Entra ID Password Protection + Smart Lockout

image

People still obsess over password complexity.

Twelve characters. Special symbols. Rotation every 90 days.

And yet accounts still get compromised.

That’s because attackers don’t guess random passwords anymore. They guess human passwords.

That’s not a complexity problem. That’s a behaviour problem.

So instead of arguing about password rules, I push clients to focus on two things they already have in Microsoft 365:

Password Protection and Smart Lockout.

Quietly running. Often ignored. Rarely tuned.

Here’s what actually matters.

What is Entra ID Password Protection + Smart Lockout, really?

It’s not a password policy.

It’s a filter and a shield.

Password Protection stops users from choosing bad passwords in the first place.

It uses a global banned password list driven by Microsoft telemetry and blocks weak or common passwords automatically—no configuration required. [learn.microsoft.com]

On top of that, you can add your own banned terms. Company names. Locations. Products. The obvious stuff attackers try first.

Then there’s Smart Lockout.

This is what most people misunderstand.

It’s not “lock the account after X attempts”.

That’s old thinking.

Smart Lockout can distinguish between a real user fat-fingering a password and an attacker trying thousands of guesses. [learn.microsoft.com]

Same identity. Different treatment.

Attackers get blocked quickly.

Real users keep working.

That’s not a nicer lockout policy.

That’s a signal-driven control.

“But we already have account lockout on-prem.”

Exactly.

And that’s the problem.

Step-by-Step: Tune Password Protection and Smart Lockout

Portal only. No scripts. No excuses.

1. Open Password Protection settings

Go to:

Entra admin centre
→ Protection
→ Authentication methods
→ Password protection

This is the only place you need.

2. Add a custom banned password list

Add terms like:

  • Company name variations

  • Internal product names

  • Common abbreviations

  • Location names

These get evaluated alongside the global list and block weak variants automatically. [learn.microsoft.com]

Not just exact matches.

Variants.

That’s the key.

3. Review Smart Lockout threshold

Default is:

Most SMBs never touch this.

My recommendation?

Lower it slightly only if you understand user behaviour.

Too low and you create support tickets.

Too high and you give attackers room to work.

You’re not tuning numbers.

You’re tuning friction.

4. Set lockout duration

Default starts short (around a minute) and increases with repeated attempts. [learn.microsoft.com]

That’s deliberate.

Short for users.

Painful for attackers.

If you override this, be careful.

Long lockouts punish users.

Short lockouts reward attackers.

5. Leave Smart Lockout on (always)

Important:

Smart Lockout is already enabled.

There’s nothing to “turn on”.

There’s only:

  • Leaving it alone

  • Or breaking it
6. Pair it with MFA (properly)

Password protection is not enough.

Microsoft is very clear on that.

Use it alongside MFA and Conditional Access. [learn.microsoft.com]

Otherwise you’re just slowing attackers down.

Not stopping them.

Why this actually changes behaviour

This is the part most MSPs miss.

These features don’t just block attacks.

They retrain users.

Bad password?

Rejected.

Repeated guessing?

Blocked.

Users learn quickly what works and what doesn’t.

No training session required.

No PDF sent out.

No awareness campaign.

The system corrects behaviour in real time.

“We’ll just educate users instead.”

You can.

Or you can enforce it once and let the platform do it forever.

Ask once. Enforce always.

Here’s the real win:

  • Fewer compromised accounts

  • Fewer lockout tickets

  • Fewer “why is this happening?” calls

And importantly:

  • Better outcomes with less effort

That’s the bit most people overlook.

Notice what’s missing?

No password complexity discussion.

No rotation debates.

No “special characters required”.

Because those don’t solve the real problem.

Attackers aren’t brute-forcing randomly anymore.

They’re spraying expected passwords across thousands of accounts.

Password Protection removes the obvious targets.

Smart Lockout kills the attack path.

Different layers.

Same outcome.

Passwords aren’t going away.

But weak passwords should.

And repeated guessing definitely should.

Password Protection isn’t there to make passwords stronger.

It’s there to make bad passwords impossible.

Certificate-Based Authentication for SharePoint Online: The Bit Everyone Avoids

image

There’s a point every SharePoint admin eventually hits.

The script works.
The logic is solid.
But it still needs a username.

And that’s where it falls apart.

Because anything that relies on a human login isn’t automation. It’s just a task waiting to break the moment MFA tightens, conditional access changes, or the account gets locked.

Certificate-based authentication fixes that. It has for years.

The problem hasn’t been what to do.
It’s been how much effort it takes to do it properly.

The Problem Isn’t Authentication. It’s Assembly.

