What If Other People Could Use It?
Adding Clerk made sign-in easy. The real challenge was authorisation, tenant boundaries and keeping every SaaS customer's data securely separated.
Blog
Browse all posts, filter by category or tag, and choose your preferred reading layout.
Migrating from a Traditional Secure Web Gateway to Global Secure Access
Migrating from a traditional Secure Web Gateway to Microsoft Global Secure Access is more than replacing one endpoint client with another. This article explores policy rationali...
EWS Retirement: The Exchange Deadline You Cannot Keep Ignoring
EWS retirement is about far more than rewriting an application. The 1 October 2026 Exchange Online disablement phase is almost here, and April 2027 will arrive quickly. Have you...
Entra Internet Access: Moving Web Security to the Identity Layer
Explore how Microsoft Entra Internet Access moves traditional Secure Web Gateway controls towards an identity-aware security model, combining web filtering, user and group polic...
WebAuthn Redirection Comes to the Windows App on macOS
Microsoft has introduced in-session WebAuthn redirection in preview for the Windows App on macOS, addressing a major passkey and FIDO2 limitation for Windows 365 and Azure Virtu...
Global Secure Access on Mobile Devices
Explore how Microsoft Global Secure Access extends identity-aware access to managed iOS, iPadOS and Android devices using Entra Internet Access and Entra Private Access.
Microsoft Global Secure Access on macOS: Extending Identity-Driven Access Beyond Windows
Explore how Microsoft Global Secure Access brings identity-driven Private Access, Internet Access and Microsoft traffic controls to managed macOS devices.
I Just Need the App to Send an Email
What happens when “I just need the app to send an email” turns into a conversation about API keys, credentials, secrets and security? Part 2 of Building Again explores how a sim...
From Kempsoft to Vibe Coding
Nearly 30 years after creating Kempsoft, AI has brought me back to building software. This is how vibe coding became my new development companion.
Replacing Traditional VPN Access with Microsoft Entra Private Access
Learn how Microsoft Entra Private Access replaces broad VPN connectivity with identity-driven, application-aware access to private resources.
Bringing Authentication Assurance Together
Bring Authentication Assurance together into a complete architecture, connecting Trust Levels, passkeys, FIDO2, Authentication Strengths, Conditional Access, TAP, privileged acc...
Cyber Security Microsoft Microsoft 365 Security Passwordless Privileged Access Privileged Identity Security Strategy Zero Trust
#Conditional Access
#Consulting
#Cloud Security Strategy
#Continuous Improvement
#Cyber Security
#FIDO2
#entra-id
#Entra ID
#Endpoint Security
#Identity and Access Management
#Phishing-Resistant Authentication
#Passwordless
#Passkeys
#Privileged Access
#Privileged Identity
#Zero Trust
#Security
Building High-Assurance Administrative Accounts
Learn how to build high-assurance administrative identities by combining dedicated accounts, FIDO2 security keys, Authentication Strengths, Conditional Access, PAWs, PIM and sec...
Cyber Security Microsoft Microsoft 365 Security Passwordless Privileged Access Privileged Identity Security Strategy Zero Trust
#Conditional Access
#Consulting
#Cloud Security Strategy
#Continuous Improvement
#Cyber Security
#FIDO2
#entra-id
#Entra ID
#Endpoint Security
#Identity and Access Management
#Phishing-Resistant Authentication
#Passwordless
#Passkeys
#Privileged Access
#Privileged Identity
#Zero Trust
#Security
Giving SaaS Applications a Fixed Egress IP with Microsoft Entra Private Access"
Use Microsoft Entra Private Access source IP anchoring to give IP-restricted SaaS applications a controlled and predictable public egress address.
Compliance & Governance Global Secure Access Microsoft Microsoft 365 Security Security Strategy Zero Trust Cyber Security Entra Identity
#Cloud Security Strategy
#Conditional Access
#Cyber Security
#Devices
#dns
#Entra ID
#GSA
#identity
#Microsoft 365
#Windows11
#Zero Trust
#ZTNA
#Security Architecture
#Security
#Windows Hello for Business
Temporary Access Pass and Secure Onboarding
Explore how Temporary Access Pass can securely bootstrap and recover passwordless authentication, and why single-use, multi-use, duration and identity verification all matter wh...
