Security | EzCloudInfo

Rethinking Network Access: A Deep Dive into Microsoft Entra Global Secure Access Diagnostics & Troubleshooting

Entra ID, Global Secure Access, SSE January 5, 2026 Leave a comment

Modern network access has evolved, and Microsoft Entra Global Secure Access (GSA) is leading the transformation. Whether users are accessing private resources, Microsoft 365 services, or the internet, every request is now routed through an identity aware, Zero Trust-aligned infrastructure. This shift introduces new troubleshooting paradigms and this guide is here to help.

Why Global Secure Access Exists

Global Secure Access combines multiple security layers to deliver robust protection and optimized routing:

Zero Trust enforcement for all traffic
Unified identity, device, and network controls
VPN replacement for private apps
Secure outbound internet access
Optimized Microsoft 365 routing

Traffic Profiles Explained

GSA categorizes traffic into three distinct profiles:

Internet Access → Secure outbound browsing

Microsoft 365 Access → Optimized, identity-aware routing

Private Access → Zero Trust access to internal apps

For architectural flow diagrams and examples (e.g., Synology NAS), refer to my previous blog.

Continue reading →

From Home to Zero Trust: A Hands-On Guide to Microsoft Entra Private Access

Entra ID, Global Secure Access, Network Security December 16, 2025 1 Comment

In today’s hybrid work environment, secure access to internal resources without relying on traditional VPNs is a key requirement. Microsoft Entra Private Access, part of the Global Secure Access suite, enables Zero Trust-based connectivity to private applications hosted on-premises or in private networks.

In this demo, we’ll walk through setting up a home lab using an Azure tenant, installing the Entra connector, and configuring access to a Synology NAS as a private application—all from a personal laptop and home network.

Before starting, make sure you have:

Microsoft Entra ID tenant with Global Secure Access enabled.
Microsoft Entra Global Secure Access license (Private Access feature).
Windows 11 Pro device (required for advanced networking and policy support).
Device joined to Microsoft Entra ID (Azure AD joined or Hybrid joined).
Intune-managed device for policy enforcement and NRPT configuration.
Administrative access to your Azure tenant and local machine.
Microsoft Entra Connector installer downloaded from the Entra Admin Center.
Global Secure Access Client installer for Windows.
Internal resource (Synology NAS or similar) reachable on your home network.
Internal IP address of the resource (e.g., 10.0.x.x).
Optional DNS setup:
- Private DNS zone or hosts file entry for FQDN (e.g., demo.synology.me).
Self-signed certificate (optional) for HTTPS access.
Internet connectivity for connector registration and client sign-in.

Continue reading →

Navigating DORA with Microsoft Purview: A compliance blueprint for Microsoft 365

Microsoft 365, Purview October 28, 2025 Leave a comment

Digital Operational Resilience Act (DORA) is reshaping how EU financial entities manage ICT risk, resilience testing, incident reporting, and third‑party risk. If you run Microsoft 365, Microsoft Purview Compliance Manager gives you a practical way to translate DORA requirements into actions, evidence, and measurable progress. This guide walks through a clean, step‑by‑step implementation flow from setting up a DORA assessment to assigning improvement actions and tracking your score, so you can be audit ready without drowning in spreadsheets.

Why use Microsoft Purview Compliance Manager for DORA ?

Prebuilt assessments: DORA assessment templates map regulatory articles to actionable controls you can assign and track.
Control mapping: Microsoft‑managed baselines and customer‑managed controls provide clarity on shared responsibility.
Improvement actions: Structured tasks with owners, due dates, and recommended steps create accountability.
Evidence management: Centralized artifacts (documents, links, screenshots) simplify audit preparation.
Real‑time scoring: Compliance scores help prioritize high‑risk gaps and demonstrate progress.

Prerequisites and approach

Access: Ensure you have appropriate roles in Microsoft Purview (e.g., Compliance Manager Admin or similar).
Scope: Decide which services to cover first; start with Microsoft 365 for a focused rollout.
Vanilla setup: Use a fresh assessment group to avoid inherited noise and control drift.

Quick Tip

Can also use the default user access options available from the Assesment option in the Compliance Manager Portal

Step‑by‑step setup in Compliance Manager

Create and configure your DORA assessment

Open Purview: Go to Microsoft Purview portal → Compliance Manager – Navigate to assessment – Select Regulation
Find templates: Search for “Digital” under assessment templates. (I was not able to find with DORA :))

Continue reading →

Top 10 Browser Security Controls that can be Enforced with Microsoft Intune

Cloud Security, Endpoint Security, Intune, Security October 17, 2025 Leave a comment

In today’s enterprise landscape, most applications are accessed through modern browsers like Microsoft Edge and Google Chrome, especially on Windows devices. While these browsers come with built-in security features, organizations must go a step further to enforce consistent and robust browser security policies across all endpoints.

If your organization uses Microsoft Intune, you have powerful tools at your disposal to configure and enforce browser security settings. In this blog, we’ll walk through 10 essential browser security controls you can implement using Intune’s Settings Catalog to enhance protection against web-based threats.

1. Enable Windows Defender SmartScreen

SmartScreen helps protect users from phishing attacks and malicious websites or downloads.

Recommended Settings:

Enable Windows Defender SmartScreen
Don’t allow SmartScreen warning overrides for unverified files
Don’t allow SmartScreen warning overrides

Continue reading →

Deep Dive into Microsoft Purview Adaptive Protection: A SOC Team’s Guide to Investigating Insider Risk Alerts in Adaptive Protection

Adaptive Protection, DLP, Microsoft 365, Purview October 7, 2025 Leave a comment

In today’s hybrid work environment, insider threats are becoming increasingly complex. Microsoft Purview’s Adaptive Protection and Insider Risk Management (IRM) offer a dynamic, risk-based approach to protecting sensitive data while enabling SOC teams to investigate and respond to alerts with precision.

This blog provides a step by step walkthrough of how SOC teams can leverage these tools to investigate alerts, assess user behavior, and take appropriate action.

Step 1: Understanding the Adaptive Protection Dashboard

The Adaptive Protection dashboard is the SOC team’s starting point. It provides a bird’s-eye view of user risk levels across the organization, helping analysts prioritize investigations.

Key Elements of the Dashboard:

User Risk Levels:
- Elevated Risk: Users exhibiting high-risk behavior that may indicate potential data exfiltration or policy violations.
- Moderate Risk: Users with concerning patterns but not yet critical.
- Minor Risk: Users with low level anomalies or early warning signs.

Policy Integration:
- Shows which Insider Risk policies are actively using these risk levels.
- Helps correlate user behavior with policy triggers, such as data leakage,
- Security violations, or unusual access patterns.

Continue reading →

SOC Analyst Guide: Investigating Insider Risk Alerts in Microsoft Purview

DLP, Microsoft 365, Purview October 2, 2025 Leave a comment

This blog post provides a comprehensive guide for SOC analysts to investigate and respond to alerts generated by Microsoft Purview’s Insider Risk Management and Adaptive Protection. It outlines step-by-step workflows for accessing alerts, triaging incidents, analyzing user behavior, managing cases, and leveraging Microsoft Defender integration.

The guide also includes best practices and suggested screenshots to help SOC teams effectively mitigate insider threats and maintain organizational security.

Introduction

Microsoft Purview’s Insider Risk Management (IRM) and Adaptive Protection empower SOC teams to detect and respond to insider threats dynamically. This guide walks through how SOC analysts can triage, investigate, and respond to alerts generated by these systems.