Dom explains how the FIDO2 standard uses public-key cryptography to ensure mutual authentication, effectively neutralizing these common threats by verifying the domain before any exchange occurs.

The discussion addresses the practicalities of a corporate rollout. They compare the high-security benefits of physical YubiKeys against the emerging ease of use provided by device-bound passkeys in the Microsoft Authenticator app. For IT leaders, the focus is on risk management and staging deployments through user tranches rather than a one-size-fits-all approach. By leveraging existing tools like Windows Hello for Business and Microsoft Entra ID, organizations can significantly harden their security posture against today's most prevalent digital threats.

Dom Kirby is the Senior Director of Professional Services at Pax8, where he leads a team supporting MSP partners worldwide. His work is grounded in a simple belief: technology only matters when it creates meaningful outcomes for people and businesses. By aligning strategy, people, and process, Dom helps partners grow, gain efficiencies, and strengthen cyber resilience.

Nathan Taylor is the Senior Vice President and Global Microsoft Practice Leader at Sourcepass, where he leads the Sourcepass Center of Excellence for Microsoft. His work is grounded in a simple idea: Microsoft should not be complicated. By removing complexity, confusion, and frustration from the Microsoft ecosystem, Nathan helps organizations focus on outcomes while getting the most from their Microsoft investment.

[00:03:00] The Vulnerability of Modern MFA 
SMS and TOTP were major improvements over passwords, but they no longer suffice against modern session-stealing techniques. Dom highlights how actors exploit these mediums, making phishing-resistant methods a necessity rather than an option for modern businesses.

[00:05:00] Anatomy of an Adversary-in-the-Middle Attack 
These attacks work by placing a reverse proxy between the user and the legitimate service to steal session tokens. Once an attacker has this token, they can bypass MFA entirely because the service believes the user has already authenticated.

[00:11:00] The Core Logic of FIDO2 
FIDO2 replaces shared secrets with proof of possession and mutual authentication to ensure both parties are who they claim to be. This open standard, backed by industry giants, ensures that authentication only happens with the legitimate domain.

[00:15:00] Moving Toward Approachable Passkeys 
Passkeys simplify the FIDO2 experience by using biometrics on mobile devices instead of requiring separate physical hardware. This shift makes a high-level security approachable for the average user while maintaining the same underlying cryptographic protections.

[00:24:00] Staging Your Security Rollout 
Deploying phishing-resistant MFA should be phased in, starting with high-privilege administrators and executive teams. This risk-based approach allows IT teams to identify edge cases and legacy applications that might not yet support modern authentication.

[00:26:00] Scaling FIDO2 for Service Providers Scaling hardware-backed security across multiple client tenants presents unique hurdles for technicians who traditionally used shared accounts. Nathan and Dom discuss using GDAP and PIM/PAM as better alternatives to maintain security without the risk of "golden tickets" leaving with former employees.

Episode Resources:
If you are ready to move your organization toward a phishing-resistant future and want to discuss your strategy with one of our Microsoft problem solvers, reach out to us here: https://sourcepassmcoe.com/demystifying-microsoft-contact 

Dominic Kirby on LinkedIn 

Nathan Taylor on LinkedIn

Demystifying Microsoft is handcrafted by our friends over at: fame.so

The conversation highlights ways to replace aging VPN infrastructure with more secure, per-app tunneling methods. Nathan addresses the emerging challenge of managing non-human identities through Entra Agent ID. By examining the synergy between AI-driven risk engines and conditional access, this episode provides a roadmap for IT leaders looking to modernize their security posture. 

Whether you are managing a mid-market enterprise or a large-scale organization, understanding these identity layers is critical for preventing account compromise and ensuring least privilege access. Learn how to leverage verified IDs to combat deepfakes and secure your workforce in an AI-first world.

[00:09:15] Conditional Access Logic 

Nathan describes the mechanisms that function as the digital firewall for your enterprise identities. This section explores how various signals interact to permit or deny access in real time. You might find the discussion on how these rules adapt to specific device platforms particularly relevant to your current security roadmap.

[00:15:30] The Future of Remote Connectivity 

There is a significant focus on moving away from traditional methods of connecting to private resources. The episode touches on the inherent vulnerabilities of older hardware-based solutions that many teams still rely on today. Understanding the shift to per-app tunneling could change how you view your network boundary.

[00:29:29] AI Identity Governance 

As more autonomous entities enter the workspace, the need for distinct permissions becomes paramount. This portion of the talk looks at how to avoid invisible actors within your infrastructure. It raises interesting questions about how we treat non-human users in a standard security framework.