If you’ve ever set this up manually, you’ll know the sequence:

  • Create or import a certificate

  • Register an app in Entra ID

  • Assign API permissions like Sites.FullControl.All
  • Upload the certificate

  • Grant admin consent

  • Capture the thumbprint

  • Wire it all into your PowerShell scripts

None of it is particularly hard.

But it’s fragmented, fiddly, and very easy to get wrong.

Which is why most environments quietly fall back to interactive sign-ins… right up until they stop working.

What This Approach Actually Does

I’ve been written a new script —

https://github.com/directorcia/Office365/blob/master/o365-connect-spo-cert.ps1

with full documentation here – https://github.com/directorcia/Office365/wiki/Certificate-based-authentication-for-SharePoint-Online

The script behind this approach is designed to remove that friction.

Instead of documenting the steps, it executes them.

At a high level, it runs in one of two modes:

1. Generate Everything Locally

-GenerateLocalCertificate

This builds the foundation:

  • Creates a local certificate (optionally exports a PFX)

  • Can provision an Entra app automatically

  • Assigns required permissions (including SharePoint and Graph)

  • Prepares everything needed for ongoing use

It effectively handles the “setup once” phase.

2. Use Certificate Authentication

-UseCertificateAuth

This is the day-to-day mode:

  • Connects to SharePoint Online using the app and certificate

  • No username

  • No password

  • No MFA prompt

  • No interaction required

Just a clean, repeatable connection into the SharePoint admin endpoint. [github.com]

Why This Matters More Than It Looks

At face value, this is just authentication.

In reality, it’s capability.

Once your connection is non-interactive, a whole class of work becomes possible:

  • Scheduled SharePoint reporting

  • Overnight clean-up jobs

  • Site lifecycle management

  • External sharing audits

  • Compliance checks

All the tasks that were “nice ideas” suddenly become operational.

Because they no longer depend on someone being present.

That’s the real shift.

The Security Side (That People Miss)

There’s also a security upside that often gets overlooked.

Certificate-based authentication:

  • Removes passwords from scripts entirely

  • Reduces exposure to phishing and credential theft

  • Uses a service principal instead of a human identity

  • Allows tighter, scoped permissions (like Sites.Selected)

In short, it’s both more secure and more predictable than traditional login methods.

The Gotcha Everyone Hits Once

If you build this from scratch, you’ll probably hit the same issue most people do:

It doesn’t work immediately.

Not because it’s broken — but because permissions need time to propagate across Entra ID and SharePoint.

That delay is normal.

It’s also the main reason people abandon setups halfway through and revert to “just use an account”.

Where This Fits for MSPs

If you’re managing multiple tenants, this becomes even more valuable.

The pattern is simple:

  • One script

  • One certificate per tenant

  • One app registration per workload (or per tenant, depending on your model)

  • Store the mapping once

  • Reuse it everywhere

From there, your tooling becomes predictable.

No credential prompts.
No dependence on admin accounts.
No surprises when security policies tighten.

The Bottom Line

Certificate-based authentication isn’t new.

It’s just been inconvenient.

What this approach does is remove the inconvenience.

And once you do that, you start using it everywhere.

Because the real benefit isn’t the connection.

It’s everything that becomes possible after it.

Source material

The Quiet Productivity Cost of Watching AI Work

image

I noticed something a few weeks back during a busy Friday afternoon. I’d asked Copilot in Word to pull together a draft summary of a long client document, and instead of moving on to the next thing on my list, I just sat there. Watching. Cursor blinking. Sentences slowly stitching themselves across the screen like I was waiting for a kettle to boil. It took me a good thirty seconds to realise I was, in effect, staring at a digital pot — and getting absolutely nothing else done while I did it.

That small moment has stuck with me. Because I don’t think I’m the only one doing it.

The watching trap

There’s a quiet productivity tax that nobody really warned us about with generative AI inside Microsoft 365. We’ve been told these tools save us hours. And they will — but only if we actually use those hours. The moment we anchor ourselves to the screen and watch Copilot draft a reply in Outlook, summarise a meeting recording in Teams, or build out a deck slide by slide in PowerPoint, we hand back every minute of the gain.

I think this happens because the output feels unfinished until it’s done. The brain treats it a bit like a conversation — and you don’t walk away from someone mid-sentence. But Copilot isn’t speaking to you. It’s working for you. And it doesn’t care whether you’re in the room.

The result is a strange new flavour of busywork. You look productive. You’re sitting at your desk, focused, eyes on the screen. But the actual output of your time is whatever Copilot was going to produce anyway. You’ve added nothing. You’ve just supervised a process that didn’t need supervising.

