AI Under Attack: Building Zero Trust Security with Microsoft Copilot, Azure & Microsoft 365 - Mourtaza Fazlehoussen [MVP]

AI Under Attack: Building Zero Trust Security with Microsoft Copilot, Azure & Microsoft 365 - Mourtaza Fazlehoussen [MVP]

Artificial intelligence is transforming cybersecurity faster than any technology before it. But while AI helps defenders automate investigations and respond to incidents faster, it also gives cybercriminals powerful new capabilities. In this episode of the M365 Show, Microsoft MVP, CISO, technology evangelist, and international speaker Mourtaza Fazlehoussen joins Mirko Peters to discuss how organizations can embrace AI without increasing their security risks. FROM CLASSIC CYBERSECURITY TO AI-POWERED DEFENSE Mourtaza shares his journey from programming on MS-DOS systems and Microsoft technologies to leading enterprise security initiatives around the world. Drawing from decades of experience across Europe, Africa, and Asia, he explains how the cybersecurity landscape has evolved from protecting networks to defending identities, cloud platforms, AI workloads, and intelligent agents. The discussion highlights why security today requires continuous adaptation as attackers become increasingly sophisticated with AI-powered techniques. WHY BUYING MORE SECURITY TOOLS DOESN'T MAKE YOU MORE SECURE Many organizations continue investing heavily in cybersecurity products but still struggle to improve their overall security posture. Mourtaza explains why technology alone is never enough. Successful security depends on adoption, governance, integration, operational processes, executive support, and continuous monitoring. Without these elements, even the most advanced security platforms remain underutilized while employees create new risks through Shadow IT and Shadow AI. AI HAS CHANGED THE ATTACKER'S PLAYBOOK The conversation explores how generative AI has fundamentally changed phishing attacks, social engineering, and identity-based threats. Modern attackers no longer send emails filled with grammar mistakes. Instead, they use AI to create highly personalized campaigns based on publicly available information from platforms like LinkedIn. Mourtaza shares a fascinating real-world example of attackers compromising an organization through a malicious restaurant menu PDF after researching employee behavior. MICROSOFT SECURITY COPILOT EXPLAINED What exactly is Microsoft Security Copilot, and how does it differ from Microsoft 365 Copilot? Mourtaza explains that Microsoft Security Copilot is designed specifically for Security Operations Centers (SOC) and security analysts. Rather than replacing security professionals, it acts as an intelligent assistant capable of: * Prioritizing security alerts * Correlating incidents across Microsoft Defender, Sentinel, and Intune * Generating investigation summaries * Accelerating threat hunting * Helping junior analysts perform at a much higher level Unlike Microsoft 365 Copilot, which focuses on productivity, Security Copilot is built to improve incident response and security operations. BUILDING AI GOVERNANCE BEFORE DEPLOYING AI One of the central themes of this episode is AI Governance. Organizations cannot simply deploy AI assistants and hope everything remains secure. They need governance frameworks covering data classification, approved AI services, access control, responsible prompting, compliance requirements, and continuous monitoring. Mourtaza explains how Microsoft Purview, Azure AI Foundry, Microsoft Defender, Microsoft Entra ID, and Microsoft Security Copilot work together to establish responsible AI governance while supporting regulations such as the EU AI Act, GDPR, DORA, CRA, and NIS2. ZERO TRUST IN THE AGE OF AI Zero Trust remains one of Microsoft's core security principles—but AI expands its importance. The discussion covers why organizations must: * Verify every identity * Apply least privilege access * Assume breach * Secure AI agents like human identities * Monitor prompts, data access, and AI behavior continuously As AI systems gain access to business-critical information, identity becomes the new security perimeter. INSIDE A RANSOMWARE INCIDENT Mourtaza walks through the critical first hour after discovering a ransomware attack. He explains the importance of rapid detection, containment, investigation, executive communication, evidence preservation, business continuity planning, and disaster recovery. Microsoft Security Copilot can significantly reduce investigation time by automatically correlating events and generating incident summaries, allowing security teams to focus on response rather than manual analysis. KEY TAKEAWAYS AI is changing cybersecurity for both defenders and attackers. Organizations must combine modern security technology with strong governance, identity protection, Zero Trust principles, and continuous monitoring. Microsoft Security Copilot is an incredibly powerful assistant—but it complements security professionals rather than replacing them. As Mourtaza concludes, governance is the foundation that enables organizations to innovate with AI while maintaining trust, compliance, and resilience. Become a supporter of this podcast: https://www.spreaker.com/podcast/m365-fm-modern-work-security-and-productivity-with-microsoft-365--6704921/support [https://www.spreaker.com/podcast/m365-fm-modern-work-security-and-productivity-with-microsoft-365--6704921/support?utm_source=rss&utm_medium=rss&utm_campaign=rss].