[00:11:45] Risk Re-evaluation in Real Time 

Most security checks happen at the front door, but this episode explores what happens after a user is already inside. Nathan explains a method for continuous monitoring that can revoke access the moment a threat is detected. It is a look at a more dynamic way to handle session security during a breach attempt.

[00:27:10] Combatting AI-Driven Spoofing 

Identity verification is evolving to handle sophisticated threats like deepfakes. The discussion covers a new way to ensure a person is actually who they claim to be during high-risk workflows. This approach uses biometric checks that are designed to be much harder to bypass than traditional MFA.

[00:31:45] Strategic Licensing Decisions 

Choosing between different tiers of security can be complex, given the recent rebranding of legacy products. Nathan breaks down the practical differences between the standard identity tiers and the full integrated suite. This segment clarifies which features are essential for a robust defense strategy versus what might be redundant.

About The Host - Nathan Taylor
Nathan Taylor is the Senior Vice President and Global Microsoft Practice Leader at Sourcepass, where he leads the Sourcepass Center of Excellence for Microsoft. His work is grounded in a simple idea: Microsoft should not be complicated. By removing complexity, confusion, and frustration from the Microsoft ecosystem, Nathan helps organizations focus on outcomes while getting the most from their Microsoft investment.

Chat with our team about hardening your environment against modern credential-based threats:

Demystifying Microsoft is handcrafted by our friends over at: fame.so

In this episode, Nathan Taylor and Lindsay Cowan from the Sourcepass Center of Excellence for Microsoft break down the transition from legacy OEM and Open License models to modern subscription-based strategies. We dive deep into the nuances of core-based licensing, the "honor system" of CALs, and why the move to CSP offers unprecedented management clarity via the Microsoft Admin Portal. 

The conversation moves beyond basic compliance into strategic cost-saving opportunities like Azure Hybrid Use Benefit, which can slash cloud costs by up to 50%. We also explore how Azure Local and Azure Arc extend modern management to on-premises workloads while addressing the looming end-of-support deadlines for Server 2012 and Windows 10.

Lindsay Cowan is a Senior Manager of Sales and Business Development at Sourcepass MCOE, a company focused on helping organizations simplify, secure, and optimize their Microsoft environments. With over a decade in the Microsoft ecosystem, she specializes in helping organizations maximize their investment in Windows and SQL Server technologies through strategic licensing and cloud adoption.

Nathan Taylor is the Senior Vice President and Global Microsoft Practice Leader at Sourcepass, where he leads the Sourcepass Center of Excellence for Microsoft. His work is grounded in a simple idea: Microsoft should not be complicated. By removing complexity, confusion, and frustration from the Microsoft ecosystem, Nathan helps organizations focus on outcomes while getting the most from their Microsoft investment.

[00:04:00] The Shift to CSP Subscription Models 

Microsoft is moving away from legacy "one-time purchase" models toward subscription-based licensing that offers ongoing upgrade rights. This shift provides IT leaders with greater flexibility to adjust core counts as their server infrastructure scales up or down.

[00:08:30] Decoding the Core Licensing Minimums 

Understanding physical core requirements is essential to stay in compliance, starting with an eight-core minimum per processor and 16 per server. These rules change slightly in Azure, where an eight-core minimum applies to even the smallest virtual machines.

[00:14:00] SQL Server: Cores vs. CALs 

The decision between licensing by user CALs or by physical cores usually hinges on a "tipping point" of around 25 to 30 users. Organizations with public-facing apps or large internal teams often find the per-core model more cost-effective and easier to manage.

[00:17:00] Unlocking Azure Hybrid Use Benefit 

By using CSP subscriptions instead of pay-as-you-go licensing in Azure, businesses can reduce their cloud compute costs by 20% to 50%. This financial advantage makes CSP the primary choice for any organization running Windows Server workloads in the cloud.

[00:20:00] Modernizing On-Prem with Azure Local 

Azure Local allows companies to run the Azure codebase in their own data centers, providing a secure way to manage legacy applications without open ports. It enables features like AVD on-prem, which combines the security of cloud login with the performance of local hardware.

[00:23:00] Managing Compliance through Azure Arc 

For IT leaders who have lost track of legacy keys, Azure Arc acts as a management layer that brings on-premises servers into the Azure portal. It provides a clear path to licensing compliance and facilitates extended security updates for aging systems like Server 2012.

If Microsoft licensing is creating friction, let’s talk. We’ll review your environment and help you get clear on what matters, and what doesn’t. Contact us here: https://sourcepassmcoe.com/demystifying-microsoft-contact
Lindsay Cowan on LinkedIn
Nathan Taylor on LinkedIn

Demystifying Microsoft is handcrafted by our friends over at: fame.so

We unpack why email migrations are often the easiest part and why identity conflicts, unmanaged devices, legacy infrastructure, and licensing gaps create the biggest risks. Discover how to approach Microsoft in the M&A process with a comprehensive integration framework that improves security, reduces downtime, and optimizes licensing costs.