Why staring at it doesn’t help

The other problem with the watching habit is that it isn’t even useful. You can’t speed Copilot up by looking at it harder. You’re not catching errors in real time, because most of us don’t read carefully enough mid-generation to spot a problem — and you’ll review the final output once it’s done anyway. The watching is pure overhead.

Worse, it primes a passive mindset. When you sit and observe the machine doing the work, you start to mentally check out. The next task on your list feels heavier than it should. You lose the rhythm of context-switching that real knowledge work depends on. By the time the draft email or summary lands, you’ve already half-disengaged. So instead of pouncing on it, reviewing it sharply, and sending it on its way, you take another minute or two to gather yourself.

That’s two layers of cost. The time you spent watching, and the time it takes to mentally re-enter the work.

Treat Copilot like a colleague, not a performance

The shift I’ve had to make is treating Copilot the same way I’d treat anyone I’ve delegated something to. You don’t stand over a colleague’s shoulder while they write a document. You hand it off, you go do something else, and you come back to review when it’s ready.

So when I ask Copilot in Excel to analyse a dataset, I switch to my inbox and clear a few replies. When I have Copilot in Word drafting something substantial, I move into Teams and respond to chats. When a deck is being assembled in PowerPoint, I’m reviewing tomorrow’s calendar or skimming a SharePoint document I’d been putting off. The five or ten seconds of context-switch cost is well worth the two or three minutes I would have otherwise stared away.

The deeper habit, though, is queueing the work. I now line up several AI-assisted tasks at once. A summary running here, a draft being produced there, an analysis underway in another window. Copilot is happy to run in parallel across Microsoft 365. There’s no good reason to make those tasks sequential by tying each one to your eyeballs.

What I’m watching next

The thing I’m paying attention to from here is how teams handle this collectively. Because once AI is doing more of the small tasks across an organisation, the productivity ceiling stops being defined by what the tools can do and starts being defined by what their humans do while the tools work. The businesses that win the Copilot game won’t be the ones with the best prompts. They’ll be the ones whose people have stopped sitting and watching, and started filling that reclaimed time with thinking, deciding, and acting.

The technology is doing its part. The next move is ours.

TechWerks 30 – Comprehensive Recap & Best-Practice Guide

After hosting the recent Techwerks event in Melbourne, I go Copilot to put together this summary of the day as a reference to what the day is all about and hopefully demonstrate the value it provides by attending.

TechWerks 30 was a full-day, face-to-face Microsoft 365 deep-dive hosted by Robert Crane (CIAOPS) in Melbourne on 24 June 2026. This manual provides an in-depth recap of the major topics and hands-on sessions recorded during TechWerks 30, serving both as a post-event reference for attendees and a resource showcasing the unique value of these immersive training days to prospective participants. It synthesizes content from all four recorded sessions, focusing on key themes, tools, and takeaways while omitting any personal or sensitive information.

Executive Summary: TechWerks 30 offered a highly interactive, attendee-driven training experience in Microsoft 365 and related technologies. Instead of passively listening to pre-set slides, a small group of under 20 attendees actively shaped the agenda by voting on the topics they needed most. This approach ensured every session tackled real-world scenarios and pressing challenges that participants face in their day-to-day work, from managing cloud storage to bolstering security settings, and even exploring emerging features like Microsoft Copilot* and Copilot Co‑pilot’s new usage-based billing model. The event delivered practical demonstrations, live problem-solving, and best practices that participants could immediately apply in their own environments – producing numerous “Monday-morning” takeaways and clear business value.

Major Topics and Hands-On Activities

TechWerks 30 encompassed multiple major themes spanning the Microsoft 365 ecosystem, each addressed through interactive demonstrations and group discussions. Key topics included cloud collaboration best practices, security & identity management in M365, and the latest AI and product updates (with an emphasis on practical implications). Below we delve into each of these themes in detail, describing what was covered and highlighting the session’s live demos, best practices, and takeaways.

1. Collaboration & Cloud Data Management (OneDrive, SharePoint, & Teams)

OneDrive for Business & SharePoint Best Practices: A significant portion of the day was devoted to optimizing file storage and collaboration workflows in Microsoft 365, particularly OneDrive for Business (ODFB) and SharePoint Online. Many attendees still had questions on effectively using ODFB, highlighting that even seasoned users often seek clarity on fundamentals (a common scenario noted by the host).