Copilot in Microsoft Entra ID - Simply Explained

Managing identities has become one of the most challenging responsibilities for modern IT teams. Every day, organizations process thousands of sign-ins, evaluate Conditional Access policies, detect risky users, and investigate authentication failures. Finding the root cause often means jumping between multiple dashboards, logs, and policy views. Copilot in Microsoft Entra ID changes that experience completely. Instead of manually searching through sign-in logs, audit logs, and Identity Protection alerts, administrators can simply ask questions in plain English and receive clear explanations, recommendations, and summaries within seconds. WHY IDENTITY TROUBLESHOOTING IS SO HARD Traditional Entra troubleshooting is time-consuming. A failed sign-in often requires checking Sign-in Logs, Conditional Access evaluations, device compliance, Identity Protection, Audit Logs, and user information across multiple screens. Administrators must interpret technical error codes, correlation IDs, and JSON data before they can determine what actually happened. For experienced identity engineers this is manageable—but for junior administrators and helpdesk teams, it can be overwhelming.  AN AI ASSISTANT FOR YOUR IDENTITY PLATFORM Copilot is built directly into the Microsoft Entra admin center. Instead of searching manually, administrators ask questions such as: * Why did this user fail to sign in? * Show me high-risk users. * Summarize sign-in activity from the last 24 hours. * Which Conditional Access policy blocked this user? Copilot automatically searches Sign-in Logs, Conditional Access policies, Identity Protection, Audit Logs, and user information before returning a plain-English explanation instead of raw technical data. It also suggests helpful follow-up questions, making investigations much more efficient. FASTER SIGN-IN TROUBLESHOOTING One of Copilot's biggest strengths is investigating failed sign-ins. Instead of manually filtering logs and interpreting error codes, administrators can simply ask why a user couldn't access Microsoft Teams or another application. Copilot reviews recent sign-ins, evaluates Conditional Access policies, checks device compliance, and identifies the exact reason for the failure. It can also provide additional context such as browser information, operating system, IP address, location, and authentication method. Tasks that previously required fifteen minutes of investigation can often be completed in less than a minute.  INVESTIGATING RISKY USERS Identity Protection continuously detects suspicious user activity, but understanding those alerts isn't always easy. Copilot summarizes risky users by combining multiple detections into a single narrative. Instead of reviewing numerous individual alerts, administrators receive a complete explanation describing why a user is considered high risk, what suspicious activity occurred, and which remediation steps Microsoft recommends. Suggested actions may include password resets, blocking future sign-ins, or validating whether the activity was legitimate, allowing security teams to respond much more quickly.  UNDERSTANDING CONDITIONAL ACCESS Conditional Access policies are powerful—but also incredibly complex. Copilot explains exactly which policies applied during a sign-in, why they were triggered, and what conditions caused the final decision. It can also identify frequently triggered policies, overlapping configurations, and opportunities to simplify policy design. Combined with Microsoft's Conditional Access Optimization Agent, administrators receive recommendations for improving policy quality without manually reviewing every configuration. DOES IT REALLY SAVE TIME? Microsoft's internal studies demonstrate significant productivity improvements. Administrators completed sign-in investigations 46% faster, while investigation accuracy improved by 46.8%. Most participants reported higher confidence in their work, and nearly all wanted to continue using Copilot as part of their daily identity management workflow. Although results vary between organizations, the overall trend is clear: AI dramatically reduces the time spent on repetitive identity investigations.  SECURITY AND GOVERNANCE  Copilot operates entirely within your existing Microsoft Entra security model. It inherits the administrator's existing permissions, meaning it can never access information that the user isn't already authorized to view. Conditional Access policies continue to apply, prompts are recorded through standard audit logging, and administrators remain responsible for approving sensitive actions. Copilot provides recommendations—it never performs privileged identity operations automatically.  WHY COPILOT IN ENTRA ID MATTERS Copilot transforms identity management from searching through technical logs into having conversations about identity. Helpdesk teams can solve sign-in problems without escalating every issue. Identity administrators investigate incidents significantly faster. Security analysts understand risky users more quickly. Even application owners can diagnose authentication failures without becoming Entra experts. Rather than replacing identity professionals, Copilot amplifies their expertise, allowing organizations to resolve problems faster while making Microsoft's identity platform far more accessible to everyone responsible for managing modern authentication and security. Become a supporter of this podcast: https://www.spreaker.com/podcast/m365-fm-modern-work-security-and-productivity-with-microsoft-365--6704921/support [https://www.spreaker.com/podcast/m365-fm-modern-work-security-and-productivity-with-microsoft-365--6704921/support?utm_source=rss&utm_medium=rss&utm_campaign=rss].

