Demystifying Microsoft

Most attacks on Microsoft 365 now target the identity layer. Business email compromise, adversary-in-the-middle phishing, and token theft give threat actors a valid session. From there, they go after invoices, ACH details, and corporate cash. Licensing and tenant hardening reduce that risk, but determined attackers, increasingly helped by AI, still get through.

In this episode of Demystifying Microsoft, host Nathan Taylor of the Sourcepass Center of Excellence for Microsoft gives a hands-on demo of Petra Security Identity Threat Detection and Response (ITDR). He shows how the platform ingests up to six months of Microsoft 365 logs, flags indicators of compromise, and automatically contains compromised accounts at any hour.

Nathan also breaks down a real incident in which an attacker went undetected for more than six weeks. He explains why residential proxies make malicious sign-ins look local, and how forensic reporting supports insurers, law enforcement, and regulators. Nathan closes with the recent SkyKick Cloud Backup supply chain attack, and how Petra disabled the risky enterprise apps and confirmed whether tenants were affected.

What You’ll Learn:

• What ITDR is and where it fits in your Microsoft 365 security strategy

• The sign-in and mailbox behaviors that signal a compromised account

• Why Nathan treats ITDR as the next step after Business Premium and tenant hardening

• How an adversary-in-the-middle attack went undetected for more than six weeks

• How Petra’s remediation and forensic reporting simplify incident response

• What the SkyKick supply chain attack means for your tenant, and how to check your exposure

About the Host:

Nathan Taylor is the Senior Vice President and Global Microsoft Practice Leader at the Sourcepass Center of Excellence for Microsoft. With more than 20 years of experience supporting small and mid-sized organizations, Nathan brings a pragmatic perspective shaped by real-world deployments, Microsoft 365 security strategy, and close collaboration with Microsoft. He helps IT leaders cut through the noise of an ever-changing Microsoft ecosystem so they can make informed, defensible decisions with confidence.

Episode Highlights:

• 01:21 What ITDR Actually Is

ITDR monitors identities, detects threats, and responds to them automatically. It has become critical as threat actors focus on business email compromise, phishing, and token theft. Petra correlates signals such as unfamiliar IP addresses, new MFA methods, and suspicious mailbox rules to spot compromised accounts.

• 04:27 Business Premium, Tenant Hardening, Then ITDR

Nathan sets Microsoft 365 Business Premium, or Microsoft 365 E3 above 300 seats, as the baseline, followed by a tenant hardening engagement. Token theft and AI-assisted attacks still get through, so ITDR is the next step.

• 10:45 Anatomy of a Six-Week Account Compromise

An SEO-driven phishing campaign and an adversary-in-the-middle kit gave an attacker access for one month and 13 days. During that time, they accessed 91 potentially sensitive emails, including tax forms, and created an inbox rule to hide their tracks.

• 12:36 How Residential Proxies Hide Attackers

Smart TVs, refrigerators, and sprinkler controllers can route attacker traffic. A malicious sign-in can then look like it came from a house down the street from your office, which defeats location-based detection.

• 20:17 How Petra Responded to the SkyKick Supply Chain Attack

Threat actors used compromised keys and tokens from SkyKick Cloud Backup to reach customer tenants. Petra automatically disabled the risky enterprise apps and swept the logs for indicators of compromise, confirming there was no data exfiltration.

Episode Resources:

Concerned that your tenant was exposed in the SkyKick incident, or unsure what an attacker could do with a stolen token today? Connect with the Sourcepass MCOE team for a complimentary Petra scan and a clear view of your identity risk.

https://sourcepassmcoe.com/demystifying-microsoft-contact

• Microsoft Website

• Sourcepass Website

• Nathan Taylor on LinkedIn

Quotes:

• “Threat actors continue to focus the majority of their attacks on identity. They’re trying to steal ACH numbers, invoices, credit cards, and bank account numbers to get at corporate cash. Most of the attacks are hitting the identity layer.”

• “These attacks often happen late at night or early in the morning. They might steal someone’s tokens on Friday afternoon at 3, but do most of their damage at 1 AM on Sunday, when nobody is paying attention”

• “For me, having a tool like Petra is the second step in hardening a tenant.”

• “The advantage for threat actors is that they can route traffic through a TV in a house right down the street from your business, so it looks like a local login.”

• “I think getting an ITDR solution in place is the number one thing you can do besides hardening your tenant and running Business Premium.”

Demystifying Microsoft is handcrafted by our friends over at: https://www.fame.so/

Microsoft does an excellent job of keeping Microsoft 365 resilient. That resilience includes faithfully replicating every deletion, corruption, and misconfigured retention policy. Section 6b of the Microsoft Services Agreement puts responsibility for backing up content and data on the customer, which leaves IT leaders with one question: can you actually roll back when something goes wrong?

In this episode of Demystifying Microsoft, host Nathan Taylor of the Sourcepass Center of Excellence for Microsoft is joined by Steve Brining, Cybersecurity Evangelist at Acronis, to discuss why backing up your Microsoft 365 data is critical, how retention policies and backups serve different purposes, and the key strategies to protect your Exchange, Teams, OneDrive, and SharePoint data from deletion, corruption, and insider threats.

What You’ll Learn:

• What Section 6b of the Microsoft Services Agreement means for your backup strategy

• Why a platform outage can take native Microsoft 365 Backup offline along with your production data

• The cost and configuration trade-offs of native Microsoft 365 Backup versus a per-seat third-party solution

• How the 3-2-1-1-0 backup strategy adds immutability and verified recovery

• The difference between Microsoft 365 backup, archiving, and retention policies

• Why Microsoft Teams data and Microsoft Entra ID identity data need protection

About the Guest:

Steve Brining is a Cybersecurity Evangelist at Acronis, where he has spent nearly nine years helping organizations strengthen backup, recovery, and data protection strategies. He brings 30 years of experience in cybersecurity, much of it on the software vendor side. Steve also served 20 years in the Arizona Army National Guard, retiring as a commander in July 2026.

About the Host:

Nathan Taylor is the Senior Vice President and Global Microsoft Practice Leader at the Sourcepass Center of Excellence for Microsoft. With more than 20 years of experience supporting small and mid-sized organizations, Nathan brings a pragmatic perspective shaped by real-world deployments, Microsoft 365 security strategy, and close collaboration with Microsoft. He helps IT leaders cut through the noise of an ever-evolving Microsoft ecosystem so they can make informed, defensible decisions with confidence.

Episode Highlights:

• 01:02 Section 6b and the Shared Responsibility Model

Microsoft is responsible for infrastructure security and uptime. Section 6b of the Microsoft Services Agreement makes backing up your content and data your responsibility.

• 02:14 When Native Backup Goes Down with the Platform

Native Microsoft 365 Backup runs inside the Microsoft ecosystem. A broad outage can take down your production data and your ability to restore it at the same time.

• 09:11 Backup vs. Archive

Backup is for fast, point-in-time recovery after ransomware, corruption, or deletion. Archiving is for keeping data for years to meet compliance, legal, and historical requirements.

• 11:57 Why Retention Policies Aren’t Backups

Retention policies control how long Microsoft 365 keeps data. They can be changed or misconfigured, and only an independent backup gives you a separate recovery copy.

• 13:38 Insider Threats and the Value of Granular Restore

Departing employees can time deletions to outlast your retention windows. Granular restore and audit logs let you recover exactly what was lost and see who removed it.

• 22:06 AI Agents, Identity, and Microsoft Entra ID Backup

Identity is the main battleground, and misconfigured AI agents add new risk. Backing up Microsoft Entra ID lets you roll users, groups, and configurations back to a known-good state.

Episode Resources:

Would your current Microsoft 365 setup survive a malicious deletion, a retention policy misstep, or an extended platform outage? Connect with the Sourcepass MCOE team to review your backup, archive, and retention strategy, and make sure your Exchange, OneDrive, SharePoint, Teams, and Microsoft Entra ID data can be recovered when it counts.

https://sourcepassmcoe.com/demystifying-microsoft-contact

• Steve Brining on LinkedIn

• Acronis Website

• Microsoft Website

• Sourcepass Website

• Nathan Taylor on LinkedIn

Quotes:

• “Microsoft is responsible for the security of the infrastructure and for uptime, but you’re ultimately responsible for backing up the data.”

• “A backup really answers the question, ‘How do I get my data back?’ An archive is about long-term retention for compliance, legal, and other business requirements.”

• “Retention determines how long Microsoft 365 must preserve the data. Backup is a separate recovery mechanism for when you need to restore.”

• “You really have to get your identity and access management in order because identity, especially with AI, is the scary part for me.”

Demystifying Microsoft is handcrafted by our friends over at: https://www.fame.so/

Business email compromise is accelerating, and threat actors are moving faster than most security teams can monitor. Host Nathan Taylor and Sourcepass Client Success Manager Tracy Harper break down the attack techniques driving the surge, including device code flow phishing and adversary-in-the-middle token theft, and explain how Microsoft 365 tenant hardening and identity threat detection and response (ITDR) close the after-hours gap. They also cover retiring on-premises Active Directory, modernizing legacy SMTP relays, and why Microsoft 365 Copilot Business is the smarter AI investment for organizations under 300 users.

What You’ll Learn:

• Why device code flow phishing and token theft are fueling the rise in business email compromise

• Which Microsoft 365 tenant hardening controls stop the most phishing attacks

• How ITDR with Petra provides 24/7 mailbox monitoring and automated response

• How to retire on-premises Active Directory without breaking legacy dependencies

• How to modernize an SMTP relay to meet Microsoft's SPF, DKIM, and DMARC requirements

• Why Microsoft 365 Copilot Business delivers enterprise Copilot capabilities at roughly 30% less

About the Guest:

Tracy Harper is a Client Success Manager at Sourcepass, where she has spent the past five years advocating for clients and guiding them through technical and business challenges. Working daily with small and mid-sized organizations, Tracy sees firsthand the issues IT leaders are prioritizing, from Microsoft 365 Copilot licensing decisions to the aftermath of business email compromise.

About the Host:

Nathan Taylor is the Senior Vice President and Global Microsoft Practice Leader at the Sourcepass Center of Excellence for Microsoft. With more than 20 years of experience supporting small and mid-sized organizations, Nathan brings a pragmatic perspective shaped by real-world deployments, Microsoft 365 security strategy, and close collaboration with Microsoft. He helps IT leaders cut through the noise of an ever-evolving Microsoft ecosystem so they can make informed, defensible decisions with confidence.

