EndlessTech Blog | M365 Security & Zero Trust for SMBs

Latest Blog Posts

EndlessTech is a practical, vendor-neutral blog on Microsoft 365 security for IT professionals, MSP technicians, and SMBs. Expect hands-on guides on Zero Trust, Conditional Access, Intune, Entra ID, Purview, and Defender — each grounded in real tenant work, not marketing.

Three layered Defender for Office 365 tiers shown as shields — EOP, Plan 1 and Plan 2 — with a phishing mail probing them

Microsoft Defender for Office 365: Plans, Features, and a Sane SMB Setup

August 2026 • By Philipp Schmidt

EOP vs Plan 1 vs Plan 2 without the licensing fog — and the preset policy setup that stops most phishing using the licence you already pay for.

Balance scale weighing a cloud AI API against a local GPU with hardware, energy and personnel costs

Cloud API vs. Local AI Models: The Honest TCO and Security Analysis

August 2026 • By Philipp Schmidt

Pay per token or buy the GPU? The honest cost-of-ownership and security math — why utilization, not technology, decides the price, and why local deployment shifts risk rather than removing it.

Cartoon of agitated men at a garden party arguing in speech bubbles about Microsoft and US cloud dependency while children play carefree nearby

Digital Sovereignty: Why Europe Lost the Cloud Race — And Why That's Okay

June 2026 • By Philipp Schmidt

A birthday party debate about US cloud dependency turns into a reality check: fear is not a strategy, autarky is an illusion, and Europe's real chance lies in asymmetric investment.

Microsoft Entra ID identity management dashboard showing free and paid tier options

Is Microsoft Entra ID Free? Pricing Guide for Small Businesses

By Philipp Schmidt

Yes, Microsoft Entra ID has a free tier — and most small businesses already have it bundled with Microsoft 365. Here is exactly what is included, what Premium P1 and P2 cost, and when upgrading actually makes sense.

Microsoft Scout autonomous AI agent with Entra ID identity executing local system commands

Microsoft Scout: Why the "Autopilot" for Your IT Is Brilliant—But Not Ready for You Yet

By Philipp Schmidt

Microsoft's autonomous AI agent runs shell commands on your devices. The Entra ID architecture is brilliant, but Purview DLP, audit trails, and EU Data Boundary compliance are missing. The reality check behind the hype.

Airport-themed IT security visualization with departure board showing Zero Trust security controls

Your IT Security Is an Airport – And Everyone Is Sneaking Through the Emergency Exit

By Philipp Schmidt

Your company's IT security works exactly like an airport. Some departments have TSA Pre-Check, others are sneaking through the emergency exit. A sarcastic but dead-accurate guide to Zero Trust.

PowerShell terminal cleaning up orphaned Teams Private Channel sites in an M365 tenant

Ghost Hunting in the M365 Tenant: Cleaning Up Orphaned Teams Private Channel Sites

By Philipp Schmidt

A SharePoint archiving project with 10 Private Channel sites went sideways. Microsoft Graph: 404. GUI: blocked. The fix? Five PowerShell cmdlets and a lot of dead ends.

Tangled SharePoint permission connections scanned by a Copilot readiness tool, with over-shared files flagged in red

Taming the SharePoint Permission Nightmare: The New Copilot Readiness Tool

By Philipp Schmidt

Auditing SharePoint permissions used to mean fragile PowerShell scripts and blind spots. Microsoft's new native Data Access Governance report changes everything — and one Copilot license unlocks it all.

Microsoft 365 Copilot ROI dashboard showing knowledge management impact

Copilot ROI: Why Knowledge Management Is the Difference Between 1.4:1 and 5.4:1

By Philipp Schmidt

Real cost model for 60 users, a 7-term glossary, NIST AI RMF mapping, and a 10-point readiness checklist. The $195,000 gap between a poor and a proper Copilot rollout starts with knowledge management.

An old dusty server rack connected to a glowing modern cloud via a giant rusty switch

The Final Exchange Server: Why the Cloud Switch Isn't a Magic Wand

By Philipp Schmidt

Microsoft's new Exchange SOA switch promises to let you shut down your last on-premises server. But configuration drift, split management, and a nasty offboarding trap say otherwise.

