June 2025 updates

alexverboon · alexverboon · commit bc61035dffc8 · 2025-06-29T17:33:34.000+02:00
diff --git a/docs/azurenetworksecurity.md b/docs/azurenetworksecurity.md
@@ -6,6 +6,7 @@
 
 ## Microsoft Tech Community Blogs
 
+- [Azure WAF Integration in Security Copilot is Now Generally Available](https://techcommunity.microsoft.com/blog/azurenetworksecurityblog/azure-waf-integration-in-security-copilot-is-now-generally-available/4422055)
 - [Getting Started with Azure Firewall REST API: A Step-by-Step Guide – Part I](https://techcommunity.microsoft.com/blog/azurenetworksecurityblog/getting-started-with-azure-firewall-rest-api-a-step-by-step-guide-%E2%80%93-part-i/4390715)
 - [Protecting the Public IPs of Secured Virtual Hub Azure Firewalls against DDoS Attacks](https://techcommunity.microsoft.com/blog/azurenetworksecurityblog/protecting-the-public-ips-of-secured-virtual-hub-azure-firewalls-against-ddos-at/4387435)
 - [Comprehensive Guide to Monitoring Azure WAF Metrics and Logs](https://techcommunity.microsoft.com/blog/azurenetworksecurityblog/comprehensive-guide-to-monitoring-azure-waf-metrics-and-logs/4378260)
diff --git a/docs/entraid.md b/docs/entraid.md
@@ -9,6 +9,10 @@
 
 ## Microsoft Tech Community Blogs
 
+- [Important Update: Azure AD Graph retirement](https://techcommunity.microsoft.com/blog/microsoft-entra-blog/important-update-azure-ad-graph-retirement/4364990)
+- [Important Update: AzureAD PowerShell retirement](https://techcommunity.microsoft.com/blog/microsoft-entra-blog/important-update-azuread-powershell-retirement/4364989)
+- [OAuth consent phishing explained and prevented](https://techcommunity.microsoft.com/blog/microsoft-entra-blog/oauth-consent-phishing-explained-and-prevented/4423357)
+- [Getting started with the Microsoft Entra Suite](https://techcommunity.microsoft.com/blog/microsoft-entra-blog/getting-started-with-the-microsoft-entra-suite/4422972)
 - [New policy enhancement tools in Entra Conditional Access](https://techcommunity.microsoft.com/blog/microsoft-entra-blog/new-policy-enhancement-tools-in-entra-conditional-access/4418866)
 - [Advanced deployment guide for Conditional Access Policy templates](https://techcommunity.microsoft.com/blog/microsoft-entra-blog/advanced-deployment-guide-for-conditional-access-policy-templates/4406767)
 - [Simplify frontline workers’ sign-in experience with QR code authentication](https://techcommunity.microsoft.com/blog/microsoft-entra-blog/simplify-frontline-workers%E2%80%99-sign-in-experience-with-qr-code-authentication/3822034)
@@ -1757,6 +1761,9 @@
 
 ## Community Blogs
 
+- [What is Tier Zero — Part 1](https://posts.specterops.io/what-is-tier-zero-part-1-e0da9b7cdfca)
+- [What is Tier Zero — Part 2](https://posts.specterops.io/what-is-tier-zero-part-2-6e1d14fddcaf)
+- [Beyond the GUI: Properly Securing Your Admin Apps with Custom Security Attributes in Entra ID](https://www.linkedin.com/pulse/beyond-gui-properly-securing-your-admin-apps-custom-security-lawalt-akwlf/)
 - [Managing Restricted Groups with Access Packages](https://nathanmcnulty.com/blog/2025/04/managing-restricted-groups-with-access-packages/)
 - [QR code authentication: a new simplified sign-in experience for frontline workers - Janic Verboon](https://www.basevision.ch/microsoft-entra-qr-code/)
 - [External Collaboration Settings with Application Permissions](https://suryendub.github.io/2024-12-21-extCollaboration/)
@@ -1814,6 +1821,7 @@
 - [Kenneth van Surksum](https://x.com/kennethvs)
 - [Daniel Chronlund](https://twitter.com/DanielChronlund)
 - [Nicola Suter](https://twitter.com/nicolonsky)
+- [Thomas Naunheim](https://www.linkedin.com/in/thomasnaunheim/)
 