Episode Highlights:

• 01:07 Why Organizations Are Leaving On-Premises Active Directory

As you know, on-premises Active Directory carries ongoing server, backup, and security overhead, and domain controllers come with a well-documented attack playbook. Moving to cloud-only with Intune, Entra ID join, and Windows Autopilot simplifies management and shrinks the attack surface.

• 03:01 Untangling Okta, Entra ID, and Active Directory Dependencies

Disconnecting Entra Connect is often a single PowerShell command. The real work is mapping everything else tied to Active Directory. Nathan walks through phasing a migration for a customer with both Okta and Entra ID synced to on-premises infrastructure.

• 04:24 Migration Pitfalls and the Hybrid Middle Ground

Line-of-business apps and authentication flows like RADIUS for Wi-Fi are the dependencies that stall migrations. When a legacy system still needs Active Directory, endpoints can move to Entra ID join while a reduced Active Directory footprint runs in Azure for only the users who need it.

• 05:33 Modernizing a Legacy SMTP Relay with Postfix

Stricter SPF, DKIM, and DMARC enforcement, along with tighter Microsoft requirements, have broken many legacy SMTP relays. Nathan compares third-party relay services for high-volume senders with a Postfix relay for lower-volume scenarios, and flags the encryption, port, and alignment details that commonly cause failures.

• 08:32 Microsoft 365 Copilot Business vs. Enterprise

Microsoft 365 Copilot Business offers effectively the same capabilities as the enterpise SKU for organizations under 300 users at roughly 30% less. Tracy shares how clients have responded, and Nathan explains why small business SKUs like Business Premium often outperform enterprise options such as E3.

• 16:22 Device Code Flow Phishing, Token Theft, and Tenant Hardening

Adversary-in-the-middle token theft and device code flow phishing have exploded in recent months. Tracy and Nathan outline the hardening baseline the Sourcepass Center of Excellence for Microsoft starts with: SPF, DKIM, and DMARC, Direct Send and device code flow restrictions, phishing-resistant MFA with FIDO2 passkeys, and device compliance policies.

Episode Resources:

Concerned about how quickly a stolen token could turn into a fraudulent payment in your environment? Connect with the Sourcepass Center of Excellence for Microsoft to assess your Microsoft 365 tenant, close common business email compromise gaps, and put round-the-clock identity threat detection in place.

https://sourcepassmcoe.com/demystifying-microsoft-contact

• Tracy Harper on LinkedIn

• Microsoft Website

• Sourcepass Website

• Nathan Taylor on LinkedIn

Quotes:

• “I love advocating for clients, helping clients, and working through problems. Whatever a client needs, I'm here for them. And if I don't know the answer, I definitely know people who can help.”
• “It's wonderful when you can go to a client and say, ‘Hey, I can save you some money.’”
• “When threat actors get into a client's environment, they can do something as simple as changing one letter in an email address so the recipient doesn't notice.”
• “Microsoft 365 Copilot Business is perfect for clients with under 300 business users, and it's about 30% less than the enterprise version.”

Demystifying Microsoft is handcrafted by our friends over at: https://www.fame.so/

Attackers have become very good at getting past traditional multifactor authentication. SMS codes and voice calls are now regular targets of SIM swapping, social engineering, and session interception. Microsoft is responding by retiring Microsoft-provided SMS and voice MFA in Microsoft Entra ID and making passkeys the default authentication experience across Microsoft 365, Azure, and connected business applications.

In this solo episode of Demystifying Microsoft, host Austin Kelly of the Sourcepass Center of Excellence for Microsoft covers the milestones IT leaders need on their calendars, how passkeys use cryptographic, device-bound authentication to remove whole categories of phishing attacks, and how identity threat detection and response (ITDR) adds containment and remediation inside your Microsoft 365 environment, alongside Microsoft’s native controls rather than in place of them.

What You’ll Learn:

• The three key dates in Microsoft’s SMS and voice MFA retirement timeline, and who each one affects
• Why phone-based authentication is no longer a sufficient security control
• How passkeys work with Microsoft Authenticator, Windows Hello for Business, and FIDO2 security keys
• What happens to users who reach a retirement milestone with only SMS or voice registered
• A four-phase approach for moving to passkeys
• How identity threat detection and response complements Microsoft Defender and Microsoft Purview

About the Host:

Austin Kelly is a Client Success Manager at Sourcepass MCOE, a company focused on helping organizations simplify, secure, and optimize their Microsoft environments. He works closely with businesses to evaluate licensing, improve security posture, and align Microsoft investments with real operational needs.

Episode Highlights:

• 00:58 Microsoft Makes Passkeys the Default in Microsoft Entra ID

Microsoft is moving away from SMS and voice as secure authentication methods. This changes how users authenticate to Microsoft 365, Azure, and business applications.

• 01:48 The Three Retirement Dates IT Leaders Need to Know

• September 1, 2026: SMS and voice users became candidates for passkey registration.
• February 1, 2027: Microsoft-provided SMS and voice MFA retires for all users.
• July 1, 2027: The final milestone for global administrators and external users who received an extended timeline.

• 03:27 Why SMS and Voice MFA No Longer Hold Up

Phone-based authentication is exposed to SIM swapping, social engineering, message interception, and token capture. This is why Microsoft is pushing organizations toward authentication that is phishing-resistant by design.

• 04:35 How Passkeys Actually Work

Passkeys replace shared secrets with cryptographic keys tied to a trusted device. The private key never leaves the device, and users verify with a biometric or device PIN. The result is stronger security and a simpler sign-in experience.

• 05:58 What Users Will Experience During the Transition

Microsoft is already prompting users to register passkeys during sign-in, and registration usually takes a couple of minutes. After the retirement dates, users with only SMS or voice registration can be required to register a passkey before they can sign in again.

• 07:28 A Four-Phase Passkey Rollout Plan

• Discover which users rely on SMS and voice.
• Pilot with IT administrators, executives, and high-risk users.
• Expand department by department while monitoring help desk volume.
• Remove the risk by making sure every employee has at least one phishing-resistant method before the deadlines.

• 08:44 Bring your own Telephony Provider for SMS and Voice Exceptions

Organizations with a legitimate business, regulatory, or operational need for phone-based MFA can buy those services through approved providers. At launch, those providers are Soprano and Telesign. SMS and voice now become exceptions rather than the default.

• 09:40 Adding Identity Threat Detection and Response to Microsoft 365

Microsoft’s controls protect the front door. Petra monitors what happens inside, acting when it finds a compromise: it revokes sessions, locks compromised accounts, removes malicious inbox and forwarding rules, and removes MFA methods an attacker added. It also produces detailed forensic reporting.

• 13:23 Three Takeaways for your Passkey Strategy

• Passkeys are the future of authentication in Microsoft Entra ID.
• Microsoft-provided SMS and voice MFA are being retired.
• Organizations that adopt passkeys early reduce phishing risk and avoid user disruption.

Episode Resources:

Facing a February 2027 deadline with users still relying on SMS or voice MFA? Connect with the Sourcepass MCOE team to identify at-risk users, pilot passkeys with your administrators and leadership, and build a phased rollout plan before Microsoft’s retirement dates arrive: https://sourcepassmcoe.com/demystifying-microsoft-contact

Austin Kelly on LinkedIn

Quotes:

• “From a security perspective, this is probably the most important identity improvement Microsoft has made since the introduction of modern MFA.”
• “Better security and a better user experience is a rare combination, but that’s exactly what passkeys are providing.”
• “Microsoft helps protect the front door, whereas Petra helps us monitor what happens inside the building.”
• “Attackers have become extremely effective at bypassing traditional multifactor authentication and targeting phone-based authentication methods.”
• “Organizations should be proactive rather than waiting for the user experience to become disruptive.”

Demystifying Microsoft is handcrafted by our friends over at: https://www.fame.so/

Business email compromise is now the leading cause of cyber-related financial loss, and the signals most IT teams rely on to catch it no longer hold up. Host Nathan Taylor and Petra Security Co-founder and COO Nathan Ostrowski explain how residential proxies, phishing toolkits, and SEO phishing let attackers log in from your users’ own cities.

Not sure whether an attacker is already signed in to one of your Microsoft 365 accounts? Talk with the Sourcepass Center of Excellence for Microsoft about a free Microsoft 365 Identity Threat Assessment, powered by Petra. You’ll see which accounts are affected, how the attacker got in, how long they had access, and what they opened, forwarded, or deleted, along with prioritized recommendations for hardening your tenant. Take the Assessment here: https://go.fame.so/sourcepasspetra

They cover why location-based conditional access falls short, how behavioral identity threat detection and response (ITDR) catches Microsoft 365 account takeover in under a minute, and which tenant hardening steps reduce your exposure.

What You’ll Learn:

• How residential proxies let attackers sign in from a user’s own city without being flagged as a VPN
• Why legacy location lockouts and geo-blocking conditional access policies can do more harm than good
• How behavioral profiling across Exchange, SharePoint, and Teams logs spots account takeover that sign-in data misses
• How attackers registered a compliant device to compromise a CEO
• What SEO phishing is and why poisoned “Microsoft password reset” results are driving a wave of attacks
• Why one compromise per 500 identities per month is a realistic baseline
• Which Microsoft 365 hardening steps cut your attack surface the most

About the Guest:

Nathan Ostrowski is the COO and Co-founder of Petra Security, which provides identity threat detection and response (ITDR) for Microsoft 365. Petra builds behavioral profiles for every user in a tenant by correlating sign-in, Exchange, SharePoint, and Teams activity. That lets it tell a legitimate user from an attacker, shut down account takeover as it happens, and produce detailed forensics after a compromise.

About the Host:

Nathan Taylor is the Senior Vice President and Global Microsoft Practice Leader at the Sourcepass Center of Excellence for Microsoft. With more than 20 years of experience supporting small and mid-sized organizations, Nathan brings a pragmatic perspective shaped by real-world deployments, Microsoft 365 security strategy, and close collaboration with Microsoft. He helps IT leaders cut through the noise of an ever-evolving Microsoft ecosystem so they can make informed, defensible decisions with confidence.