Microsoft 365 cloud productivity platform connected to Baramundi on-premises endpoint management

Microsoft 365 vs. Baramundi: The Real Story

By Philipp Schmidt

They're not competitors — they don't even play in the same league. A factual breakdown of why comparing M365 and Baramundi is like comparing apples to oranges, and when you actually need both.

IT admin overwhelmed by laptop boxes vs. relaxed employee with self-configured laptop

Stop the Setup Chaos: How Windows Autopilot Deploys Hundreds of Devices Without Breaking a Sweat

By Philipp Schmidt

Forget imaging. Windows Autopilot ships devices straight from the manufacturer to the employee — self-configuring, zero IT touch. Here's how to pick the right strategy: v1 vs. v2.

Calm workspace with laptop and notebook in natural daylight representing a reflective IT career journey from Windows NT to Microsoft 365

From NT to M365 – A Journey Through Tech, Decisions, and the People Behind Them

By Philipp Schmidt

A personal reflection on 15+ years in IT consulting – from Windows NT and Active Directory to M365 and Zero Trust – and the moments that shaped the journey.

Split view of an outdated golden tenant blueprint versus a modern automated Intune compliance dashboard

The Golden Tenant Is Dead. Here's What Replaces It.

By Philipp Schmidt

Static golden tenants can't keep up with Microsoft's update pace. Learn why IT teams and MSPs are moving to automated, drift-aware Intune management.

Individual files being lifted from a SharePoint library into a locked archive vault, illustrating file-level archiving

The Future of SharePoint Archiving: File-Level is Coming

By Philipp Schmidt

A deep dive into the upcoming file-level archiving in SharePoint with Microsoft 365 Archive, its costs, roadmap, and how it compares with current third-party solutions.

Microsoft 365 as one integrated suite versus a fragmented stack of separate third-party building blocks

You Don't Have to Love Microsoft – But You Should Understand Its Dominance (Pragmatism Over Ideology)

By Philipp Schmidt

Microsoft 365 isn't perfect, but it's unrivaled. Why its market position is earned, alternatives are mostly building blocks, and independent backups are key to resilience.

iPad showing Apple Business Manager enrollment error with Not Contacted status in Microsoft Intune

iOS/iPadOS ABM Enrollment Troubleshooting: The 'Not Contacted' Nightmare

By Philipp Schmidt

A deep dive into why iOS devices fail to enroll via Apple Business Manager (ABM) and show a 'Not Contacted' status in Intune. Learn the root cause and the mandatory factory reset fix.

Microsoft Copilot interface overlaid with digital sovereignty and cloud governance compliance symbols

The Copilot "Mandate" - A Fact-Check on Digital Sovereignty and Cloud Governance

By Philipp Schmidt

A fact-check on the Swiss Parliament's Microsoft Copilot incident, exploring digital sovereignty, cloud governance, and the shared responsibility model in the AI era.

Digital security gateway blocking unauthorized personal devices from Intune MDM enrollment

Intune Enrollment Restrictions: Your Foundational Control Against Local Admin Risk

January 2026 • By Philipp Schmidt

Discover why Intune Enrollment Restrictions are the foundational control for a Zero Trust architecture. Learn how to block personal Windows devices, mitigate local admin risks, and build a secure endpoint environment from the ground up.

Diagram comparing Microsoft Entra ID tenant structure with Azure subscription hierarchy

Microsoft Entra Tenant vs. Azure Subscriptions – What's the Difference?

January 2026 • By Philipp Schmidt

A clear guide to understanding the relationship between Microsoft Entra ID Tenants and Azure Subscriptions, and how they work together to manage identity and cloud resources.

Transition from aging office hardware to modern Windows 11 devices with TPM 2.0 security chips

Windows 11 and Hardware Lifecycles: Why the Debate is Bigger Than Microsoft

December 2025 • By Philipp Schmidt

The debate over Windows 11's hardware requirements isn't about an update; it's about the future of IT infrastructure and why a structured hardware lifecycle is a business necessity.

Microsoft 365 security add-on layers stacked above Business Premium showing E5 Security and Compliance upgrades

Beyond the Basics: Why Smart M365 Add-Ons Are Your Best Investment

December 2025 • By Philipp Schmidt

Learn why Business Premium is essential for SMBs and how E5 Security and Compliance add-ons deliver enterprise-grade protection at a fraction of the cost.

