Blog | WCS

Layered protective shields in front of connected servers and cloud services

CyberRisikoCheck

CyberRisikoCheck under DIN SPEC 27076: who it suits and what comes next from 50 employees

26 October 2026

The BSI CyberRisikoCheck is a standardised interview for companies with fewer than 50 employees. What it covers, who may carry it out and which review helps companies with 50 or more employees on Microsoft 365.

Schematic illustration of an access package that bundles groups, applications and SharePoint sites with approval and expiry

Entra ID Governance

Access packages in Entra ID Governance: granting and removing access in a way you can prove

21 October 2026

Access rights pile up and nobody removes them. How access packages, access reviews and Lifecycle Workflows in Entra ID Governance help, which licences apply and how to start.

Schematic view of sign-in policies in Microsoft Entra ID with users, devices and applications

Conditional Access

Rolling out Conditional Access without locking out your staff

20 October 2026

Conditional Access decides who gets into Microsoft 365. This article sets out a safe rollout sequence: inventory, emergency access accounts, report-only mode, a pilot group and the evidence your auditor will ask for.

Isometric illustration: an email, a voice recording and a fake sign-in window hit a protective shield, behind it a laptop with connected signals and a security key

AI

Detecting and stopping AI-powered attacks: what works in Microsoft 365

20 October 2026

AI makes phishing flawless, voices easy to fake and attacks faster. Effective defence does not depend on staff spotting the fake. The five measures in Entra ID and Defender to start with, and how these attacks show up in your signals.

Security analyst working in the Microsoft Defender portal with an AI-assisted incident summary

AI

AI and cybersecurity in Microsoft environments: Security Copilot, AI phishing and Copilot adoption

Updated 19 October 2026

Three concrete topics instead of buzzwords: what Microsoft Security Copilot offers a small security team, what works against AI-generated phishing, and which risks to settle before rolling out Microsoft 365 Copilot.

Azure

Finding, preventing and evidencing misconfigurations in Azure

Updated 19 October 2026

Which Azure misconfigurations we check first in an assessment, and how to fix them permanently and document them as evidence with Microsoft Defender for Cloud, Azure Policy and a landing zone.

Insurance policy document alongside a digital lock symbolising cyber coverage requirements

Cyber Insurance

Cyber insurance: evidencing insurer requirements with Microsoft 365

Updated 19 October 2026

What cyber insurers typically ask about MFA, EDR, patching, backup and logging, and which reports from Entra ID, Defender, Intune and Azure Backup evidence your answers.

Regulatory compliance checklist grid for financial sector operational resilience requirements

DORA

DORA in the Microsoft cloud: what financial entities must implement and evidence

Updated 19 October 2026

DORA has applied since 17 January 2025. What the regulation requires, what role Microsoft plays as an ICT third-party service provider, and how to maintain evidence with Purview Compliance Manager, Sentinel and Defender.

Entra ID

Securing Microsoft Entra ID for mid-sized businesses

Updated 19 October 2026

Entra ID controls access to Microsoft 365 and Azure, which makes it a prime attack target. This article shows which measures protect your identities: MFA, permissions, Conditional Access and log analysis.

Security team analysing an incident in the Microsoft Defender portal with a timeline and affected accounts

Incident Response

Incident response in the Microsoft 365 tenant: What companies should prepare

Updated 19 October 2026

Which decisions management has to make before an incident, what IT does in the first hour after an account takeover in Entra ID, and which evidence counts for NIS2 and insurers.

NIS2

NIS2 in Germany: implementing the obligations and proving them with Microsoft 365

Updated 19 October 2026

The German NIS2 implementation act has applied since 6 December 2025. Who is in scope, which obligations and reporting deadlines apply, and how to implement and evidence the measures with Entra ID, Defender, Sentinel and Intune.

Schematic view of protected endpoints, locked-down administrator accounts and an immutable backup vault

Ransomware

Ransomware preparedness in Microsoft environments: Why backups alone are not enough

Updated 19 October 2026

Backups are necessary but not sufficient. How to harden endpoints with Defender for Endpoint and Intune, protect administrator accounts, and make backups in Azure Backup and Microsoft 365 Backup tamper-resistant.

Two security dashboards side by side: the incident view in Defender XDR and analytics rules in Microsoft Sentinel

Microsoft Defender XDR

Defender XDR and Microsoft Sentinel: When is XDR enough, and when do you need Sentinel?

Updated 19 October 2026

What Microsoft Defender XDR covers at no extra cost, what Microsoft Sentinel adds, how the cost logic works, and which operating model has to stand behind “someone is watching the alerts”.

Zero Trust

Zero Trust explained: an adoption guide for businesses

Updated 19 October 2026

Zero Trust is an architectural principle. This article explains the concept and shows how to implement it step by step with Entra ID, Intune, Defender, Sentinel and Purview.

Passkeys

Conditional Access and passkeys: how to move to phishing-resistant sign-in

16 October 2026

Microsoft is making passkeys the default in Entra ID and retiring SMS and voice as sign-in methods. This article covers the available methods, how to enforce them with Conditional Access and the order in which the migration works.

Microsoft 365

How to tell if your IT provider runs Microsoft 365 securely

13 October 2026

Ten pieces of evidence a good IT provider or internal IT team can produce within a day: from MFA coverage and Conditional Access to DMARC, backups and the monthly report. With guidance on what a good answer looks like.

Digital padlock from which a stream of credentials, email symbols and warning signs is pulled into a vortex

Email Security

Email security with Microsoft 365, part 1: setting up SPF, DKIM and DMARC correctly

9 October 2026

SPF, DKIM and DMARC are basics, yet they are misconfigured again and again. What the three DNS records do, what happens without them, and how to implement them properly in Exchange Online.

Defender for Office 365

Email security with Microsoft 365, part 2: getting Defender for Office 365 right

6 October 2026

Many organisations already pay for Microsoft Defender for Office 365 but run it on defaults. What each protection feature does, which misconfigurations we see most often and how to evidence the protection.

Abstract illustration of network traffic routed through a central control point to approved AI services

Global Secure Access

Using Global Secure Access to control which AI tools are used in your organisation

2 October 2026

AI bans are rarely followed. How to allow approved AI tools with Microsoft Entra Internet Access, make the rest visible or block it, and produce evidence an auditor will accept.

Schematic illustration of document libraries, permissions and classifications being reviewed before an AI assistant

AI

How to make AI adoption succeed with Entra ID, Purview, SharePoint and OneDrive

29 September 2026

Microsoft 365 Copilot and Claude surface whatever a user can already access. The real risk is oversharing. The steps in Entra ID, SharePoint and Purview that belong before the roll-out.

Schematic illustration of AI agents as distinct identities alongside users and applications in a directory

Entra Agent ID

What Microsoft Entra Agent ID is and how it fits into existing services

25 September 2026

AI agents act with permissions, so they need identities, accountable owners and a lifecycle. What Microsoft Entra Agent ID provides, how it works with Conditional Access and ID Governance, and what to do now.

Shield containing a stylised neural network, with streams of binary code running off to the right

Defender for Endpoint

Defender for Endpoint: detecting and blocking prompt injection in local AI agents

22 September 2026

AI agents such as Claude Code or GitHub Copilot CLI work with the permissions of the person at the keyboard. Microsoft Defender for Endpoint can detect and block injected instructions at runtime. What the feature does, what it requires and how to roll it out.