עבריתBook a call
Book a call
Microsoft 365 SecurityGriffin31Admin RightsWeb SecurityWhy OnCloudContact
עברית
Book a call
Microsoft Zero Trust

Microsoft 365 Security

Identity management, device management and protection, and cloud app protection — together, in one central management console. This is how you implement Zero Trust: full visibility of users, devices and data, and prevention of unusual security events.

The Zero Trust principles we implement

  • Verify explicitly

    Every access to a system or to data requires identity verification — whether the request comes from inside the corporate network or outside it.

  • Least-privilege access

    Every user gets the minimum access they need to do their job.

  • Protect the data

    Encryption and precise access control keep data safe wherever it is.

  • Prevent threats

    Continuous monitoring and fast response to threats across the environment.

Microsoft Entra ID

The foundation. Your on-premises Active Directory is synced to the cloud, with advanced security capabilities on top.

  • Conditional Access — Dynamic access policies for apps and data based on identity, device state, location and risk.
  • Single sign-on and smart MFA — SSO to cloud apps, and multi-factor authentication adapted to location, operating system and client type.
  • Remote access without VPN — Secure access to internal web apps and the terminal environment through Microsoft Entra, after MFA.
  • Risk-based authentication — When Microsoft detects suspicious activity on an account, access is blocked automatically until the password is reset and the user re-verifies.
  • Just-in-time admin rights — Admins work as regular users and elevate only for a task, with approval — reducing the exposure of admin accounts.
  • Central app portal — One entry point to all of a user’s apps.

Device management — Microsoft Intune

A cloud service to manage Windows and macOS computers, tablets and phones — even outside the corporate network.

Computers

  • Security policies from the cloud — Replaces Group Policy, so computers outside the office are always up to date.
  • Compliance policies — A computer that doesn’t meet the requirements doesn’t get access to company resources.
  • Zero-touch deployment — Computers ship straight to the employee, ready to work, with no IT involvement.
  • App deployment and security updates — Automatically, or from a company app store.
  • Remote actions — Wipe a lost or stolen computer; reset and reinstall when something breaks.
  • Endpoint analytics — Analyze and improve performance and stability, such as boot times and app reliability.

Phones

  • Security policies — Including data loss prevention.
  • Compliance policies — A device that doesn’t meet the requirements doesn’t get access.
  • App deployment — Automatically or from the company app store.
  • Remote wipe — Of the whole device, or only of the company data.

Endpoint protection — Microsoft Defender for Endpoint (EDR)

  • Simple deployment — No extra agents, no compatibility issues or slowdown.
  • Attack surface reduction (ASR) — Blocks malicious code arriving through Office scripts and email.
  • Network protection — Blocks outbound connections to untrusted hosts and sites.
  • Ransomware protection — Controlled folder access blocks untrusted processes from sensitive folders.
  • Local and cloud protection engine — Against malicious files, scripts, memory-based attacks and advanced threats.
  • Vulnerability management — Real-time visibility of missing updates and recommended settings, prioritized — including the expected user impact before each change.
  • Automated investigation and response — Every alert is fully investigated, and fixes run on the endpoints without admin involvement.
  • Tied to access — A high-risk device is automatically blocked from cloud services.

Cloud app security — Microsoft Defender for Cloud Apps (CASB)

  • Control access to cloud services — Block access from unmanaged computers, or block downloads, uploads and printing specifically.
  • Shadow IT discovery — Find unsanctioned cloud apps in the organization, see their risk, and block them in one click.
  • Information protection and DLP — Connected to Microsoft Purview to detect sensitive data in the cloud and act automatically, such as blocking sharing.
  • Unusual activity detection — Such as mass file encryption, account takeover and malicious apps connected to mailboxes.
  • Compliance — Checks cloud services against your security standards and blocks those that don’t comply.

Ask someone who knows.

A short intro call with a security engineer from the team. No call center, no sales script.

Book a callContact us