Kurt Shintaku's Blog

Join us for our 5th annual Azure Cosmos DB Conf 2025, a free virtual developer event co-hosted by Microsoft and the Azure Cosmos DB community.

Tune in to learn why Azure Cosmos DB is the leading database for the era of AI and modern app development. Dive into a dynamic mix of sessions from Microsoft and community experts, showcasing their innovative projects and breakthroughs. Join our engaging 3-hour live show and explore additional sessions on-demand. Mark your calendar for April 15, 2025, and join us online for an exciting day of learning, sharing, and inspiration!

Visit https://aka.ms/azurecosmosdbconf to register!

Reflecting on 2024: A Look Back
Last year’s sessions at the Azure CosmosDB Conf 2024 event were filled with groundbreaking insights, innovative use cases, and practical demonstrations that illuminated the vast possibilities of Azure Cosmos DB. As we prepare for 2025, let’s take a moment to look back at some of the standout sessions and memorable moments from Azure Cosmos DB Conf 2024.

• Playlist of All 2024 Talks: Relive the entire conference experience by browsing through the full playlist of sessions. This collection showcases a variety of topics and deep dives that spanned the event.
• Highlight Reel: Get a taste of the most exciting moments with the Azure Cosmos DB Conf 2024 Highlight Reel, capturing the energy, key announcements, and high-impact sessions that defined the conference.

We’re all being asked to do more with less.  Maximizing ROI for every dollar is now more important than ever.  It’s critical that technology decision makers have the information needed to make those tough calls around where to invest.  You’re familiar with Windows, but what about the tangible benefits it provides for the organization and employees? 

Here’s an opportunity to gather timely information to help truly understand the value of Windows Enterprise. Grab a coffee or quick bite then join us for any of the six, quick-hit, 20-minute sessions.  

These sessions, led by subject matter experts and available live and on-demand, delve into topics such as: 

• The advancements Universal Print have made in the cloud print space (ON-DEMAND)
• The security Windows 11 provides and the Microsoft Windows Resiliency Initiative (ON-DEMAND)
• Copilot+ PCs  (Feb 27, 2025)
• Extended Security Updates in association with Windows 10 end of support in October 2025  (Mar 27, 2025)
• Hotpatch for Windows: Patch Tuesdays Reimagined (April 24, 2025)
• Windows Autopatch and Windows Update for Business deployment service unification (May 29th, 2025)

And more! See the list of upcoming Windows Enterprise webinars & register at:

• https://learning.eventbuilder.com/EnterpriseWebinarSeries

Microsoft Cybersecurity Incident Response, Senior Security Researcher, Lukas Beran maintains an amazing security web site & a great security YouTube channel which documents ways to protect your Microsoft cloud & on-premises footprint.

He posts regularly about Microsoft Sentinel, Microsoft Defender XDR, Microsoft Entra ID, Active Directory, Microsoft Intune & Office 365. For example, here’s a list of some of his amazing videos:

• Entra ID
  • How to secure Microsoft Entra ID tenant
  • Difference between delegated and application permissions in Microsoft Entra ID
  • Microsoft Entra ID Authentication Strengths explained
  • Recommended conditional access policies in Microsoft Entra ID
  • How to prevent users from joining their devices to Microsoft Entra ID
  • How to enable Microsoft Entra ID single sign-on (SSO) on macOS devices
  • How to enable Microsoft Authenticator passkeys in Microsoft Entra ID
  • How to secure Microsoft Entra ID tenant
  • Understanding Entra ID Device Join Types
• Exchange Online
  • How to secure your email with SPF, DKIM and DMARC
  • How to block emails from the onmicrosoft.com domain in Office 365
  • How to create a DMARC record for the onmicrosoft.com domain in Office 365
• Intune
  • How to deploy Microsoft Defender for Endpoint on macOS via Microsoft Intune
  • How to manage Microsoft 365 Apps updates in Microsoft Intune
  • How to manage Microsoft Edge updates in Microsoft Intune
  • How to block top-level domains via Microsoft Intune
  • How to turn off Windows Ads via Microsoft Intune
  • Microsoft Intune device enrollment options for Apple iOS devices
  • Microsoft Intune device enrollment options for Android devices
  • How to configure Platform SSO for macOS via Microsoft Intune
  • How to manage driver and firmware updates using Microsoft Intune
• Windows
  • How to disable Local Policy Merge on Windows Firewall
  • How to reset domain admin password on an Azure VM

If you are responsible for cybersecurity in your organization & work with Microsoft technologies, I highly encourage you to parse through Lukas’ web site & YouTube channel.

• YOUTUBE CHANNEL: Cybersecurity World – Lukas Beran
  https://youtube.com/@cswrldcom?si=EWhQb9dKRP-pMRlD
• WEB SITE: Cybersecurity World – Lukas Beran
  https://www.cswrld.com/

If Microsoft 365 Copilot licenses are purchased for a sub-segment of your Microsoft 365 GCC users, it can provide SharePoint Advanced Management licensing for ALL USERS as announced on our blog. For instance, if a customer buys 250 seats for M365 Copilot, all 20,000+ users in the M365 cloud instance will access to SharePoint Advanced Management.

Note however: GCC customers will not automatically receive these SharePoint Advanced Management licenses until April 2025.