Cyber Security Microsoft Microsoft 365 Security Passwordless Privileged Access Privileged Identity Security Strategy Zero Trust
#Conditional Access
#Consulting
#Cloud Security Strategy
#Continuous Improvement
#Cyber Security
#FIDO2
#entra-id
#Entra ID
#Endpoint Security
#Identity and Access Management
#Phishing-Resistant Authentication
#Passwordless
#Passkeys
#Privileged Access
#Privileged Identity
#Zero Trust
#Security
Authentication Strengths in Microsoft Entra
Learn how Microsoft Entra Authentication Strengths and Conditional Access can turn Authentication Assurance from an architectural principle into an enforceable security control.
Cyber Security Microsoft Microsoft 365 Security Passwordless Privileged Access Privileged Identity Security Strategy Zero Trust
#Conditional Access
#Consulting
#Cloud Security Strategy
#Continuous Improvement
#Cyber Security
#FIDO2
#entra-id
#Entra ID
#Endpoint Security
#Identity and Access Management
#Phishing-Resistant Authentication
#Passwordless
#Passkeys
#Privileged Access
#Privileged Identity
#Zero Trust
#Security
Choosing the Right Authentication for Each Trust Level
Learn how to align authentication methods with identity Trust Levels, from dedicated FIDO2 security keys for critical administrators to device-bound and synced passkeys where ap...
Cyber Security Microsoft Microsoft 365 Security Passwordless Privileged Access Privileged Identity Security Strategy Zero Trust
#Conditional Access
#Consulting
#Cloud Security Strategy
#Continuous Improvement
#Cyber Security
#FIDO2
#entra-id
#Entra ID
#Endpoint Security
#Identity and Access Management
#Phishing-Resistant Authentication
#Passwordless
#Passkeys
#Privileged Access
#Privileged Identity
#Zero Trust
#Security
Not All Passkeys Provide the Same Level of Assurance
Discover why phishing-resistant authentication doesn't automatically provide the same level of operational assurance, and how different passkey implementations influence privile...
Cyber Security Microsoft Microsoft 365 Security Passwordless Privileged Access Privileged Identity Security Strategy Zero Trust
#Conditional Access
#Consulting
#Cloud Security Strategy
#Continuous Improvement
#Cyber Security
#FIDO2
#entra-id
#Entra ID
#Endpoint Security
#Identity and Access Management
#Phishing-Resistant Authentication
#Passwordless
#Passkeys
#Privileged Access
#Privileged Identity
#Zero Trust
#Security
Understanding Modern Passkeys
Learn what passkeys are, how they work and the differences between platform, roaming, synced and device-bound passkeys in modern authentication.
Cyber Security Microsoft Microsoft 365 Security Passwordless Privileged Access Privileged Identity Security Strategy Zero Trust
#Conditional Access
#Consulting
#Cloud Security Strategy
#Continuous Improvement
#Cyber Security
#FIDO2
#entra-id
#Entra ID
#Endpoint Security
#Identity and Access Management
#Phishing-Resistant Authentication
#Passwordless
#Passkeys
#Privileged Access
#Privileged Identity
#Zero Trust
#Security
The Evolution of Authentication
Discover how authentication has evolved from passwords to phishing-resistant passkeys, and why understanding that journey is key to designing modern identity security.
Cyber Security Microsoft Microsoft 365 Security Passwordless Privileged Access Privileged Identity Security Strategy Zero Trust
#Conditional Access
#Consulting
#Cloud Security Strategy
#Continuous Improvement
#Cyber Security
#FIDO2
#entra-id
#Entra ID
#Endpoint Security
#Identity and Access Management
#Phishing-Resistant Authentication
#Passwordless
#Passkeys
#Privileged Access
#Privileged Identity
#Zero Trust
#Security
Why Authentication Assurance Matters
Why modern identity security is about more than enabling MFA. Learn why authentication assurance should increase alongside the value and impact of the identities you're protecting.