Copilot for Microsoft Fabric - Simply Explained

Microsoft has several Copilots, but each one serves a completely different purpose. Microsoft 365 Copilot helps you write documents and summarize meetings. GitHub Copilot helps developers write code. Copilot for Microsoft Fabric is designed specifically for data and analytics. It acts as an AI-powered data assistant that helps you write SQL, generate DAX measures, build reports, create data pipelines, and transform datasets using plain English. Instead of memorizing complex syntax, you simply describe what you want, and Copilot generates a working first draft that you can review and refine. AN AI ASSISTANT FOR YOUR DATA Copilot is built directly into Microsoft Fabric and understands your organization's data. Powered by Azure OpenAI, it doesn't rely on generic internet knowledge. Instead, it understands your Fabric workspace, semantic models, tables, schemas, and relationships. Whether you're asking for a SQL query, a Power BI report, or a PySpark transformation, Copilot generates content based on your actual business data. Think of it as a junior data engineer who works incredibly fast—but still needs your review before anything goes into production. WHERE COPILOT WORKS  Copilot is integrated across several Microsoft Fabric workloads. Inside Data Factory, it helps build Power Query transformations and data pipelines using natural language. Within Data Engineering, it generates PySpark code for Fabric Notebooks, explains existing code, and helps developers understand complex data transformations. In the Data Warehouse, Copilot converts plain English into SQL queries, making data exploration much easier for users who don't write SQL every day. Finally, in Power BI, Copilot creates dashboards, generates DAX measures, builds visualizations, and summarizes reports in natural language for business users. REAL-WORLD EXAMPLES Different roles benefit from Copilot in different ways. A data engineer can generate PySpark code to clean and transform raw datasets without manually writing every line of code. A business analyst can describe a dashboard in plain English and have Copilot build the initial Power BI report, complete with charts, KPIs, and calculated measures. A SQL user can request a query such as "Show total sales by region for last quarter," allowing Copilot to generate the SQL automatically instead of manually writing joins and aggregations. Each scenario dramatically reduces repetitive work while allowing experts to focus on analysis rather than syntax. GETTING STARTED Using Copilot requires very little setup. Organizations need Microsoft Fabric running on a paid Fabric capacity (F2 or higher), and a Fabric administrator must enable Copilot within the tenant settings. Once enabled, Copilot appears directly inside the supported Fabric experiences without requiring additional installation or configuration. It also respects existing security permissions, meaning users only receive AI assistance for data they are already authorized to access. WHY BEGINNERS SHOULD CARE One of the biggest barriers to analytics has always been learning technical languages such as SQL, DAX, and PySpark. Copilot dramatically lowers that barrier by allowing users to describe business problems in natural language instead of writing code from scratch. Rather than spending weeks learning syntax before becoming productive, beginners can start building reports, exploring data, and learning by reviewing the code Copilot generates. It accelerates learning while making self-service analytics accessible to a much wider audience. THE HUMAN STILL MATTERS Despite its impressive capabilities, Copilot should never be treated as an autonomous data engineer. It can misunderstand prompts, generate inefficient SQL, select the wrong visual, or produce calculations that require refinement. Every generated query, DAX measure, notebook, and report should be reviewed and validated before being used in production. Copilot removes repetitive work—but data quality, governance, security, and business decisions still belong to people. WHY COPILOT FOR FABRIC MATTERS Copilot for Microsoft Fabric represents one of Microsoft's biggest advances in modern data analytics. By combining AI with Fabric's unified data platform, it enables both beginners and experienced professionals to build pipelines, analyze data, create reports, and generate insights much faster than before. Rather than replacing data professionals, it allows them to spend less time writing repetitive code and more time solving business problems. When paired with a clean semantic model and strong governance, Copilot becomes an incredibly powerful productivity tool that makes Microsoft Fabric more approachable, more efficient, and significantly easier to learn. Become a supporter of this podcast: https://www.spreaker.com/podcast/m365-fm-modern-work-security-and-productivity-with-microsoft-365--6704921/support [https://www.spreaker.com/podcast/m365-fm-modern-work-security-and-productivity-with-microsoft-365--6704921/support?utm_source=rss&utm_medium=rss&utm_campaign=rss].

