--- title: "Information Security" --- # Information Security --- # ATA Learning Adam the Automator Tap to hide [ ATA Learning ](/) * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Search for: * [](https://twitter.com/adbertram) * [](https://github.com/Adam-the-Automator) * [](https://www.linkedin.com/company/adam-the-automator-llc) * [](/feed/) Show FilterReset Filters × Reset Filters ## Tag Search Search tags ## Tags * Security(30) * Azure(8) * Microsoft 365(8) * Active Directory(7) * PowerShell(7) * AI(6) * Linux(5) * Microsoft Entra(5) * Specops(5) * Automation(3) * Microsoft 365 Copilot(3) * Microsoft Sentinel(3) * Windows(3) * AWS(2) * Certificates(2) * Containers(2) * Governance(2) * Group Policy(2) * Kubernetes(2) * Microsoft Azure(2) * Microsoft Graph(2) * Windows Events(2) * windows server(2) * AKS(1) * AWS Cloudwatch(1) * Azure AD(1) * Azure Monitor(1) * Azure Pipelines(1) * Azure PowerShell(1) * Azure Virtual Machines(1) See 10 more No posts match those tags. Reset the filters and try again. [![](https://adamtheautomator.com/wp-content/uploads/publisher/4065d9c85b2b81caa866d0f71bf0002b/66051cfb556b73d2e1c3b14eb006283e65cc77f3781dce13b5a0a0ec58ca99f0.webp)](/azure-devops-workload-identity/) * [Azure](/tag/azure/) * [Azure Pipelines](/tag/azure-pipelines/) * [Microsoft Entra](/tag/microsoft-entra/) * [Security](/tag/security/) [ ## Eliminate Azure DevOps Secrets with Workload Identity Retire Azure DevOps client secrets and PATs for workload identity federation, then prove a stolen credential fails before production cutover. ](/azure-devops-workload-identity/) [![Adam Bertram Avatar](https://secure.gravatar.com/avatar/d0b9d42e21e5622713f8b693aa5c0f9244d5f7dd200ed29b8398f52dee5de337?s=192&d=mm&r=g) Adam Bertram11 min. read ](/author/adam-bertram/) [![](https://adamtheautomator.com/wp-content/uploads/publisher/3f35d9c85b2b812193d4cc7a6d4be13d/1daf00385836df44b470b450d81ec18105c2ccff55f54f2fd2f72592fca6e34c.png)](/identity-verification-onboarding/) * [Active Directory](/tag/active-directory/) * [Microsoft 365](/tag/microsoft-365/) * [Microsoft Entra](/tag/microsoft-entra/) * [Security](/tag/security/) * [Sponsored](/tag/sponsored/) [ ## Stop Impersonation: Verify Identity at Onboarding Prevent impersonation by verifying identity during onboarding. Why identity proofing must happen before provisioning access to new hires. ](/identity-verification-onboarding/) [![Adam Bertram Avatar](https://secure.gravatar.com/avatar/d0b9d42e21e5622713f8b693aa5c0f9244d5f7dd200ed29b8398f52dee5de337?s=192&d=mm&r=g) Adam Bertram4 min. read ](/author/adam-bertram/) [![](https://adamtheautomator.com/wp-content/uploads/publisher/3f95d9c85b2b8194adeee658911c3d7a/7f6a2f144374610925efe230aa9b7df588fbe316342ea3599805d58d8ef3616c.jpg)](/find-unsigned-powershell-scripts/) * [PowerShell](/tag/powershell/) * [Security](/tag/security/) * [Windows](/tag/windows/) [ ## How to Find Every Unsigned PowerShell Script on a File Share Use Get-AuthenticodeSignature to find unsigned or edited PowerShell scripts on a file share, then export every failed check to a CSV. ](/find-unsigned-powershell-scripts/) [![Adam Bertram Avatar](https://secure.gravatar.com/avatar/d0b9d42e21e5622713f8b693aa5c0f9244d5f7dd200ed29b8398f52dee5de337?s=192&d=mm&r=g) Adam Bertram3 min. read ](/author/adam-bertram/) [![](https://adamtheautomator.com/wp-content/uploads/publisher/3f35d9c85b2b811abe48f654e457f7e2/690ce33be28df06aba492262db9a7509c7621c624fe455abff00c8b5b3edb0b4.webp)](/retain-copilot-chats-purview-audit/) * [eDiscovery](/tag/ediscovery/) * [Microsoft 365](/tag/microsoft-365/) * [Microsoft 365 Copilot](/tag/microsoft-365-copilot/) * [Security](/tag/security/) [ ## Stop Copilot Audit Gaps: Retain Chats