Cyber Security Microsoft Microsoft 365 Security Passwordless Privileged Access Privileged Identity Security Strategy Zero Trust
#Conditional Access
#Consulting
#Cloud Security Strategy
#Continuous Improvement
#Cyber Security
#FIDO2
#entra-id
#Entra ID
#Endpoint Security
#Identity and Access Management
#Phishing-Resistant Authentication
#Passwordless
#Passkeys
#Privileged Access
#Privileged Identity
#Zero Trust
#Security
Authentication Assurance – Introduction
An introduction to Authentication Assurance and why modern identity security is about more than simply enabling MFA or going passwordless.
Cyber Security Microsoft Microsoft 365 Security Zero Trust Passwordless Privileged Access Privileged Identity Security Strategy
#Continuous Improvement
#Entra ID
#Microsoft
#Microsoft 365
#Microsoft Entra
#Zero Trust
#Conditional Access
#Consulting
#Cloud Security Strategy
#Cyber Security
#FIDO2
#entra-id
#Endpoint Security
#Identity and Access Management
#Phishing-Resistant Authentication
#Passwordless
#Passkeys
#Privileged Access
#Privileged Identity
#Security
Building a Modern Privileged Access Strategy
Learn how to build a modern privileged access strategy by combining Trust Levels, Privileged Access Workstations, phishing-resistant authentication, Conditional Access, PIM and...
Operating and Maintaining a Privileged Access Workstation
Learn how to operate and maintain a Privileged Access Workstation by managing configuration drift, patching, compliance, monitoring and governance to preserve administrative ass...
Hardening a Modern Privileged Access Workstation
Learn how to harden a modern Privileged Access Workstation using Microsoft Intune, Microsoft Defender, Conditional Access, PIM and Windows security features to build a trusted a...
Choosing the Right Administrative Environment
Learn how to choose the right administrative environment by balancing risk, operational requirements and assurance when deploying Privileged Access Workstations.
Virtual Privileged Access Workstations
Explore how Virtual Privileged Access Workstations (vPAWs) provide a secure and practical alternative to physical PAWs by balancing administrative assurance with operational fle...
Physical Privileged Access Workstations
Discover why dedicated physical Privileged Access Workstations remain the highest assurance option for protecting privileged identities and securing administrative environments.
When Do You Need a Privileged Access Workstation?
Discover when a Privileged Access Workstation is justified, how to assess administrative risk, and why workstation assurance should reflect the level of trust placed in an ident...
What is a Privileged Access Workstation
Discover what a Privileged Access Workstation (PAW) is, why it matters, and how it strengthens privileged identity security by protecting the administrative trust boundary.
Privileged Access Workstations: Introduction
An introduction to Privileged Access Workstations (PAWs), why they matter, and how they fit into a modern privileged identity strategy using Microsoft Entra.
Why Stepping Away From Your Desk Might Be the Most Productive Thing You Do
In a world of constant notifications, AI-assisted development and back-to-back meetings, sometimes the best thing you can do is close the laptop and step away.
From Tier 0 to Trust Levels: Rethinking Privileged Access for the Cloud Era
Traditional administrative tiering was built for an infrastructure-centric world. As organisations move to cloud-native identities, Zero Trust and passwordless authentication, t...
From a Blog Series to a Book – The Unexpected Journey of The Privileged Path
What started as a handful of blog posts became one of the biggest professional challenges I've ever undertaken. This is the story behind The Privileged Path—why I wrote it, what...
Passkeys: The Hardest Part Nobody Talks About
Passkeys are transforming authentication, but the technology is not the hardest part. Learn why onboarding, bootstrapping, Temporary Access Passes (TAPs), Conditional Access and...
Behind the Build: The Story Behind My New Website
Discover the architecture behind my new website, from Cloudflare Pages and GitHub to a custom Markdown CMS, a refreshed brand, and the story of Atlas.
Microsoft Global Secure Access: More Than Just a VPN Replacement?
Learn what Microsoft Global Secure Access is, how Private Access and Internet Access work, licensing requirements, and where GSA fits within a Zero Trust architecture
Windows Hello for Business Is More Than a Login Method
Most organisations think their phishing-resistant authentication journey starts with passkeys. In reality, many have already deployed one of the most important phishing-resistan...