Episode Highlights:

• 01:33 Defining Identity Threat Detection and Response

Business email compromise now tops the FBI’s list of costly cyberattacks. Nathan explains what identity threat detection and response (ITDR) covers, from account takeover and session theft to the fraud that follows.

• 03:09 Why Location-Based Detection Stopped Working

Most identity attacks now come from inside the US, often from the user’s own city. Nathan explains why traditional SIEM rules miss them and how per-user behavioral profiles catch what sign-in location can’t.

• 11:34 A CEO Compromised From His Own Hometown

Despite layered security tools and compliant-device enforcement, one CEO was compromised from a residential proxy in his small hometown. The attacker then registered a compliant device through a Microsoft Authentication Broker gap.

• 14:39 Microsoft 365 Breach Forensics in a Day

As you know, investigating a compromise through the Microsoft Entra ID portal is slow and error-prone. Petra’s forensic reports show how attackers got in, how long they stayed, and what they touched, often catching mailbox rules and devices a manual review missed.

• 17:48 One Compromise Per 500 Identities

Stolen sessions are bought and sold, and attackers often wait before acting. Petra sees about one compromise per 500 identities per month. If you aren’t seeing that rate, something may be going unnoticed.

• 19:12 Why a 56-Second Response Time Matters

Automated toolkits do their most valuable work in the first ten minutes. Correlating logins, mailbox rules, and new devices in real time can stop an attacker before sensitive financial data leaves the mailbox.

• 21:48 Hardening Recommendations for Microsoft 365

Nathan shares the changes with the biggest impact: disabling direct send, moving toward passkeys and compliant devices, and tightening SPF and DKIM. He also explains SEO phishing, which poisons “Microsoft password reset” search results.

Episode Resources:

• Nathan Ostrowski on LinkedIn
• Petra Security Website
• Microsoft Website
• Sourcepass Website
• Nathan Taylor on LinkedIn

Quotes:

• “Identity has become the frontier for everything. 90% of all attacks. That is an insane statistic.”

• “The harsh reality is that even if you do all these things, there’s still a need for detection and response, always.”

• “At the very top of cyber investment still people lose a ton of money to cyber investment schemes. The first cyber attack that costs people money is business email compromise.”

• “Residential proxies are something that AI companies use to scrape the Internet. What you're going to do is you're going to use a residential proxy which uses real users devices and goes through those real user devices.”

• “I actually don't think that people should set up conditional access policies to block outside US logins. Every time somebody is traveling they're going to get a little bit jaded about the cyber program and so you will lose so much organizational buy in.”

• “Identity is the frontier. The harsh reality is that even if you do all these things, there's still a need for detection.”

Demystifying Microsoft is handcrafted by our friends over at: https://www.fame.so/

Navigate the Microsoft AI ecosystem with host Nathan Taylor and Microsoft's Ricky Lawson as they break down Microsoft Cowork, Microsoft Scout (now Autopilot), and M365 Copilot agents. Learn how the July 1st shift to Copilot credits impacts your AI strategy, discover effective Copilot FinOps practices, and determine when to leverage autonomous Cowork orchestration versus lightweight in-app agents across Word, Excel, PowerPoint, and Outlook.

What You’ll Learn:

• How Microsoft Cowork actually works
• When to use Cowork vs. in-app Copilot agents
• How the /cost command and reasoning steps work in Cowork
• What Microsoft Scout (now Autopilot) actually is
• Why Microsoft 365 Copilot’s dual-model advantage matters
• A bonus Fable 5.1 pro tip for creating instructional doodle videos in Cowork

About the Guest:

Ricky Lawson is an AI Workforce Sales Specialist at Microsoft, focused on the AI workforce space and helping customers get the most out of Microsoft 365 Copilot. With over a decade in and out of the Microsoft ecosystem, Ricky brings a hands-on perspective to how organizations are actually adopting Cowork, Scout (now Autopilot), and the broader Copilot stack. An early adopter of generative AI since 2024, he's passionate about showing customers how these tools enrich the way people work, not replace them.

About the Host:

Nathan Taylor is the Senior Vice President and Global Microsoft Practice Leader at the Sourcepass Center of Excellence for Microsoft. With more than 20 years of experience supporting small and mid-sized organizations, Nathan brings a pragmatic perspective shaped by real-world deployments, Microsoft 365 security strategy, and close collaboration with Microsoft. He helps IT leaders cut through the noise of an ever-evolving Microsoft ecosystem so they can make informed, defensible decisions with confidence.

Episode Highlights:

• 02:07 Cowork as an Orchestration Tool

Cowork is an orchestration layer that pulls together the full Microsoft AI stack to complete complex, multi-step tasks. Ricky shares how he used it to build synthetic-data HTML dashboards that instantly wowed customers, showing the real power of Cowork as a rapid prototyping engine.

• 06:22 The AI Paradigm Shift

Each wave of AI has forced us to rethink work itself. Nathan reflects on how the learning curve is about rewiring your workflow to take advantage of what these tools can now do.

• 10:31 How Copilot in Outlook Delivers Cowork-Style Value Without Consuming Copilot Credits

Microsoft is quietly building Cowork-style features directly into apps like Outlook, delivering end-of-day recaps and email triage without burning Copilot credits. It’s a reminder that in-app Copilot agents are often the smarter, cheaper path to the same productivity outcome.

• 16:38 The OpenAI Plus Anthropic Advantage in Microsoft 365 Copilot

Microsoft 365 Copilot delivers the latest models from both OpenAI and Anthropic, including Fable 5.1 on launch day. You get the best of the frontier model race without sacrificing the governance your enterprise needs.

• 19:01 Introducing Microsoft Scout

Microsoft Scout (now Autopilot) is essentially a local version of Cowork, built on the Claude Code framework, with access to your local files and expanded capabilities beyond what Cowork can do. Ricky shares an offside story where a Scout-built dashboard changed how leaders consumed information in real time.

• 22:04 Why Microsoft Scout Matters for Enterprise Security

Open-source Claude Code has been a security nightmare for enterprises, with teams pulling untrusted skills from the internet. Scout (now Autopilot) brings the power of local AI orchestration into a secure, managed Microsoft context, a game-changer for organizations that want the capability without the risk.

• 26:05 AI as Accelerator, Not Replacement

The most successful Copilot adopters aren’t using AI to cut headcount; they’re using it to make productive humans more productive. Whether it’s drafting emails, analyzing spreadsheets, or building presentations, the human in the loop becomes more valuable.

Episode Resources:

Wondering whether Cowork is the right tool for the job, or if an in-app Copilot agent could get you 90% there for a fraction of the cost? Connect with the Sourcepass MCOE team to map your workflows to the right layer of the Microsoft AI stack, so every Copilot credit you spend delivers real productivity gains.

https://sourcepassmcoe.com/demystifying-microsoft-contact

• Ricky Lawson on LinkedIn

• Microsoft Website

• Sourcepass Website

• Nathan Taylor on LinkedIn

Quotes:

• “It's a learning experience because we all are having to learn how to use this tool effectively because you can do so much with it, but you have to weigh the costs with that too. And so that's really where my conversations are going today with my customers.”

• “Scout. Think of it as Clawpilot. Think of it as Cowork, but it is local. So it has access not only to your OneDrive and everything, but also to anything local on your hard drive.”

• “We're not out here replacing people. But I do want it to make me more efficient when I'm in my role and I get to spend more time talking to people like yourself and actually humans. And so it's nice.”

• “I actually use Scout to review my inbox every 15 minutes and if it sees something that I should probably reply to, it will draft an email and put it in my inbox for me to review.”

Demystifying Microsoft is handcrafted by our friends over at: https://www.fame.so/

AI is moving faster than most budgets can keep up with. In this episode of Demystifying Microsoft, host Nathan Taylor sits down with Graham Rosenberg, Director of Intelligence and Automation at Sourcepass, to unpack one of the most urgent conversations in the Microsoft ecosystem today: AI FinOps for Microsoft Copilot.

What You’ll Learn:

• Why Copilot, Copilot Studio agents, and Copilot Cowork require a new kind of financial discipline
• The two control planes every IT and finance leader needs to understand
• Hard-won lessons on setting spending policies, building environments, avoiding runaway agent loops, and identifying power users who may justify a full Microsoft 365 Copilot license
• Guidance on Azure AI Foundry, Copilot Studio, and cost-effective model selection
• How to build enforcement caps so no one wakes up to a surprise bill

About the Guest:

Graham Rosenberg is the Director of Intelligence and Automation at SourcePass, where he leads the RPA automation, business intelligence, and AI teams. With deep expertise across the Microsoft stack, Graham helps organizations build custom AI agents, workflow automations, and BI dashboards that drive real operational efficiency. He splits his focus between scaling Sourcepass's internal operations and applying that same playbook to help customers navigate the fast-moving world of agentic AI, Microsoft Copilot, and AI FinOps.

About the Host:

Nathan Taylor is the Senior Vice President and Global Microsoft Practice Leader at the Sourcepass Center of Excellence for Microsoft. With more than 20 years of experience supporting small and mid-sized organizations, Nathan brings a pragmatic perspective shaped by real-world deployments, Microsoft 365 security strategy, and close collaboration with Microsoft. He helps IT leaders cut through the noise of an ever-evolving Microsoft ecosystem so they can make informed, defensible decisions with confidence.

Episode Highlights:

• 03:26 Why Copilot Needs a FinOps Discipline

AI has shifted Microsoft licensing from predictable per-seat pricing to consumption-based billing. Every agent, prompt, and long-running task now runs a meter.

• 05:48 Where Teams Get Their AI Billing Model Wrong

Copilot credits flow through two separate control planes: one for Cowork, one for Copilot Studio agents. Confusing them is the #1 source of billing surprises.

• 09:02 The End of Free Cowork

As of July 1st, Cowork requires both a spending policy and an agent assignment to work. Miss either step, and your users are locked out.

• 15:00 How Copilot Studio Agents Factor Into Your AI Budget

Paid Microsoft 365 Copilot license holders get near-unlimited agent usage. Everyone else needs metered billing policies tied to dedicated Power Platform environments.

• 18:18 Steps to Avoid a Surprise Copilot Bill

Enable auto-shutoff at 100%, build per-agent Azure resource groups, and set threshold alerts at 50/70/90/100%. Enforcement caps beat notifications every time.

