https://blog.andykemp.com/ Practical posts on Microsoft 365 security, identity, Zero Trust and modern workplace. en-gb Fri, 06 Nov 2026 17:00:00 GMT https://blog.andykemp.com/scan-to-save-a-digital-business-card-people-save-in-one-tap/ https://blog.andykemp.com/scan-to-save-a-digital-business-card-people-save-in-one-tap/ Fri, 06 Nov 2026 17:00:00 GMT Scan to Save is a free digital business card from Andy Kemp Consulting: people scan your QR code and save you to their contacts in one tap, with your photo, company logo, badges and links. Consulting Web Development Community https://blog.andykemp.com/two-exchange-servers-one-ip-address/ https://blog.andykemp.com/two-exchange-servers-one-ip-address/ Thu, 05 Nov 2026 16:40:00 GMT I have a production Exchange server and a lab one, and a single public IP address. Both want port 443. HAPMan is the free tool I built to route them by name, with HAProxy doing the work and a web page I'm happy to use. Microsoft Exchange Networking https://blog.andykemp.com/win11-image-prep-from-powershell-script-to-windows-app/ https://blog.andykemp.com/win11-image-prep-from-powershell-script-to-windows-app/ Thu, 05 Nov 2026 09:00:00 GMT Win11 Image Prep builds Windows 11 install media with your drivers already in it: a free Windows app that grew out of a PowerShell script for the Surface Laptop 7th Edition. Windows 11 Intune Microsoft Devices Automation Scripting https://blog.andykemp.com/exchange-certificates-urls-and-domains-without-the-homework/ https://blog.andykemp.com/exchange-certificates-urls-and-domains-without-the-homework/ Wed, 04 Nov 2026 22:30:00 GMT Setting up Exchange Server means virtual directory URLs, a certificate and accepted domains, done in the right order. I do it rarely enough to look it up every time, so I built a free Windows app to do it for me. Exchange Windows Server Microsoft https://blog.andykemp.com/tls-inspection-and-custom-block-pages/ https://blog.andykemp.com/tls-inspection-and-custom-block-pages/ Thu, 29 Oct 2026 12:09:00 GMT Turn Global Secure Access’s “connection reset” into a custom block page. Deploy a TLS inspection certificate with Intune, scope it to a pilot and block QUIC. https://blog.andykemp.com/source-ip-anchoring-with-private-network-connectors/ https://blog.andykemp.com/source-ip-anchoring-with-private-network-connectors/ Mon, 19 Oct 2026 09:00:00 GMT Install a Microsoft Entra Private Network Connector, configure selected SaaS traffic through Private Access, and verify the public IP seen by the application. https://blog.andykemp.com/understanding-traffic-forwarding-and-advanced-diagnostics/ https://blog.andykemp.com/understanding-traffic-forwarding-and-advanced-diagnostics/ Thu, 15 Oct 2026 08:00:00 GMT Understand Global Secure Access forwarding profiles, investigate Tunnel and Bypass decisions, and test SharePoint and internet traffic with Windows Advanced Diagnostics. https://blog.andykemp.com/i-just-needed-my-battery-to-last/ https://blog.andykemp.com/i-just-needed-my-battery-to-last/ Wed, 14 Oct 2026 15:50:00 GMT In this instalment of Building Again, I share how coding drains the batteries on my Mac and Surface devices, and how Windows 365 helps me continue across devices without worrying about closing the lid. AI Automation Copilot GitHub Personal Development Windows 365 https://blog.andykemp.com/deploying-the-global-secure-access-client-with-intune/ https://blog.andykemp.com/deploying-the-global-secure-access-client-with-intune/ Tue, 13 Oct 2026 13:33:00 GMT Learn how to deploy the Microsoft Global Secure Access Windows client using Intune, configure a controlled pilot and verify traffic forwarding. https://blog.andykemp.com/operating-windows-laps-deployment-isn-t-the-finish-line/ https://blog.andykemp.com/operating-windows-laps-deployment-isn-t-the-finish-line/ Thu, 08 Oct 2026 09:00:00 GMT Operate Windows LAPS: privileged retrieval, auditing, post-authentication rotation, event-log monitoring and governance of other local administrator accounts. https://blog.andykemp.com/windows-laps-on-windows-server-same-technology-different-design/ https://blog.andykemp.com/windows-laps-on-windows-server-same-technology-different-design/ Tue, 06 Oct 2026 08:00:00 GMT Windows LAPS works across Windows clients and servers, but the architecture shouldn't