The episode also highlights how M&A creates an opportunity to modernize. Companies can rethink their data structure, move away from on premise systems, and adopt more cloud-based approaches using tools like Microsoft 365 and Azure.

However, everything cannot be modernized immediately, this is a gradual process.. Many organizations still rely on legacy systems, and part of the challenge is finding secure and scalable ways to maintain access while planning long term transitions.

Licensing is another critical area that often gets missed. Without proper planning, companies can end up paying for duplicate licenses and/or getting locked into renewal cycles that increase costs.

What You’ll Learn:

Nathan Taylor is the Senior Vice President and Global Microsoft Practice Leader at Sourcepass, where he leads the Sourcepass Center of Excellence for Microsoft. His work is grounded in a simple idea: Microsoft should not be complicated. By removing complexity, confusion, and frustration from the Microsoft ecosystem, Nathan helps organizations focus on outcomes while getting the most from their Microsoft investment.

[00:01:10] How M&A Migration can become a Technology Problem
Mergers often begin with a strong focus on business outcomes like growth, market expansion, and cost efficiencies. However, technology quickly becomes one of the biggest variables that can either accelerate or slow down progress. Without a clear plan for integrating Microsoft environments, teams can run into compatibility issues and delays early in the process. This segment talks about how addressing technology upfront helps avoid setbacks and keeps the integration aligned with business goals.

[00:04:30] Email Migration Is the Easy Part
Most M&A projects start with email migration because it is critical to day-to-day operations and communication. While the technical execution can be complex, it is usually well understood and supported by existing tools. The bigger challenge lies in setting expectations and ensuring clear communication throughout the transition. A smooth migration depends as much on change management as it does on technical execution.

[00:08:40] The Data Question Most Teams Skip
Before moving data, organizations need to take a step back and understand where their data resides. Migration is an opportunity to clean up outdated or redundant information and rethink storage, retention, and access policies. Making deliberate decisions here can significantly improve long-term usability and governance.

[00:12:20] Identity and Devices Are the Real Risk
Identity has become the foundation of modern security, especially within Microsoft ecosystems. During M&A, overlooking identity and device management can create serious risks around access control and compliance. These elements influence how users authenticate, what they can access, and how securely devices connect to the environment. Getting this right early is critical for both security and long-term architectural stability.

[00:21:40] Licensing Mistakes That Increase Costs
Licensing is often treated as a secondary concern, but it can have a significant financial impact if not handled carefully. Overlapping licenses, missed renewal cycles, or incorrect assumptions can quickly drive up costs during integration. Taking a proactive approach to licensing helps control expenses and ensures better alignment with actual usage.

[00:26:10] Why Early Planning Changes Everything
Bringing technical planning into the conversation early can dramatically change the outcome of an M&A project. It allows teams to identify potential risks, align systems more effectively, and avoid last-minute surprises. Early involvement also helps create a clearer roadmap for integration, reducing delays.

Our team would be happy to jump on a call to discuss your migration or Microsoft projects: https://sourcepassmcoe.com/demystifying-microsoft-contact

Nathan Taylor on LinkedIn

Demystifying Microsoft is handcrafted by our friends over at: fame.so

The discussion clarifies the often confusing Microsoft Defender landscape, comparing Defender for Business, Plan 1, and Plan 2 across both Endpoint and Office 365. You will understand how to leverage Business Premium as a comprehensive security foundation and why a holistic tenant assessment is the first step toward true resilience. Nathan and Tracy also provide actionable insights into Conditional Access Policies and the transition from basic security to a hardened posture that survives modern identity attacks.

Tracy Harper is a Client Success Manager at Sourcepass MCOE and has spent the last decade acting as a primary advocate for her clients. Drawing on her professional experience in the banking sector, she provides a pragmatic approach to risk management and identity protection. She is focused on simplifying the Microsoft landscape for organizations, ensuring they have the right tools and strategies to defend against sophisticated phishing attacks.

Nathan Taylor is the Senior Vice President and Global Microsoft Practice Leader at Sourcepass, where he leads the Sourcepass Center of Excellence for Microsoft. His work is grounded in a simple idea: Microsoft should not be complicated. By removing complexity, confusion, and frustration from the Microsoft ecosystem, Nathan helps organizations focus on outcomes while getting the most from their Microsoft investment.

