Expect two approvals when changing Google Workspace admin-role scope under multi-party review
A move between organizational-unit scopes can remain pending until both generated requests are approved.
Read the guideDSE security knowledge hubMicrosoft 365 & Identity
Microsoft 365 & Identity
Knowledge
Page 2 of the DSE Microsoft 365 & Identity knowledge center, with source-backed guidance and practical next steps.
DSE-authoredOfficial sourcesReviewed guidance
Search the library Explore this topic
Start with the cornerstone guide Microsoft 365 & Identity knowledge center
Clear guidance for Microsoft 365, Entra identity, account protection, collaboration, endpoint policy, and lifecycle changes.
DSE post stream
760 articlesMicrosoft 365 & Identity
Plan Google Workspace 2SV enforcement around enrollment grace and scheduling behavior
The scheduled enforcement date is not a precise activation time, and new-user grace still allows password-only access.
Read the guide
Account for Google web-session exclusions and the upstream IdP session
A shorter Google web session may renew silently if the upstream identity-provider session is still valid.
Read the guide
Choose scope-specific Google Workspace app access before marking an integration Trusted
An application that needs one service does not automatically need permission to request every Workspace scope.
Read the guide
Review required OIDC claims before connecting a SaaS application through Cloudflare Access
A missing required claim can block authentication even after the user signs in successfully.
Read the guide
Match Cloudflare Access session settings to the authentication prompt you expect
A short application token does not always mean another identity-provider login.
Read the guide
Resolve a duplicate iOS mail profile before expecting Intune to replace it
Why can an existing iOS email profile prevent an Intune email configuration from arriving?
Read the guide
Separate Elastic SAN private-endpoint creation authority from connection approval
The role used to create the volume-group endpoint and the operation used to approve its connection are distinct checks.
Read the guide
Supply the principal type when a just-created identity's Azure role assignment races replication
A newly created service principal can be unavailable to a role-assignment operation in another region.
Read the guide
Scope Monitoring Active Directory for Signs of Compromise in observed AD/DNS state
Microsoft states: “Law Number Five: Eternal vigilance is the price of security. - 10 Immutable Laws of Security Administration).”
Read the briefing