• 20:57 What IT and Finance Leaders Should Do This Quarter

Pick your control plane, set hard caps, and treat AI spend as a collaborative business decision. Start with capped pilots.

• 22:47 Agent 365, Observability, and the Future of Microsoft AI FinOps

Microsoft is rapidly closing FinOps gaps in the Copilot admin panel. Expect deeper observability and governance tooling over the next six to twelve months.

• 25:00 When to Move Beyond Copilot Studio Into Azure AI Foundry

Copilot Studio shines for chat-based agents. For agentic workflows without a human in the loop, Azure Functions and AI Foundry offer more flexibility at lower cost.

• 27:10 Cost-Effective Model Selection

Well-instructed agents can run on cheaper models like GPT-4o mini at $0.29 per million output tokens, a fraction of frontier model pricing.

• 28:52 Why Copilot Still Wins on Access to Frontier Models

Copilot delivers the latest OpenAI and Anthropic models inside Microsoft Enterprise Data Protection, giving you frontier capability with enterprise-grade security and governance.

Episode Resources:

Not sure where your Copilot credits are going, or whether your spending caps will actually hold? Connect with the Sourcepass MCOE team to build a Microsoft Copilot FinOps strategy with the right licenses, control planes, and enforcement caps, so AI spend stays predictable: https://sourcepassmcoe.com/demystifying-microsoft-contact

• Graham Rosenberg on LinkedIn

• Sourcepass Website

• Nathan Taylor on LinkedIn

Quotes:

• “Historically, small businesses have survived on cloud services with per-month licensing. Very repeatable, you know what your cost is going to be. AI and everything with it is very much like Azure consumption. The more you use it, the more you're going to pay.”
• “You can look at just Copilot credits as one currency but two control planes.”
• “I like to tell people when you're setting up these limits, think of it very similar to when you go gambling in Vegas. Only bring the money you're willing to lose.”
• “It's really a muscle we all have to work at and get good at. There's really no right or wrong answer to how to use it. You have to figure out how to use it.”
• “There is a trap here where the shortcut answer is just give them a paid license and a lot of these problems go away. And if you can afford that, by all means, it simplifies everything. But it's not always the most cost effective way of going about it.”

Demystifying Microsoft is handcrafted by our friends over at: https://www.fame.so/

Device code flow attacks are exploding across Microsoft 365 environments in 2025, and they bypass many of the security controls organizations rely on, including FIDO2 keys, MFA, and Conditional Access. In this episode of Demystifying Microsoft, host Nathan Taylor breaks down exactly how these attacks work, why threat actor groups like Storm-2372 are leveraging phishing-as-a-service kits like Kali365, Octopi365, FlowerStorm, and EvilTokens to industrialize the attack, as well as how to detect and block device code phishing in your own tenant.

What You’ll Learn:

• What device code flow sign-in is
• How to detect device code flow activity in your tenant
• Why device code flow attacks bypass your strongest security controls
• How to build the conditional access policy that blocks it
• Who's behind the current wave of attacks?
• How to handle legitimate exceptions safely

About the Host:

Nathan Taylor is the Senior Vice President and Global Microsoft Practice Leader at the Sourcepass Center of Excellence for Microsoft. With more than 20 years of experience supporting small and mid-sized organizations, Nathan brings a pragmatic perspective shaped by real-world deployments, Microsoft 365 security strategy, and close collaboration with Microsoft. He helps IT leaders cut through the noise of an ever-evolving Microsoft ecosystem so they can make informed, defensible decisions with confidence.

Episode Highlights:

• 01:54 What Is Device Code Flow Sign-In?

A legitimate Microsoft authentication method built for conference room PCs, digital signage, and devices without a proper keyboard or browser.

• 04:16 Why Device Code Flow Bypasses MFA, FIDO2, and Conditional Access

The victim completes a fully legitimate Microsoft login on their trusted device, passing MFA and FIDO2 checks, then hands the resulting token to the attacker.

• 05:43 Storm-2372, Midnight Blizzard, and the Rise of Phishing-as-a-Service

The Storm-2372 threat actor group is driving this attack through WhatsApp, Signal, and Microsoft Teams messages. Phishing-as-a-service kits like Kali365, Octopi365, Freedom365, and EvilTokens have industrialized the attack and made it accessible to low-skill actors.

• 08:40 Hands-On Demo: Detecting Device Code Flow in Microsoft Entra

Go to entra.microsoft.com → Users → Sign-in logs, set the range to one month, and filter by authentication protocol. Always run this audit before deploying a block policy to avoid breaking legitimate logins.

• 10:58 Building the Conditional Access Policy to Block Device Code Flow

Create a new CA policy targeting all users and all resources, add the authentication flows condition for the device code flow, and set the grant control to block access. A five-minute change that hardens every tenant.

• 12:56 Handling Legitimate Use Cases

For conference room PCs, kiosks, or scripts that genuinely need device code flow, exclude the specific account and layer compensating controls: lock it to a single office IP, require phishing-resistant MFA, or require an Entra hybrid joined compliant device.

• 17:31 Why You Still Need an ITDR Tool Like Petra

Blocking device code flow doesn’t cover every attack path. An Identity Threat Detection and Response tool monitors sign-in behavior 24/7, catches unusual token activity, and can lock accounts before attackers exfiltrate data via Graph API.

Episode Resources:

Still figuring out whether your tenant is exposed to device code flow attacks or which conditional access policies you actually need? Connect with the Sourcepass MCOE team to build a Microsoft 365 security posture that blocks tomorrow’s attack vectors before they hit: https://sourcepassmcoe.com/demystifying-microsoft-contact

Nathan Taylor on LinkedIn

Quotes:

• “Before we put in a policy to block it, you really want to understand the impact on your org because you may have legitimate uses of this.”
• “The downside of device code flow is if a threat actor sends you this link and the code and you pull it up, you're probably filling it out on your trusted device.”
• “Tools like an ITDR certainly help me rest better at night, knowing that 24/7, there's a team watching for suspicious things.”
• “It's a clean, legitimate Microsoft login that you're filling in your MFA for, you're passing your FIDO2 keys, and it's authenticating you. And then it passes back to the threat actor a token.”

Demystifying Microsoft is handcrafted by our friends over at: https://www.fame.so/

Taking charge of meeting summary notes is only one of Microsoft 365 Copilot’s many abilities.

In this episode of Demystifying Microsoft, Nathan Taylor, SVP Global Microsoft Practice Leader at Sourcepass, explores how Copilot can support the entire meeting lifecycle, from setting up and configuring meetings to capturing conversations, organizing information, creating follow-up tasks and referencing meeting context later.

Nathan looks at how tools such as Facilitator, Loop and WorkIQ work together to make meetings more productive and ensure that valuable information isn’t lost once the conversation ends. He also highlights the broader potential of AI-powered meeting intelligence for leaders and organizations.

What You’ll Learn:

• How Microsoft 365 Copilot can support the entire meeting process, from setup and configuration to follow-up and referencing.
• How Facilitator, Loop and WorkIQ work together to capture and preserve valuable meeting context
• How to turn meeting conversations into actionable tasks
• How AI can make meeting information searchable and easier to reference
• How to reduce the time leaders spend on meeting administration and documentation
• How to use Copilot to create smoother, more productive meetings and turn conversations into meaningful outcomes

Tune in to learn how to make the most of Microsoft 365 Copilot across your meetings and organization.

About the Host:

Nathan Taylor is the SVP Global Microsoft Practice Leader at Sourcepass, passionate about the technology landscape. With a focus on real-world applications, licensing and technology adoption, Nathan helps IT leaders understand how Microsoft's evolving tools can improve productivity without being complex.

Episode Highlights:

02:47 Meeting Recap Goes Beyond Notes

Nathan explains how Teams Recap helps users quickly revisit what was discussed, including key topics and action items, while newer intelligent, audio and video recap capabilities make it easier to catch up on meetings.

07:37 Microsoft 365 Copilot for Business

Nathan breaks down the Copilot for Business license for organizations with fewer than 300 users and explains why its lower cost makes it worth considering for small businesses.

10:00 From Meeting Notes to Action Items

Facilitator notes are saved in Loop, where teams can add to them, organize meeting history and turn assigned tasks into Planner or To Do items.

12:14 Meeting Context Becomes AI Context

Nathan explains how Loop and Facilitator notes feed into WorkIQ, giving Copilot more organizational context and enabling more detailed questions about meetings, projects and customers.

14:31 Make Meeting Intelligence Automatic

Nathan demonstrates how recurring meetings and meeting templates can automatically enable recording, transcription and Facilitator, helping organizations build a consistent record of conversations over time.

19:15 Turn Meeting History Into Productivity

Nathan shares how he uses Copilot to quickly understand recent customer interactions by bringing together emails, Teams conversations and meeting context, helping him get up to speed before a call.

Episode Resources:

Nathan Taylor on LinkedIn

Quotes:

• “It’s not just a meeting summary or meeting notes capability. It really is a deeper capability that provides meeting life cycle experience that go all the way through configuring it ahead of time to record automatically, and into follow-up where you’ve got all the data from your meetings and WorkIQ to reference through AI in the future”
• “I’ve got a number of recurring meetings where I regularly start the meeting by going back and looking at the recap from the previous call because I have so many meetings I'm in. Sometimes I forget context, and I could quickly get that context”
• “Facilitator notes and loop documents go right into WorkIQ. When you turn up as a facilitator, you’re able to ask more detailed questions of Copilot, and it has that context because it can reference those loop documents.”
• “My ability to go back and ask Copilot, 'Give me an update on recent interactions with this customer', with facilitator notes, I not only get recent emails and Teams threads, but it has all my meeting context.”

Demystifying Microsoft is handcrafted by our friends over at: https://www.fame.so/

Microsoft 365 licensing for small and mid-sized businesses just got more interesting, yet confusing. In this episode of Demystifying Microsoft, host Austin Kelly from Sourcepass MCOE breaks down two of the most compelling SMB offerings in the Microsoft ecosystem right now: Microsoft 365 Business Standard with the Copilot add-on and the Microsoft 365 Business Premium with Copilot bundle.

If you’re evaluating Copilot pricing, Microsoft 365 security, endpoint management, or SMB licensing strategy, this episode reframes the conversation from “what does it cost” to “what is an hour of my employee’s time worth?”