Contact us here: https://sourcepassmcoe.com/demystifying-microsoft-contact
 
Learn more about our Microsoft 365 Email Security Assessment  https://sourcepassmcoe.com/microsoft-365-security-assessment-sourcepass-mcoe

Tracy Harper on LinkedIn

Nathan Taylor on LinkedIn

[00:03:56] The Evolution of EDR 

The team explores why antivirus has transitioned into Extended Detection and Response (EDR) through Defender for Endpoint. This integrates traditional protection with advanced capabilities built directly into the Microsoft platform to provide better visibility. It represents a move toward more proactive threat hunting rather than simple reactive scanning.

[00:06:46] Small Business Security Value ]Nathan explains why Business Premium is considered the "hero SKU" for organizations with fewer than 300 seats. This specific license pack includes nearly 85% of the capabilities found in enterprise-level Plan 2 security. It allows smaller teams to maintain a high security posture without the enterprise price tag.

[00:09:44] The Human Cost of Phishing 

Tracy shares a personal story regarding a $100,000 loss from a sophisticated email scam to highlight the stakes of social engineering. This narrative proves that technology alone cannot solve security if there is no human in the loop for verification. It underscores the necessity of pairing technical tools with robust accounting controls.

[00:13:51] Securing the Direct Send Vulnerability 

The host warns about a recent surge in attackers exploiting the default direct send function in Microsoft 365 tenants. This legitimate functionality is being used to bypass security filters and send high volumes of internal phishing emails. Nathan notes that this can be disabled with a single PowerShell command to immediately reduce risk.

[00:17:16] MFA as Table Stakes 

While many organizations feel safe with partial MFA, Nathan insists that it must be enforced for every single user to be effective. Relying only on global admins to have MFA leaves the rest of the environment vulnerable to identity attacks. Using conditional access policies is the most effective way to ensure this protection is consistent across the tenant.

[00:20:10] Pragmatic Tenant Hardening 

The conversation shifts to how Sourcepass MCOE approaches security through assessments rather than just selling licenses. They focus on "low-hanging fruit" to close immediate gaps in email, SharePoint, and Teams configuration. This pragmatic approach ensures that the most effective controls are implemented quickly to improve overall resilience.

Contact us here: https://sourcepassmcoe.com/demystifying-microsoft-contact
 
Tracy Harper on LinkedIn

Nathan Taylor on LinkedIn

Demystifying Microsoft is handcrafted by our friends over at: fame.so

The conversation centers on three key shifts:

With the introduction of M365 E7, Agent 365, and Copilot enhancements, Microsoft is bundling AI deeper into the platform. While the value is compelling, it also introduces new governance challenges especially around shadow AI, data exposure, and user behavior outside sanctioned tools. New controls in Edge, Purview, and Global Secure Access aim to address this, but they require intentional rollout.


2. Security is shifting to identity and automation

Traditional perimeter security is no longer the focus. Microsoft is doubling down on identity-centric security, AI-driven threat detection, and automated response. Updates from RSA including agentic SOC capabilities, voice threat detection, and expanded data loss prevention signal where security investments are heading.


3. Licensing is getting more complex and more consequential

Between upcoming price increases, changes to renewal/grace periods, and new constructs like the Extended Service Term (with a 23% premium), licensing decisions are carrying more financial risk. At the same time, new bundled offers like E7 may be cost-effective but only if aligned correctly to usage.

The episode also highlights practical changes that can improve day-to-day operations, including:

Nathan Taylor is the Senior Vice President and Global Microsoft Practice Leader at Sourcepass, where he leads the Sourcepass Center of Excellence for Microsoft. His work is grounded in a simple idea: Microsoft should not be complicated. By removing complexity, confusion, and frustration from the Microsoft ecosystem, Nathan helps organizations focus on outcomes while getting the most from their Microsoft investment.

[00:01:26] More Than a Product Launch
Some announcements feel incremental but this one doesn’t. Nathan touches on a release that signals a broader change in how Microsoft is thinking about AI across its ecosystem. It raises questions about how organizations will manage something that is no longer confined to a single tool or workflow.

[00:04:23] When Meetings Start Turning Into Content
Catching up on meetings has always been a time tradeoff. This update starts to change how that time can be used. It hints at a future where information flows differently, but also leaves open questions around how teams will adapt to it.

[00:06:15] The Problem No One Fully Sees Yet
Shadow AI is not new, but it is expanding faster than most teams can track. Nathan walks through why visibility is still a challenge even with existing tools. The interesting part is how Microsoft is trying to solve it without fully controlling it.

[00:09:20] A Small Change That Changes Risk Decisions
Some updates do not get much attention but quietly alter how teams respond to incidents. This is one of them. It introduces a middle ground that did not exist before, which could change how cautious teams approach certain actions.

