Workplace Ninja Summit 2024

In this session we will cover how organizations are using Defender for Office 365 to detect and respond to new and emerging collaboration threats including phishing and BEC. We will walk through how SOC teams can be more effective and efficient using the power of XDR as well as build user resilience to new and emerging threats.

We've spent the last few years modernizing clients, kicking them out of Active Directory and optimizing them to run outside the corporate network. The use of modern protocols, conditional access and the integration of MDE and Intune now enables us to access cloud services with access management that largely complies with the principles of zero trust.

However, when it comes to accessing legacy apps in the old data center world, we unfortunately all too often fall back on the old solutions - perhaps enhanced with some SAML and certificates - and features such as microsegmentation and session revocation are sought in vain.

In this session I would like to discuss and show why Microsoft's SSE solution is so much closer to my understanding of Zero Trust Network Access by explicitly checking every session in the network during its establishment, limiting access to the least necessary and disconnecting in case of a breach.

As a security architect who used to deal intensively with networks and in recent years with identity, I am very much looking forward to a deep dive on the topic of Single SignOn when accessing the OnPrem environment with Private Access.

In addition to the way the technology works, you will learn what needs to be considered during POC and rollout and what differences there are to a classic VPN project.

Join us for a session with two experts in transitioning to cloud-native device management. Learn about their journey from managing on-premises devices to using Intune for cloud-based management. Is the transition smooth? Can it save costs? Understand why this shift is important and get valuable insights.

Discover the challenges they faced and learn best practices, tips, and tricks for a successful transition. Don't miss this chance to upgrade your device management strategy.

Think you know Passwordless Authentication? Well, think again. In this deep dive session, Join Microsoft MVP, Andy Malone as he takes you on a journey inside the next generation of Passwordless authentication using FIDO technologies. Now that FIDO keys have become virtual and can be deployed via any mobile device or desktop. Design to thwart hackers and ensure your digital world remains secure. With discussions, demos, tips and advice. Andy will walk you through all aspects of exactly what Passkey’s are, how they work and of course how to manage them.

Engage in a comprehensive discussion on how we found out how Microsoft is hardening the MDM enrollment (Windows Enrollment Attestation) and which steps they took to do so.

We will take you on a Deep Dive (Level 1000 session) into the first steps of the Windows Enrollment Attestation process and explain how Microsoft created something magical! We will show you how it works from the inside and outside and why this is one of the biggest security improvements in Intune.

If you want to hear the details and what magic Microsoft implemented, make sure you are going to sign up for this session!

Have you always wanted to understand the inner workings of Defender for Endpoint, to improve your troubleshooting skills or to help customers get successfully set up in their unique environment?
 
Join this session to gain a deeper understanding of Defender for Endpoint, how it works, what to keep an eye on and how to ensure smooth operation in a variety of environments. We will walk through architecture, deployment, portal setup and (security) operations as well as troubleshooting - giving you the tools you need to defend endpoints like a pro!

In addition, you will get a glimpse of where the product is heading in the future.

Terraform is widely recognized as the dominant language for professional cloud configuration. It has become an essential tool for Azure, AWS, and Kubernetes projects, offering numerous advantages such as a readable declaration language, reliable state tracking for changes, robust auditing of all modifications through git, and automatic documentation of infrastructure.

Until now, Terraform has primarily focused on configuring cloud infrastructures and provided limited support for Entra ID. However, we are introducing a groundbreaking development: the Terraform Provider for Microsoft 365. This session provides an overview of this provider, which in it's first incarnation enables the configuration of almost all aspects of Intune. With support for Autopilot, Conditional Access, Configuration Profiles with Settings Catalog, Compliance Policies, and more, it opens up entirely new possibilities for Enterprise or MSP Tenant Management through Terraform.

In the ControlUp session you will learn how you can gain the best in class end to end visibility for your Microsoft EUC environment from Azure, AVD to the physical client. One single pane of glass dashboard that allows you to manage, analyze and secure the digital employee experience of your users on any desktop, with any application and anywhere.

