https://www.andykemp.com/blog/ Practical posts on Microsoft 365 security, identity, Zero Trust and modern workplace. en-gb Tue, 06 Oct 2026 08:00:00 GMT https://www.andykemp.com/2026/10/06/windows-laps-on-windows-server-same-technology-different-design/ https://www.andykemp.com/2026/10/06/windows-laps-on-windows-server-same-technology-different-design/ Tue, 06 Oct 2026 08:00:00 GMT Windows LAPS works across Windows clients and servers, but the architecture shouldn't simply be copied from Windows 11. A practical look at member servers, Active Directory, password encryption, delegation, Server 2025 and DSRM. https://www.andykemp.com/2026/10/05/finding-my-place-reflections-after-scottish-summit/ https://www.andykemp.com/2026/10/05/finding-my-place-reflections-after-scottish-summit/ Mon, 05 Oct 2026 11:53:00 GMT An honest reflection on Scottish Summit: the joy of speaking, the discomfort of feeling on the outside, and how small gestures can help people feel welcome. Community Personal Personal Development https://www.andykemp.com/2026/10/04/i-m-a-microsoft-mvp-that-still-feels-strange-to-say/ https://www.andykemp.com/2026/10/04/i-m-a-microsoft-mvp-that-still-feels-strange-to-say/ Sun, 04 Oct 2026 14:52:00 GMT On 1 October 2026, I found out I’d been awarded Microsoft MVP. The timing was special, but it also made me reflect on community, sharing what I know and what the award actually means to me. Community Personal Personal Development https://www.andykemp.com/2026/10/04/windows-laps-intune-or-group-policy-for-windows-11/ https://www.andykemp.com/2026/10/04/windows-laps-intune-or-group-policy-for-windows-11/ Sun, 04 Oct 2026 13:01:00 GMT Windows LAPS can be configured through Intune or Group Policy, but what happens when both are present? A practical look at policy precedence, hybrid environments and choosing a single management owner. https://www.andykemp.com/2026/09/30/windows-laps-on-windows-11-designing-local-admin-properly/ https://www.andykemp.com/2026/09/30/windows-laps-on-windows-11-designing-local-admin-properly/ Wed, 30 Sep 2026 09:29:00 GMT Windows LAPS can now create and manage its own local administrator account on Windows 11. But which account should you manage, and what about every other local admin? https://www.andykemp.com/2026/09/28/our-conditional-access-policy-says-require-mfa-what-does-that-actually-mean/ https://www.andykemp.com/2026/09/28/our-conditional-access-policy-says-require-mfa-what-does-that-actually-mean/ Mon, 28 Sep 2026 09:00:00 GMT What does “Require MFA” in Conditional Access actually guarantee? A practical look at MFA, Authentication Strength, phishing-resistant authentication, passkeys, synced passkeys and attestation. Cyber Security Identity Microsoft Microsoft 365 Security Zero Trust https://www.andykemp.com/2026/09/24/windows-laps-more-than-password-rotation/ https://www.andykemp.com/2026/09/24/windows-laps-more-than-password-rotation/ Thu, 24 Sep 2026 09:00:00 GMT Windows LAPS is about more than rotating a local administrator password. In this introduction, I look at how Windows LAPS has evolved, the difference between the account, management plane and credential store, and why managing a LAPS credential isn't the same as managing local administrative privilege. https://www.andykemp.com/2026/09/22/what-i-learned-deploying-global-secure-access-for-real/ https://www.andykemp.com/2026/09/22/what-i-learned-deploying-global-secure-access-for-real/ Tue, 22 Sep 2026 15:24:00 GMT After ten posts exploring Microsoft Global Secure Access, it is time to step back from the configuration guides and architecture diagrams. These are the lessons I learned from deploying it for real. https://www.andykemp.com/2026/09/22/global-secure-access-and-privileged-access-an-architecture-i-want-to-test/ https://www.andykemp.com/2026/09/22/global-secure-access-and-privileged-access-an-architecture-i-want-to-test/ Tue, 22 Sep 2026 09:00:00 GMT What could Microsoft Global Secure Access add to a privileged-access architecture? This article explores a conceptual design combining Entra Private Access, application segmentation, Conditional Access, phishing-resistant authentication, PIM and privileged workstations --- while being clear about what I have and have not tested. https://www.andykemp.com/2026/09/21/designing-entra-private-access-properly-don-t-rebuild-your-vpn-in-the-cloud/ https://www.andykemp.com/2026/09/21/designing-entra-private-access-properly-don-t-rebuild-your-vpn-in-the-cloud/ Mon, 21 Sep 2026 