[00:12:20] Where Security is Actually Moving
The conversation moves away from traditional security thinking into where attention is now shifting. Identity, automation, and AI-driven responses start to take center stage. It is not just about protection anymore, but about how fast systems can react.

[00:15:53] Why Timing is Becoming a Decision Factor
Pricing changes are expected, but timing them is becoming more complex. Nathan outlines how renewal cycles and pricing updates intersect. It leaves a practical question for teams to consider before making any changes.

Contact Us:

We help teams simplify and optimize Microsoft every day. If you want a clear view of where you stand and what to change, we can work through it with you. 

Sourcepass MCOE: https://sourcepassmcoe.com/demystifying-microsoft-contact
 
Nathan Taylor on LinkedIn

Demystifying Microsoft is handcrafted by our friends over at: fame.so

They break down how this 23% premium affects organizational budgets and renewal workflows, particularly within the New Commerce Experience framework. The discussion highlights why accidentally falling into EST can lead to unexpected billing surges and how IT leaders can instead use it strategically during complex transitions or leadership changes.

Beyond the technical shifts, they address specific optimization paths, such as moving from legacy Enterprise SKUs to Business Premium to capture better features at lower costs. Understanding these timelines is essential for maintaining service continuity without overpaying for a state of restricted access.

Nathan Taylor is the Senior Vice President and Global Microsoft Practice Leader at Sourcepass, where he leads the Sourcepass Center of Excellence for Microsoft. His work is grounded in a simple idea: Microsoft should not be complicated. By removing complexity, confusion, and frustration from the Microsoft ecosystem, Nathan helps organizations focus on outcomes while getting the most from their Microsoft investment.

Austin Kelly is a Client Success Manager at Sourcepass MCOE, a company focused on helping organizations simplify, secure, and optimize their Microsoft environments. He works closely with businesses to evaluate licensing, improve security posture, and align Microsoft investments with real operational needs.

[00:02:43] The Shift to Paid Grace Periods 

The team explores why the transition between license states is becoming more rigid under new Microsoft policies. This shift changes how organizations must view the final days of a subscription term. It introduces a financial layer to what was previously a simple administrative window.

[00:07:34] Why Free Insurance is Ending 

Austin describes a specific safety net that partners have relied on for years to protect clients from service drops. This mechanism is undergoing a fundamental change in how it is billed and accessed. The discussion centers on why free access is no longer part of the equation.

[00:10:10] The Cost of Indecision 

Nathan points out a specific percentage increase that might catch unprepared IT departments off guard during their next billing cycle. This premium applies to several major product families, including Dynamics and Power Platform. The conversation suggests a way to calculate the true cost of falling into this new status.

[00:13:59] Strategic Use of EST 

The host discusses a specific scenario where a more expensive licensing path might actually be the correct strategic choice. This applies to organizations facing internal delays or leadership transitions. It highlights a tool for maintaining access when traditional renewals are not an option.

[00:17:15] Identifying Obsolete Enterprise Licenses 

There is a specific threshold for seat counts that makes certain legacy enterprise licenses unnecessary. The team examines a better alternative that offers more features for a lower price point. This segment focuses on identifying which organizations are currently overpaying for outdated bundles.

[00:22:41] The Copilot Pricing Advantage 

A significant price gap exists between different versions of AI productivity tools that many users might overlook. Austin explains how to identify if your organization qualifies for the more cost-effective tier. It turns out that the label on the license dictates the monthly savings.

Contact Us:

Sourcepass MCOE: https://sourcepassmcoe.com/demystifying-microsoft-contact

Austin Kelly on LinkedIn
Nathan Taylor on LinkedIn

Demystifying Microsoft is handcrafted by our friends over at: fame.so

Microsoft-focused consultant Mike Hughes joins Nathan Taylor to break down what E7 licensing actually represents and why it is designed for a specific class of enterprise organizations preparing for autonomous AI agents and agentic workflows. As many IT leaders are already seeing, the value of these platforms becomes far more relevant once AI adoption moves beyond experimentation and into operational deployment.

The discussion explores how Microsoft is evolving from traditional licensing models toward bundled enterprise value combined with AI consumption pricing through tokens, Copilot usage, and agent-based compute. Mike also examines what recent E5 licensing changes may signal about Microsoft’s broader enterprise strategy.

The conversation also addresses the growing complexity of the AI ecosystem. Rather than relying on a single large language model, enterprises are increasingly being pushed toward multi-model AI environments that require flexibility, interoperability, and stronger governance frameworks. Microsoft’s positioning around AI integration and orchestration reflects that reality.

The episode closes with a discussion on AI governance, identity security, and operational oversight. As AI agents become embedded across workflows, IT and security leaders will need to manage them with the same rigor applied to human users, including visibility, permissions, access controls, compliance, and lifecycle management.