What You’ll Learn:

• How Copilot helps employees spend less time “working around their work”
• Why the Business Premium with Copilot bundle is actually cheaper than buying Business Premium and the Copilot add-on separately
• How to choose between Standard and Premium
• Why AI adoption gets messy without a governed Microsoft 365 environment
• How vendor consolidation into the Microsoft stack can simplify IT for lean teams

About the Host:

Austin Kelly is a Client Success Manager at Sourcepass MCOE, a company focused on helping organizations simplify, secure, and optimize their Microsoft environments. He works closely with businesses to evaluate licensing, improve security posture, and align Microsoft investments with real operational needs.

Episode Highlights:

• 02:28 The Real Value of Copilot

Copilot’s ROI isn’t measured in features; it's measured in hours reclaimed from low-value admin work. Stop asking what Copilot costs and start asking what an hour of your employee’s time is worth.

• 04:09 Business Standard with Copilot Explained

You’re not reinventing the wheel. Just adding AI to the Microsoft 365 apps your team already uses every day. It’s the fastest path to productivity gains without changing your environment.

• 06:31 Business Premium with Copilot: The Bundle

The bundle pairs Copilot productivity with stronger security, device management, and identity controls, and it’s cheaper than buying Business Premium and the Copilot add-on separately.

• 08:10 The Vendor Consolidation Story

Most SMBs accumulate 4+ vendors for productivity, security, endpoint, and email protection. Business Premium collapses that stack into one connected Microsoft ecosystem: fewer contracts, fewer integrations, and less complexity.

• 09:41 Governing AI Sprawl

When employees sign up for random AI tools, company data ends up scattered across platforms with different policies. Copilot inside Microsoft 365 makes AI part of a governed strategy instead of a shadow-IT problem.

• 10:41 How to Choose: Standard vs. Premium

Standard with Copilot helps employees work better. Premium with Copilot helps them work better while giving the business more control over how that work is protected. Your priorities decide.

Episode Resources:

Still evaluating whether Copilot and Business Premium make sense for your team? Connect with the Sourcepass MCOE team to build a modern Microsoft 365 security and licensing strategy that pays for itself: : https://sourcepassmcoe.com/demystifying-microsoft-contact

Austin Kelly on LinkedIn

Quotes:

• “At the end of the day, it doesn't matter if there's 27 features or 17 features. Business owners, businesses are really gonna only care about a few things. That's how I can save my employees' time, how can I make our teams more productive, and how can we protect the business while we do it?”
• “Copilot can help reduce the difference between your strongest Microsoft 365 user and everybody else.”
• “It's cheaper to buy the bundle than buying Business Premium and the Copilot add-on.”
• “Standard with Copilot helps employees work better. Premium with Copilot helps employees work better while giving the businesses more control over how that work is protected, and that's really the distinction.”
• “AI adoption inside businesses can get messy very quickly.”

Demystifying Microsoft is handcrafted by our friends over at: https://www.fame.so/

For years, the AVD decision was closely tied to an Azure infrastructure decision. If you wanted Microsoft’s brokered remote desktop experience, the assumption was usually that the session hosts would live in Azure too.

AVD Hybrid changes that equation.

In this episode of Demystifying Microsoft, Nathan Taylor sits down with Denis Vozian, Azure Cloud Engineer at Sourcepass, to explore how Azure Virtual Desktop can now extend to virtual machines running on infrastructure an organization already owns.

What You’ll Learn:

• Why organizations want AVD without moving the underlying workload into Azure
• How AVD Hybrid brokers access to on-premises virtual machines
• Why HTTPS-based access can reduce reliance on VPN-based remote desktop connectivity
• How Entra ID Conditional Access can still apply to AVD Hybrid connections
• Why AVD Hybrid is less restrictive about underlying infrastructure than Azure
• Why Azure Arc is central to the deployment architecture
• How Denis uses Azure DevOps and BICEP to automate VM onboarding
• Why the lack of Windows 11 multi-session support remains a significant limitation

About the Guest:

Denis Vozian is an Azure Cloud Engineer at Sourcepass with deep expertise across Microsoft Azure and Microsoft 365 technologies. A highly certified Microsoft professional, Dennis holds advanced credentials including Azure Solutions Architect Expert, Azure Network Engineer Associate, Enterprise Administrator Expert, Azure Security Engineer Associate, and Teams Administrator Associate.

With extensive hands-on experience designing, securing, and optimizing modern cloud environments, he helps organizations navigate complex Microsoft infrastructure, networking, security, and workplace transformation challenges.

About the Host:

Nathan Taylor is Senior Vice President and Global Microsoft Practice Leader at Sourcepass, where he leads the Sourcepass Center of Excellence for Microsoft, also known as the Sourcepass MCOE. With nearly two decades of experience, he helps organizations manage complex Microsoft cloud and security decisions by turning technology into secure, scalable outcomes.

Episode Highlights:

03:13 Why Denis Still Likes AVD

Denis explains why AVD remains a strong option for managed desktops, especially when infrastructure can be deployed through code, documented properly and scaled according to actual usage.

07:48 Microsoft-Brokered Access to Your Own Infrastructure

AVD Hybrid lets users connect to virtual machines running on-premises through the Windows app over HTTPS, without requiring the VM itself to sit in Azure or users to establish a traditional VPN connection.

10:19 AVD Hybrid vs. Azure Local

Azure Local requires specific infrastructure and deployment patterns. Denis explains why AVD Hybrid gives IT teams considerably more freedom over the underlying hypervisor and hardware.

13:37 Moving Remote Access Security Up the Stack

With Microsoft handling the connection brokerage, IT no longer needs to manage the remote-access gateway in the same way. Conditional Access in Entra ID can then be applied to control who is allowed to connect.

15:57 Automating Arc Enablement

The main deployment challenge Denis identifies is getting virtual machines Arc-enabled reliably. He explains how he uses an Azure DevOps agent, managed service account, PowerShell, and pipeline logic to automate the process.

19:28 The Windows 11 Multi-Session Limitation

AVD Hybrid supports familiar AVD concepts such as RemoteApp and full desktops, but Windows 11 multi-session is not currently supported. Denis calls that out as a major missing capability for many prospective deployments.

Episode Resources:

Explore whether AVD Hybrid is the right fit for your infrastructure. Talk to Sourcepass MCOE about designing a secure, flexible deployment around your existing environment: https://sourcepassmcoe.com/demystifying-microsoft-contact?utm_source=podcast&utm_medium=show-notes&utm_campaign=demystifying-microsoft-show

Denis Vozian on LinkedInNathan Taylor on LinkedIn

Quotes:

• “You can connect over HTTPS without any VPN, without anything like that.”
• “You’re not forced to use Azure Local, and you’re not forced to use that hardware that has been certified.”
• “The security benefit is really great. You don’t have to manage that brokerage anymore.”

Demystifying Microsoft is handcrafted by our friends over at: https://www.fame.so/

Organizations tend to approach AI risk from one of two directions: restrict it heavily or encourage adoption quickly. Gabriel Friedlander, Founder and CEO of Wizer and former founder of ObserveIT, sees problems with both.

In this episode of Demystifying Microsoft, Nathan and Gabriel discuss why organizations are dealing with a new category of insider threat, how security awareness needs to evolve alongside it, and why IT leaders should establish a baseline of actual AI usage before reaching for controls. They also look at what happens next because AI may increase what a team can produce, but that makes governance more important, not less.

What You’ll Learn:

• Why banning AI can push legitimate work into personal accounts
• How shadow AI develops even among well-intentioned employees
• Why AI workers introduce a different type of insider threat
• Where identity and observability become difficult with autonomous agents
• Why AI cannot be expected to apply human common sense to sensitive data
• How malicious and unintentional insider-threat models are expanding
• How short, continuous security training can improve engagement
• Why security guardrails should support AI adoption rather than stop it
• Why human oversight remains central as AI systems become more autonomous

About the Guest:

Gabriel Friedlander is the Founder and CEO of Wizer, a security awareness platform used by approximately 20,000 organizations.

Gabriel has spent more than a decade focused on insider threat prevention, human behavior, and security awareness. Before Wizer, he co-founded ObserveIT, an insider threat detection and prevention company that was acquired by Proofpoint. His work now focuses on helping organizations make security training more effective as new risks, including shadow AI and AI-driven insider risk, change how employees interact with company data.

About the Host:

Nathan Taylor is Senior Vice President and Global Microsoft Practice Leader at Sourcepass, where he leads the Sourcepass Center of Excellence for Microsoft, also known as the Sourcepass MCOE. With nearly two decades of experience, he helps organizations manage complex Microsoft cloud and security decisions by turning technology into secure, scalable outcomes.

Episode Highlights:

05:48 AI Bans Lead to Underground Usage

Gabriel explains why companies that believe employees are not using AI can easily lose visibility instead. When approved tools are unavailable, employees may bring personal AI accounts into the workflow to keep pace with expectations.

09:09 AI Workers Are the New Insider-Threat Model

AI agents can access data, take actions, and make decisions, but they may not have the identities and monitoring structures IT expects from human workers. Gabriel argues that this creates a genuine insider-risk problem.

16:46 Start With an AI Risk Baseline

Before assuming policy is working, Gabriel recommends finding out what employees are actually doing: which tools they believe are approved, whether personal accounts are involved, and whether people know where to go with questions.

20:48 Why Security Training Needs to Get Shorter

Gabriel explains Wizer’s approach to awareness content: roughly 90 seconds, direct, useful, and stripped of repetition. If the audience has to watch, that does not mean the content should stop competing for their attention.

25:38 Security Should Help AI Move Faster

Gabriel compares security with brakes on a car. Their purpose is not simply to slow things down; they make speed safer. The same principle applies to AI governance.

Episode Resources:

Get ahead of shadow AI and emerging agent risk. Work with Sourcepass MCOE to put the right security controls, policies, and oversight in place: https://sourcepassmcoe.com/demystifying-microsoft-contact

Gabriel Friedland on LinkedIn

Nathan Taylor on LinkedIn

Quotes:

• “You’ve got a worker. You’ve got a real insider threat in the company.”
• “When it comes to AI, they don’t have common sense.”
• “We cannot offload decision-making. We have to be part of it.”
• “We’re not here to slow anyone down. We’re here to make businesses go faster without crashing.”