• From an administrative standpoint, for any of my customers purchasing pilot Microsoft 365 Copilot GCC licenses (~10% of your Microsoft 365 footprint) right now until April 2025, contact your Account team and we can request an exception with Microsoft 365 engineering to roll out SharePoint Advanced Management trial licenses tenant-wide for you extended for 3 months until it’s fully integrated with the M365 Copilot GCC purchases in April 2025 & can obtain full licenses/non-trial licenses.
• After the exception is approved, we can work with you to ensure that your Unified CSAM &/or CSA are working together to then educate you on assigning licenses, configuring features, enabling them, and best practices on monitoring and usage.
• There is also an offering from Unified Support called “SharePoint Optimization” that can be leveraged, with modules of SharePoint Advanced Management being included in it.

NOT READY TO LICENSE MICROSOFT 365 COPILOT?
Organizations with Microsoft 365 GCC that don’t want to license Microsoft 365 Copilot immediately, wil be able to deploy Microsoft 365 Copilot Chat in April 2025. Copilot Chat is the “lite” version of M365 Copilot which provides Enterprise secure, IT-managed Copilot for end users as part of their Entra ID Premium P1 licensing. Microsoft 365 Copilot Chat exclusively provides responses based on Internet/web data & does NOT INDEX OR PROVIDE RESPONSES based on Microsoft 365 GCC protected data from Exchange Online, SharePoint Online, Teams or OneDrive for Business. (Microsoft 365 Copilot Chat consequently does not include SharePoint Advanced Management since Copilot Chat does not automatically index SharePoint Online or OneDrive files.)

(Note: There are no “trial” licenses of Microsoft 365 Copilot. If you wish to “test” Microsoft 365 Copilot & it’s integration with your Microsoft 365 tenant data, you are required to purchase licenses. These licenses will again include SharePoint Advanced Management licensing as mentioned above & this will activate the “Semantic Index service” and the “Microsoft 365 Copilot System service” for use in your organization’s Microsoft 365 cloud instance.)

To read more about SharePoint Advanced Management, visit:

• Get ready for Microsoft 365 Copilot with SharePoint Advanced Management – SharePoint in Microsoft 365
• Microsoft 365 Copilot now includes SharePoint Advanced Management at no additional cost

For customers looking to deploy Microsoft 365 Copilot but want to ensure it doesn’t accidentally discover data that wasn’t properly secured, Microsoft is providing a powerful solution that restricts discoverability & access of Microsoft 365 Copilot at no additional cost to M365 Copilot customers without requiring labelling, classification & security policies.

This solution is called “SharePoint Advanced Management” & customers with Microsoft 365 Copilot licenses will also get complimentary SharePoint Advanced Management licenses which will start appearing in GCC tenants in the next couple months.

The process of using SharePoint Advanced Management licenses to prevent oversharing in anticipation of using Microsoft 365 Copilot are discussed here but in summary:

• Set Restricted Access Control (RAC) at the SP/ODFB site level. Even if individual files/folders have broken inheritance and over shared, only RAC allowed users can access through Search and M365 Copilot – (available to GCC & in SAM)
• Set site level Restricted content Discoverability (RCD) to restrict content discoverability via Copilot and Org wide search– (available to GCC & in SAM)
• Data access governance reports for SharePoint sites: These reports help you discover sites that contain potentially overshared or sensitive content. You can use these reports to assess oversharing and apply appropriate security and compliance policies. ((available to GCC & in SAM)
• Conditional access policy for SharePoint sites and OneDrive: With Microsoft Entra ID authentication context, you can enforce stringent access conditions for users who access SharePoint sites. Authentication contexts can be directly applied to SharePoint sites or used with Microsoft Purview Information Protection sensitivity labels to connect Entra ID Conditional Access policies to labeled sites.  
• Setup user access reviews to clean up group and site membership in Entra ID Governance.  
• Data assessments in Data Security Posture Management for AI to identify, remediate, and monitor potential oversharing of data. (coming soon to GCC)

Not yet available for GCC however for customers with Non-Disclosure Agreements & Microsoft 365 Commercial test environments:

• PREVIEW: Use AI Powered Semantic matching to find similar sites (Requires signed agreement)
  You discovered a site containing crucial business data that lacks proper protection. Are there more sites like this one that might have similar vulnerabilities? Soon, AI Powered Semantic matching helps you locate these sites using the site you discovered as the example. The AI powered semantic matching tool reads through all the sites you have, including content, files, metadata, and give you a list of similar sites based on your example site.
  Sign up to participate in the preview by following instructions here.

Extended Security Updates for Windows 10 are now available for purchase today through the Microsoft Volume Licensing Program.

Pricing
ESUs for Windows 10 will be $61 USD per device for Year One & will double every consecutive year, for a maximum of three years.  ($122/device, $244/device) For more information, see When to use Windows 10 Extended Security Updates.

Available for free for Azure Virtual Desktops or Cloud PCs
ESUs for Windows 10 are available at no additional cost for Windows 10 virtual machines running in Windows 365 or Azure Virtual Desktop. Windows 10 endpoints connecting to Windows 365 Cloud PCs will be entitled to the ESU for up to 3 years, with an active Windows 365 subscription license. For more information about Windows 365, see What is Windows 365?.

Read more at:

• Extended Security Updates (ESU) program for Windows 10