Accelerynt
Security 101
Plain-language answers to common questions about securing Microsoft 365, Entra ID, Defender and Sentinel. Each article explains how something works and what to check in your own environment.
Microsoft 365 and identity security
How to keep Microsoft 365 and Entra ID configured the way you intended, and how to show auditors that the controls are working.
-
How Do You Check Microsoft 365 Against the CIS Benchmark?
The CIS Microsoft 365 Foundations Benchmark is a consensus set of secure configuration recommendations. Here is what it covers, how teams check against it,…
-
How Do You Find Risky App Registrations and Service Principals in Entra ID?
App registrations and service principals give software its own access to your Microsoft tenant. Here is how they differ, what makes one risky, and…
-
How Do You Get a Security Control Approved by the Change Advisory Board?
Stage and test the control, then bring the board measured results. The same board can then review the changes that never came through it.
-
How Do You Manage Microsoft 365 Security and Prove It Works?
What Microsoft 365 security management covers, how to catch settings that change, and how to turn your tenant’s configuration into evidence auditors and executives…
-
Is There Something Better Than Microsoft Secure Score?
Microsoft Secure Score measures every tenant against the same Microsoft recommendations. Here is why measuring your tenant against your own approved baseline tells you…
-
What Is Continuous Control Validation for Microsoft Security?
How continuous control validation tests whether your Microsoft security controls enforce as intended, and keeps your audit evidence current between audits.
-
What Should Happen When Configuration Drift Is Detected?
Detecting configuration drift is the easy part. Here is how to declare a baseline, decide what each change means, and give every drift finding…
-
Which Conditional Access Policy Takes Precedence in Entra ID?
Conditional Access has no policy order. Every policy that applies to a sign-in is enforced, and a block ends the evaluation. Here is how…
Managed detection and response
How managed detection and response works on Microsoft Defender and Sentinel, and what to look for in a provider.
-
How Do You Automate Incident Containment in Microsoft Sentinel?
Automation rules decide when a playbook runs and playbooks decide what it does. The harder work is agreeing which threats may be contained without…
-
How Do You Choose an MDR Provider for Microsoft Defender and Sentinel?
The criteria security leaders use to compare MDR providers for Microsoft Defender and Sentinel, and the questions that show how each provider really operates.
-
How Do You Choose an Outsourced SOC for a Microsoft Environment?
An outsourced SOC for a Microsoft environment can mean SOC as a Service or MDR. Here is how the two differ and the questions…
-
How Does Co-Managed Microsoft Sentinel Work?
Co-managed Microsoft Sentinel means your team and a provider work in the same Sentinel workspace. Here is how access works, who does what, and…
-
How Does Managed Detection and Response Improve SIEM?
How an MDR team adds investigation and containment to the alerts your SIEM already collects, and what to ask a provider that works in…
-
Which MDR Providers Let You See What Their SOC Is Doing?
What you can see of a provider’s work depends on where that work happens and what gets documented. Use these criteria and questions to…
-
Which SOC Metrics Show Whether Risk Is Going Down?
Ticket counts and alert volumes show activity. Here are the SOC metrics that show whether risk is actually going down, and what to ask…
-
Why Does Incident Response Stall After the Alert Fires?
When the alert fires on time and containment still comes late, the time is lost in handoffs and approvals. Here is where it goes…
Assessments and remediation
How to turn security assessment findings into a plan your team can act on.
-
How Do You Measure Security Readiness?
Count the critical dependencies your incident response relies on that have no current proof, and work that number down. Here is how the measure…
-
How Do You Protect the Help Desk From Social Engineering?
Help desk password and MFA resets are a common target for social engineering. Here is how to test the real reset process and engineer…
-
How Do You Run a Tabletop Exercise That Tests Real Readiness?
A tabletop exercise proves something when it runs on your own environment with the real decision makers, and when it is allowed to find…
-
How Do You Turn Security Assessment Findings Into a Remediation Roadmap?
How to turn a list of security assessment findings into a prioritized remediation roadmap with owners, dates, and reporting your board can follow.
-
How Do You Verify an Outsourced IT Provider Follows Your Security Controls?
Contracts and certification reports describe what a provider agreed to. A controlled test shows what its people do today when someone calls asking for…
-
Is Passing a Security Audit the Same as Being Ready for an Attack?
An audit confirms what was in place for the period it reviewed. Readiness is a claim about today and the next incident, and it…
Talk to a Microsoft security engineer
We work inside your Microsoft environment, with your team, and show you where to focus first.