What You’ll Learn:
• Why E7 licensing is built for enterprises deploying autonomous AI agents
• How AI consumption models are reshaping Microsoft licensing and enterprise costs
• What recent E5 licensing changes may indicate about Microsoft’s long-term strategy
• Why multi-model AI environments are becoming the new enterprise reality
• How agent sprawl introduces new governance, identity, and security challenges
• What IT and security teams should prioritize now to prepare for AI-driven operations

Mike Hughes works closely with enterprises and MSPs to build and secure Microsoft environments. He previously served as a CTO managing large-scale operations across multiple companies and now focuses on helping organizations navigate Microsoft 365, security, and AI adoption. He also develops frameworks and tools to help organizations mature from basic security setups to advanced AI-driven environments.

[00:01:30] Why E7 Isn’t for Everyone
The conversation starts by setting boundaries around who E7 is built for. It quickly becomes clear that most organizations may not need it yet, which raises a bigger question about where Microsoft expects customers to go next.

[00:03:20] The Changes In E5 Licensing
Recent changes to E5 are not just incremental updates. They hint at a broader shift in how Microsoft is packaging security, analytics, and AI into its core offerings.

[00:06:10] AI Isn’t Free Even When It Looks Bundled
The discussion moves into how AI is being bundled into licenses, but still carries underlying costs. There’s a tension between accessibility and control that organizations will need to understand early.

[00:13:15] The Quiet Expansion of Identity and Security
New additions across identity, access, and infrastructure are expanding what Microsoft covers. It raises questions about where third-party tools still fit in.

[00:18:29] What It Means to Treat Agents Like Employees
The idea of agents behaving like users introduces a different kind of complexity. Governance, visibility, and accountability start to look very different in this model.

[00:25:47] Why IT Teams Can’t Sit This One Out
The episode closes with a clear message. AI adoption is already happening inside organizations, whether IT teams are ready or not.

Our team can review and audit your current licenses, helping you align the right licensing strategy to your organization’s needs.

Contact Us:
https://sourcepassmcoe.com/demystifying-microsoft-contact 

Mike Hughes on LinkedIn
Nathan Taylor on LinkedIn

Demystifying Microsoft is handcrafted by our friends over at: fame.so

They break down one of the most common and misunderstood decisions IT leaders face: choosing the right Microsoft 365 license. From Business Premium to E3 and E5, the conversation moves beyond feature lists into real-world decision-making, cost optimization, and security trade-offs.

The discussion explores when Business Premium is more than enough, why many organizations stay on E3 longer than they should, and how E5 changes the game for companies consolidating security and compliance tools. They also unpack how add-ons like Defender and Purview can bridge the gap without forcing a full upgrade.

This episode is a guide to cutting through Microsoft licensing complexity and making decisions that actually align with business outcomes.

Austin Kelly is a Client Success Manager at Sourcepass MCOE, a company focused on helping organizations simplify, secure, and optimize their Microsoft environments. He works closely with businesses to evaluate licensing, improve security posture, and align Microsoft investments with real operational needs.

[00:01:00] Why Licensing Decisions Are Being Revisited
Most organizations only rethink licensing when renewal season forces the conversation. The problem is, these decisions are often made reactively, without a clear understanding of current usage or future needs. This creates a cycle of carrying forward suboptimal setups year after year.

[00:04:00] The Case for Business Premium
There’s a reason this SKU keeps coming up as a baseline recommendation. It brings together security, device management, and identity in a way that covers most real-world needs. The conversation explores why many organizations underestimate how much it already includes.

[00:12:50] Extending Capabilities Without Jumping to E5
Upgrading isn’t always the most efficient path forward. There are targeted ways to layer additional capabilities that address specific gaps without overcommitting. This section reframes how to think about incremental upgrades versus full transitions.

[00:26:00] The Trade-Offs of Mixing Licenses
Combining different SKUs can offer flexibility, especially as organizations scale. But it also introduces inconsistencies in features and access across users. This creates edge cases that require more deliberate planning than most teams anticipate.

[00:30:00] How Licensing Terms Shape Cost Strategy
It’s not just what you buy, it’s how you buy it. Different commitment models and payment structures can significantly impact cost over time. This segment highlights how organizations can use terms strategically rather than treating them as a formality.

[00:32:30] When Consolidation Replaces Point Solutions
Many organizations are running multiple tools across security, compliance, and monitoring. The conversation explores when it makes sense to bring those capabilities into one ecosystem. It’s less about features and more about how data and workflows come together.