19:18:00 GMT Microsoft Entra Private Access can replace traditional VPN access, but simply publishing broad private networks through Quick Access risks recreating the same access model in a new service. This article looks at application segmentation, discovery, connector design, Conditional Access, DNS and a practical path towards least-privilege private access. https://www.andykemp.com/2026/09/16/global-secure-access-alongside-your-existing-security-stack/ https://www.andykemp.com/2026/09/16/global-secure-access-alongside-your-existing-security-stack/ Wed, 16 Sep 2026 16:15:00 GMT Where Global Secure Access fits alongside Intune, Defender, Conditional Access and network controls, and how to separate useful overlap from policy duplication. https://www.andykemp.com/2026/09/11/mac-or-windows-i-use-both-and-that-s-kind-of-the-point/ https://www.andykemp.com/2026/09/11/mac-or-windows-i-use-both-and-that-s-kind-of-the-point/ Fri, 11 Sep 2026 12:50:00 GMT Mac or Windows? I use both. From Surface Laptop 7 and MacBook Pro performance to battery life, Intune, passkeys and WebAuthn, here's where each works best. Intune Mac OS Microsoft Windows 11 Windows 365 https://www.andykemp.com/2026/09/09/windows-365-link-revisited-i-gave-it-another-chance/ https://www.andykemp.com/2026/09/09/windows-365-link-revisited-i-gave-it-another-chance/ Wed, 09 Sep 2026 18:16:00 GMT Four months after audio redirection made me put the Windows 365 Link aside, I tested it again. YouTube, Spotify and Windows notifications now work. Microsoft Microsoft 365 Security Windows 365 https://www.andykemp.com/2026/09/04/what-if-other-people-could-use-it/ https://www.andykemp.com/2026/09/04/what-if-other-people-could-use-it/ Fri, 04 Sep 2026 13:36:00 GMT Adding Clerk made sign-in easy. The real challenge was authorisation, tenant boundaries and keeping every SaaS customer's data securely separated. https://www.andykemp.com/2026/08/31/migrating-from-a-traditional-secure-web-gateway-to-global-secure-access/ https://www.andykemp.com/2026/08/31/migrating-from-a-traditional-secure-web-gateway-to-global-secure-access/ Mon, 31 Aug 2026 09:22:00 GMT Migrating from a traditional Secure Web Gateway to Microsoft Global Secure Access is more than replacing one endpoint client with another. This article explores policy rationalisation, coexistence, transitional security controls, staged migration, validation and when Autopilot should finally move to GSA. Entra Global Secure Access Microsoft 365 Security Security Strategy https://www.andykemp.com/2026/08/31/ews-retirement-the-exchange-deadline-you-cannot-keep-ignoring/ https://www.andykemp.com/2026/08/31/ews-retirement-the-exchange-deadline-you-cannot-keep-ignoring/ Mon, 31 Aug 2026 08:48:00 GMT EWS retirement is about far more than rewriting an application. The 1 October 2026 Exchange Online disablement phase is almost here, and April 2027 will arrive quickly. Have you inventoried your EWS apps, cross-tenant calendar sharing and Exchange hybrid dependencies—and do you know where Exchange Server SE fits? I have pulled Microsoft’s current guidance into one practical overview. If you have tested the newer paths, I would be interested to compare notes. EWS Exchange Exchange Online EXO Hybrid Microsoft Microsoft Graph https://www.andykemp.com/2026/08/26/entra-internet-access-moving-web-security-to-the-identity-layer/ https://www.andykemp.com/2026/08/26/entra-internet-access-moving-web-security-to-the-identity-layer/ Wed, 26 Aug 2026 20:21:00 GMT Explore how Microsoft Entra Internet Access moves traditional Secure Web Gateway controls towards an identity-aware security model, combining web filtering, user and group policy, Conditional Access and Global Secure Access. https://www.andykemp.com/2026/08/26/webauthn-redirection-windows-app-macos/ https://www.andykemp.com/2026/08/26/webauthn-redirection-windows-app-macos/ Wed, 26 Aug 2026 10:00:00 GMT Microsoft has introduced in-session WebAuthn redirection in preview for the Windows App on macOS, addressing a major passkey and FIDO2 limitation for Windows 365 and Azure Virtual Desktop users. Azure Virtual Desktop Identity Passwordless Windows 365 https://www.andykemp.com/2026/08/25/global-secure-access-on-mobile-devices/ https://www.andykemp.com/2026/08/25/global-secure-access-on-mobile-devices/ Tue, 25 Aug 2026 13:08:00 GMT Explore how Microsoft Global Secure Access extends identity-aware access to managed iOS, iPadOS and Android devices using Entra Internet Access and Entra Private