Demystifying Microsoft is handcrafted by our friends over at: https://www.fame.so/

Modern security teams are not short on alerts. The bigger challenge is knowing what deserves attention first and responding before an incident spreads.

In this episode of Demystifying Microsoft, Austin Kelly from Sourcepass MCOE explains how Microsoft Defender has evolved beyond traditional antivirus into a broader security platform for identities, endpoints, email, collaboration tools, cloud applications and data. The episode covers five Microsoft Defender features that help organizations connect security signals, prioritize real risk, and respond faster to active threats.

What You’ll Learn:

• How Microsoft Defender has expanded beyond endpoint antivirus
• Why Attack Disruption matters when an attacker is already inside the environment
• How Unified XDR connects separate alerts into one security incident
• Why email, Teams, SharePoint and OneDrive remain major areas for attack prevention
• How Exposure Management helps prioritize vulnerabilities by actual risk
• Why vulnerability volume alone does not show what needs to be fixed first
• How Microsoft Defender can surface unusual data movement and insider risk
• Where Microsoft Security Copilot can support faster investigation without replacing security professionals

About the Host:

Austin Kelly is a Client Success Manager at Sourcepass MCOE, a company focused on helping organizations simplify, secure, and optimize their Microsoft environments. He works closely with businesses to evaluate licensing, improve security posture, and align Microsoft investments with real operational needs.

Episode Highlights:

02:04 Defender is More Than Antivirus

Austin explains why thinking of Defender purely as an endpoint antivirus misses most of what the platform now covers, including identities, email, cloud apps, devices and data.

03:03 Stopping an Attack While It Is Happening

Attack Disruption can automatically disable compromised accounts and contain affected devices. Austin explains why reducing the gap between detection and containment matters when attackers are trying to move laterally.

05:43 Protecting Collaboration

Email remains a common entry point, but the collaboration surface now extends across Outlook, Teams, SharePoint and OneDrive. Austin explains why protection needs to follow users across that stack.

07:36 Fix the Risks That Matter First

Finding hundreds of vulnerabilities is easy. Deciding which ones materially reduce risk is harder. Austin explains how Exposure Management helps IT prioritize accordingly.

09:01 Security Ultimately Comes Back to Data

Austin shifts the conversation from keeping attackers out to controlling where sensitive information goes. Unusual downloads, risky sharing, and suspicious user activity matter whether the cause is malicious or accidental.

Episode Resources:

Reach out to Sourcepass MCOE for a Microsoft Defender strategy that keeps up with the times: https://sourcepassmcoe.com/demystifying-microsoft-contact?utm_source=podcast&utm_medium=show-notes&utm_campaign=demystifying-microsoft-show

Austin Kelly on LinkedIn

Quotes:

• “The problem isn’t finding those vulnerabilities. The problem is finding out which ones matter.”
• “Protecting the data itself is really what security is all about.”
• “AI isn’t replacing security professionals. It’s really helping them work smarter and respond faster.”
• “Microsoft Defender, it’s not just another antivirus product anymore. It is a security platform.”

Demystifying Microsoft is handcrafted by our friends over at: https://www.fame.so/

GoDaddy can make Microsoft 365 easy to adopt when a company is small. The friction tends to appear later, when IT needs access to controls that sit outside GoDaddy’s managed experience.

In this episode of Demystifying Microsoft, Nathan Taylor sits down with Lindsay Cowan, Senior Sales and Business Development Manager at the Sourcepass Center of Excellence for Microsoft, to explain what actually happens when an organization moves away from GoDaddy Microsoft 365.

What You’ll Learn:

• Why growing organizations begin running into GoDaddy’s Microsoft 365 limitations
• The difference between a Microsoft 365 migration and GoDaddy defederation
• Why GoDaddy licensing should remain active until defederation is complete
• How staggered GoDaddy renewal dates complicate licensing decisions
• Why the Partner Center Web App needs to be checked and removed
• What happens to users during the defederation process
• Why Defender for Office 365 still requires configuration after licensing
• What to consider before changing a GoDaddy-created Microsoft tenant name
• Why post-defederation tenant hardening should be part of the project

About the Guest:

Lindsay Cowan is the Senior Sales and Business Development Manager at the Sourcepass Center of Excellence for Microsoft. She has spent five years with the Sourcepass team and works closely with organizations navigating Microsoft licensing, Microsoft 365 transitions and GoDaddy defederation projects.

About the Host:

Nathan Taylor is Senior Vice President and Global Microsoft Practice Leader at Sourcepass, where he leads the Sourcepass Center of Excellence for Microsoft, also known as the Sourcepass MCOE. With nearly two decades of experience, he helps organizations manage complex Microsoft cloud and security decisions by turning technology into secure, scalable outcomes.

Episode Highlights:

01:26 When “Easy” Starts Becoming Limiting

GoDaddy works well for many companies when they are getting started. Lindsay explains why that changes once IT needs greater control over Microsoft 365 administration, security, licensing, partner management and AI capabilities.

06:55 Defederation Is Not a Data Migration

Nathan explains what federation actually means and why removing GoDaddy’s layer does not require moving mailboxes or rebuilding the Microsoft environment. The underlying tenant stays where it is.

10:47 Don’t Cancel GoDaddy Licensing Early

One of the simplest mistakes can also create one of the biggest headaches. Lindsay explains why the existing licenses need to remain intact until the defederation work has been completed.

13:23 Deciding Whether to Rename the Tenant

Defederation can provide an opportunity to replace a randomly generated GoDaddy onmicrosoft.com tenant name. The tradeoff: changing it can break previously shared SharePoint URLs.

23:18 The Signs You’ve Outgrown GoDaddy

Lindsay says she often sees the conversation begin around 10 to 15 employees, when companies start wanting more control over security policies and the broader IT environment.

Episode Resources:

Hitting GoDaddy’s limits with Microsoft 365 as you scale? Let’s chat about the smoothest path forward for your team: https://sourcepassmcoe.com/demystifying-microsoft-contact?utm_source=podcast&utm_medium=show-notes&utm_campaign=demystifying-microsoft-show

Lindsay Cowan on LinkedIn

Nathan Taylor on LinkedIn

Quotes:

• “At some point, easy turns into limiting.”
• “Security controls with a GoDaddy Microsoft account are extremely limited.”
• “Saying that your tenant is now defederated, that is not the finish line. That’s the start of the race.”

Demystifying Microsoft is handcrafted by our friends over at: https://www.fame.so/

Microsoft has a habit of dropping new capabilities into subscriptions without much noise. Business Premium is no longer just a "basic" option for small teams and Austin Kelly highlights why. The most immediate gain is the increase to a 100GB mailbox, which removes a long-standing frustration for heavy email users and eliminates the need for extra Exchange Plan 2 licenses.

The conversation moves to the security and compliance side of the house. Business Premium now serves as a base for advanced tools like Microsoft Defender and Microsoft Purview, bringing XDR, identity protection, and data governance within reach of smaller organizations. Austin explains how these tools provide visibility into threats and sensitive data, creating the necessary foundation for anyone looking to adopt AI.

Finally, the focus turns to Copilot for Microsoft. Austin describes the value of AI in a small business environment where employees often wear multiple hats. He clarifies that the business version of Copilot offers the same functionality as the enterprise version while maintaining the security boundaries already established in your Microsoft 365 tenant.

What You’ll Learn:

• Why the 100GB mailbox update eliminates the need for separate Exchange licenses
• How Business Premium now supports enterprise-grade security via Defender suite add-ons
• The role of Microsoft Purview in classifying data and preventing oversharing
• Why a secure Microsoft 365 environment is a prerequisite for AI adoption
• The ways Copilot for Microsoft helps small teams reclaim time from repetitive tasks

About the Host:

Austin Kelly is a Client Success Manager at Sourcepass MCOE, a company focused on helping organizations simplify, secure, and optimize their Microsoft environments. He works closely with businesses to evaluate licensing, improve security posture, and align Microsoft investments with real operational needs.

Episode Highlights:

[00:03:30] The 100GB Mailbox Update

One of the biggest differences between business and enterprise plans has finally disappeared. Austin explains why moving from 50GB to 100GB is a massive win for IT management and user experience.

[00:06:15] Accessing Advanced Security

Prevention is only half the battle. This section covers how the Defender Suite add-on allows smaller organizations to detect and respond to threats using tools that were previously only for E5 customers.

[00:09:30] Data Visibility with Purview

AI is only as good as the data it accesses. Austin details how Purview helps organizations find their sensitive info and apply protection policies automatically.

[00:10:45] AI for the Multi-Hat Employee

Small businesses don't always have the luxury of hiring more people. Austin describes how Copilot for Microsoft 365 handles drafting, summarizing, and analysis so your current team can focus on higher-value work.

Episode Resources:

Are you paying for add-ons that are now included in your base subscription? Our team can help you optimize your set-up to find cost savings. Get in touch today: https://sourcepassmcoe.com/demystifying-microsoft-contact

Austin Kelly on LinkedIn

Demystifying Microsoft is handcrafted by our friends over at: https://www.fame.so/

Moving into an AI-centered workflow is a continuous process of trying, learning, and iterating rather than a one-time software rollout. Steve Adams highlights that while technology changes by the hour, human instincts and organizational habits often lag years behind. To see a real return on investment, leaders must align their AI efforts with existing business goals rather than getting distracted by technical novelties that don't impact the bottom line.

The conversation looks at the logistical reality of credit consumption and why frontier models aren't always the answer for every task. By understanding when to use heavy-hitting tools like Cowork and when to rely on leaner, efficient models, organizations can save hundreds of hours without ballooning their budget. Steve and Nathan also cover the necessity of starting with governance that works for the 85% of employees who use these tools for daily tasks, rather than getting paralyzed by extreme edge cases.

What You’ll Learn:

• The "Try, Learn, Iterate" framework for constant technical change
• How to align AI use cases with your actual annual business goals
• The difference between serial and parallel AI processing for productivity
• Why cultural readiness matters more than the Microsoft 365 Copilot ribbon
• Managing the cost of AI tokens and credits effectively
• Building an auditable governance structure for the average knowledge worker

About the Guest:

Steve Adams is the Chief Innovation Officer and President of produhktiv, where he leads the company's vision, culture, and growth. He is an AI expert enthusiast whose work centers on Microsoft's AI strategy and Microsoft 365 Copilot. With 13 years of experience at Microsoft and 15 years in the partner channel, Steve focuses on the user experience and on helping knowledge workers be more productive in secure and cost effective ways. Today he helps organizations modernize their training and enablement so teams can keep pace with the rapid evolution of AI.

