Jonathan Glendenning

New video looking at the Azure Files Provisioned v2 model giving more flexibility, performance and cost predictability. https://lnkd.in/gZv4t2pf 00:00 - Introduction 00:16 - Azure Files service 00:30 - Azure Files standard pay-as-you-go 03:54 - Azure Files Premium 06:22 - Provisioned v2 billing option 08:08 - IOPS bucket 10:09 - Storage account configuration 12:35 - File share creation settings 14:47 - Account level limits 15:35 - Per share metrics 16:53 - Supported capabilities 17:46 - Which to use 19:04 - Close There is also a one-minute short version at https://lnkd.in/gN6CN7pY. #azure #cloud #microsoft #cloudcomputing #microsoftazure #azurecloud #youtubevideo #learning #azureadministrator #azurearchitect #microsoftcloud

225

3 Comments

[Entra - App Administrator role] 👾 I too often see Application Administrator role handed out tenant-wide. Why is this a problem? This role often has paths to very privileged actions via Application Permissions. You do not want an Application Administrator to lay down credentials to a privileged Service Principal that has application permissions and then inherit the permissions via SP impersonation. Chances are there is a path to Global admin from App Admin in a large organization. IMO Application Admin is one of the most dangerous roles in Entra ID right after privileged role and privileged auth admin. Consider any application that has dangerous application permissions such as Mail[.]ReadWrite, Files[.]ReadWrite[.]All, RoleEligibilitySchedule[.]ReadWrite[.]Directory, Directory[.]ReadWrite[.]All etc. This can then all be inherited by the Application Administrator. This may break your compliance data boundary. Also consider your Microsoft Entra AD Synchronization Service App too! (see later note) ✅ Solution(s): - Reduce Tenant Wide Role for App Admin and move to scope via application where possible. - Use Entra Application Policies to protect secrets being added to Sensitive Service Principals (especially do this for your breakglass application if you use an application for this!). App admin cannot edit Entra application Policies unless they have Security Administrator assigned too. 💯 Benefits: - Better than app owners as easier to audit and govern all from one pane. App Owners doesn't support groups so this is a good way around this. - You can use Identity governance features such as PIM, Access Reviews etc. - Reduced paths to Global Admin and other privileges. - Because access can be granted more granularly, Active assignments can be used for low privilege applications to reduce PIM fatigue. 🤪 Downsides - Conditional Access Policy targeting App Administrator doesn't support App Admin that is non-directory wide, similar to roles applied to an Admin Unit. This issue is easily remediated by applying strong CA to admin portals / Graph & PIM authentication Contexts. <FYI Credentials can be issued to Enterprise Applications too not just application Registrations. This can only be done with Graph/PS and is not available in the GUI. This is incredibly dangerous as there is no audit for the secret existing in the portal beyond the 30 day portal logs. If you are missing audit logs you will have no audit trail that this happened. Adding a credential only affects the instance in that particular tenant and not the Application Registration (even if the application registration i.e. the definition lives in another tenant)> #Entra #Security #Audit #Govern #Identity #Cybersecurity #Microsoft #MVPBuzz

163

7 Comments

Getting started with Intune and Entra managed devices may seem straight forward, but there are a lot of hidden settings which could cause you issues further down the line. In this post I've looked at the settings across M365 to help those making the jump into cloud management I've probably missed some, but will keep updating it https://lnkd.in/epUzhxd8

101

5 Comments

In today's video, I dive into the variance between Android Device Administrator (#ADA) and #AOSP Device Management. I highlight how devices are categorised in Intune as either Personal or Corporately owned, shedding light on crucial aspects to consider during migrations to AOSP. Stay informed! #MicrosoftTeams

36

3 Comments

Are your ADMX-backed policies in Intune coming out overcooked? Two weeks ago, an issue at one Azure Scale Unit left ADMX policies like OneDrive and Edge settings burnt and unusable: Error 65000. New and existing devices simply didn’t get them. In this blog, I break down: https://lnkd.in/eZtYV7yv -How ADMX ingestion is supposed to work -Why Error 65000 happens -What went wrong and how to check for it #Intune #MSIntune #Windows #Windows11 #WindowsAutopilot #Policies #Microsoft #Security

89

5 Comments

Microsoft is set to transition its hotpatching feature for Windows Server 2025 from the current preview phase to a paid subscription model effective July 1, 2025. This feature, aimed at minimizing server downtime by enabling software updates without the need for a reboot, will be offered at a rate of $1.50 USD per CPU core per month post the subscription launch. Hotpatching, a method commonly utilized for the Linux kernel, VMware products, and the Xen hypervisor, allows for seamless software updates without disrupting operations. For current hotpatching preview users, automatic enrollment into the subscription service will occur on July 1st unless disenrollment is completed by June 30th. Notably, Azure Editions of Windows Server will maintain complimentary access to hotpatching. The question arises: Are you willing to invest in uninterrupted patching with the upcoming subscription model? Source: [Microsoft Blog] https://lnkd.in/gZG7Ry7X [The Register https://lnkd.in/gpKSJeGW #serverpatching #windowspatching #hotpatching

37

1 Comment

The legendary Granfeldt PowerShell Management Agent for Microsoft Identity Manager and Entra Provisioning Service ECMA On-Premise capability now supports PowerShell 7. This is an opt-in change! PowerShell 7 support is enabled on a per-Management Agent basis, allowing you to update the Granfeldt PSMA DLL without impacting existing implementations. Configuration remains on Windows PowerShell, but runtime execution flips to PS7 when configured. Huge thanks to Søren Granfeldt for merging my PR. #FIM2010 #MIM #PowerShell #Identity https://lnkd.in/gvXvTDMx

29