Microsoft 365
Most Microsoft 365 risk isn't in Defender, it's in over-shared SharePoint sites, stale guest access and Copilot surfacing content nobody meant to expose.
Updated
How I use it
- SharePoint and OneDrive oversharing review before Copilot rollout
- Guest access and external sharing policy tightening
- DLP policy design against real data flows, not generic templates
- Audit and retention configuration review for incident readiness
Recurring problems I find
- Copilot enabled before oversharing is fixed, so it just makes existing exposure easier to find
- DLP rules copied from a template and never tuned to actual sensitive data
Purview DLP now covers Copilot in Word, Excel and PowerPoint, and extends to custom agents built with the Agents SDK.
Related
Microsoft Entra ID
Entra ID hardening: Conditional Access design, PIM, phishing-resistant authentication, app registration governance and agent identity.
Cloud security assessment
Configuration and architecture assessment for Azure, GCP and Alibaba Cloud: identity, network, data, logging and CSPM findings with a fix roadmap.
Google Workspace
Google Workspace hardening: Context-Aware Access, OAuth app governance, Drive sharing defaults and admin console audit configuration.