with Purview Retain Copilot prompts and responses for an audit. Scope a Purview policy to Microsoft Copilot experiences, then prove the chats in eDiscovery. ](/retain-copilot-chats-purview-audit/) [![Adam Bertram Avatar](https://secure.gravatar.com/avatar/d0b9d42e21e5622713f8b693aa5c0f9244d5f7dd200ed29b8398f52dee5de337?s=192&d=mm&r=g) Adam Bertram12 min. read ](/author/adam-bertram/) [![](https://adamtheautomator.com/wp-content/uploads/publisher/3f35d9c85b2b8163bfd8c19fffd29114/f9a5917f2b479095fe70fd66284d12c7457277d162ce2002d4247ecb24613ff2.webp)](/purview-dlp-paste-blocks-ai-sites/) * [AI](/tag/ai/) * [Endpoint Management](/tag/endpoint-management/) * [Microsoft 365](/tag/microsoft-365/) * [Security](/tag/security/) [ ## Fix Purview DLP Paste to Browser Blocks on AI Sites Purview DLP paste blocks fall back to an allow rule. Fix the domain group, rule condition, and browser coverage, then prove it in Activity Explorer. ](/purview-dlp-paste-blocks-ai-sites/) [![Adam Bertram Avatar](https://secure.gravatar.com/avatar/d0b9d42e21e5622713f8b693aa5c0f9244d5f7dd200ed29b8398f52dee5de337?s=192&d=mm&r=g) Adam Bertram10 min. read ](/author/adam-bertram/) [![](https://adamtheautomator.com/wp-content/uploads/publisher/3f35d9c85b2b8179a90ac78068758b8e/a73d28e0d4b237b4d869f4d1e51a24f3720c1bc819ff3ef01894ea81641429d2.jpg)](/exclude-confidential-files-copilot-dlp/) * [Microsoft 365](/tag/microsoft-365/) * [Microsoft 365 Copilot](/tag/microsoft-365-copilot/) * [Security](/tag/security/) * [SharePoint](/tag/sharepoint/) [ ## Stop Copilot Summarizing Confidential Files with Purview DLP Build a Purview DLP policy that stops Microsoft 365 Copilot processing labeled files, then probe the citations and prompt uploads that still leak. ](/exclude-confidential-files-copilot-dlp/) [![Adam Bertram Avatar](https://secure.gravatar.com/avatar/d0b9d42e21e5622713f8b693aa5c0f9244d5f7dd200ed29b8398f52dee5de337?s=192&d=mm&r=g) Adam Bertram11 min. read ](/author/adam-bertram/) [![](https://adamtheautomator.com/wp-content/uploads/publisher/3f35d9c85b2b81db9b78e52704dbd111/3650a0b7acbaf739069578f880254f978fe1383bc1b0453cd800afd989ff19ef.png)](/stop-copilot-web-searches/) * [Microsoft 365](/tag/microsoft-365/) * [Microsoft 365 Copilot](/tag/microsoft-365-copilot/) * [Security](/tag/security/) [ ## Stop Copilot Web Searches from Leaking Sensitive Data Block Microsoft 365 Copilot from sending sensitive prompt text to external web search with a Purview DLP rule, then prove the block in the audit log. ](/stop-copilot-web-searches/) [![Adam Bertram Avatar](https://secure.gravatar.com/avatar/d0b9d42e21e5622713f8b693aa5c0f9244d5f7dd200ed29b8398f52dee5de337?s=192&d=mm&r=g) Adam Bertram5 min. read ](/author/adam-bertram/) [![](https://adamtheautomator.com/wp-content/uploads/publisher/3f35d9c85b2b8157af67cfe805737c4c/d87a8e3ffd5988406606bd14f49a16ebbed72206f31a33a1f24372061a22b0e9.webp)](/purview-missing-ai-prompts/) * [Microsoft 365](/tag/microsoft-365/) * [Microsoft Exchange](/tag/microsoft-exchange/) * [PowerShell](/tag/powershell/) * [Security](/tag/security/) [ ## Troubleshoot Missing AI Prompts in Purview Activity Explorer Find why Purview records AI activity without prompt text. Check audit settings, capture policies, and viewer permissions in a scoped test. ](/purview-missing-ai-prompts/) [![Adam Bertram Avatar](https://secure.gravatar.com/avatar/d0b9d42e21e5622713f8b693aa5c0f9244d5f7dd200ed29b8398f52dee5de337?s=192&d=mm&r=g) Adam Bertram9 min. read ](/author/adam-bertram/) [![](https://adamtheautomator.com/wp-content/uploads/publisher/3ec5d9c85b2b812da7abf2b9778c798e/8e7898c657638b870c388cf9b2e1ea1b99cfd5da6356984d5c703b14d7a098c8.webp)](/cks-certification-study-guide/) * [Containers](/tag/containers/) * [Kubernetes](/tag/kubernetes/) * [Linux](/tag/linux/) * [Security](/tag/security/) [ ## CKS Exam 2026: Study Guide, Practice Labs and Five-Week Plan Map every CKS 2026 exam domain, build a kubeadm practice lab, drill Trivy, Falco, AppArmor, and RBAC, then follow a five-week plan to a passing score. ](/cks-certification-study-guide/) [![Adam Bertram Avatar](https://secure.gravatar.com/avatar/d0b9d42e21e5622713f8b693aa5c0f9244d5f7dd200ed29b8398f52dee5de337?s=192&d=mm&r=g) Adam Bertram11 min. read ](/author/adam-bertram/) [![](https://adamtheautomator.com/wp-content/uploads/publisher/3ec5d9c85b2b8198b651eec70c447ee1/bc27e65fd261774769a0da850c0fe0f594bb2c6ba5bfcf317eadea5471382804.jpg)](/find-expired-certificates-powershell/) * [Certificates](/tag/certificates/) * [PowerShell](/tag/powershell/) * [Security](/tag/security/) * [Windows](/tag/windows/) [ ## Find Expired Windows Certificates Instantly via PowerShell Use PowerShell to scan every certificate store across a Windows fleet, report expired and expiring certificates, and alert before authentication breaks. ](/find-expired-certificates-powershell/) [![Adam Bertram Avatar](https://secure.gravatar.com/avatar/d0b9d42e21e5622713f8b693aa5c0f9244d5f7dd200ed29b8398f52dee5de337?s=192&d=mm&r=g) Adam Bertram11 min. read ](/author/adam-bertram/) [![](https://adamtheautomator.com/wp-content/uploads/publisher/3ec5d9c85b2b81c8a7f8e65f33231fa4/606223a2505919db35cb97858e8eafa9a96eb8d297bab790394df6d592d2af99.webp)](/sysmon-detect-hidden-malware/) * [PowerShell](/tag/powershell/) * [Security](/tag/security/) * [Windows](/tag/windows/) * [Windows Events](/tag/windows-events/) [ ## Sysmon: Detect Hidden Malware in Windows Event Logs Deploy Sysinternals Sysmon with a tuned config, then use Get-WinEvent and Sysmon event IDs to catch process injection and C2 beaconing. ](/sysmon-detect-hidden-malware/) [![Adam Bertram Avatar](https://secure.gravatar.com/avatar/d0b9d42e21e5622713f8b693aa5c0f9244d5f7dd200ed29b8398f52dee5de337?s=192&d=mm&r=g) Adam Bertram13 min. read ](/author/adam-bertram/) [![](https://adamtheautomator.com/wp-content/uploads/publisher/2e05d9c85b2b81c080b8d45ec1cdfbb3/71dd588b2369d52e1695c95c1493383c6c0ed2adb4aac7eba04c1ab324f3a6a6.webp)](/stop-service-principal-sprawl-entra-id-powershell/) * [Microsoft Entra](/tag/microsoft-entra/) * [Microsoft Graph](/tag/microsoft-graph/) * [PowerShell](/tag/powershell/) * [Security](/tag/security/) [ ## Stop Service Principal Sprawl in Entra ID with PowerShell Inventory every app registration and service principal, then automate ownership, rotation, and safe disablement with PowerShell and Microsoft Graph. ](/stop-service-principal-sprawl-entra-id-powershell/) [![Adam Bertram Avatar](https://secure.gravatar.com/avatar/d0b9d42e21e5622713f8b693aa5c0f9244d5f7dd200ed29b8398f52dee5de337?s=192&d=mm&r=g) Adam Bertram16 min. read ](/author/adam-bertram/) [![](https://adamtheautomator.com/wp-content/uploads/publisher/2e05d9c85b2b81dcbcf5eda389061979/e56f758e2e845005bdef1f99eb4feb9315fc53a0423f968bd418c5cf15e5e4ee.webp)](/stop-ai-sprawl-in-azure-governance-hub/) * [AI](/tag/ai/) * [Azure](/tag/azure/) * [Governance](/tag/governance/) * [Security](/tag/security/) [ ## How to Stop AI Sprawl in Azure with a Governance Hub Build an Azure governance hub that inventories your AI estate, routes every model call through an AI gateway, and enforces identity, DLP, and policy. ](/stop-ai-sprawl-in-azure-governance-hub/) [![Adam Bertram Avatar](https://secure.gravatar.com/avatar/d0b9d42e21e5622713f8b693aa5c0f9244d5f7dd200ed29b8398f52dee5de337?s=192&d=mm&r=g) Adam Bertram19 min. read ](/author/adam-bertram/) [![](https://adamtheautomator.com/wp-content/uploads/2026/08/2026.08_Best-Practices-for-Building-a-Secure-New-Hire-Account-Activation-Workflow-1-e3df9fca.png)](/secure-new-hire-account-activation/) * [Sponsored](/tag/sponsored/) [ ## Best Practices for Building a Secure New-Hire Account Activation Workflow Onboarding is a uniquely high-risk process in that the IT department creates new identities and communicates with people who may not yet be fully embedded in ](/secure-new-hire-account-activation/) [![Adam Bertram Avatar](https://secure.gravatar.com/avatar/d0b9d42e21e5622713f8b693aa5c0f9244d5f7dd200ed29b8398f52dee5de337?s=192&d=mm&r=g) Adam Bertram4 min. read ](/author/adam-bertram/) [![](https://adamtheautomator.com/wp-content/uploads/2026/08/featured_image-2.webp)](/splunk-to-sentinel-migration/) * [Automation](/tag/automation/) * [Microsoft Sentinel](/tag/microsoft-sentinel/) * [Security](/tag/security/) * [Splunk](/tag/splunk/) [ ## Migrate Splunk to Sentinel Without Losing Detection Coverage A phased playbook for migrating Splunk to Microsoft Sentinel: audit detections, translate SPL to KQL, validate parity, and plan rollback. ](/splunk-to-sentinel-migration/) [![Adam Bertram Avatar](https://secure.gravatar.com/avatar/d0b9d42e21e5622713f8b693aa5c0f9244d5f7dd200ed29b8398f52dee5de337?s=192&d=mm&r=g) Adam Bertram15 min. read ](/author/adam-bertram/) [![](https://adamtheautomator.com/wp-content/uploads/2026/08/featured_image.webp)](/entra-pim-vs-delinea-cyberark/) * [Active Directory](/tag/active-directory/) * [Governance](/tag/governance/) * [Microsoft Entra](/tag/microsoft-entra/) * [Security](/tag/security/) [ ## Entra PIM vs. Delinea vs. CyberArk: Don’t Buy the Wrong PAM Entra PIM grants roles; Delinea and CyberArk vault credentials. Compare scope, session recording, audit evidence, and three-year cost. ](/entra-pim-vs-delinea-cyberark/) [![Adam Bertram Avatar](https://secure.gravatar.com/avatar/d0b9d42e21e5622713f8b693aa5c0f9244d5f7dd200ed29b8398f52dee5de337?s=192&d=mm&r=g) Adam Bertram17 min. read ](/author/adam-bertram/) [![](https://adamtheautomator.com/wp-content/uploads/2026/07/featured_image-2.png)](/deploy-paws-microsoft-entra-pim/) * [Active Directory](/tag/active-directory/) * [Microsoft Entra](/tag/microsoft-entra/) * [Security](/tag/security/) [ ## Deploy PAWs with Microsoft Entra PIM Harden privileged access by pairing Microsoft Entra PIM with PAWs, Intune compliance, and Conditional Access so admin roles activate only from trusted devices. ](/deploy-paws-microsoft-entra-pim/) [![Adam Bertram Avatar](https://secure.gravatar.com/avatar/d0b9d42e21e5622713f8b693aa5c0f9244d5f7dd200ed29b8398f52dee5de337?s=192&d=mm&r=g) Adam Bertram7 min. read ](/author/adam-bertram/) [![](https://adamtheautomator.com/wp-content/uploads/2026/07/featured_image-1.png)](/practical-guide-kubernetes-security-management/) * [AKS](/tag/aks/) * [Containers](/tag/containers/) * [DevSecOps](/tag/devsecops/) * [Kubernetes](/tag/kubernetes/) * [Security](/tag/security/) [ ## A Practical Guide to Kubernetes Security Management Manage Kubernetes security with RBAC, Pod Security, network policies, posture scanning, and runtime detection using Kubescape, Falco, and Defender. ](/practical-guide-kubernetes-security-management/) [![Adam Bertram Avatar](https://secure.gravatar.com/avatar/d0b9d42e21e5622713f8b693aa5c0f9244d5f7dd200ed29b8398f52dee5de337?s=192&d=mm&r=g) Adam Bertram9 min. read ](/author/adam-bertram/) ## Categories * [IT Ops](/category/it-ops/) * [Cloud](/category/cloud/) * [DevOps](/category/devops/) * [Home Ops](/category/home-ops/) * [Information Security](/category/infosec/) * [Software Development](/category/software-development/) ## Site * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Copyright 2026© ATA Learning | [Privacy Policy](/privacy/)