Cloud PKI issues the client certificates, but Microsoft sells nothing that terminates EAP-TLS. The authenticator decision, NPS, cloud RADIUS, or the box itself, quietly decides how much Active Directory you keep.
Cloud PKI automates issuance, renewal, and revocation, but its edges are where certificate incidents come from. What is documented, what the field has observed, and how I design around both.
Cloud PKI gives you three certificate authority slots and no way to edit a CA after you create it. That makes hierarchy design a one-shot decision, and this is how I make it.
Everything so far has been about making the endpoint strong. This last piece is about what the endpoint then says about itself, because a managed device produces a risk verdict, and that verdict can flow into compliance and from there…
Attack surface reduction is a family, not a feature, and it is the part of the protection stack that shrinks the ground an attacker gets to stand on. The Intune guide already taught the discipline of rolling these rules out,…
A channel now points at the device, and the question becomes what it should carry. The protection engine is where most of the real posture lives, and it is also where the defaults deserve the most scrutiny, because a few…
The awkward question the last article ended on has a precise answer. Security Settings Management is how you configure a device that is onboarded to Defender but not enrolled in Intune. It reaches the machines your design deliberately left outside…
Onboarding is the smallest of the three verbs and the one most often mistaken for the whole job. It connects the sensor to your tenant and does nothing else. It does not enroll the device in Intune, it does not…
