A developer runs a local coding agent that reads instructions hidden in project content. Intune can deploy Defender runtime protection in Audit so admins can review detections before blocking supported activity. Verify the pilot and its coverage before broadening enforcement.
Device code phishing uses the real microsoft.com/devicelogin page. MFA succeeds, the attacker gets the tokens. Block Authentication flows > Device code in Conditional Access, report-only first.
Defender Experts MDR Plan 2 extends managed detection beyond Microsoft products through Sentinel, covering non-Microsoft cloud, identity, email, network, and endpoint sources.
Most MSPs can tell you which Azure VMs are running. Fewer can tell you which ones stopped sending Defender telemetry last week. A new Logic App automation from Microsoft closes that gap daily — and it is a compliance-monitoring service waiting to happen.
Most MSPs can’t answer which service principals are active in a client tenant, let alone which are over-privileged. Microsoft Defender now surfaces NHI inventory and governance—and that is a recurring-service opportunity hiding in plain sight.
VS Code’s AllowedExtensions policy shipped in November 2024. GitHub — a Microsoft subsidiary — wasn’t enforcing it when a poisoned Nx Console extension walked out with 3,800 internal repos in 11 minutes. The policy framework was never missing. The enforcement was. Here’s the Intune remediation script and the Copilot/MCP guardrails that close the exact attack path TeamPCP used.
If you manage Microsoft Entra for clients, shadow tenants are now easier to spot with related-tenant discovery signals (B2B, multitenant apps, and shared billing). The practical playbook is straightforward: enable continuous discovery, triage unknown tenants, and quarantine untrusted ones until assessed. Also plan now for the August 15, 2026 retirement of the legacy workforce tenant creation flow.