About the Host:

Nathan Taylor is Senior Vice President and Global Microsoft Practice Leader at Sourcepass, where he leads the Sourcepass Center of Excellence for Microsoft, also known as the Sourcepass MCOE. With nearly two decades of experience, he helps organizations manage complex Microsoft cloud and security decisions by turning technology into secure, scalable outcomes.

Episode Highlights:

[00:05:13] The Ribbon Era vs. The AI Era

Most users haven't changed how they use Outlook or Word in 20 years. We look at why the rapid pace of AI needs crossing mental blocks toward constant adaptation rather than waiting for a three-year update cycle.

[00:11:00] Finding Business Outcomes in the Hype

AI can feel like a parlor trick if it isn't solving a real problem. Nathan and Steve talk about looking back at your annual planning to ensure your AI resources target the initiatives that actually drive the organization forward.

[00:22:24] The Right Tool for the Right Job

Not every task requires a frontier model that costs thousands of dollars to run. Understand the balance between human efficiency and the cost of tokens to ensure your automation efforts remain profitable.

[00:29:26] The ROI of Parallel Processing

Using Cowork to synthesize reports, spreadsheets, and presentations simultaneously can save 20 hours of manual labor. Hear how to justify the credit cost when the time savings are this significant.

[00:35:02] Solving the People Problem

If you just give someone a license, the signals show they probably won't click the button. Adoption is a cultural challenge that requires a new way of thinking about readiness and training.

[00:37:30] Governance for the 85%

Don't let the lack of case law stop you from enabling your team. Learn why creating guidance for the majority of your workers provides more value than worrying about extreme edge cases today.

Episode Resources:

Reach out to Sourcepass MCOE to build an AI strategy that sticks: https://sourcepassmcoe.com/demystifying-microsoft-contact?utm_source=podcast&utm_medium=show-notes&utm_campaign=demystifying-microsoft-show

Steve Adams on LinkedIn

Nathan Taylor on LinkedIn

Quotes:

• "We learned how to use Outlook 20 years ago, and most of us still use Outlook exactly the same way that we always have.”
• “We didn't require thinking about change, and heaven forbid, in Office when we got the ribbon, that was the end of the world. But we were adapting to changes that came every three years."
• "AI, Copilot can do more things than we can imagine it could do. So I tell everyone to step back, look at your business goals. When you went into your annual planning meeting last year, what were the key initiatives you needed to get done? Let's focus our efforts, our investments, and our resources on the things that drive to the business goals."
• "We know for a fact that for the 85% of workers, if we give them the Copilot license and it shows up on their desktop, the signals tell us they're not going to click it.”
• “The way we adopt new software has to change. That's a mindset, a cultural mindset, not a technology problem."

Demystifying Microsoft is handcrafted by our friends over at: https://www.fame.so/

The speed of AI innovation means that proofs of concepts that once took years now reach production in weeks. Nathan Taylor and Chance Weaver analyze how workflows went from chat interfaces to sophisticated agentic workflows within the Microsoft ecosystem. They even discuss Sourcepass MCOE’s experience helping partners move from theoretical interest to functional deployment using tools like Copilot Studio and the newly announced Agent365.

As you know, identifying business problems is the first step toward effective automation. Chance shares his experience building a "Chief of Staff" agent to manage global roadblocks and explains why teaching internal teams to build their own agents is the most effective training method. They also address the "token economy," where efficiency in model selection becomes a financial necessity rather than just a technical preference.

What You’ll Learn:

• The structural advantages of Agent 365 for managing agent identity and auditing
• Differences between responsive Copilot, automated Cowork, and autonomous Scout
• Strategies for achieving token efficiency in a consumption-based pricing model
• Why local AI processing on Copilot PCs might change your cost structure
• The importance of data governance to prevent IP leakage into public models

About the Guest:

Chance Weaver is the Global VP of AI Adoption for Pax8, where he helps partners implement and monetize AI technology through the Pax8 marketplace. He brings nearly three decades of experience in technology and business development to the role. Before joining Pax8, he founded and scaled a highly successful, Microsoft focused MSP in Southern California that he later sold to a large platform company, where he went on to lead its Microsoft practice and AI strategy across dozens of acquisitions. Today he leads global initiatives that help the partner community have deeper business conversations and pinpoint where the real opportunity to implement AI lies.

About the Host:

Nathan Taylor is the Senior Vice President and Global Microsoft Practice Leader at Sourcepass, where he leads the Sourcepass Center of Excellence for Microsoft. His work is grounded in a simple idea: Microsoft should not be complicated. By removing complexity, confusion, and frustration from the Microsoft ecosystem, Nathan helps organizations focus on outcomes while getting the most from their Microsoft investment.

Episode Highlights:

[00:12:12] The Chief of Staff Agent Concept

Chance explains his creation of an autonomous agent that monitors global projects and surfaces roadblocks daily. This tool acts as a proactive assistant, identifying potential issues before they disrupt operations for the leadership team.

[00:15:15] Security and IP Protection in AI

Uploading sensitive business data to public models like Anthropic without enterprise licensing can result in a loss of intellectual property. Nathan and Chance stress why working with a partner like Sourcepass MCOE is vital for maintaining data sovereignty.

[00:20:32] Solving the Identity Crisis with Agent365

Managing agents under a user's personal identity creates massive security and auditing risks. Agent 365 introduces a dedicated agent identity, allowing for full audit trails and professional lifecycle management of automated tasks.

[00:22:51] Microsoft’s AI Licensing Realities

Current pricing models for tools like Agent 365 often feel out of reach for the average SMB. Microsoft is currently iterating on these structures, and businesses should expect significant changes as the licensing settles over the next six months.

[00:25:27] Preparing for the Token Economy

Consumption-based pricing means that token efficiency is now an art that IT leaders must master. Understanding which models to use will determine the long-term profitability and sustainability of AI projects.

[00:26:40] Local Processing and Copilot+ PCs

While most current Microsoft AI tools rely on cloud processing, the arrival of NPU-equipped hardware offers a path to lower costs. Running smaller models locally could eventually offset the token consumption costs associated with cloud-only workflows.

Episode Resources:

Reach out to Sourcepass MCOE to see how your organization can build its own AI agents: https://sourcepassmcoe.com/demystifying-microsoft-contact&nbsp?utm_source=podcast&utm_medium=show-notes&utm_campaign=demystifying-microsoft-show;

Chance Weaver on LinkedIn

Nathan Taylor on LinkedIn

Quotes:

• "Agent365 being able to bring agent identity—having an identity for an agent, being able to track that identity, have full audit capability—is incredibly powerful. It solves a lot of those what do we do from a security standpoint from an agent? to manage agents for clients in a way that they would have difficulty doing before."
• "The token economy is coming. And you know, you gotta make sure as an SMB that you're working with a partner that understands which models you should use to basically—I call it token efficiency—to make sure that you have token efficiency when you're building out agents or when you're building out automations."
• "If you go to an SMB and you say, 'Hey, what are the problems in your business?' a lot of times they're like, 'I don't know.' They are just heads down trying to get stuff done on a day-to-day basis. So being able to have the conversations to help identify that or teach them a little bit about AI, I think this is incredibly powerful."

Demystifying Microsoft is handcrafted by our friends over at: https://www.fame.so/

AI agents and Copilot for Microsoft 365 are transforming how teams manage data, but the sheer volume of options often leads to organizational paralysis. Nathan Taylor and Brittney Saultman address how the agent store can be overwhelming. By beginning with specific business outcomes, the way forward becomes easier to chart.

They highlight the dramatic improvements in Cowork and the importance of personalizing Copilot to match your brand voice. The conversation covers the competitive edge of staying within the Microsoft ecosystem for security and auditability. Brittney shares how her own team automated repetitive CRM tasks and meeting follow-ups. By strengthening what only humans can do, you can delegate the rest to your digital assistant and reclaim your work week.

What You’ll Learn:

• How to identify business opportunities for AI agent implementation
• The functional advantages of the Copilot Frontier program
• Why staying in the Microsoft ecosystem ensures better data security
• Strategies for forcing behavior change during AI adoption
• The impact of Work IQ on personalized AI responses
• How to automate CRM entry and meeting management with Copilot for Sales

About the Guest:

Brittney Saultman is a Partner Profitability Director with The Partner Masters, a business consulting firm specializing in Microsoft partnerships. She helps technology companies grow their Microsoft business by unlocking incentives and funding that expand customer technology needs. Her focus is on leveraging Microsoft partnership programs, AI and automation to increase organizational profitability and efficiency.

About the Host:

Nathan Taylor is the Senior Vice President and Global Microsoft Practice Leader at Sourcepass, where he leads the Sourcepass Center of Excellence for Microsoft. His work is grounded in a simple idea: Microsoft should not be complicated. By removing complexity, confusion, and frustration from the Microsoft ecosystem, Nathan helps organizations focus on outcomes while getting the most from their Microsoft investment.

Episode Highlights:

[00:03:10] Start with Opportunities Not Agents

Brittney advises against shopping for agents like they are car parts. Instead, identify the specific business problems or profitability goals you want to solve before looking at technology.

[00:07:00] Automating Meeting Preparation with Cowork

Nathan shares how he uses Cowork to review daily meetings and correlate email context. This simple automation makes his day more efficient by providing summaries of past interactions before he joins a call.

[00:11:00] Testing the Future with Copilot Frontier

Enabling the Frontier program in your admin portal allows key users to access early features like cloud models. This gives organizations a head start on testing new capabilities before they hit the general commercial space.

[00:17:00] Doubling Portfolio Size Through Automation

Hear now Brittney's delivery resources managed to double their client portfolios in two years by implementing Copilot for Sales. By automating CRM data entry and platform access, they saved enough time per task to significantly scale their operations.

[00:20:00] Personalizing AI for Brand Consistency

Modern Copilot features allow users to tell the AI to avoid emojis or use specific factual tones. This personalization ensures that the output aligns with organizational branding and messaging across all documents.

