Watch or listen
The 2 September briefing
Four minutes thirty-eight. Three changes. One named owner for each.
Video
The video for this episode is coming soon.
Audio
The podcast version is coming soon.
01 | Security
On is not the same as covering
Microsoft Threat Intelligence describes a campaign distributing malware through counterfeit vendor download pages. The installer adds Defender exclusion paths, deletes shadow copies and disables Windows Update, and the download is rebuilt for every request so the hash changes each time. Microsoft’s mitigation is to enforce tamper protection. The documentation adds that exclusions are covered only if four conditions all hold, and a co-managed device is listed as not supported.
Owner: Whoever owns endpoint security, with whoever can say how each device is managed
Seven day action: read TPExclusions under Windows Defender, Features on a sample of devices; 1 means exclusions are protected, 0 means they are not, whatever the dashboard says.
Retain: the dated readings with the device management model that explains them, the tamper protection assignment, and the Defender exclusion list in force at the time.
01 Read
02 Explain
03 Keep
02 | Cost
Reversible describes the setting, not the data
Two Azure Monitor capabilities reached general availability. The cheap Auxiliary log plan now accepts standard Azure tables, and an existing table can be moved onto it in place, keeping its name, schema and queries. Microsoft calls the switch fully reversible. The documentation records that alerts stop working on a table moved to Auxiliary, that plan changes are limited to one per table per week, and that data written on the cheap plan is not in your normal queries after you switch back.
Owner: Whoever owns the Azure Monitor bill, jointly with whoever owns alerting
Seven day action: pick the noisiest tables you pay for, then list every alert rule and summary rule reading them before a single plan changes, not after.
Retain: the table plans as they stand today, every alert rule bound to them, the date of each change, and the window where data is reachable only by a search job.
01 Pick
02 List
03 Keep
03 | Networking
A toggle that costs a maintenance window
Azure Firewall auto-learn SNAT routes reached general availability. The firewall learns internal address ranges every thirty minutes and stops rewriting the source address on traffic to them, so original source addresses survive to the far side. The prerequisite is an Azure Route Server in the same virtual network, and Microsoft states that creating one where a VPN or ExpressRoute gateway already lives takes that gateway down for around ten minutes.
Owner: The network lead who owns the hub virtual network, with the change manager
Seven day action: look at what else lives in the firewall’s virtual network; if a gateway is there, this is a change window and Microsoft recommend booking sixty minutes.
Retain: the SNAT private ranges before the change, what else occupies that network, the approved window against the observed downtime, and the learned prefix list after.
01 Look
02 Book
03 Verify
Chapters
00:00 Cold open
00:11 Briefing and AI disclosure
00:28 On is not the same as covering
01:56 Reversible describes the setting, not the data
03:18 A toggle that costs a maintenance window
04:15 Three actions this week
Transcript
The accessible transcript will be published here with the episode.
AI-use disclosure
Produced by the Braintree AI news team. Both voices are AI. AI supported research, writing and narration. Every factual claim was checked against primary Microsoft sources. Each Braintree article lists its sources at the bottom.
CONNECTED EXPERTISE
Related products & services.
Explore the connected products, services and support for your next step.
