From Shadow AI to Runtime Protection: Governing Claude Code and Codex with Microsoft Defender

A field implementation for discovering local AI coding agents, scoping the affected Windows devices, and deploying Microsoft Defender AI agent runtime protection through an audit-first rollout.

October 5, 2026 · 9 min · Robel Mehari

Stop Treating Remembered MFA Devices as a Security Strategy

Why remembered MFA devices should be reviewed carefully and how Conditional Access session controls give admins a cleaner security model.

June 20, 2026 · 4 min · Robel Mehari

OneDrive Moving to onedrive.cloud.microsoft: What Admins Should Check First

OneDrive web URLs are moving to onedrive.cloud.microsoft. Existing links keep working, but admin-owned URL controls need a quick review.

June 17, 2026 · 5 min · Robel Mehari

Microsoft Entra Registration Campaigns Now Support Passkeys

Microsoft Entra registration campaigns can now nudge users to register passkeys during sign-in.

June 15, 2026 · 3 min · Robel Mehari

Defender version compliance with Intune proactive remediations

A field note on using Intune proactive remediations to detect Microsoft Defender version drift, trigger updates, and keep evidence.

June 14, 2026 · 3 min · Robel Mehari