New-hire onboarding in Entra ID with a Temporary Access Pass: the user signs in once with a short-lived code, registers a passkey, and never touches a password. The setup steps, the Conditional Access policies that make it hold, and the interrupt-mode behavior that broke the flow in my lab.

Two Microsoft admin surfaces reported different answers about the same tenant on the same afternoon, and the more reassuring one described a policy that did not exist. Five governance decisions in the order they have to be made, the licensing split for E3 and Business Premium tenants, and the Restricted SharePoint Search retirement dates.

Token protection is the one Conditional Access control that goes after token replay directly, but it is also the one most likely to be misread as a complete answer to token theft. What it binds, the two scoping rules that will lock out your own users, and how to stage it in report-only before it touches anyone.

How to design break-glass accounts that work when everything else is locked out: the design principles, the governance cadence, and why mandatory MFA enforcement now applies to these accounts with no exception.

A practical Conditional Access baseline for 2026: eleven policies, the design logic behind each one, and the three platform changes that make this year’s baseline different from last year’s.

As of mid-2026, classic Windows Autopilot is still the production default for most enterprise environments. Device preparation is the newer, re-architected path, but newer does not mean use it everywhere yet. Four questions that tell you which one fits your environment.

If you're running the same Intune checks every month, clicking through the portal is the long way around. Here are 7 PowerShell scripts that handle the repeating work.It All Begins Here