Windows 365 for Secure Work: The Device Experience Nobody Talks About
Introduction Windows 365 promises a simple idea: a consistent, secure Windows experience delivered from the cloud, accessible from almost anywhere. In practice, the quality of t...
Microsoft 365 Tenant Audit – Sample Enterprise Report
Most Microsoft 365 tenants don’t lack tools, they lack visibility. This sample enterprise audit report shows how to uncover risk, simplify access, and gain a clear, structured v...
Welcome to Andy Kemp Consulting
Why I Started Andy Kemp Consulting After many years working across Microsoft 365, security, identity, and large‑scale change programmes, I reached a clear conclusion. The work I...
Introducing TechPress All-In-One
Introduction For years I have been frustrated by how most WordPress themes claim to be lightweight or developer friendly but still require a small universe of plugins just to de...
Data – The Fourth Pillar of Zero Trust
Introduction In this Zero Trust blog series, we’ve already explored how Identity, Devices, and Applications form the foundation of a modern security strategy. Each pillar plays...
Compliance & Governance Cyber Security Data Protection Entra Information Protection Microsoft Microsoft 365 Security Security Strategy Zero Trust
#Compliance
#Continuous Improvement
#DLP (Data Loss Prevention)
#Data Security
#Encryption
#Insider Risk
#Microsoft
#Microsoft Purview
#Sensitivity Labels
#Shadow IT
#Zero Trust
Applications – The Third Pillar of Zero Trust
Introduction In the first two posts of this Zero Trust series, we established that identity is the new perimeter and devices are the frontline of defence. By verifying every use...
Devices – The Second Pillar of Zero Trust
Introduction In the first post of this series, we explored how identity has become the new perimeter in a world where users, apps, and data are no longer confined to…
Identity: The New Perimeter in Zero Trust
Welcome to the first deep dive in my Zero Trust blog series. If you’ve read the series introduction, you’ll know that Zero Trust isn’t a single product or a quick…
Zero Trust Blog Series: A Microsoft-Centric Approach
Introduction Over the past few years, I’ve seen a growing interest in Zero Trust but also a lot of confusion. Many still view it as a product you can buy…
Self-Hosted WordPress Made Simple
Introduction In a previous post, I walked through the step-by-step process of setting up a LAMP stack and deploying WordPress on Ubuntu. While that approach is great for learnin...
Automate Your Elgato Key Light Air with Microsoft Teams Presence
Introduction If you’re anything like me, you’ve probably joined a video call only to realise your lighting isn’t quite right. I use an Elgato Key Light Air, and I wa...
Secure Dynamic DNS Updates to Azure with AzureDNSSync
Introduction Like many home users, my broadband connection comes with a dynamically assigned public IP address. This means that my IP can change at any time sometimes witho...
OpenVPN Site-to-Site setup
Introduction Setting up a Site-to-Site VPN is a powerful way to securely link two remote networks—such as a home lab and a cloud environment—so they behave as if they’...
Deploying Azure Virtual Desktop – A Modular, Automated Approach
Introduction Azure Virtual Desktop (AVD) is Microsoft’s comprehensive Desktop-as-a-Service platform, enabling secure remote access to Windows desktops and apps from virtual...
Automation Azure Azure Virtual Desktop Entra Infrastructure as Code Intune Microsoft Microsoft Graph PowerShell Scripting Virtual
#AVD
#Azure
#Conditional Access
#Entra ID
#Microsoft
#Microsoft Graph
#PowerShell
#Virtual
#automation
#azure-ad
#bicep
#dns
#enterprise
#fslogix
#hybrid-join
#identity
#infrastructure-as-code
#rbac
#remote-desktop
#storage
Windows Image Prep Tool for Microsoft Surface Laptop 7th Edition
Introduction A while back I wrote a post about my experience with getting my Microsoft Surface Laptop 7th Edition working with a clean install of Windows 11, you can see…
Using Cloud PKI with Always On VPN
Using Microsoft Cloud PKI With Always On VPN Introduction I have been playing around with Always On VPN recently. Using it with Domain, Hybrid and Entra Joined devices. As you&#...