simply be copied from Windows 11. A practical look at member servers, Active Directory, password encryption, delegation, Server 2025 and DSRM. https://blog.andykemp.com/finding-my-place-reflections-after-scottish-summit/ https://blog.andykemp.com/finding-my-place-reflections-after-scottish-summit/ Mon, 05 Oct 2026 11:53:00 GMT An honest reflection on Scottish Summit: the joy of speaking, the discomfort of feeling on the outside, and how small gestures can help people feel welcome. Community Personal Personal Development https://blog.andykemp.com/i-m-a-microsoft-mvp-that-still-feels-strange-to-say/ https://blog.andykemp.com/i-m-a-microsoft-mvp-that-still-feels-strange-to-say/ Sun, 04 Oct 2026 14:52:00 GMT On 1 October 2026, I found out I’d been awarded Microsoft MVP. The timing was special, but it also made me reflect on community, sharing what I know and what the award actually means to me. Community Personal Personal Development https://blog.andykemp.com/windows-laps-intune-or-group-policy-for-windows-11/ https://blog.andykemp.com/windows-laps-intune-or-group-policy-for-windows-11/ Sun, 04 Oct 2026 13:01:00 GMT Windows LAPS can be configured through Intune or Group Policy, but what happens when both are present? A practical look at policy precedence, hybrid environments and choosing a single management owner. https://blog.andykemp.com/windows-laps-on-windows-11-designing-local-admin-properly/ https://blog.andykemp.com/windows-laps-on-windows-11-designing-local-admin-properly/ Wed, 30 Sep 2026 09:29:00 GMT Windows LAPS can now create and manage its own local administrator account on Windows 11. But which account should you manage, and what about every other local admin? https://blog.andykemp.com/our-conditional-access-policy-says-require-mfa-what-does-that-actually-mean/ https://blog.andykemp.com/our-conditional-access-policy-says-require-mfa-what-does-that-actually-mean/ Mon, 28 Sep 2026 09:00:00 GMT What does “Require MFA” in Conditional Access actually guarantee? A practical look at MFA, Authentication Strength, phishing-resistant authentication, passkeys, synced passkeys and attestation. Cyber Security Identity Microsoft Microsoft 365 Security Zero Trust https://blog.andykemp.com/windows-laps-more-than-password-rotation/ https://blog.andykemp.com/windows-laps-more-than-password-rotation/ Thu, 24 Sep 2026 09:00:00 GMT Windows LAPS is about more than rotating a local administrator password. In this introduction, I look at how Windows LAPS has evolved, the difference between the account, management plane and credential store, and why managing a LAPS credential isn't the same as managing local administrative privilege. https://blog.andykemp.com/what-i-learned-deploying-global-secure-access-for-real/ https://blog.andykemp.com/what-i-learned-deploying-global-secure-access-for-real/ Tue, 22 Sep 2026 15:24:00 GMT After ten posts exploring Microsoft Global Secure Access, it is time to step back from the configuration guides and architecture diagrams. These are the lessons I learned from deploying it for real. https://blog.andykemp.com/global-secure-access-and-privileged-access-an-architecture-i-want-to-test/ https://blog.andykemp.com/global-secure-access-and-privileged-access-an-architecture-i-want-to-test/ Tue, 22 Sep 2026 09:00:00 GMT What could Microsoft Global Secure Access add to a privileged-access architecture? This article explores a conceptual design combining Entra Private Access, application segmentation, Conditional Access, phishing-resistant authentication, PIM and privileged workstations --- while being clear about what I have and have not tested. https://blog.andykemp.com/designing-entra-private-access-properly-don-t-rebuild-your-vpn-in-the-cloud/ https://blog.andykemp.com/designing-entra-private-access-properly-don-t-rebuild-your-vpn-in-the-cloud/ Mon, 21 Sep 2026 19:18:00 GMT Microsoft Entra Private Access can replace traditional VPN access, but simply publishing broad private networks through Quick Access risks recreating the same access model in a new service. This article looks at application segmentation, discovery, connector design, Conditional Access, DNS and a practical path towards least-privilege private access. https://blog.andykemp.com/global-secure-access-alongside-your-existing-security-stack/ https://blog.andykemp.com/global-secure-access-alongside-your-existing-security-stack/ Wed, 16 Sep 2026 16:15:00 GMT Where Global Secure Access fits alongside Intune, Defender, Conditional Access and network controls, and how to separate useful overlap from policy duplication. https://blog.andykemp.com/mac-or-windows-i-use-both-and-that-s-kind-of-the-point/ https://blog.andykemp.com/mac-or-windows-i-use-both-and-that-s-kind-of-the-point/ Fri, 11 Sep 2026 12:50:00 GMT Mac or Windows? I use both. From Surface Laptop 7 and MacBook Pro performance to battery life, Intune, passkeys and WebAuthn, here's where each works best. Intune Mac OS Microsoft Windows 11 Windows 365 https://blog.andykemp.com/windows-365-link-revisited-i-gave-it-another-chance/ https://blog.andykemp.com/windows-365-link-revisited-i-gave-it-another-chance/ Wed, 09 Sep 2026 18:16:00 GMT Four months after audio redirection made me put the Windows 365 Link aside, I tested it again. YouTube, Spotify and Windows notifications now work. Microsoft Microsoft 365 Security Windows 365 https://blog.andykemp.com/what-if-other-people-could-use-it/ https://blog.andykemp.com/what-if-other-people-could-use-it/ Fri, 04 Sep 2026 13:36:00 GMT Adding Clerk made sign-in easy. The real challenge was authorisation, tenant boundaries and keeping every SaaS customer's data securely separated. https://blog.andykemp.com/migrating-from-a-traditional-secure-web-gateway-to-global-secure-access/ https://blog.andykemp.com/migrating-from-a-traditional-secure-web-gateway-to-global-secure-access/ Mon, 31 Aug 2026 09:22:00 GMT Migrating from a traditional Secure Web Gateway to Microsoft Global Secure Access is more than replacing one endpoint client with another. This article explores policy rationalisation, coexistence, transitional security controls, staged migration, validation and when Autopilot should finally move to GSA. Entra Global Secure Access Microsoft 365 Security Security Strategy https://blog.andykemp.com/ews-retirement-the-exchange-deadline-you-cannot-keep-ignoring/ https://blog.andykemp.com/ews-retirement-the-exchange-deadline-you-cannot-keep-ignoring/ Mon, 31 Aug 2026 08:48:00 GMT EWS retirement is about far more than rewriting an application. The 1 October 2026 Exchange Online disablement phase is almost here, and April 2027 will arrive quickly. Have you inventoried your EWS apps, cross-tenant calendar sharing and Exchange hybrid dependencies—and do you know where Exchange Server SE fits? I have pulled Microsoft’s current guidance into one practical overview. If you have tested the newer paths, I would be interested to compare notes. EWS Exchange Exchange Online Hybrid Microsoft Microsoft Graph https://blog.andykemp.com/entra-internet-access-moving-web-security-to-the-identity-layer/ https://blog.andykemp.com/entra-internet-access-moving-web-security-to-the-identity-layer/ Wed, 26 Aug 2026 20:21:00 GMT Explore how Microsoft Entra Internet Access moves traditional Secure Web Gateway controls towards an identity-aware security model, combining web filtering, user and group policy, Conditional Access and Global Secure Access. https://blog.andykemp.com/webauthn-redirection-windows-app-macos/ https://blog.andykemp.com/webauthn-redirection-windows-app-macos/ Wed, 26 Aug 2026 10:00:00 GMT Microsoft has introduced in-session WebAuthn redirection in preview for the Windows App on macOS, addressing a major passkey and FIDO2 limitation for Windows 365 and Azure Virtual Desktop users. Azure Virtual Desktop Identity Passwordless Windows 365 https://blog.andykemp.com/global-secure-access-on-mobile-devices/ https://blog.andykemp.com/global-secure-access-on-mobile-devices/ Tue, 25 Aug 2026 13:08:00 GMT Explore how Microsoft Global Secure Access extends identity-aware access to managed iOS, iPadOS and Android devices using Entra Internet Access and Entra Private Access. https://blog.andykemp.com/microsoft-global-secure-access-on-macos-extending-identity-driven-access-beyond-windows/ https://blog.andykemp.com/microsoft-global-secure-access-on-macos-extending-identity-driven-access-beyond-windows/ Mon, 24 Aug 2026 08:00:00 GMT Explore how Microsoft Global Secure Access brings identity-driven Private Access, Internet Access and Microsoft traffic controls to managed macOS devices.