Episode Resources:

Reach out to Sourcepass MCOE to understand how to leverage AI agents for your business: https://sourcepassmcoe.com/demystifying-microsoft-contact&nbsp?utm_source=podcast&utm_medium=show-notes&utm_campaign=demystifying-microsoft-show;

Brittney Saultman on LinkedIn

Nathan Taylor on LinkedIn

Quotes:

• "We don't have problems in our companies. We have opportunities. And so if you start with what your goals are, right? And so your goals could be to be more profitable as an organization. Okay, well, what is your current profitability and what types of things are stopping you from becoming more profitable?"
• "Gone are the days of taking notes during your meetings. Like you get to be fully present and listening to everything. Cause if you're sitting there taking notes, then you're not listening, right? You're thinking that you're taking notes of what just occurred."
• "At what point will co pilot know you better than your spouse? That's a good question, honestly. Cause we spend so much time working, you know, and it's it's monitoring our behaviors."
• "I'm glad you brought it up because it's all the integration, right? It's pulling from and looking at your behavior like we just talked about. It's pulling from documents internal. And so there's a lot of security risks to other models, right? The free models that you have to be aware of."
• "My favorite frontier feature has been the inclusion of work IQ, which is Microsoft's underlying data layer where Copilot just has a better understanding of me and what I'm doing every day. It just knows my context, my emails. The power of researcher is not only that it can go do all that maybe Googling you would have done... but it also knows all your email and your teams and your recent documents."
• "I figure out the things that only I can do and try to focus on those and things other people can do, I try to delegate those. And I think that mindset's kind of necessary for a co pilot world of, Hey, you just got another coworker. What can you delegate to them and what can't it do that only you can do?"

Demystifying Microsoft is handcrafted by our friends over at: https://www.fame.so/

Microsoft Defender for Endpoint security and EDR telemetry offer a powerful fail safe for organizations. Nathan Taylor and Nick Ross look at the technical advantages of enabling passive mode to maximize Microsoft 365 licensing. They examine how this configuration allows businesses to retain their preferred third-party EDR while gaining access to Microsoft identity signals and SmartScreen phishing protection.

The conversation highlights the value of the Microsoft XDR portal for threat hunting and how additional telemetry improves the accuracy of Security Copilot. By utilizing the built in sensor for Endpoint DLP and web content filtering, IT leaders can simplify their security stack without sacrificing performance.

What You’ll Learn:

• How to configure passive mode to prevent antivirus conflicts on Windows devices
• The specific telemetry benefits for Security Copilot and incident response
• Ways to implement Endpoint DLP to track data exfiltration to USB or personal email
• Why the Defender for Business vulnerability management tool outperforms basic checklists
• The truth about using block mode as a secondary detection engine for known threats
• Steps for testing this setup with a pilot group using Intune profiles

About the Guest:

Nick Ross is the CEO of CloudCapsule and a three-time Microsoft MVP specializing in Microsoft 365 security and automation. As the creator of the T-Minus 365 YouTube channel, he has built a following by breaking down complex Microsoft topics into practical guidance for MSPs, IT professionals, and SMBs.

Nick's career spans leadership roles at CloudCapsule, Sourcepass, Summit Technology, and Pax8, where he helped shape products and services across the Microsoft ecosystem. Known for his hands-on approach to security assessments, remediation, identity protection, and Microsoft best practices, Nick is dedicated to helping organizations secure and optimize their Microsoft environments.

Episode Highlights:

[00:02:45] The Concept of Passive Mode

Nick explains that passive mode allows Microsoft security tools to coexist with third-party software like CrowdStrike. This setup ensures you still receive the benefits of threat and vulnerability management included in your current subscription without causing system instability.

[00:05:12] Connecting Identity to the Endpoint

Nathan points out that Microsoft sees both sides of a connection, linking logins to the actual device. This visibility provides better detection for man in the middle phishing attacks that standalone EDR tools might miss.

[00:08:58] Preparing for the Era of AI

AI tools require a massive amount of data to provide accurate results for security teams. Enabling the Defender sensor ensures Security Copilot has the telemetry needed to assist with complex incident response tasks.

[00:11:00] Endpoint DLP for Data Governance

Nick describes how the Defender sensor tracks sensitive data movement, such as files being copied to USB drives or personal Gmail accounts. This functionality works natively in the operating system without requiring additional heavy agents.

[00:15:30] Automating the Configuration

Most modern Windows devices detect an active third-party antivirus and switch to passive mode automatically. However, using specific registry keys is a best practice to ensure servers and workstations remain stable during the process.

[00:27:14] Consolidating the Security Stack

Moving security signals into a single portal like Microsoft Lighthouse or the XDR dashboard reduces operational overhead. It allows teams to triage alerts from multiple clients or departments from one central location.

Episode Resources:

Standard security is a checklist. True resilience is a graph. If you want to understand how to use your security data to create a proactive defense strategy, reach out to the Sourcepass MCOE team: https://sourcepassmcoe.com/demystifying-microsoft-contact?utm_source=podcast&utm_medium=show-notes&utm_campaign=demystifying-microsoft-show

Nick Ross on LinkedIn

Nathan Taylor on LinkedIn

Quotes

• "I like to think about it in the sense of the funnel. If SentinelOne does its job and it analyzes some event or action on the endpoint and says, 'hey, I don't think this is malicious,' then Microsoft could come in at the end of that and still say, 'this is malicious' and take action and block events."
• "ASR rules are super powerful and they can actually stop a lot, but they are super disruptive in legacy environments.”
• “So with modern clients, you can audit it for about forty-five days and probably see that nothing's gonna really break, and then enforce that, which gives you a lot of protections."
• "AI is always better with more data. And so if you're running security copilot and CrowdStrike, you probably still want passive mode because the data that Security Copilot gets through Sentinel and through collecting all those back end pieces of telemetry is going to help you someday with incident response."
• "Nothing turns a high-end computer into potato like two antiviruses fighting over a computer.”

Demystifying Microsoft is handcrafted by our friends over at: https://www.fame.so/

Truly understanding government contracting requires more than just good intentions; you must have the right digital environment to really be suitable for it. Nathan Taylor and Lindsay Cowan look at the specific tiers of Microsoft’s government clouds to clarify which organizations actually need them. While GCC serves as an entry point for many civilian agencies, GCC High is the standard for contractors dealing with CUI and ITAR data. They explain that moving to these clouds is a full-scale migration, not a simple license toggle.

The conversation highlights the strategy of enclaving to manage costs and maintain productivity. By isolating sensitive data for a subset of users, organizations can avoid the restrictive feature sets and high costs of moving an entire workforce into a government-only tenant. Nathan and Lindsay also detail the eligibility process, including the importance of CAGE codes for validation. Using these identifiers fast-tracks approval and ensures that businesses can meet their contractual obligations without unnecessary delays.

What You’ll Learn:

• The structural differences between GCC and GCC High infrastructure
• How to use enclaves to limit compliance costs and user impact
• The role of CMMC and ITAR in choosing your cloud tier
• Why government cloud eligibility requires upfront validation
• The migration reality: Why you can't just flip a switch
• Procurement nuances for Azure Gov and Microsoft 365 government SKUs

About the Guest:

Lindsay Cowan is a Senior Manager of Sales and Business Development at Sourcepass MCOE, a company focused on helping organizations simplify, secure, and optimize their Microsoft environments. With over a decade in the Microsoft ecosystem, she specializes in helping organizations maximize their investment in Windows and SQL Server technologies through strategic licensing and cloud adoption.

About the Host:

Nathan Taylor is the Senior Vice President and Global Microsoft Practice Leader at Sourcepass, where he leads the Sourcepass Center of Excellence for Microsoft. His work is grounded in a simple idea: Microsoft should not be complicated. By removing complexity, confusion, and frustration from the Microsoft ecosystem, Nathan helps organizations focus on outcomes while getting the most from their Microsoft investment.

Episode Highlights:

[00:02:35] Understanding Microsoft 365 GCC

Understand the role of GCC as the initial entry point for government entities and how this tier uses logical segregation on commercial infrastructure to meet moderate impact data requirements.

[00:05:42] The Jump to GCC High and Azure Gov

Learn how GCC High serves as a physically separate environment built specifically for the defense industrial base. This tier provides the rigorous data sovereignty and personnel screening required for ITAR and CMMC level two compliance.

[00:09:32] Managing Feature Delays Through Enclaving

Moving to a government cloud often means seeing new features months after the commercial release. Nathan suggests using an enclave strategy to limit these restrictions and higher costs to only the users who handle sensitive data.

[00:19:14] Eligibility and the Power of Cage Codes

Accessing these clouds requires strict validation from Microsoft to ensure the organization is a qualifying entity. Having a CAGE code acts as an identifier that speeds up the approval process significantly.

[00:32:55] The Reality of the Migration Process

Transitioning to GCC or GCC High is a full lift and shift operation rather than a simple license change. Organizations must prepare for a complete data migration using specialized tools that meet high compliance standards.

[00:35:54] Compliance is Not Just a Security Upgrade

A common myth is that government clouds are inherently more secure than commercial ones. These environments focus on compliance guarantees regarding who can touch data and where it resides rather than just adding security features.

Episode Resources:

Reach out to Sourcepass MCOE to understand your options when it comes to government clouds: https://sourcepassmcoe.com/demystifying-microsoft-contact&nbsp?utm_source=podcast&utm_medium=show-notes&utm_campaign=demystifying-microsoft-show;

Lindsay Cowan on LinkedIn

Nathan Taylor on LinkedIn

Quotes:

• "Microsoft is vouching for the people accessing it, and the data centers are US only, but all of the configuration, the policies, the procedures, all the things that really make up a compliance program are yours.
• Microsoft's providing compliant plumbing. You're the one who's hooking up into the house and building the house."
• "It's not that it's more secure. What is different is that it is compliance guarantees about data residency, isolations, and who can touch it.
• When you start looking into the ITAR and CUI controls, it's all about who's allowed to get to this data, and can you prove that?"
• "GCC does require eligibility validations. Confirming eligibility early is the best thing that you can do.
• There's nothing worse than working with a client who is already envisioning this GCC environment and then perhaps they are not eligible."

Demystifying Microsoft is handcrafted by our friends over at: https://www.fame.so/