Access. https://www.andykemp.com/2026/08/24/microsoft-global-secure-access-on-macos-extending-identity-driven-access-beyond-windows/ https://www.andykemp.com/2026/08/24/microsoft-global-secure-access-on-macos-extending-identity-driven-access-beyond-windows/ Mon, 24 Aug 2026 08:00:00 GMT Explore how Microsoft Global Secure Access brings identity-driven Private Access, Internet Access and Microsoft traffic controls to managed macOS devices. https://www.andykemp.com/2026/08/21/i-just-need-the-app-to-send-an-email/ https://www.andykemp.com/2026/08/21/i-just-need-the-app-to-send-an-email/ Fri, 21 Aug 2026 08:00:00 GMT What happens when “I just need the app to send an email” turns into a conversation about API keys, credentials, secrets and security? Part 2 of Building Again explores how a simple application requirement quickly became an architectural decision. https://www.andykemp.com/2026/08/20/from-kempsoft-to-vibe-coding/ https://www.andykemp.com/2026/08/20/from-kempsoft-to-vibe-coding/ Thu, 20 Aug 2026 09:00:00 GMT Nearly 30 years after creating Kempsoft, AI has brought me back to building software. This is how vibe coding became my new development companion. https://www.andykemp.com/2026/08/19/replacing-traditional-vpn-access-with-microsoft-entra-private-access/ https://www.andykemp.com/2026/08/19/replacing-traditional-vpn-access-with-microsoft-entra-private-access/ Wed, 19 Aug 2026 08:00:00 GMT Learn how Microsoft Entra Private Access replaces broad VPN connectivity with identity-driven, application-aware access to private resources. https://www.andykemp.com/2026/08/13/bringing-authentication-assurance-together/ https://www.andykemp.com/2026/08/13/bringing-authentication-assurance-together/ Tue, 18 Aug 2026 08:00:00 GMT Bring Authentication Assurance together into a complete architecture, connecting Trust Levels, passkeys, FIDO2, Authentication Strengths, Conditional Access, TAP, privileged access and credential lifecycle. https://www.andykemp.com/2026/08/13/building-high-assurance-administrative-accounts/ https://www.andykemp.com/2026/08/13/building-high-assurance-administrative-accounts/ Mon, 17 Aug 2026 08:00:00 GMT Learn how to build high-assurance administrative identities by combining dedicated accounts, FIDO2 security keys, Authentication Strengths, Conditional Access, PAWs, PIM and secure recovery into a complete privileged access path. https://www.andykemp.com/2026/08/13/giving-saas-applications-a-fixed-egress-ip-with-microsoft-entra-private-access/ https://www.andykemp.com/2026/08/13/giving-saas-applications-a-fixed-egress-ip-with-microsoft-entra-private-access/ Thu, 13 Aug 2026 16:51:00 GMT Use Microsoft Entra Private Access source IP anchoring to give IP-restricted SaaS applications a controlled and predictable public egress address. Compliance & Governance Global Secure Access Microsoft Microsoft 365 Security Security Strategy Zero Trust https://www.andykemp.com/2026/08/13/temporary-access-pass-and-secure-onboarding/ https://www.andykemp.com/2026/08/13/temporary-access-pass-and-secure-onboarding/ Thu, 13 Aug 2026 12:49:00 GMT Explore how Temporary Access Pass can securely bootstrap and recover passwordless authentication, and why single-use, multi-use, duration and identity verification all matter when designing Authentication Assurance. https://www.andykemp.com/2026/08/13/authentication-strengths-in-microsoft-entra/ https://www.andykemp.com/2026/08/13/authentication-strengths-in-microsoft-entra/ Thu, 13 Aug 2026 10:23:00 GMT Learn how Microsoft Entra Authentication Strengths and Conditional Access can turn Authentication Assurance from an architectural principle into an enforceable security control. https://www.andykemp.com/2026/08/13/choosing-the-right-authentication-for-each-trust-level/ https://www.andykemp.com/2026/08/13/choosing-the-right-authentication-for-each-trust-level/ Thu, 13 Aug 2026 10:07:00 GMT Learn how to align authentication methods with identity Trust Levels, from dedicated FIDO2 security keys for critical administrators to device-bound and synced passkeys where appropriate. https://www.andykemp.com/2026/08/11/not-all-passkeys-provide-the-same-level-of-assurance/ https://www.andykemp.com/2026/08/11/not-all-passkeys-provide-the-same-level-of-assurance/ Tue, 11 Aug 2026 18:08:00 GMT Discover why phishing-resistant authentication doesn't automatically provide the same level of operational assurance, and how different passkey implementations influence privileged identity security.