Platform Engineering: The New Operating Model for Azure

DevOps changed how software is built, but it didn't eliminate complexity—it simply redistributed it. As organizations adopted cloud platforms, Infrastructure as Code, containers, and CI/CD pipelines, developers inherited responsibilities that once belonged to operations teams. Networking, security, identity, compliance, monitoring, governance, and infrastructure provisioning became part of every developer's daily workload. The result was a new bottleneck driven by cognitive overload rather than manual ticket queues. In this episode of the M365 FM Podcast, host Mirko Peters explores why Platform Engineering has emerged as the next evolution of cloud operations and how it fundamentally changes the way enterprises build and operate Microsoft Azure environments. Instead of treating infrastructure as a service that developers request, Platform Engineering treats it as a product they consume. You'll discover how Internal Developer Platforms (IDPs), Azure Bicep, Azure Verified Modules, Golden Paths, self-service infrastructure, and automated governance dramatically improve developer productivity while strengthening security and compliance. This episode provides a practical blueprint for organizations looking to scale Azure without scaling operational complexity. WHY DEVOPS REACHED ITS LIMITS DevOps transformed software delivery by breaking down barriers between development and operations. For small teams, this worked remarkably well. But as organizations grew, developers inherited an ever-expanding list of operational responsibilities, dramatically increasing cognitive load and reducing the time available for building business value.  Topics include: * Infrastructure as Code * Networking * Identity Management * Security * Compliance * Monitoring * Incident Response * Automation * CI/CD * Developer Experience Rather than eliminating bottlenecks, DevOps often shifted them from operations teams to developers. THE COGNITIVE LOAD CRISIS One of the central themes of this episode is cognitive load. Modern developers must understand networking, Azure Policy, RBAC, identity, monitoring, infrastructure, security, and application development—all at the same time. Every deployment requires context switching across multiple systems, dramatically reducing productivity. The discussion explains why developer burnout isn't caused by difficult programming problems, but by unnecessary operational complexity that distracts teams from delivering business value. Platform Engineering reduces this burden by moving infrastructure complexity into reusable platform services.  PLATFORM ENGINEERING EXPLAINED Platform Engineering introduces an entirely different operating model. Instead of infrastructure teams responding to tickets, they build internal products that developers consume through self-service. The conversation explores: * Internal Developer Platforms (IDPs) * Self-service infrastructure * Platform teams * Infrastructure products * Developer portals * Automation * Platform APIs * Standardization * Service catalogs * Product thinking Infrastructure becomes predictable, repeatable, and immediately available without manual approvals. GOLDEN PATHS & SELF-SERVICE INFRASTRUCTURE A key concept discussed throughout the episode is the Golden Path. Rather than forcing developers to make hundreds of infrastructure decisions, Platform Engineering provides secure, opinionated deployment patterns that automatically include organizational standards. Topics include: * Golden Paths * Azure Bicep * Azure Verified Modules * Infrastructure templates * Deployment automation * Governance by design * Built-in security * Observability * Logging * Compliance Developers focus on building applications while the platform automatically enforces security, governance, and operational best practices. AZURE BICEP AS THE FOUNDATION Azure Bicep plays a central role in enabling modern Platform Engineering. Instead of maintaining large ARM Templates or manually provisioning Azure resources, organizations create reusable Bicep modules that encapsulate networking, identity, monitoring, security, and infrastructure standards. The episode explains how Azure Verified Modules, module registries, semantic versioning, and Infrastructure as Code enable organizations to scale Azure consistently across hundreds of subscriptions and development teams.  GOVERNANCE WITHOUT SLOWING DEVELOPERS DOWN Traditional governance often relies on manual approvals that slow software delivery. Platform Engineering replaces those approval gates with automated guardrails. The discussion covers: * Azure Policy * RBAC * Policy as Code * Compliance as Code * Continuous validation * Automated security * Landing Zones * Management Groups * Drift detection * Governance automation Instead of reviewing deployments after they're created, organizations enforce standards automatically before infrastructure reaches production. INTERNAL DEVELOPER PLATFORMS (IDPS) Technology alone doesn't create great developer experiences. Platform Engineering introduces Internal Developer Platforms that act as centralized portals where developers discover templates, deploy infrastructure, review documentation, and consume reusable platform services. Rather than searching across multiple repositories or submitting support tickets, developers gain access to standardized infrastructure through intuitive self-service experiences. The episode also explores why successful platform teams measure adoption and developer satisfaction—not simply the number of features they deliver.  PLATFORM ENGINEERING AS A PRODUCT One of the biggest mindset shifts discussed is treating the platform itself as a product. Platform teams become internal product organizations that continuously improve developer experience through feedback, usage metrics, adoption analysis, and iterative improvements. Success is measured by: * Developer satisfaction * Platform adoption * Time-to-first-deployment * Reduced support tickets * Faster onboarding * Reduced cognitive load * Deployment frequency * Lead time * Reliability * Business value A successful platform is one developers choose because it makes their work easier Become a supporter of this podcast: https://www.spreaker.com/podcast/m365-fm-modern-work-security-and-productivity-with-microsoft-365--6704921/support [https://www.spreaker.com/podcast/m365-fm-modern-work-security-and-productivity-with-microsoft-365--6704921/support?utm_source=rss&utm_medium=rss&utm_campaign=rss].

