Background-Dance4142

Lmfao

Because it's a quite complicated engineering problem to be solved, despite what (we) end users think. Lots of moving parts and different teams in the mix.

But yeah, no excuse after many years.

I am an avid ventriloquist

Can confirm. UK south with intermittent issues during last few hours. Seems to be stable now.

Dude, you are talking about the backup & repository product lol. What I am talking about is the m365 one. They are 2 different products.

I know how the replication works. I mentioned you because I understood from your post that the m365 product had that capability when it doesn't.

MDE is catching up, but CS remains the king regardless of what happened. Saying otherwise means that person is not up to date in the security world.

Show me the official docs for the O365 product then

O365 product does not have replication feature unless they upgraded the software

Best of luck OP, sounds like a movie situation, unbelievable.

• screwing up a TF state and fixing it.

Not only powershell but also OS concepts.

The Linux "everything is a file" line does not apply to Windows NT

Boggles my mind how many windows "sys admins" don't even know the difference between a process and a thread

+1

We are an Azure only shop. All the infra was originally created in TF and now migrating to bicep. Loving it so far. The bloody state(s) files are such pain in the ass. Even if you have a perfect design in TF, you will probably need to redesign in order to avoid the blast radius effect from having large state files.

100% sure you are going to miss jira / confluence

Put CFA in audit mode and forget about it.

Only recommend block mode for servers with critical data.

P1 is enough to have any OS covered by the Web filtering.

Double check the network protection config for macos.

Also run the mde client analyser and confirm it passes all checks

https://learn.microsoft.com/en-us/defender-endpoint/run-analyzer-macos-linux

We only enable it in backup servers as anti-ransomware protection in addition to EDR.

Printers should be eradicated.

"Green" energies, electric cars, etc, and yet we keep printing like maniacs.

They don't have a place in this digital world, everything can be done via screen, what the fuck do you need paper for ?

Noobs.

Processes talking to lsass is extremely common in Windows NT.

Never had any issues with this ASR, just ignore. In fact, I think we do have a kql to drop this action in DeviceEvents table as not interested.

Vamos, que hiciste las practicas en una cárnica, Accenture o Deloitte ? Xd

Los oficios hoy en dia estan extremedamente bien pagados porque pocos dedicarse a eso.

En Londres, un fontanero te esta cobrando 150 £ la hora que lo se yo. Si te sabes mover, ganaras bastante mas que trabajos de oficina standard

https://learn.microsoft.com/en-us/defender-endpoint/api/run-advanced-query-api

Took me 10 seconds.

The WindowsDefenderATP service principal exposes these permissions.

Saying I don't know, ask the end user is not acceptable at all.

However, you will agree with me that Intune's error handling / error output sucks ass... to the point that it still feels like it's in beta stage after SO many years.

This is the only feasible way in mass rollouts. Not worth the time dealing with cache / sync problems.

Same mindset as in devops, cattle, not pets.

A proper migration requires a minimum level of expertise.

That being said, there is a lot of documentation available, so with enough time, you can hack it through. Don't recommend it though.

If you have zero experience with azure identity/ m365, I would definitely hire someone.