 ## GitHub
 
@@ -1827,6 +1835,8 @@
 - [Conditional-Access-Validator](https://github.com/jasperbaes/Conditional-Access-Validator)
 - [M365AdminAccessReviewer](https://github.com/notEricaZelic/M365AdminAccessReviewer)
 - [Conditional access Baseline](https://github.com/j0eyv/ConditionalAccessBaseline)
+- [Microsoft Zero Trust Assessment V2 - Private Preview](https://github.com/microsoft/zerotrustassessment/blob/psnext/src/powershell/doc/readme.md)
+- [Microsoft Zero Trust Assessment Code](https://github.com/microsoft/zerotrustassessment/tree/psnext/src/powershell)
 
 ## Podcasts
 
@@ -1836,6 +1846,13 @@
 
 - [Entra ID Admin Roles Report](https://rksolutions.nl/entra-id-admin-roles-report/?utm_source=substack&utm_medium=email)
 - [AAGUIDs](https://aaguid.nicolasuter.ch/)
+- [Microsoft 365 Message Center Archive](https://mc.merill.net/)
+- [Tier 0 Table](https://github.com/SpecterOps/TierZeroTable/)
+
+## EntraOps Classification and Automation
+
+- [EntraOps Classification Files](https://github.com/cloud-architekt/azureprivilegediam)
+- [Community Project “EntraOps”](https://www.entraops.com)
 
 ## Secure Configuration
 
diff --git a/docs/mdc.md b/docs/mdc.md
@@ -8,6 +8,12 @@
 
 ## Microsoft Tech Community Blogs
 
+- [New feature in Defender for Storage: Optional Index Tags](https://techcommunity.microsoft.com/blog/microsoftdefendercloudblog/new-feature-in-defender-for-storage-optional-index-tags/4427987)
+- [Optimizing Resource Allocation with Microsoft Defender CSPM](https://techcommunity.microsoft.com/blog/microsoftdefendercloudblog/optimizing-resource-allocation-with-microsoft-defender-cspm/4427785)
+- [Microsoft Named a Leader in the IDC MarketScape for CNAPP: Key Takeaways for Security Buyers](https://techcommunity.microsoft.com/blog/microsoftdefendercloudblog/microsoft-named-a-leader-in-the-idc-marketscape-for-cnapp-key-takeaways-for-secu/4427071)
+- [Unlocking API visibility: Defender for Cloud Expands API security to Function Apps and Logic Apps](https://techcommunity.microsoft.com/blog/microsoftdefendercloudblog/unlocking-api-visibility-defender-for-cloud-expands-api-security-to-function-app/4426864)
+- [Performing Advanced Risk Hunting in Defender for Cloud](https://techcommunity.microsoft.com/blog/microsoftdefendercloudblog/performing-advanced-risk-hunting-in-defender-for-cloud/4420633)
+- [Enhancements for protecting hosted SQL servers across clouds and hybrid environments](https://techcommunity.microsoft.com/blog/microsoftdefendercloudblog/enhancements-for-protecting-hosted-sql-servers-across-clouds-and-hybrid-environm/4414783)
 - [Connecting Defender for Cloud with Jira](https://techcommunity.microsoft.com/blog/microsoftdefendercloudblog/connecting-defender-for-cloud-with-jira/4411691)
 - [Plug, Play, and Prey: The security risks of the Model Context Protocol](https://techcommunity.microsoft.com/blog/microsoftdefendercloudblog/plug-play-and-prey-the-security-risks-of-the-model-context-protocol/4410829)
 - [From visibility to action: The power of cloud detection and response](https://techcommunity.microsoft.com/blog/microsoftdefendercloudblog/from-visibility-to-action-the-power-of-cloud-detection-and-response/4411280)
diff --git a/docs/mdca.md b/docs/mdca.md
@@ -8,6 +8,7 @@
 