  • **“Add to OneDrive” vs Syncing Document Libraries: One best-practice discussed was the use of OneDrive Shortcuts (the “Add shortcut to OneDrive” feature) instead of syncing entire SharePoint libraries. This approach offers key benefits: it saves local disk space and reduces sync complexity by letting users pick specific folders or libraries to access via their OneDrive, rather than syncing large libraries in full. Shortcuts also streamline collaboration by ensuring a single source of truth (no duplicate copies) and improving users’ day-to-day workflows through easier access to shared content. Participants learned how to create and manage these shortcuts and how they appear in their OneDrive, avoiding common issues with oversynchronization and orphaned local copies.
  • OneDrive Storage Management: The group addressed how to manage and increase OneDrive storage quotas. Attendees learned that Microsoft 365 tenants can raise the default ODFB storage from 1TB to 5TB per user for eligible plans. The manual review included step-by-step guidance (via the Microsoft 365 Admin Center and PowerShell commands) to adjust both default storage quotas and existing user quotas to 5 TB for all users – a valuable tip for growing businesses to avoid users hitting capacity limits. This discussion underscored the importance of proactive tenant capacity planning in cloud storage deployments.
  • **OneDrive Offline Access and File Sync: The latest OneDrive enhancements were highlighted, including the new Offline Mode for OneDrive Web. This upcoming feature (an extension of the Files On-Demand concept) allows users to mark files/folders in OneDrive web as “always available offline” – so they can continue working on cloud files in the browser even without internet, with changes syncing once reconnected. While offline web access was still rolling out in 2026, attendees appreciated how it narrows the gap between local and cloud storage and ensures business continuity during internet outages. The trainer contrasted this with the existing OneDrive Sync client (OneDrive.exe), which has long provided offline access by syncing files to local drives. The combination of these capabilities – traditional Sync for robust offline use, and the new Web offline mode for added flexibility – was discussed as part of a holistic file access strategy.
  • Real-World Troubleshooting Example – Excel & OneDrive: In the spirit of addressing real problems in real time, a participant’s recent issue was examined: Microsoft Excel crashing when saving files to a OneDrive Shared Library (via a shortcut). Rather than theoretical advice, the group diagnosed the issue interactively. Drawing on community and Microsoft knowledge, they discovered it was a known bug triggered by a recent patch (the May 2026 update) affecting Excel’s integration with OneDrive shortcuts. They discussed the official guidance that Microsoft provided (and any available workarounds), thereby reinforcing the day’s focus on immediate problem-solving. This example illustrated how TechWerks sessions deal with timely challenges and share the latest information on issues that matter to participants – in this case, confirming that Microsoft was aware of the bug and investigating, and that a fix or mitigation was on the way.
2. Security & Identity: Best Practices and Tools for Microsoft 365

Another core theme was securing Microsoft 365 environments. Attendees explored practical identity and access management strategies, with a particular focus on Conditional Access policies in Azure Active Directory (Entra ID) and baseline security configurations for small-to-medium businesses.

  • Conditional Access (CA) Policies – Implementation & Avoiding Pitfalls: The group walked through the process of setting up Conditional Access policies that enforce modern zero-trust principles in Microsoft 365. This included real-time demonstrations of creating CA policies to require multi-factor authentication (MFA) for users, block legacy authentication, and restrict logins from risky locations. A key best practice highlighted was to configure “named locations” (trusted geographic locations or IP ranges) in advance before enabling broad location-based blocking policies. This prevents an*“accidental lockout”* of all users – an easy mistake if an admin, for example, enables a blanket “block all sign-ins outside country X” rule without first defining country X as a trusted location. By applying this lesson, attendees learned how to tighten security without cutting off legitimate access to their cloud services.
  • Automating Best-Practice Security Setup: The session introduced tools to streamline the implementation of best-practice security baselines. Participants were shown a PowerShell-based “M365 Best Practice” script toolkit (commonly used by the CIAOPS community) that can automatically configure recommended security settings – including a baseline set of CA policies aligning with standards like the Australian Cyber Security Centre’s “Essential Eight” framework (ASD guidelines). Running these baseline scripts on a test tenant produced an immediate snapshot of the environment’s security posture, highlighting gaps and misconfigurations. Attendees were impressed by the results of a*“Tenant Posture”* script, which quickly identified areas for improvement (eliciting a “wow” from participants as it revealed areas of risk and potential enhancements).
  • Advanced Security & Compliance Topics: The group further discussed emerging security features and strategies. This included an overview of recent additions like Microsoft Entra ID improvements (for identity protection), and the importance of routine secure score reviews and policy audits to keep up with evolving threats. The interactive format allowed participants to ask specific security scenario questions (for example, how to handle specialized cases in conditional access, or ensuring privileged accounts remain accessible during emergencies). The emphasis was on practical steps that small and midsize organizations can implement immediately – such as enabling MFA for all users, using Conditional Access templates or “baseline” policies provided by Microsoft, and leveraging monitoring tools (like Secure Score and sign-in logs) to continuously track and improve tenant security. Participants left with clearer guidance on prioritizing critical security measures and confidence to apply these in their own environments.
3. Emerging Technologies & Microsoft 365 Updates

