Author: Shehan Perera

I’m a self driven and passionate individual about Windows Server management, Cloud strategies, Azure, Microsoft 365, Exchange Server, Microsoft Teamwork, Microsoft Infrastructure technologies, ITIL standards, end user support and a passion for troubleshooting. I strongly believe my skills in different layers in IT Infrastructure during the last 10 years has immensely helped me to become the person I am today and I embrace it and loving every second of it.

🎙High time for a Podcast – Out of Band

The name was coined as a little play to the Windows patch updates - "Out of Band Updates". We are 3 tech professionals talking about all things Microsoft Security and everything in between in the podcast sessions. This idea was bubbling away for a couple of months and finally, we were able to sit down … Continue reading 🎙High time for a Podcast – Out of Band

How to Configure Entra Identity Governance Features with Private Access for Jump Hosts

TL;DR: Jump Hosts - We login to Jump Hosts to then login to the servers and other apps we need to access mainly to perform admin tasks. Jump Hosts are often secured on the Network Layer and other Windows Permissions which will come into play when the admin logs in. But what can be done … Continue reading How to Configure Entra Identity Governance Features with Private Access for Jump Hosts

My 2024 LinkedIn Rewind and Thank you!

https://coauthor.studio/rewind was awesome as it just collates all the LinkedIn activities. And as 2024 is coming to an end, it is always to look back what you have accomplished and what impact you have had on the community. Looking forward to 2025! I would like to thank everyone who is reading my blogs and getting … Continue reading My 2024 LinkedIn Rewind and Thank you!

The 3 Stages of CA Policy Maturity – Lessons from the Field

Not too long ago I spoke in the Adelaide Microsoft IT Pro User Group regarding Conditional Access Policies (CA policies) we all know and love. It was not a 100% technical how-to discussion as chances are you are already using this in your environment. If I break down my presentation into 3 main parts, it … Continue reading The 3 Stages of CA Policy Maturity – Lessons from the Field

Inspecting Microsoft Defender Attack Surface Reduction Rules

What I will be covering in this article 👇🏽 Not a How, but more of a WhyProactive Prevention Vs. Reactive DetectionThe Ever-Expanding Attack SurfaceWhy Does Attack Surface Management Matter? - Painting the Picture With An ExampleA Good Rollout RoadmapPolicy Exceptions - Experience From the FieldPlanning the DeploymentLet's Categorize the RulesUnderstanding the ASR Rule ModesIf You … Continue reading Inspecting Microsoft Defender Attack Surface Reduction Rules

I May Have Finally Launched my YouTube Channel

This is something I wanted to do from a long time and I guess finally I did it. Launching my own YouTube channel. I gave a lot of thought to planning the goal of this channel and what content I want to bring in and I'm so excited to share my knowledge in this form … Continue reading I May Have Finally Launched my YouTube Channel

Mandatory MFA Enforcements! Including Service Accounts and Break Glass Accounts. Now What?

Mark the calendars and make the necessary reminders - 15 Oct 2024 as this will be the day that this enforcement will come into play. This is a good initiative as it will apply the extra layer of protection to the set of applications below. As you can see most of the applications listed below … Continue reading Mandatory MFA Enforcements! Including Service Accounts and Break Glass Accounts. Now What?

Browser Security With Microsoft Intune – Set Google Workspace Domain Restrictions

It is possible that the organizations are in multi-cloud environments. Having a Google Workspace is nothing new. However, if you want to make sure your users are only login to a given list of domains and not to other Domains, a policy setting is imminent. Usage: This policy works in both Microsoft Edge and Google … Continue reading Browser Security With Microsoft Intune – Set Google Workspace Domain Restrictions

Browser Security With Microsoft Intune – How to Block Browser Extensions?

This is blog post 1 of the Browser Security With Microsoft Intune series. I wanted to dedicate this article to browser extensions. This is something we all know dearly, but can pose issues in a working environment if it's not managed properly. The IssuePast Browser Extension-Related IncidentsCreate the PolicyMicrosoft EdgeGoogle ChromeMozilla FirefoxKey Settings to Consider … Continue reading Browser Security With Microsoft Intune – How to Block Browser Extensions?