Modern security teams use various tools like SIEM, XDR, SOAR, UEBA, exposure management, and threat intelligence. However, these tools generate a large number of alerts and security signals, making it difficult for security professionals to manage them efficiently. In this session, Ramya Chitrakar will discuss how a unified security operations platform can break down these silos with a seamless experience, allowing security admins and analysts to work more effectively to level up your company’s defenses and ultimately bring down your MTTR in the case of an attack.

Automatic attack disruption, offered by Microsoft’s Unified Security and Operations Platform, provides out-of-the-box protection to its customers.

In this session, we will update you on the current status, recent advancements, and future plans in the area of threat intelligence and data-science based disruption.

The talk will also include a technical deep-dive into a real-life incident.
We will conclude by showing what you need to do to maximize the benefit of this powerful capability.

This demo-based session explores the potent collaboration between OpenAI and Copilot for Security.

Discover how the fusion of artificial intelligence is revolutionizing threat detection, response strategies, and proactive risk mitigation.

The session contains following topics:
- How AI used by attackers
- How Copilot for Security works
- Setting up security using with AI
- Detect threats with the AI-assistant
- Give a quick and informative AI-driven response
- A few words about licensing

Microsoft first introduced Kerberos as an authentication protocol in Windows 2000 Active Directory. Since then, many extensions to the protocol have been introduced to allow for constrained delegation, protocol translation and more. You may be surprised that Kerberos is still actively used in Microsoft Entra and solves several challenges, including SSO for hybrid users, hybrid user sign-ins using FIDO keys, Kerberos sign-in to Windows auth websites, and user authentication to cloud-hosted SMB file share.

Come to this session, and John Craddock will show you how Kerberos works and how Microsoft has implemented Kerberos in the cloud. This is packed with demos and insights that will allow you to troubleshoot your environments. Don't miss this session!

In today's rapidly evolving digital landscape, staying ahead with the latest updates is a must-have for maintaining a secure and efficient virtual desktop environment. Join Sander Rozemuller, Microsoft Security and Windows and Devices MVP in this session as he reveals a new feature revolutionizing Azure Virtual Desktop (AVD) management: host pool updates.

Sander will guide through this new feature that helps simplify updating your AVD environment. Discover how host pool updates work in detail and how to setup the configuration of host pool updates. Of course in this session, Sander with his automation first philosophy will show how to seamlessly integrate it into your existing automation strategies.
At last, Sander will top it all of where he also explain how to monitor for - and initiate updates.

Don't miss your chance to unlock the future of AVD management in this session.

This session will introduce attendees to the new Microsoft Cloud PKI solution. Microsoft Cloud PKI is a cloud-based certificate services solution that significantly simplifies the deployment and management of client authentication certificates commonly used for Wi-Fi and VPN access. Cloud PKI eliminates the need for administrators to deploy complex on-premises infrastructure to support certificate authentication.

Collecting logs from Windows endpoints is a critical part of maintaining healthy and secure IT systems. However, there are many ways to collect logs, and choosing the right method can be a daunting task for your Cloud Native devices.

We'll explore various paths to seamlessly integrate your data into log analytics, from legacy HTTP Data Collector API to Azure Monitor Agent and new Log Ingestion API. We'll guide you through diverse options, explain when to use different methods, and discuss managing access to log data and retention policies.

We will show how to Migrate from Data Collector API and custom fields-enabled tables to DCR-based custom log collection

We will also discuss best practices for log collection and manage log retention policies.

This session will provide a comprehensive introduction to tabletop cybersecurity exercises, focusing on their importance, design, and execution. Participants will gain insights into the benefits of conducting tabletop exercises, including improved incident response readiness, enhanced communication and coordination among stakeholders, and identification of gaps in policies and procedures. Practical guidance will be provided on structuring exercises to align with organizational objectives, selecting relevant scenarios, and engaging participants effectively.

Join us for an interactive "Ask Me Anything" (AMA) session with leading cybersecurity experts. This unique opportunity allows attendees to engage directly with industry veterans and pioneers in cybersecurity. Whether you have questions about the latest cyber threats, strategies for building resilient security architectures, insights into threat intelligence, or any other security-related topics, our panel is here to provide valuable answers and insights. Bring your toughest questions and join a dynamic discussion designed to enhance your understanding and knowledge in the ever-evolving field of cybersecurity.