Operating Windows LAPS: Deployment Isn't the Finish Line
Read the full article.
BLOG START HERE
Start with the right Microsoft 365 topic
The full blog is intentionally broad. This page groups the strongest routes into the main themes: security, identity, privileged access, Copilot readiness, endpoint modernisation and cloud change.
LATEST STARTING POINTS
Recent Posts Worth Reading First
Windows LAPS on Windows Server: Same Technology, Different Design
Windows LAPS works across Windows clients and servers, but the architecture shouldn't simply be copied from Windows 11. A practical look at member serve...
Finding My Place: Reflections After Scottish Summit
An honest reflection on Scottish Summit: the joy of speaking, the discomfort of feeling on the outside, and how small gestures can help people feel welc...
CURATED READING PATHS
Choose a Theme
SECURITY FOUNDATION
Microsoft 365 Security and Identity
Start here for identity governance, privileged access, Conditional Access, authentication assurance and practical Microsoft 365 security decisions.
Related service: Security & IdentityOperating Windows LAPS: Deployment Isn't the Finish Line
Read the full article.
Windows LAPS on Windows Server: Same Technology, Different Design
Windows LAPS works across Windows clients and servers, but the architecture shouldn't simply be copied from Windows 11. A practical look at member serve...
Windows LAPS: Intune or Group Policy for Windows 11?
Windows LAPS can be configured through Intune or Group Policy, but what happens when both are present? A practical look at policy precedence, hybrid env...
Windows LAPS on Windows 11: Designing Local Admin Properly
Windows LAPS can now create and manage its own local administrator account on Windows 11. But which account should you manage, and what about every othe...
TRUSTED ADMINISTRATION
Zero Trust and Privileged Access
A curated path through Zero Trust thinking, administrative workstations, assurance levels and practical privileged access strategy.
Related service: Security & IdentityOperating Windows LAPS: Deployment Isn't the Finish Line
Read the full article.
Windows LAPS on Windows Server: Same Technology, Different Design
Windows LAPS works across Windows clients and servers, but the architecture shouldn't simply be copied from Windows 11. A practical look at member serve...
Windows LAPS: Intune or Group Policy for Windows 11?
Windows LAPS can be configured through Intune or Group Policy, but what happens when both are present? A practical look at policy precedence, hybrid env...
Windows LAPS on Windows 11: Designing Local Admin Properly
Windows LAPS can now create and manage its own local administrator account on Windows 11. But which account should you manage, and what about every othe...
ENDPOINTS AND ACCESS
Modern Workplace, Intune and Cloud PCs
Posts on Windows 365, Azure Virtual Desktop, Intune, device security and remote access choices for modern work.
Related service: Modern WorkplaceOperating Windows LAPS: Deployment Isn't the Finish Line
Read the full article.
Windows LAPS on Windows Server: Same Technology, Different Design
Windows LAPS works across Windows clients and servers, but the architecture shouldn't simply be copied from Windows 11. A practical look at member serve...
Windows LAPS: Intune or Group Policy for Windows 11?
Windows LAPS can be configured through Intune or Group Policy, but what happens when both are present? A practical look at policy precedence, hybrid env...
Windows LAPS on Windows 11: Designing Local Admin Properly
Windows LAPS can now create and manage its own local administrator account on Windows 11. But which account should you manage, and what about every othe...
IDENTITY-LED NETWORKING
Global Secure Access and Network Modernisation
Follow the move from traditional network access patterns toward Microsoft Global Secure Access, Private Access and identity-aware controls.
Related service: Security & IdentityYour Conditional Access Policy Says Require MFA. What Does That Actually Mean?
What does “Require MFA” in Conditional Access actually guarantee? A practical look at MFA, Authentication Strength, phishing-resistant authentication, p...
What I Learned Deploying Global Secure Access for Real
After ten posts exploring Microsoft Global Secure Access, it is time to step back from the configuration guides and architecture diagrams. These are the...
Global Secure Access and Privileged Access: An Architecture I Want to Test
What could Microsoft Global Secure Access add to a privileged-access architecture? This article explores a conceptual design combining Entra Private Acc...
Designing Entra Private Access Properly: Don't Rebuild Your VPN in the Cloud
Microsoft Entra Private Access can replace traditional VPN access, but simply publishing broad private networks through Quick Access risks recreating th...
AI READINESS
Copilot, AI and Automation
Useful reading on AI adoption, Microsoft 365 Copilot readiness, automation, data exposure and practical tooling.
Related service: AI & Copilot AdoptionWhat If Other People Could Use It?
Adding Clerk made sign-in easy. The real challenge was authorisation, tenant boundaries and keeping every SaaS customer's data securely separated.
EWS Retirement: The Exchange Deadline You Cannot Keep Ignoring
EWS retirement is about far more than rewriting an application. The 1 October 2026 Exchange Online disablement phase is almost here, and April 2027 will...
I Just Need the App to Send an Email
What happens when “I just need the app to send an email” turns into a conversation about API keys, credentials, secrets and security? Part 2 of Building...
From Kempsoft to Vibe Coding
Nearly 30 years after creating Kempsoft, AI has brought me back to building software. This is how vibe coding became my new development companion.
CHANGE AND DELIVERY
Cloud, Migration and Architecture
A route into cloud architecture, tenant change, migration planning, Exchange, hybrid environments and delivery lessons.
Related service: Cloud TransformationEWS Retirement: The Exchange Deadline You Cannot Keep Ignoring
EWS retirement is about far more than rewriting an application. The 1 October 2026 Exchange Online disablement phase is almost here, and April 2027 will...
Bringing Authentication Assurance Together
Bring Authentication Assurance together into a complete architecture, connecting Trust Levels, passkeys, FIDO2, Authentication Strengths, Conditional Ac...
Building High-Assurance Administrative Accounts
Learn how to build high-assurance administrative identities by combining dedicated accounts, FIDO2 security keys, Authentication Strengths, Conditional...
Temporary Access Pass and Secure Onboarding
Explore how Temporary Access Pass can securely bootstrap and recover passwordless authentication, and why single-use, multi-use, duration and identity v...