Security is always an important concern in any organization, but what happens when the services and features that you try to secure are always changing. What you used to know as secure and best practice may not be the best idea this year. So this session will look at all the things that you should do, and then some things that you should consider doing to improve the security of your M365/Entra ID tenant. Your task, should you choose to accept it, will be to leave the conference with a better understanding of what you need to do next, and the comfort to know that it does not need to be that difficult. The session will cover better Entra ID tokens and why they matter, and then how you manage tokens with a series of features including Conditional Access, Authentication Methods migration and External Authentication Methods, passkeys and Authentication Strengths. We will also cover Privileged Identity Management (PIM), break-glass emergency accounts, Global Secure Access, password reset, device management and more.

For more than a decade, hybrid identity has followed a familiar pattern. We create and manage identities in Active Directory, synchronise them to the cloud directory—Azure AD, now Microsoft Entra ID—and then use Entra ID as the identity platform for Microsoft’s cloud services. The trade-off is that Active Directory remains the source of authority, so attributes synchronised to the cloud are effectively read-only in Entra ID. In 2026, Microsoft began changing that model in stages. First, synchronised identities could be edited in Entra ID. Later updates added the ability to write those changes back to Active Directory. In other words, Microsoft started to turn the established hybrid identity model of the past ten-plus years on its head. That gives us a genuinely modern identity platform and two possible paths. We can use this capability as a step towards retiring Active Directory altogether, or we can move day-to-day identity management into Entra ID while continuing to synchronise the objects back to Active Directory. Either way, the direction of management no longer has to be from on-premises to the cloud. And there is another important outcome: this can help us remove the last Exchange Server. Traditionally, when hybrid identities flow from Active Directory through Entra ID to Exchange Online Directory Services, we have needed either an Exchange Server or recipient management tools that write to Active Directory. That has been the supported way to manage Exchange Online attributes. If we cut over Exchange identity administration to Exchange Online, we can finally remove that last Exchange Server as well. In this session, I’ll show you what has changed, how the new model works and what it means for your hybrid identity and Exchange strategy.

Keeping your tenant and Microsoft 365 services secure has never been more important. With AI-powered attacks evolving and Microsoft’s services changing constantly, it can be difficult to feel completely confident that your tenant is configured as securely as it should be. You may find yourself asking: Have we configured everything correctly? Is the tenant genuinely secure? And what about the features we know less about or areas where our expertise is not as strong as we would like? That is where Maester comes in. Maester is an open-source toolkit that lets you run security assessments across Entra ID, Microsoft 365 and Active Directory, while also helping you manage change. During this session, I will introduce you to Maester, show you how to get started and explain how to interpret the results. I am a dual Microsoft MVP in Microsoft 365 and Microsoft Security, and I will also demonstrate how Maester can be used for drift analysis, so you can answer a crucial question: what has changed? Maester is already used in more than 60,000 tenants. It includes over 360 built-in security tests, and you can create your own tests as well. In my view, it is a toolkit that belongs in every Microsoft 365 and Entra deployment. So, over the next hour, I will take you on a practical tour of what Maester can do and show you how to get started.