Blog
Notes from the CloudPandas team
Practical guidance on Microsoft 365, Azure, Intune, Entra ID, security, and modern communications.
SecurityDMARCDKIM: Who Signed This Message?
DKIM signs the message itself, and the signature survives every hop that changes nothing. Whoever signed it is not necessarily the sender. Why Microsoft 365 needs two rotations to reach 2048 bits, and why a properly signed message can still be phishing.
Martin Sende·
SecurityMicrosoft 365DMARCSPF: Who Gets to Speak in Your Name?
SPF answers a single question: is this server allowed to hand over mail on behalf of this domain? Why the ten-lookup limit exists, where the lookups go in real-world records, why SPF breaks on forwarding, and why an SPF pass without alignment counts for nothing under DMARC.
Martin Sende·
SecuritySecurityDMARCNIS2 and DMARC: Why No Law Tells You What to Do
NIS2 never mentions DMARC. For many companies there is still no way around it. The path from the law to the actual technology runs through the state of the art and Germany's BSI technical guidelines. With legal context from Raphael Köllner.
Martin Sende·
SecurityComplianceIntuneCompany Portal usage data: the one toggle you cannot configure
Company Portal telemetry is enabled by default with no official admin switch. We dive deep into the UWP settings hive to show you where the toggle lives and how to manage it.
Artem Brening·
SecurityMigrationMicrosoft 365Passkeys become the default in Entra ID – what to do before September 1
With Microsoft phasing out SMS and voice MFA in Entra ID, passkeys are becoming the new default. Here is how to prepare your organization before the deadlines.
Artem Brening·
Modern WorkModern WorkMicrosoft 365How Teams connects to the telephone network
While Teams Phone brings phone features to the client, it does not yet connect them to the public telephone network. To do that, you need one of three connection options. Which one is right for you - and what you need to consider.
Pascal Freund·
SecurityMicrosoft 365ExchangeFull Participation: Why a DMARC Standard Doesn't Mean p=reject for Everyone
DMARC is now an IETF standard, RFC 9989. But a standard is not a mandate, and full participation does not mean p=reject. What DMARCbis actually requires, and why the standard even bars receivers from blindly enforcing p=reject.
Martin Sende·
Modern WorkAIMicrosoft 365AI Phone Systems: 3 tips to improve your Voice Agents
AI Voice Agents need more than a good prompt. Here's 3 tips to further improve them.
Pascal Freund·
SecurityDMARCSecurityDMARCbis: The DNS Tree Walk and Why np Doesn't Always Fire on DNSSEC Domains
DMARCbis replaces the Public Suffix List with a DNS Tree Walk. What the psd tag actually does, and why np can silently fail on DNSSEC domains that use Compact Denial of Existence.
Martin Sende·
Modern WorkMicrosoft 365Modern WorkNew Call Flow visualizer in Teams Admin Center
Microsoft has introduced a Call Flow Visualizer for auto attendants in the Teams Admin Center. What this feature shows, when it became available, and which limits it has..
Pascal Freund·
SecurityDMARCMicrosoft 365DMARCbis: The tag changes and why t doesn't replace pct
DMARCbis cleans up the DMARC tags: pct, rf, and ri are dropped, while np and t are added. It sounds like routine, but it isn't everywhere. Why t does not replace pct and what this means for the path to full enforcement.
Martin Sende·
SecurityMicrosoft 365DMARCDMARCbis is here. What is changing. And what is not.
The new DMARCbis standard is here: Learn what is changing with email authentication, why your existing record will continue to work, and which DNS details are now important.
Martin Sende·