The "AI" Security Insights Show Episode 284 - Microsoft Sentinel Pricing....it's like MAAGIC!

In this episode we have the good folks from the security company - LockBase Cyber. Leonard Volling and Charlie Smith will come on and talk about their new Microsoft Sentinel pricing tool.

Also Ed talks about how this work travel kept him from doing his homework and messed up the last show, Frank is still trying to decide if he would rather teach security or AI and Rod has finished his No Pop-Tarts January. Oh, we also talked about AI security, Sentinel data lake, AI chips from Google and how we will pivot the show in 2026 to have a deep focus on all things that help secure AI, blah, blah, blah.

Words of Wisdom:

The biggest lie we tell ourselves is, “I don’t need to write this down because I will remember it”.

Cool Tools and Links:

• https://cmd.ms/ - the Microsoft Cloud command line!

TOP AI and Security Links to take a look-see:

• Link to New Microsoft Security and AI Architect Certification - Survey | Qualtrics Survey Software

• LockBase Cyber: - Sentinel Log Planner by LockBase - Plan Your Microsoft Sentinel Data Strategy

• Open AI ready made prompts: https://academy.openai.com/public/tags/prompt-packs-6849a0f98c613939acef841c

• All the admin portal and API endpoints: 🖥 Home | [cmd.ms]

• Sentinel and XDR portal: UPDATE: New timeline for transitioning Sentinel experience to Defender portal | Microsoft Community Hub

• Microsoft Community Hub - Monthly news - February 2026 | Microsoft Community Hub

Weekly Microsoft 365 Announced Changes:

• (Updated) Upcoming Conditional Access change: Improved enforcement for policies with resource exclusions
  ID: MC1223829 | Service: Microsoft Entra | Tags: Updated message, Feature update, User impact, Admin impact
  Starting March 27, 2026, Conditional Access policies targeting All resources will be enforced even if they have resource exclusions, affecting sign-in...

• Microsoft 365 Copilot: User-day export for Copilot dashboard metrics in public preview
  ID: MC1222978 | Service: Microsoft Copilot (Microsoft 365) | Tags: Feature update, User impact, Admin impact
  Microsoft 365 Copilot dashboard adds a public preview of a new user-day export option, allowing company-level users to download de-identified daily us...

• Microsoft Defender for Android: End of support for Android 10 devices
  ID: MC1222977 | Service: Microsoft Defender XDR | Tags: User impact, Admin impact, Retirement
  Microsoft Defender for Android will end support for Android 10 devices on March 31, 2026. After this date, these devices will no longer receive update...

---

Microsoft General:

• Latest progress update on Microsoft’s Secure Future Initiative | Microsoft Security Blog

• ​​Whisper Leak: A novel side-channel attack on remote language models | Microsoft Security Blog

• New IDC research highlights a major cloud security shift | Microsoft Security Blog

AI Security:

• Public Preview: Entra ID support for RDP connections in portal

• DNS flow trace logs in Azure Firewall are now generally available

• General Availability of JavaScript Challenge in Azure Front Door WAF

• Using Packet Capture for troubleshooting Azure Firewall flows

• Public Preview: Custom WAF Block Status & Body for Azure Application Gateway

Azure Security & Defender for Cloud News:

• Microsoft Defender for Cloud Innovations at Ignite 2025

• Announcing Microsoft cloud security benchmark v2 (public preview)

• Fast-Start Checklist for Microsoft Defender CSPM: From Enablement to Best Practices

• Unlocking Business Value: Microsoft’s Dual Approach to AI for Security and Security for AI

• Check This Out! (CTO!) Guide (October 2025)

• Update Coverage Workbook in Microsoft Defender for Cloud to Include Defender for AI Plan status

Purview - Compliance & Governance:

• Consolidate & Conquer: Driving Business Transformation with Integrated Security (Part 1 of 2) | Microsoft Community Hub

Microsoft Entra:

• Microsoft named a Leader in the Gartner® Magic Quadrant™ for Access Management for the ninth consecutive year | Microsoft Security Blog

  ICYMI: Watch replays of Microsoft Entra sessions at Microsoft Ignite 2025 | Microsoft Community Hub

Copilot for Security:

• Agents built into your workflow: Get Security Copilot with Microsoft 365 E5 | Microsoft Security Blog

Sentinel:

• The Microsoft Copilot Data Connector for Microsoft Sentinel is Now in Public Preview | Microsoft Community Hub

• Turn Complexity into Clarity: Introducing the New UEBA Behaviors Layer in Microsoft Sentinel | Microsoft Community Hub

• Strategies for Threat Awareness and Response - Not product focused. Threat Actor focused and actional-able guidance.

• Sentinel & Defender XDR Ninja Training - Product focused. What’s new, deep dives, best practices ...etc.

Defender XDR:

• Monthly news - November 2025

• Strengthening calendar security through enhanced remediation

• Microsoft Ignite 2025: Transforming Phishing Response with Agentic Innovation

• Microsoft Defender for Office 365: Fine-Tuning

• You may be right after all! Disputing Submission Responses in Microsoft Defender for Office 365

• Ensure your ICES solution works seamlessly alongside Microsoft Defender

• Using the Microsoft Defender for Endpoint Files API to Validate Malware Hashes | Microsoft Community Hub

• MDE for Non‑Persistent VDI — Implementation Guide & Best Practices.

Watch the live replay