 ## Microsoft Tech Community Blogs
 
+- [Protect SaaS apps from OAuth threats with attack path, advanced hunting and more](https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/protect-saas-apps-from-oauth-threats-with-attack-path-advanced-hunting-and-more/4395997)
 - [Get visibility into your DeepSeek use with Defender for Cloud Apps](https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/get-visibility-into-your-deepseek-use-with-defender-for-cloud-apps/4372520)
 - [Microsoft Defender for Cloud Apps’ Shadow IT Discovery Capabilities Now Support MacOS](https://techcommunity.microsoft.com/t5/microsoft-defender-xdr-blog/microsoft-defender-for-cloud-apps-shadow-it-discovery/ba-p/4159677)
 - [Data Protection Made a Breeze: MDA integration in Edge for Business](https://cloudbrothers.info/en/data-protection-breeze-mda-integration-edge-business/)
diff --git a/docs/mde.md b/docs/mde.md
@@ -352,4 +352,3 @@
 - [Nuke It From Orbit](https://github.com/lkarlslund/nifo)
 - [MDE Troubleshooter](https://github.com/ThomasVrhydn/MDE-troubleshooter)
 - [Powershell Digital Forensics & Incident Response](https://github.com/Bert-JanP/Incident-Response-Powershell)
-
diff --git a/docs/mdi.md b/docs/mdi.md
@@ -9,6 +9,8 @@
 
 - [Scope Identity Protection with Defender for Identity](https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/new-scope-identity-protection-with-defender-for-identity/4422968)
 - [Microsoft Defender for Identity has announced the public preview of a new service account discovery module that automatically identifies and classifies service accounts in Active Directory](https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/discover-and-protect-service-accounts-with-microsoft-defender-for-identity/4395347)
+- [Expanding the Identity perimeter: the rise of non-human identities](https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/expanding-the-identity-perimeter-the-rise-of-non-human-identities/4418953)
+- [Discover and protect Service Accounts with Microsoft Defender for Identity](https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/discover-and-protect-service-accounts-with-microsoft-defender-for-identity/4395347)
 - [Securing Identities: 10 recommendations for building a stronger identity security posture](https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/securing-identities-10-recommendations-for-building-a-stronger-identity-security/4371879)
 - [Introducing the new Defender for Identity sensor management API](https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/introducing-the-new-defender-for-identity-sensor-management-api/4367164)
 - [Microsoft Defender for Identity: the critical role of identities in automatic attack disruption](https://techcommunity.microsoft.com/t5/microsoft-defender-xdr-blog/microsoft-defender-for-identity-the-critical-role-of-identities/ba-p/4236688)
diff --git a/docs/mdiot.md b/docs/mdiot.md
@@ -6,6 +6,8 @@
 
 ## Microsoft Tech Community Blogs
 
+- [Sensor Disconnection Notifications with Microsoft Defender for IoT and Microsoft Sentinel](https://techcommunity.microsoft.com/blog/microsoftdefenderiotblog/sensor-disconnection-notifications-with-microsoft-defender-for-iot-and-microsoft/4375517)
+
 - [Make OT security a core part of your SOC strategy with Microsoft Defender XDR](https://techcommunity.microsoft.com/t5/microsoft-defender-xdr-blog/make-ot-security-a-core-part-of-your-soc-strategy-with-microsoft/ba-p/4185702)
 - [Introducing Single Sign-On (SSO) for Sensor Console: Enhanced Security and Streamlined Access](https://techcommunity.microsoft.com/t5/microsoft-defender-for-iot-blog/introducing-single-sign-on-sso-for-sensor-console-enhanced/ba-p/4129156)
 - [Analyze IoT/OT device firmware with Microsoft Defender for IoT](https://techcommunity.microsoft.com/t5/microsoft-defender-for-iot-blog/analyze-iot-ot-device-firmware-with-microsoft-defender-for-iot/ba-p/3853474)
diff --git a/docs/mdxdr.md b/docs/mdxdr.md
@@ -9,8 +9,18 @@
 