Episode Resources:
Contact Us:

Sourcepass MCOE Website: https://sourcepassmcoe.com/demystifying-microsoft-contact

Austin Kelly on LinkedIn
Nathan Taylor on LinkedIn

Demystifying Microsoft is handcrafted by our friends over at: fame.so

Most security issues come from gaps in configuration and inconsistent enforcement of basic controls. Nathan walks through how to approach tenant hardening step by step, starting with understanding your current environment through an assessment.

From there, he breaks down how to prioritize high-impact changes. The focus stays on identity and access, where MFA and conditional access policies play a central role. He explains why identity has become the primary security boundary and how small misconfigurations can create entry points for attackers.

The episode also covers email security, including DMARC, SPF, and phishing protection, before moving into risks like dormant accounts and unmanaged applications. As the conversation progresses, Nathan touches on more advanced threats like token theft and how approaches like FIDO2 authentication and compliant device policies help reduce exposure.

Nathan Taylor is Senior Vice President and Global Microsoft Practice Leader at Sourcepass, where he leads the Sourcepass Center of Excellence for Microsoft, also known as the Sourcepass MCOE. With nearly two decades of experience, he helps organizations navigate complex Microsoft cloud and security decisions by turning technology into secure, scalable outcomes.  

[00:05:30] Starting with an Assessment
The first step in securing a tenant is understanding what exists today. Nathan explains how running an assessment helps identify gaps and focus on improvements that reduce risk quickly without overwhelming teams or disrupting users.

[00:12:40] Why Identity is the New Security Boundary
Security has shifted from network perimeters to user identity. This section explores why MFA, conditional access, and authentication methods are now the most critical controls for preventing unauthorized access.

[00:20:15] Dormant Accounts as a Risk Factor
Unused accounts often go unnoticed but remain accessible. These accounts are typically not secured with MFA and can be exploited through password resets or social engineering, making them a common entry point for attackers.

[00:27:10] Strengthening Email Security Controls
Email continues to be the primary attack vector. Nathan outlines how DMARC, SPF, and Defender policies help reduce phishing and spoofing risks and why many tenants are still misconfigured.

[00:31:20] Defending Against Token-Based Attacks
More advanced attacks target authentication tokens instead of credentials. This section explains how FIDO2 authentication and device-based policies make it harder for attackers to gain persistent access.

Assess your Microsoft 365 Security Posture
Not sure where identity or access gaps exist in your tenant? A Microsoft 365 Security Assessment helps surface real risk and prioritize the next steps. Get a clear view of your exposure: https://sourcepassmcoe.com/m365-security-assessment-sourcepass-mcoe

Harden your Microsoft 365 environment
Many compromises succeed because foundational settings are missed. This checklist highlights the core controls every tenant should review. Validate your hardening baseline: https://sourcepassmcoe.com/articles/microsoft-365-hardening-checklist-sourcepass-mcoe

Close gaps with critical Conditional Access policies
Misconfigured Conditional Access remains a common entry point for attackers. This guide outlines the policies every tenant should enforce. Review the must have Conditional Access policies: https://sourcepassmcoe.com/articles/top-conditional-access-policies-for-m365-security-sourcepass-mcoe

Demystifying Microsoft is handcrafted by our friends over at: fame.so

They explore what is included in E7. It builds on E5 and adds Entra Suite, Copilot for Microsoft 365, and Agent 365. Together, these components reflect a more integrated approach, where AI is embedded into workflows while governance, access, and data controls are addressed alongside it rather than after the fact.

The conversation then shifts to how AI is changing operational expectations. Tools are moving beyond assistance and beginning to execute tasks independently. Lindsay highlights that, as many IT leaders already recognize, the core concern is not what AI can do, but how it operates within defined policies and boundaries. The episode closes with a practical view on adoption, including testing in controlled environments and preparing for the governance and security implications that follow.

What You’ll Learn:
Why Microsoft introduced E7 and what it signals about the evolving AI and security landscape
How E7 builds on E5 and where the additional control and visibility come from
What Entra Suite, Copilot, and Agent 365 contribute to a more governed AI environment
Why AI agents introduce new governance, compliance, and oversight challenges
How Copilot is evolving from assistance to execution within enterprise workflows
What to consider before scaling AI across teams and environments

About the Guest:
Lindsay Cowan is a Senior Manager, Sales and Business Development at Sourcepass Center of Excellence for Microsoft, focused on helping organizations simplify, secure, and optimize their Microsoft environments. She works closely with clients to evaluate emerging capabilities across AI and security, translating them into practical, governed use cases within enterprise environments.

Episode Highlights:

[00:01:19] Why Microsoft is Launching E7 Now
Organizations are already evaluating multiple AI solutions and, as you know, balancing innovation with risk. Microsoft’s approach with E7 is to consolidate AI, security, and identity into a single SKU that prioritizes both capability and control.

