Skill UI

Configures Microsoft Defender for Endpoint advanced protection including ASR rules, controlled folder access, network protection, and exploit safeguards so admins can harden Windows clients, meet compliance, and deploy policies via Intune, SCCM, or GPO.

Guides defenders through detecting and investigating Azure service principal abuse—ranging from unauthorized credential additions and privileged role grants to admin consent bypass and OAuth escalation—using Sentinel/Splunk queries and Graph-powered investigation steps.

Guides tuning Microsoft Defender for Office 365, Proofpoint, Mimecast, and Barracuda email gateways to detect and block spearphishing by enforcing impersonation guards, URL detonation, attachment sandboxing, and custom detection rules.

Guides administrators through enabling Microsoft Defender for Cloud across Azure workloads, covering CSPM, CWPP, compliance dashboards, adaptive controls, automated agent provisioning, and alerting to continuously protect VMs, containers, databases, storage, and hybrid resources.