Although the primary focus was on attendee-requested core topics, TechWerks 30 also touched on a few of the latest Microsoft 365 updates and emerging tools around the time of the event:

  • Copilot Cowork & Usage-Based Billing: The event coincided with Microsoft’s general availability of Copilot Cowork – a new AI-driven**“agentic” assistant in Microsoft 365** capable of performing multi-step tasks, which was widely discussed at Microsoft Build 2026. The instructor provided an overview of Copilot Cowork’s capabilities and its new usage-based billing model, noting how this marks a shift in how AI features might be purchased. Attendees learned that beyond the standard M365 Copilot license (a flat per-user fee), using Cowork’s advanced autonomy features may incur consumption-based charges (“Copilot Credits”), and that IT admins must explicitly enable and configure Cowork’s pay-as-you-go billing by linking an Azure subscription to their tenant. It was noted that at launch, Cowork is opt-in (disabled by default) to prevent surprise costs, and that early access (Frontier program) participants have a grace period until July 1, 2026 before usage costs begin. This discussion prepared attendees for the practical and financial considerations of deploying advanced AI services in their organizations.
  • Microsoft Scout and “Autopilot” Agents: The event also briefly mentioned “Microsoft Scout,” another new AI initiative unveiled at Build 2026, as part of looking at future trends. Scout is an always-on, autonomous AI “autopilot” agent that proactively assists users across Teams, Outlook, SharePoint, and more. Given the workshop’s focus was shaped by attendees and many were more interested in immediate productivity topics over speculative AI features, the discussion around Scout and similar advanced AI agents was kept high-level, with an emphasis on monitoring these developments. Attendees were encouraged to stay informed about how these technologies (like Scout and Copilot enhancements) could eventually be leveraged to increase productivity once they mature and align with business needs.
  • Other Microsoft 365 Updates: The trainer and participants also reviewed a roundup of recent updates across the Microsoft 365 ecosystem. This likely included improvements from the 2026 roadmap and Microsoft Build announcements, such as:
    • SharePoint & Teams: UI changes and new integrations (e.g., enhancements in Teams performance and architecture from the new “Teams 2.0” client).
    • Windows & Endpoint: Possibly relevant news like Windows Autopatch or Intune updates for devices were noted if attendees raised them (especially given interest in Autopilot and device management in other events).
    • Other: Additional Q&A on miscellaneous topics arose organically, reflecting the open format. For instance, participants asked about *license management and cost optimization (prompted by the Copilot discussion), and data backup/restore scenarios in M365 (how to recover deleted items or sites). The instructor addressed these with best-practice advice and references (sometimes with follow-up resource links provided).

Session-by-Session Highlights (Daily Schedule)

While the content was organized flexibly around attendees’ interests, the day’s four sessions can be summarized as follows:

Key Takeaways & Actionable Insights from TechWerks 30

The TechWerks 30 workshop delivered a rich collection of practical lessons for attendees. Each participant left with concrete knowledge and improvements to implement in their environments, underscoring the value of these deep-dive sessions. Some of the top key takeaways and actions were:

  • Adopt “Add to OneDrive” for Shared Content: Rather than syncing entire document libraries, leverage OneDrive shortcuts to access shared folders/libraries. This approach saves local storage space, reduces sync errors, and simplifies user workflows. Participants were encouraged to audit their current SharePoint/OneDrive usage and train users on using**“Add shortcut to OneDrive”** for easier file access and collaboration.
  • Optimize OneDrive Storage: Ensure your organization’s OneDrive for Business quotas are properly configured to avoid storage shortages. Increase default storage to 5 TB per user (for eligible Microsoft 365 plans) via the Admin Center or PowerShell (using Set-SPOTenant OneDriveStorageQuota commands). This proactive step is crucial for growing businesses.
  • Implement Conditional Access Baselines Safely: Put in place a strong set of baseline security policies (e.g., require MFA, block legacy auth, restrict risky locations) to protect user accounts. Use available tools (such as Microsoft’s built-in templates or community best-practice scripts) to quickly deploy these policies. However, always configure prerequisites (like named locations for trusted IP ranges or geographies) before enabling location-based blocks, to avoid inadvertently locking out admins or users.
  • Leverage Automated Tenant Posture Assessments: Utilize scripts or tools that scan your Microsoft 365 tenant’s security posture to highlight areas needing improvement. One script demonstrated at TechWerks 30 provided a comprehensive “health check” of the tenant’s configurations, revealing misconfigurations and improvement opportunities (to the surprise of attendees). Regular posture assessments help ensure you keep up with best practices and address any gaps.
  • Prepare for AI Integration: Keep an eye on new Microsoft 365 AI features like Copilot Cowork and Microsoft Scout that are on the horizon. Although many small businesses may not deploy these immediately, understanding their capabilities (e.g. Copilot’s usage-based billing and requirement for Azure subscription for cost control) helps in future-proofing your strategy. Plan ahead by considering how agentic AI tools could deliver value to your organization when you’re ready, and ensure your environment (licensing, governance, training) can support them.