[00:05:40] What E7 Actually Includes
E7 builds on E5 and layers in Entra Suite, Copilot for Microsoft 365, and Agent 365. This reflects a shift away from fragmented tooling toward a more unified, policy-driven ecosystem.

[00:10:41] The Question Organizations Should Be Asking About AI Agents
The focus is moving from capability to accountability. AI agents can perform tasks, but the real challenge lies in ensuring consistent behavior, auditability, and alignment with organizational policies.

[00:16:20] AI Moving from Assistance to Execution
Copilot is beginning to take on more active roles within workflows. As many teams are already seeing, this changes how productivity, ownership, and oversight need to be managed.

[00:18:21] AI Security is Expanding the Risk Surface
AI introduces new categories of risk, including data exposure, misuse, and compliance gaps. Microsoft is embedding governance and security controls to address risks that traditional models did not account for.

Have questions about E7, Copilot Cowork, or your Microsoft licensing stack? Talk to the Sourcepass MCOE team.

Want to dig deeper into the topics covered in this episode? Start here.

Is Microsoft 365 E7 Worth the Upgrade from E5? https://sourcepassmcoe.com/articles/is-m365-e7-worth-the-upgrade-from-e5

Copilot Cowork Brings Agentic Automation to Microsoft 365 https://sourcepassmcoe.com/articles/copilot-cowork-brings-ai-automation-to-m365

How Agent 365 Controls AI Agent Sprawl https://sourcepassmcoe.com/articles/how-agent-365-controls-ai-agent-sprawl

Demystifying Microsoft is handcrafted by our friends over at: fame.so

The takeaway is straightforward. These attacks are common, but they are also preventable when the right identity and security foundations are in place.

The focus throughout is clear. These attacks are common, but they are also preventable if the right foundations are in place.

Nathan Taylor is Senior Vice President and Global Microsoft Practice Leader at Sourcepass, where he leads the Sourcepass Center of Excellence for Microsoft, also known as the Sourcepass MCOE. With nearly two decades of experience, he helps organizations navigate complex Microsoft cloud and security decisions by turning technology into secure, scalable outcomes.

[00:07:15] The MFA Problem Most Organizations Miss
It seems like a solved problem, but it is not. Many teams believe their MFA and phishing protections are fully set up, but small gaps still exist. This moment hints at why those gaps matter more than expected.

[00:16:30] The Financial Impact You Don’t See Coming
Did you know a single compromised account can lead to losses in the hundreds of thousands? This part of the episode points to real-world outcomes that show how quickly things can escalate.

[00:19:45] Why Microsoft 365 is a Prime Target
Attackers are not choosing platforms randomly. This segment explores what makes Microsoft 365 such an attractive target and why it continues to see high volumes of attacks.

[00:03:10] What “Hacked” Really Means
The term gets used loosely, but the reality is more structured. This section teases how business email compromise actually works and why it is so effective.

[00:11:00] What Happens After Access Is Gained
Did you know attackers often wait before acting? This moment reveals how they observe, set up rules, and position themselves before making a move.

•  Assess your Microsoft 365 Security Posture
Not sure where identity or access gaps exist in your tenant? A Microsoft 365 Security Assessment helps surface real risk and prioritize the next steps. Get a clear view of your exposure: https://sourcepassmcoe.com/m365-security-assessment-sourcepass-mcoe

• Harden your Microsoft 365 environment
Many compromises succeed because foundational settings are missed. This checklist highlights the core controls every tenant should review. Validate your hardening baseline: https://sourcepassmcoe.com/articles/microsoft-365-hardening-checklist-sourcepass-mcoe

•  Close gaps with critical Conditional Access policies
Misconfigured Conditional Access remains a common entry point for attackers. This guide outlines the policies every tenant should enforce. Review the must have Conditional Access policies: https://sourcepassmcoe.com/articles/top-conditional-access-policies-for-m365-security-sourcepass-mcoe

Demystifying Microsoft is handcrafted by our friends over at: fame.so

Demystifying Microsoft is a podcast for IT leaders who want clarity, not complexity, around what matters most.
No jargon. No fluff. No vendor spin.

Each episode features direct, practical conversations with Microsoft experts on licensing, security, AI, and the decisions that shape your organization.

If you want straightforward insight into the Microsoft ecosystem, this podcast is for you.

🔔 Subscribe so you never miss an episode.

#DemystifyingMicrosoft #Microsoft365 #ITLeadership #MicrosoftLicensing #CIO #Copilot

Demystifying Microsoft is handcrafted by our friends over at: fame.so