Zero Trust security architecture diagram with Microsoft Entra Suite identity verification layers

Unlocking Zero Trust: Mastering Identity and Network Security with Microsoft Entra Suite

December 2025 • By Philipp Schmidt

A deep dive into the Microsoft Entra Suite and how it enables a Zero Trust security model for modern organizations.

Split screen showing AI Model Context Protocol benefits on one side and security risks on the other

MCP Servers: Understanding the Double-Edged Sword of AI Tooling

December 2025 • By Philipp Schmidt

Discover how the Model Context Protocol transforms AI integration while introducing critical security risks, and learn the four-layer defense strategy.

Microsoft Secure Score dashboard showing security posture gauge and improvement recommendations for SMBs

Boost Your Cyber Defense: Microsoft Secure Score for SMBs

November 2025 • By Philipp Schmidt

Discover how Microsoft Secure Score helps SMBs benchmark and improve cybersecurity. Learn practical steps, benchmarks, and expert tips for Microsoft 365 security.

Windows 365 Cloud Apps streaming interface showing targeted application delivery from Azure cloud

Windows 365 Cloud Apps: When Less is More

November 2025 • By Philipp Schmidt

Discover how Windows 365 Cloud Apps revolutionize application delivery. Targeted app streaming reduces costs and increases efficiency for SMEs.

Knox and Hawk mascots guarding a Zero Trust security perimeter with identity verification checkpoints

Zero Trust with Microsoft 365: The Complete Pillar-by-Pillar Guide

Updated June 2026 • By Philipp Schmidt

The complete guide to implementing Zero Trust across all six pillars—Identity, Endpoints, Data, Apps, Infrastructure, and Network—with M365 as the control plane. Licensing, deployment sequence, and maturity metrics included.

Smartphone with Microsoft Intune MAM policy shield protecting corporate data on a personal BYOD device

Mobile Application Management: Your Quarterback for Mobile Security

November 2025 • By Philipp Schmidt

Discover how Mobile Application Management (MAM) can help you secure corporate data on personal devices without compromising on flexibility.

Coming Soon

A preview of posts currently in the works

Infographic showing a ransomware attack chain: email bombing then Teams social engineering then DLL side-loading then ESC1 certificate abuse then Domain Admin in 180 minutes then interrupted NTDS.dit exfiltration

AD CS ESC1: The Default Misconfiguration That Hands Attackers Domain Admin

Coming Soon • By Philipp Schmidt

A misconfigured AD CS certificate template gives any user with local admin the ability to impersonate Domain Admins. Here's how to find and fix the ESC1 flaw before attackers do.

Coming Soon →

Microsoft Graph API architecture overview showing JSON response structure and request flow from Graph Explorer through app registration to M365 services

Demystifying the Microsoft Graph API: A Practical Guide

Coming Soon • By Philipp Schmidt

Every click in Intune, Entra, or SharePoint is an API call. This guide covers the tools, auth concepts, and query patterns IT practitioners actually need to automate M365 at scale.

Coming Soon →

Microsoft 365 Security Best Practices

Coming Soon • By Philipp Schmidt

Learn essential security configurations and best practices to secure your Microsoft 365 tenant against cyber threats.

Coming Soon →

About EndlessTech Blog

EndlessTech Blog is your go-to resource for practical insights on M365, cybersecurity, and Zero Trust cloud solutions. Written by Philipp Schmidt, an experienced IT consultant specializing in Intune, Entra ID, and scalable cloud implementations.

Learn More About Me

Start Here: Essential Guides

New to the blog? These cornerstone articles cover the fundamentals.

Zero Trust with M365: Complete Guide

All six pillars mapped to M365 services, licensing, deployment sequence, and maturity metrics.

Microsoft Secure Score for SMBs

Benchmark your security posture and learn the practical steps to improve it.

Intune Enrollment Restrictions Guide

The foundational control against local admin risk and unauthorized device enrollment.

Why Microsoft Is So Dominant

A pragmatic reality check on M365's market position, why alternatives are mostly building blocks, and why independent backups matter.

Zero Trust Pillars - Verify Explicitly, Use Least Privilege Access, Assume Breach

Welcome to EndlessTech Blog

Latest Blog Posts

Coming Soon

About EndlessTech Blog

Start Here: Essential Guides