Why Attend TechWerks Deep-Dive Sessions?

TechWerks events are not ordinary training days – they are a unique blend of community-driven agenda and practical immersion in Microsoft cloud technology. Key reasons why these sessions offer exceptional value include:

  • Attendee-Led Content: You shape the day. Participants vote on the agenda beforehand, ensuring the workshop covers topics you want to learn about, rather than a generic preset syllabus. This targeted focus means each session is highly relevant to the challenges and interests of those in the room.
  • Hands-On, Not “Death by PowerPoint”: TechWerks sessions are workshop-style, emphasizing live demos, real-time problem solving, and interactive labs over slide presentations. Every concept is illustrated in the context of actual real-world Microsoft 365 scenarios, making learning more engaging and practical. One attendee praised this*“interactive nature of the day” as “so much better than death by PowerPoint”*.
  • Small Group, Big Impact: Capped at 20 attendees, these sessions provide an intimate setting for one-on-one interaction with the expert instructor and peers. Everyone’s questions get answered, and the peer discussions help participants learn from each other’s experiences. The face-to-face environment fosters networking and deeper engagement, adding value beyond what online training can offer.
  • Immediate Best-Practice Takeaways: Each TechWerks event yields a wealth of actionable insights and best practices that attendees can implement right away in their businesses. As Mike H., a past participant, noted:“It is such a good format… the whole interactive nature of the day [is] so much better than death by PowerPoint.” Attendees leave with knowledge and tools that produce immediate improvements – from quick wins (like optimizing OneDrive usage) to strategic guidance (like strengthening your M365 security posture).

In summary, TechWerks 30 not only covered a variety of technical topics tailored to the audience’s needs, but also demonstrated the power of an open, hands-on format that transforms training into collaborative problem-solving. By emphasizing active learning, real-world practice, and participant-driven content, the session showcased why TechWerks’ full-day deep dives are invaluable for IT professionals seeking to stay ahead in the fast-moving world of Microsoft 365 and cloud services. Participants gained knowledge, confidence, and concrete best practices – making a strong case for the ROI of attending such face-to-face deep dive sessions.

Where Do Your Uploaded Documents Actually Go in Copilot Notebooks?

image

One of the questions I get asked most often about Microsoft 365 Copilot Notebooks is deceptively simple: when I upload a document into a notebook, where does it actually live? It’s a fair question. If you’re an MSP, an administrator, or anyone responsible for governance, “it’s in the cloud somewhere” isn’t a good enough answer. You need to know exactly where that data sits, who can reach it, and what compliance controls apply. The answer turns out to be more interesting than most people expect, and it hinges on a relatively new piece of the Microsoft 365 storage platform called SharePoint Embedded.

The short answer: SharePoint Embedded

When you upload a document into a Copilot Notebook, it does not land in your OneDrive, and it doesn’t go into a regular SharePoint site or document library that you can browse to. Instead, it’s stored in SharePoint Embedded — specifically inside a user-owned container.

Here’s the part that surprises people. Copilot Notebooks, Copilot Pages, and Loop’s “My workspace” all share the same single user-owned container per user. You don’t get a separate container for each. The first time you need any one of those experiences, Microsoft provisions one container and reuses it for all three. Even the container’s name depends on which app you opened first: it’s called “Pages” if you visited the Microsoft 365 Copilot app first, or “My workspace” (localised to your Loop language) if you opened Loop first.

There’s a governance wrinkle worth committing to memory: in the SharePoint admin center, in PowerShell, and in Purview audit data, this container’s application name always shows as “Loop” — even when it only holds Copilot Notebooks. There is no separate “Copilot Notebooks” application filter. So if you go hunting for Copilot content in your audit logs and only search for “Copilot”, you’ll come up empty. Look for Loop.

So what is SharePoint Embedded?

SharePoint Embedded is an API-only file and document management system built on the same proven Microsoft 365 storage platform that powers SharePoint and OneDrive. The key word is API-only. Unlike a normal SharePoint site, there’s no friendly web UI you can navigate to. When an application uses SharePoint Embedded, it creates a separate storage partition inside your Microsoft 365 tenant, and the documents in that partition are only accessible through Microsoft Graph APIs — and only to the owning application.

