongest programs focus on behavior change rather than annual compliance requirements. According to guidance from CISA's Education and Training Resources and Microsoft Attack Simulation Training, organizations benefit most when awareness efforts are continuous, role-based, and aligned with real-world risks. Why Security Awareness Must Go Beyond Annual Compliance Training Many organizations still approach security awareness training as a once-per-year requirement. While compliance training may satisfy regulatory obligations, it rarely creates lasting changes in employee cybersecurity behavior. Security threats evolve continuously, and employees encounter new situations throughout the year. Effective awareness programs reinforce decision-making skills through ongoing education, practical exercises, and relevant examples. Employees Are Part of the Security Control Environment Organizations routinely invest in email security, endpoint protection, identity security, and Microsoft 365 security controls. Those technologies are essential, but employees interact with every one of them. A user may decide whether to: Trust a suspicious email Approve an MFA prompt Share a document externally Verify a payment request Report unusual account activity Respond to a social engineering attempt Security awareness training helps employees make informed decisions when technology alone cannot determine intent. Phishing Education Remains a Core Requirement Phishing continues to be one of the most common techniques used to gain unauthorized access to business environments. Modern phishing campaigns may imitate: Microsoft 365 sign-in pages Vendor invoices Internal executive requests Human resources communications Financial approval workflows File-sharing notifications Employees who understand how these attacks work are more likely to identify suspicious messages and report them before damage occurs. Security Awareness Training Should Support Reporting Employees should never feel discouraged from reporting a suspected mistake or suspicious activity. Strong security programs encourage users to: Pause before taking action Verify unusual requests Report concerns quickly Ask questions without hesitation Early reporting often gives IT and cybersecurity teams more time to investigate and respond effectively. Move Beyond Completion Metrics Course completion does not automatically indicate preparedness. A mature security awareness training program focuses on outcomes such as: Improved phishing identification Increased reporting rates Faster reporting times Better verification of financial requests Greater understanding of secure collaboration practices The goal is measurable behavioral improvement rather than attendance alone. Design Role-Based Training Around Real Business Risks Employees face different cybersecurity risks depending on their role, responsibilities, and access levels. Assigning the same training to every employee often misses critical opportunities to address the threats most relevant to each group. Start With a Business Risk Assessment Before developing training content, evaluate how employees use: Microsoft 365 Email systems Cloud applications Mobile devices Remote access tools Shared files Vendor relationships Artificial intelligence tools Reviewing security incidents, audit findings, help desk requests, and policy exceptions can help identify which behaviors warrant additional attention. For example, a finance department may require stronger phishing education related to payment fraud, while legal or professional services teams may benefit from additional training on secure file sharing and data protection. Establish a Baseline for All Employees Every employee should understand foundational cybersecurity concepts, including: Phishing and social engineering Password and passkey security Multifactor authentication Secure file sharing Device protection Data handling requirements Reporting procedures This baseline creates consistency across the organization while establishing common expectations. Tailor Training by Role Role-based security awareness training increases relevance and engagement. Finance teams often benefit from training focused on: Business email compromise Payment fraud Vendor verification procedures Invoice manipulation schemes Executives may require guidance on: Targeted phishing attacks Travel security Privileged access protection Executive impersonation attacks IT personnel and service desk teams should receive instruction on: Identity verification processes Account recovery procedures Suspicious access requests Secure administrative practices Managers also play an important role by reinforcing secure behavior and encouraging employees to report concerns without fear of blame. Use Simulations as Learning Opportunities Microsoft's Attack Simulation Training capabilities can help organizations run controlled phishing simulations within Microsoft 365 environments where licensing supports those features. The objective should always be education, not punishment. Effective simulations help employees: Recognize suspicious content Practice reporting procedures Understand attacker tactics Develop confidence in their decision-making Training is most effective when employees can safely learn from mistakes before encountering a real-world threat. Connect Awareness Training to Security Controls Security awareness should support the organization's broader cybersecurity strategy. For example: Repeated credential-harvesting clicks may indicate a need for stronger identity protections. Frequent file-sharing mistakes may justify additional data loss prevention controls. Confusion around authentication prompts may require updates to Microsoft Entra ID policies and user guidance. When training