Power BI Copilot - Simply Explained

Power BI Copilot brings generative AI directly into Microsoft's business intelligence platform, helping users build reports, write DAX formulas, analyze data, and generate insights using natural language. Instead of memorizing complex formulas or spending hours designing dashboards, you can simply describe what you want, and Copilot provides a strong starting point. However, while Copilot is incredibly powerful, it isn't infallible. Understanding both its strengths and its limitations is essential if you want to use it effectively in production environments. AN AI ASSISTANT FOR YOUR DATA Power BI Copilot is built directly into both Power BI Desktop and the Power BI Service. Unlike a general-purpose AI chatbot, Copilot understands your semantic model, including tables, relationships, measures, and calculated columns. Rather than relying on internet knowledge, it works with your actual business data to generate formulas, reports, and answers tailored to your environment. This deep integration is what makes Copilot significantly more useful than simply asking a generic AI assistant about Power BI. THE THREE BIGGEST SUPERPOWERS Copilot excels in three key areas. First, it can generate DAX measures from plain English. Instead of remembering complex syntax, you describe the calculation you need, and Copilot produces both the formula and an explanation. Second, it can automatically create complete report pages. Simply describe the dashboard you want, and Copilot builds an initial layout with visuals, KPIs, slicers, and charts. Finally, Copilot allows business users to ask questions about their data in natural language while also generating written summaries that explain trends and insights without requiring deep analytical expertise. THE BIGGEST RISK One of the most important lessons when using Power BI Copilot is understanding that confident answers are not always correct. Copilot may occasionally misunderstand your semantic model, interpret report terminology incorrectly, or retrieve values from the wrong visual. Because its responses sound authoritative, users can easily trust incorrect numbers without verification. For this reason, every important result should be validated against the underlying report before being shared with stakeholders. WRITING BETTER PROMPTS The quality of Copilot's answers depends heavily on how questions are asked. Using the exact terminology from your semantic model dramatically improves accuracy. Referencing actual table names, measures, report labels, and visual titles reduces ambiguity and helps Copilot understand your intent more reliably. Being specific about time periods, visual types, and required outputs also leads to significantly better results than broad or vague requests. WHAT COPILOT CANNOT DO Despite its impressive capabilities, Copilot has clear limitations. It cannot accurately predict future business performance, explain why business events occurred, repair poor-quality data, or completely redesign report layouts. It also depends entirely on the quality of your semantic model—if your data is inconsistent or poorly structured, Copilot's responses will reflect those weaknesses. Like any AI assistant, it accelerates existing processes rather than replacing good data modeling practices. BUILDING A BETTER DATA MODEL The foundation of successful AI-powered reporting is a clean semantic model. Descriptive table names, meaningful column names, well-defined relationships, and Microsoft's "Prep Data for AI" capabilities all help Copilot understand business context more effectively. Organizations that invest time in organizing their data models consistently receive more accurate DAX formulas, report layouts, and natural language responses. WHY POWER BI COPILOT MATTERS Power BI Copilot dramatically lowers the learning curve for business intelligence. Citizen developers no longer need to memorize DAX syntax before becoming productive, while experienced analysts can automate repetitive report creation and formula writing. At the same time, Copilot serves as an excellent teaching tool by explaining generated formulas and helping users understand Power BI concepts as they build reports. The most successful users treat Copilot as a drafting assistant rather than a replacement for critical thinking. They validate calculations, refine AI-generated reports, and use Copilot to accelerate their workflow while relying on their own expertise to make final business decisions. Used this way, Power BI Copilot becomes one of the most valuable productivity features available in the modern Power BI platform. Become a supporter of this podcast: https://www.spreaker.com/podcast/m365-fm-modern-work-security-and-productivity-with-microsoft-365--6704921/support [https://www.spreaker.com/podcast/m365-fm-modern-work-security-and-productivity-with-microsoft-365--6704921/support?utm_source=rss&utm_medium=rss&utm_campaign=rss].