Within that partition, the application stores content in entities called File Storage Containers. Think of a container as an API-only document library: it can hold any file type, supports folders, versioning, search, and co-authoring, but it’s dedicated to and reachable by just the one app that owns it. That isolation is the whole point. The files your Copilot Notebook depends on are walled off from other applications, yet they still benefit from the full richness of the Office stack — you can open an uploaded Word or Excel file in Office for the web straight from the experience.

This is the same architecture Microsoft uses under the hood for Loop and Designer. Copilot Notebooks is simply another first-party consumer of the platform.

The detail that matters most: your data stays in your tenant

This is the line I always emphasise with clients. The storage partition that SharePoint Embedded creates lives inside your own Microsoft 365 tenant. Your uploaded documents do not leave your tenant boundary. That means everything your existing Microsoft Purview controls already do, they continue to do here:

  • eDiscovery — content is discoverable

  • Auditing — actions are logged (remember: under the “Loop” application name)

  • Data Loss Prevention (DLP)
  • Retention policies and sensitivity labels
  • Conditional access

So while the storage mechanism is new, the compliance posture is reassuringly familiar. The data is yours, it’s in your tenant, and your governance tooling applies.

Quotas, limits, and a billing nuance

Here’s a distinction that trips people up. The general, developer-facing SharePoint Embedded model bills storage separately through an Azure pay-as-you-go subscription, and that storage does not count against your SharePoint quota. But Microsoft’s first-party use of it for Copilot Pages and Copilot Notebooks works differently. Copilot Pages and Copilot Notebooks content counts against your organisation’s existing SharePoint storage quota — there’s no separate Azure bill for it. The user-owned container has a hard ceiling of 25 TB, which can’t be raised or lowered.

Lifecycle: tied to the user, with sharp edges

The container’s lifecycle is bound to its owner. Content is private by default, much like OneDrive — there’s no forced sharing. When the owning user’s account is deleted, the container is scheduled for deletion and follows the same lifecycle as OneDrive, including a manual handoff step at departure and the option to permanently reassign the container to a new owner.

One critical warning for anyone planning their data protection strategy: there is no end-user recycle bin for Copilot Notebooks. If a notebook is deleted, neither the user nor an administrator can recover it. That’s a meaningful gap compared to the recycle-bin safety net we take for granted in SharePoint and OneDrive, and it’s worth flagging to end users before they start relying on Notebooks for anything important.

Why this matters

Copilot Notebooks feel lightweight and personal, but underneath sits real enterprise-grade storage that you already know how to govern — just wearing a new name. Knowing it’s SharePoint Embedded, that it surfaces as “Loop” in your admin tools, that it counts against SharePoint quota, and that it has no recycle bin turns “somewhere in the cloud” into something you can actually manage.

Copilot Notebooks storage & governance

SharePoint Embedded platform

The MSP Skills Gap Nobody Is Talking About Yet

image

I had a conversation with an MSP owner last week that has been rattling around in my head ever since. He was telling me, proudly, about how his team had just finished a big project hardening a client’s endpoint stack. Patching, EDR, conditional access, the lot. Then almost as an afterthought he mentioned the same client had quietly turned on Copilot for sixty users and was already building their first agent in Copilot Studio. He had no plan for any of it. No policy, no review process, no clear idea who in his team would actually own it. And here is the uncomfortable part. He is not unusual. He is the rule.

The growth in AI agents inside SMB environments is going to be the steepest curve we have seen in years, and most MSPs are walking into it carrying the wrong toolkit. The skills that built a successful managed services business over the last decade are not the skills that will keep customers safe and productive over the next one. That gap is widening every week, and very few MSP owners I speak to have noticed.

Agents are not endpoints

For twenty years MSPs have been organised around things. Devices, servers, mailboxes, firewalls. You patch them, monitor them, back them up, replace them. The whole MSP operating model — RMM, PSA, ticketing, SLAs — assumes a world of static assets that misbehave in fairly predictable ways.

An AI agent is none of those things. It is not an endpoint. It does not sit still. It reads documents in SharePoint, drafts replies in Outlook, pulls data from line-of-business systems, and acts on behalf of a user across surfaces the MSP has never had to think about as a single connected thing. When a Copilot agent fetches the wrong document and pastes confidential numbers into an external chat, no RMM alert is going to fire. The questions are different too. Not “is it patched?” but “what did it do today, and why?” That is a governance and behaviour problem, not an infrastructure one.