and technical controls reinforce one another, organizations create a more resilient security posture. Measure Behavior Change and Continuously Improve the Program Organizations should evaluate security awareness training using operational and behavioral indicators rather than training completions alone. The objective is to determine whether employees are making safer decisions and supporting cybersecurity objectives. Measure Security Awareness Through Observable Behaviors Useful indicators include: Training completion by role Phishing reporting rates Time to report suspicious messages Repeat risky behaviors Remediation training completion Business email compromise prevention activities Suspicious MFA prompt reporting Verification of high-risk financial requests These metrics provide more meaningful insights than attendance alone. Interpret Metrics Carefully Organizations should avoid drawing conclusions from a single metric. For example: Increased phishing reports may indicate stronger employee engagement. Lower click rates may not reflect success if suspicious messages go unreported. High completion rates may still mask weaknesses among high-risk user groups. Results should be reviewed by department, role, location, and attack type to identify opportunities for improvement. Create a Feedback Loop Between Training and Operations Security awareness programs improve when operational teams contribute feedback. Information sources may include: Service desk questions Incident investigations Near-miss events Compliance reviews Security operations findings If users frequently question whether a Microsoft 365 authentication prompt is legitimate, training materials can be updated to address that specific scenario. Similarly, recurring mistakes can reveal opportunities to improve both education and technical controls. Adapt to Business and Technology Changes Cybersecurity training should evolve as the organization changes. New learning requirements may emerge from: Microsoft 365 deployments New cloud applications Mergers and acquisitions Remote work policies Regulatory requirements Artificial intelligence adoption Vendor access programs Contractors and third parties should also be included when they access company systems or handle sensitive business information. Build a Sustainable Security Culture The strongest awareness programs establish a simple habit: Pause. Verify. Report. Employees do not need to become cybersecurity specialists. They need enough context, guidance, and support to recognize unusual situations and respond appropriately. For SMBs, the result is a workforce that supports identity security, strengthens phishing resilience, improves incident visibility, and reinforces Microsoft-first security controls. Combined with strong technical safeguards, security awareness training helps organizations reduce risk while maintaining productivity and operational efficiency. FAQ What is security awareness training? Security awareness training is an ongoing education program designed to help employees recognize cyber threats, follow secure work practices, and report suspicious activity. Effective programs focus on changing behavior rather than simply meeting compliance requirements. Why is security awareness training important for SMBs? Security awareness training helps employees identify phishing attempts, social engineering attacks, credential theft efforts, and other common cyber threats. Since employees regularly interact with email, Microsoft 365, cloud applications, and sensitive information, their decisions directly influence organizational risk. How often should cybersecurity training be conducted? Most organizations benefit from continuous cybersecurity training rather than relying solely on annual compliance courses. Short, role-based learning sessions, phishing education exercises, and periodic reminders generally provide better long-term results. What is role-based security awareness training? Role-based security awareness training tailors content to the risks employees face in their specific positions. Finance teams, executives, IT administrators, and general employees often encounter different cybersecurity threats and require different guidance. How do phishing simulations support employee cybersecurity behavior? Phishing simulations provide employees with a safe environment to practice identifying and reporting suspicious messages. When used appropriately, simulations reinforce phishing education and help organizations measure improvements in employee cybersecurity behavior. How should organizations measure security awareness training success? Organizations should evaluate security awareness training using metrics such as phishing reporting rates, reporting speed, remediation completion, verification behaviors, and reductions in repeat risky actions. These measures provide insight into behavior change and cybersecurity readiness.
Read full post on blog.sourcepass.com
Azure Hybrid Benefit Cuts Windows Server Costs | Sourcepass MCOE
Azure Hybrid Benefit is a licensing right that lets you apply Windows Server and SQL Server licenses you already own toward Azure compute, so the VM is billed at the Linux base rate instead of the bundled Windows rate. If you run Windows Server VMs in Azure without it, you may be paying for the license twice.
Azure Hybrid Benefit is a licensing right that lets you apply Windows Server and SQL Server licenses you already own toward Azure compute, so the VM is billed at the Linux base rate instead of the bundled Windows rate. If you run Windows Server VMs in Azure without it, you may be paying for the license twice.
Read full post on blog.sourcepass.com
Failed to load more articles
You're all caught up!
Check back later for more profile news.