3 min readTutorial
Turn on MFA for Microsoft 365 before the next phish
By Michael NarehoodMicrosoft 365
A practical path to require multifactor authentication in Microsoft 365 for a small business, without locking everyone out on Friday afternoon.
#microsoft-365
21 articles
2 min read
When to stop self-hosting email (and when to keep it)
A straight take on leaving on-prem or cPanel mail for Microsoft 365 / Google Workspace, and the few cases where self-hosting still makes sense.
1 min read
Client data on personal phones
BYOD mail and Teams are convenient. Containerization and remote wipe need to be real.
1 min read
Power Automate and OAuth app sprawl
By Michael NarehoodMicrosoft 365
Citizen automation is great until a forgotten flow holds privileged consent.
1 min read
Detecting unusual sign-ins in Microsoft 365
By Michael NarehoodMicrosoft 365
Impossible travel, new countries, and legacy protocol spikes: signals worth a human look.
1 min read
Voicemail and Teams phone security basics
By Michael NarehoodMicrosoft 365
Toll fraud and voicemail hacks still happen. A short hardening list for modern phone systems.
1 min read
Summer interns and joiner access done safely
Temporary staff need tools on day one, not permanent Global Admin on day ninety.
1 min read
SharePoint permissions inheritance traps
By Michael NarehoodMicrosoft 365
Broken inheritance solves one share and creates ten mysteries.
1 min read
Teams external access settings worth reviewing
By Michael NarehoodMicrosoft 365
Federation and guest access are powerful, and easy to leave too open.
1 min read
Microsoft Secure Score: what to prioritize (and ignore)
By Michael NarehoodMicrosoft 365
Secure Score is a guide, not a grade. Which recommendations move risk for small tenants.
1 min read
Calendar permissions: the oversharing nobody notices
By Michael NarehoodMicrosoft 365
Open calendars leak meetings, clients, and travel plans. Tighten defaults without killing scheduling.
1 min read
Microsoft 365 backup: questions to ask before you buy
By Michael NarehoodBackups & Continuity
Retention myths, Recycle Bin limits, and the vendor questions that separate marketing from recoverability.
1 min read
Cloud storage sync is not a backup
By Michael NarehoodBackups & Continuity
OneDrive and Google Drive mirror mistakes as efficiently as they mirror files. What real backup adds.
1 min read
Spring cleaning for Active Directory and Entra ID
By Michael NarehoodMicrosoft 365
Disable stale accounts, reclaim licenses, and shrink attack surface before summer projects start.
1 min read
Email retention vs archive confusion
By Michael NarehoodMicrosoft 365
Litigation holds, archives, and “we keep mail forever”: clarify before you need eDiscovery.
1 min read
Secure document sharing with clients
Move past email attachments for sensitive files without making clients jump through hoops.
1 min read
Microsoft 365 external sharing defaults that save headaches
By Michael NarehoodMicrosoft 365
SharePoint and OneDrive sharing settings that balance client collaboration with least privilege.
1 min read
Patch Tuesday habits for busy offices
A lightweight cadence so Windows and Microsoft 365 updates do not become quarterly fire drills.
1 min read
Shared mailboxes are not a security boundary
By Michael NarehoodMicrosoft 365
Why “just use the info@ mailbox” creates audit and access problems, and cleaner patterns that scale.
1 min read
MFA fatigue and how to stop push bombing
Attackers spam approve prompts until someone taps Yes. How number matching and better MFA choices help.
5 min read
Copilot for Microsoft 365 in SMB reality
By Michael NarehoodMicrosoft 365
What Copilot actually costs, how it uses your tenant data, and when it helps small teams versus generating expensive drafts nobody trusts.