Always On VPN Entra Join – Part 5 Deploy Always On VPN for Entra Joined Devices
This is part 5 of my Always On VPN series You can review the pervious posts if required: Introduction So we now have everything in place for Always On VPN….
Always On VPN Entra Join – Part 4 Configure Always On VPN for Entra Joined Devices
This is part 4 of my Always On VPN series You can review the pervious posts if required: Introduction The infrastructure you have in its current state is great if…
Always On VPN Entra Join – Part 3 Core Always On VPN Infrastructure
This is part 3 of my Always On VPN series You can review the pervious posts if required: Introduction Now we have the certificates available the next step is to…
Always On VPN Entra Join – Part 2 Certificate Templates
This is part 2 of my Always On VPN series You can review the pervious posts if required: Introduction Certificates are at the heart of Always On VPN as this…
Always On VPN Entra Join – Part 1 Whats needed
This is part 1 of my Always On VPN series You can review the pervious posts if required: Introduction Always on VPN is a technology thats been around for some…
Microsoft Surface Laptop 7th Edition
Introduction I recently with picked up a Microsoft Surface Laptop with Copilot. I wanted to go throguh my frustrations with it to get a clean install of Windows 11 on…
Mac OS connecting to Windows 365 and AVD
Introduction You may have seen from some of my posts on here and also on my YouTube channel I have been doing a lot about Windows 365 and AVD. You…
Virtual PAW – Part 4 – Completing the basic setup
So this is part 4 of my multi part series on my journey with Bicep and ARM Templates and deploying AVD as a PAW.. Introduction In this part I’ll go…
Virtual PAW – Part 3 – Deploying the session hosts
So this is the 3rd part of a multi part series on my journey with Bicep and ARM Templates and deploying AVD as a PAW.. Introduction Welcome to the 3rd…
Virtual PAW – Part 2 – Core Components
So this is the 2nd part of a multi part series on my journey with Bicep and ARM Templates and deploying AVD as a PAW. Part One was the high…
Virtual PAW – Part 1 – A high level overview
I have decided to create this as a multi part post to hopefully make it easier to understand. Introduction So Following on from my last post I thought I’d share…
Why use a PAW?
Introduction Following on from my previous post I have been asked why I use a PAW for my own tenant, and or why not just use a conditional access policy…
Securing my privileged access with AVD
I’m trying to “lead by example” (I use that term loosely), when it comes to privileged access. A bit of background For a long time my regular Microsoft 365 acc...
Privileged Identity Management and Access Tiers
Introduction I’ve been working with a customer recently assisting with sorting out their privileged access and assisting them with their adoption of PIM (Privileged Identi...
Cost effective IPSec Site to Site VPN with Azure and UDM
Introduction There are many ways to establish a VPN between my UDM and Azure andI’ve tried them all, but, for the best result I would still recommend using an Azure…
Creating a local SMTP relay using Postfix and SendGrid
I had a question recently asking about what would be the best solution as a local SMTP relay after ditching the local Exchange Management Server after going purely cloud identit...
Recovering your self hosted WordPress sites on Ubuntu
So, you are backing up your Ubuntu Server but what happens when you have a failure? or you delete something from the server? How do you go about recovering it?…
Creating Multiple Security Groups in Microsoft Entra
I was recently asked if there was a quick way to create 180 plus Security Groups in Microsoft Entra. I used to do a lot of PowerShell Scripting but not…
Backing up your Ubuntu web server and database
Once you have your server up and running you’ll probably want to sort out backing it up on a regular basis. If you’re running your server in Azure, sure you…
Recommended updates to your self hosted WordPress
So, now your site is up and running you’ll want to get a few things installed on it as a base. for me I like to enable things like Multifactor…
Self hosting WordPress on Ubuntu 22.04.4
I’ve used various hosting services over the years including hosted Wordpress, which has been good, but it can sometimes work out costly and also you do not have full acces...
Get notified about new posts
Drop your email in and I'll let you know when there's something new.