 ## Microsoft Tech Community Blogs
 
+- [Case management now supports multiple tenants in Microsoft Defender experience](https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/case-management-now-supports-multiple-tenants-in-microsoft-defender-experience/4425329)
+- [Introducing TITAN-Powered Recommendations in Security Copilot Guided Response](https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/introducing-titan-powered-recommendations-in-security-copilot-guided-response/4416350)
+- [From on-premises to cloud: Graph-powered detection of hybrid attacks with Microsoft exposure graph](https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/from-on-premises-to-cloud-graph-powered-detection-of-hybrid-attacks-with-microso/4416295)
+- [The Best of Microsoft Sentinel — Now in Microsoft Defender](https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/the-best-of-microsoft-sentinel-%E2%80%94-now-in-microsoft-defender/4415822)
+- [Announcing File Attachments for Case Management](https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/announcing-file-attachments-for-case-management/4408881)
+- [Unified Security Summary: Enhancing Visibility and Value](https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/unified-security-summary-enhancing-visibility-and-value/4411302)
+- [Empowering SOC Analysts: Investigating Identity Threats with Microsoft Defender XDR](https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/empowering-soc-analysts-investigating-identity-threats-with-microsoft-defender-x/4398225)
+- [Announcing Rich Text for Case Management](https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/announcing-rich-text-for-case-management/4405855)
+- [Level up your defense: protect against attacks using stale user accounts](https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/level-up-your-defense-protect-against-attacks-using-stale-user-accounts/4386290)
+- [Defending Against OAuth-Based Attacks with Automatic Attack Disruption](https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/defending-against-oauth-based-attacks-with-automatic-attack-disruption/4384381)
+- [Automatic attack disruption: Enhanced containment for critical assets and shadow IT](https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/automatic-attack-disruption-enhanced-containment-for-critical-assets-and-shadow-/4402157)
 - [Case Management is now Generally Available](https://techcommunity.microsoft.com/blog/microsoftsentinelblog/case-management-is-now-generally-available/4398558)
-
 - [Monthly news - February 2025](https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/monthly-news---february-2025/4373271)
 - [Hyperscale ML threat intelligence for early detection & disruption](https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/hyperscale-ml-threat-intelligence-for-early-detection--disruption/4359763)
 - [Web Scale Graph Mining for Cyber Threat Intelligence](https://arxiv.org/abs/2411.06239)
diff --git a/docs/sentinel.md b/docs/sentinel.md
@@ -4,9 +4,12 @@
 - [Microsoft Sentinel documentation](https://learn.microsoft.com/en-us/azure/sentinel/)
 - [What's new in Microsoft Sentinel](https://learn.microsoft.com/en-us/azure/sentinel/whats-new)
 - [Become a Microsoft Sentinel Ninja](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/become-a-microsoft-sentinel-ninja-the-complete-level-400/ba-p/1246310)
+- [The Definitive SIEM Buyer’s Guide](https://marketingassets.microsoft.com/gdc/gdcDFk38S/original)
 
 ## Microsoft Tech Community Blogs
 
+- [Microsoft Sentinel: Repositories, the Future of Content-as-Code & Best Practices​](https://techcommunity.microsoft.com/blog/microsoftsentinelblog/microsoft-sentinel-repositories-the-future-of-content-as-code--best-practices%E2%80%8B/4422936)
+- [Exciting Announcements: New Data Connectors Released Using the Codeless Connector Framework](https://techcommunity.microsoft.com/blog/microsoftsentinelblog/exciting-announcements-new-data-connectors-released-using-the-codeless-connector/4421104)
 - [Multi-workspace for Multi-tenant is now in Public Preview in Microsoft's Unified SecOps Platform](https://techcommunity.microsoft.com/blog/microsoftsentinelblog/multi-workspace-for-multi-tenant-is-now-in-public-preview-in-microsofts-unified-/4398229)
 - [Multi Workspace for Single tenant is now in Public Preview in Microsoft’s unified SecOps platform](https://techcommunity.microsoft.com/blog/microsoftsentinelblog/multi-workspace-for-single-tenant-is-now-in-public-preview-in-microsoft%E2%80%99s-unifie/4398228)
 - [Microsoft Sentinel Project Deployment Tracker](https://techcommunity.microsoft.com/blog/microsoftsentinelblog/microsoft-sentinel-project-deployment-tracker/4394174)
@@ -620,3 +623,7 @@
 
 - [Optimizing Your Security Operations: Manage Your Data, Costs and Protections with SOC Optimizations](https://www.youtube.com/watch?v=Uk9x60grT-o)
 - [Optimizing your SOC's threat coverage and data value](https://www.youtube.com/watch?v=b0rbPZwBuc0)
+
+### Documentation
+
+- [Migrate from the HTTP Data Collector API to the Log Ingestion API to send data to Azure Monitor Logs](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/custom-logs-migrate)