Browser Security With Microsoft Intune

This is a new set of blog articles I want to introduce. It's no wonder that the browser has become one of the main components in the device and what browser you use, security is an integral part of it. Microsoft Intune supports browser security and goes into the deep levels of helping the admins … Continue reading Browser Security With Microsoft Intune

Identity Centric Zero-Trust Network Access (ZTNA) and Entra Private Access 🌐

I've been doing a lot of research into Microsoft's new Global Secure Access recently as most of the features have gone on General Availability. Entra Private Access caught my eye. However, before discussing the feature, it is wise to discuss about the underlying technology that Entra Private Access uses and then jump on to it. … Continue reading Identity Centric Zero-Trust Network Access (ZTNA) and Entra Private Access 🌐

How to Configure Cloud Kerberos Trust to Authenticate an Entra ID Joined Device Using Windows Hello for Business (WHfB)?

Long topic and number of jargon. Cloud Kerberos Trust, Windows Hello for Business (WHfB), Entra ID Joined. Let's break them down one by one and see how Cloud Kerberos Trust will help you in the cloud journey. This in fact will remove one more on-prem dependency. Exciting, isn't it? Let's dig in. What this article … Continue reading How to Configure Cloud Kerberos Trust to Authenticate an Entra ID Joined Device Using Windows Hello for Business (WHfB)?

Leave the Privileged Cloud Identities in the cloud with PIM and RBAC enabled and not synced!

🔸What does this mean?It simply states that Privileged accounts or the accounts that can be elevated in to privileged accounts responsible for tasks in cloud systems must be created as “in-cloud” accounts rather than syncing from a local/ on-prem directory. 🔸Why you ask?The most classic example anyone can think of is Entra ID privileged roles … Continue reading Leave the Privileged Cloud Identities in the cloud with PIM and RBAC enabled and not synced!

Hardening Exchange Online Security with Microsoft Entra, Intune, and Defender XDR

Your emails are now in the cloud, specifically Microsoft 365 - Exchange Online (EXO). Now what? For many organizations emails are the heart and soul of communication and past records and they use the same On-premises methods to protect emails in the cloud. Regardless, defending it from bad actors is a must because this is … Continue reading Hardening Exchange Online Security with Microsoft Entra, Intune, and Defender XDR

💻 Intune Policy refresh intervals Vs. Config Refresh in simple terms

These are similar-looking terms that perform two different tasks and this quick nugget is to unpack what they do. ⚡Policy Refresh Intervals⚡ This is the standard way for the device to check in with the Intune service to receive the policies and settings.When the device is enrolled with Intune for the 1st time, notifications will … Continue reading 💻 Intune Policy refresh intervals Vs. Config Refresh in simple terms

Microsoft Defender for Identity – A Deep Dive

Microsoft Defender for Identity or MDI. The main purpose of this write-up is to shed some light on the fact that why you need MDI in your environment and how it can protect your traditional on-premises AD infrastructure. It's no wonder that there are a lot of other products in the market that do similar … Continue reading Microsoft Defender for Identity – A Deep Dive

How to Change Intune Security Baseline Policy to Version 23H2?

I'm excited to see the new Security Baseline version is finally available in Intune. Version 23H2 for Windows 10/11. This is a quick look at the policy and useful details on migration to the new policy. What you will see in the Security Baselines nowWhat's Available in Version 23H2Some Notable SettingsMigrating from an older BaselineIf … Continue reading How to Change Intune Security Baseline Policy to Version 23H2?

How to Use Intune to Create a Dell BIOS Config Profile?

Creating BIOS Configs and ingesting it during the imaging process is a tad bit old school when you think about moving to newer technologies that can do the same. Microsoft Intune recently introduced the BIOS Config Profile as a template in Intune. At this stage, DELL devices can be set up with this. At the … Continue reading How to Use Intune to Create a Dell BIOS Config Profile?