Best Practices

Expert advice to optimize your technology and operations.

← Back to All News
Guide

Rolling Out Passkeys in Microsoft 365 Without Locking Anyone Out

Text-message codes and “approve this sign-in” prompts are what attackers practise against. Passkeys take the password out of the equation, and the rollout is easier than people expect if you do it in the right order.

Start with the Microsoft Authenticator app, which already supports passkeys on the phones your staff carry, and turn on the passkey authentication method in Entra ID for a pilot group of five to ten people, including at least one person who is not technical. Register two methods per person, a passkey plus a backup such as a hardware key or Temporary Access Pass held by IT, so a lost phone is an inconvenience rather than a lockout. Once the pilot has run for two weeks, expand by department, and only then use Conditional Access to require phishing-resistant authentication for admins, finance and anyone with access to client data. Leave a documented break-glass account with a long password stored offline.

Business Benefit

Passkeys cannot be phished, replayed or fatigued out of a tired employee at 4:55 on a Friday. Sign-in is faster than typing a password and a code, help desk password resets drop, and “phishing-resistant MFA” becomes a box you can tick honestly on the next cyber insurance renewal.

Guide

Test Your Backups: A Restore Drill That Takes an Afternoon

A backup you have never restored is a hope, not a plan. Once a year, block off an afternoon and prove it works.

Pick a date now and put it in the calendar. On the day, choose one server or one line-of-business system and restore it somewhere isolated: a spare host, a test virtual machine, or a sandbox in your cloud tenant. Time it. Then have the person who uses that system every day log in and do their normal job for twenty minutes. Restore a handful of files from Microsoft 365 too, including something deleted last month and a SharePoint document from a site nobody has touched in a year. Write down what worked, what took longer than you thought, and which password nobody could find. Fix those three things before the next drill. Annual is the minimum; twice a year is better if you can manage it, and any time you change backup software or add a critical system, drill again.

Business Benefit

You learn your real recovery time while it is still a Tuesday afternoon and not a ransomware incident. Insurers and auditors increasingly ask for the date of your last tested restore, and leadership gets a straight answer to “how long would we be down?” instead of a guess.

Guide

Zero Trust as the New Perimeter

The old “trusted network” model is a ghost story from a simpler time. The new threat frontier is everywhere your people work—which means trust has to be earned, not assumed.

Zero Trust isn’t a product; it’s a worldview. The idea is simple: never trust by default, always verify continuously. Whether a request comes from inside the office or a café in Toronto, every user, device, and app must prove it belongs. Authentication becomes dynamic, context-aware, and constantly reinforced.

Business Benefit

A Zero Trust posture dramatically reduces the blast radius of an attack, protects remote and hybrid teams, and eliminates the risky assumption that “inside” equals safe. Businesses gain a hardened, modern security foundation that scales cleanly as they grow.

Guide

Strong Identity Strategy

Passwords alone are polite suggestions. Identity—how you verify, protect, and retire it—is now your first line of defense.

Modern identity security blends MFA, passkeys, conditional access, and crisp lifecycle controls. It’s not enough to lock the door; you also need to collect the keys when someone leaves. Most breaches stem from weak authentication or accounts that should have been deactivated. A strong identity strategy eliminates that brittleness.

Business Benefit

Done right, identity security prevents credential-based attacks, reduces phishing risk, and shortens onboarding/offboarding effort. It’s the most cost-effective security upgrade a business can make—and one that creates immediate peace of mind.

Guide

EDR/MDR as Table Stakes

Antivirus looks for yesterday’s threats. EDR/MDR watches for today’s and tomorrow’s—and calls the fire department before you even smell smoke.

Endpoint Detection & Response (EDR) provides deep visibility into unusual behavior on laptops and servers. Managed Detection & Response (MDR) adds a 24/7 security team that investigates, correlates, and responds in real time. This combination moves security from reactive to proactive, catching threats before they erupt into downtime.

Business Benefit

Businesses that deploy EDR/MDR drastically reduce the likelihood and impact of ransomware, credential theft, and insider attacks. It safeguards productivity, cuts recovery costs, and gives leadership confidence that someone is always watching their back.

Guide

SaaS Governance

Every business runs on SaaS now—even if leadership doesn’t know which apps people actually use. The danger isn’t just risk; it’s waste.

Employees adopt SaaS tools faster than IT can track them. This leads to shadow data, redundant tools, unmonitored access, and siloed information. SaaS governance means knowing what apps exist, who uses them, where data flows, and how to secure and optimize the stack. It turns a chaotic cloud ecosystem into a disciplined, cost-effective suite.

Business Benefit

With governance, businesses eliminate duplicate subscriptions, tighten access controls, plug data-leakage holes, and simplify operations. The result is less cost, better compliance, and a cleaner, more intentional digital ecosystem that actually supports productivity.

Guide

AI & Automation Governance

AI is already in your business—you just may not know which team is using it or what data they’re feeding it. Governance protects you without killing innovation.

AI tools are powerful, but they introduce new risks: data leakage, accidental IP exposure, inconsistent quality, and unvetted automation. AI governance gives your team approved tools, usage guidelines, data safeguards, and monitoring that encourages creativity while keeping everything above board.

Business Benefit

Businesses with AI governance get the upside of automation—speed, efficiency, insight—without the legal, security, or reputational downsides. It transforms AI from a wild-card experiment into a strategic advantage.