The new skill set is governance, data and prompts

Managing agents well leans on a set of muscles most MSPs have never had to build. Understanding identity scope in Entra so an agent cannot reach data it has no business touching. Configuring sensitivity labels and DLP in Purview so a chatty agent does not quietly become a leak. Reviewing prompt design and grounding sources in Copilot Studio before an agent is let near real users. Watching audit logs in the Microsoft 365 admin centre for patterns of agent behaviour that look off.

This is closer to the work of a data steward or a security analyst than a traditional systems engineer. It is slower, more interpretive, and more about judgement than ticket throughput. It rewards curiosity and writing skills as much as PowerShell. The MSP business model has not been built for that kind of work, and the hiring pipeline certainly has not.

The retraining window is now

Here is the bit that worries me. Customers are going to assume their MSP has this covered. They will turn on Copilot, build agents in Copilot Studio, plug them into their CRM, and look across the table expecting the same calm competence they get for backups. When something goes wrong — a leaked document, an agent that quietly emails the wrong list, a workflow that has drifted off purpose — they will ring their MSP. And most will not be able to help.

The MSPs that get ahead of this will start small and start now. Pick one client, one agent, and learn it end to end. Read the audit logs. Write the policy. Build the review cadence. The technical hardening skills will still matter. They are just no longer enough on their own.

Your clients are building AI agents right now. Nobody’s watching.

image

A client rings you. “One of the team built a little AI helper that answers questions from our SharePoint. It’s started giving odd answers. Can you take a look?”

So you go looking. There’s no record of it. No owner listed. No idea what data it reaches into. And while you’re in there, you find eleven more — built by people who left months ago, quietly wired up to who-knows-what.

That’s not innovation. That’s debt.

Here’s what nobody mentions when an SMB switches Copilot on: everyone in that tenant can already build agents. Not eventually. Today. The moment Copilot Studio and Agent Builder light up, every staff member can spin up an AI agent, point it at company data, and share it around.

And by default, all of it lands in one place — the default Power Platform environment — which you can’t delete and can’t fully lock down.

Notice what’s missing? Any decision about who’s allowed, what they can touch, or who cleans up afterwards.

What is agent lifecycle governance, really?

Strip the jargon and it’s three decisions you make before the agents arrive: where they’re allowed to live, what data they’re allowed to touch, and who’s on the hook when one misbehaves.

Microsoft hands you three levers for exactly that.

Environments are the containers agents live in. Data policies decide which connectors an agent can talk to. Maker controls decide who’s even allowed to build in the first place.

Get those three right and the eleven mystery agents never happen. Get them wrong and you’re the one explaining to a client why their customer list ended up somewhere it shouldn’t.

This isn’t about saying no to AI. It’s about drawing the lines once, so everyone can say yes safely.

Step-by-Step: putting guardrails up before the sprawl

You don’t need a six-month project. You need an afternoon in the Power Platform admin centre.

Lock down who can create environments

Tenant settings first. Stop every user being able to spin up new environments on a whim. Restrict environment creation to admins, so a new space is a decision — not an accident.

Treat the default environment as hostile

You can’t delete it, so assume the worst will land there. This is where ungoverned agents breed. Keep nothing sensitive in it, and route anything serious somewhere else.

Give real agents a real home

For anything a client actually depends on, follow the dev-test-prod pattern Microsoft recommends: build in a development environment, validate in test, publish to production. Lock each one to an Entra security group so only the right people get in. Build in production and you’re editing live, in front of users, with no safety net.

Set a data loss prevention policy

This is the big one. In the admin centre, create a data policy and sort your connectors into groups:

Business     — SharePoint, Dataverse, Outlook, Teams
Non-Business — everything else, by default
Blocked      — public HTTP, personal email, social, FTP

An agent can’t combine data across the Business and Non-Business groups. So a bot reading your client’s SharePoint physically cannot also push that data to some random web endpoint.

Notice what’s missing? You didn’t write a line of code. You drew a line, and the platform enforces it for every agent, forever.

Turn on Managed Environments where it counts

For your production spaces, switch on Managed Environments. That gets you sharing limits, weekly usage insights, and an actual record of what’s being built — the visibility that turns “eleven mystery agents” into a list you can read on a Monday morning.

Why this actually changes behaviour

Most MSPs treat this as a clean-up job. Something you’ll get to after the agents pile up.

Wrong order. Governance is cheap before the sprawl and brutal afterwards. Every agent you let breed in the default environment is one you’ll eventually have to find, decode, and either rescue or retire — usually under pressure, usually after the person who built it has gone.

“But my clients are tiny — three agents, not three hundred.” Sure. Govern the three now and the thirtieth looks after itself. Skip it, and you’ll meet the thirtieth as an incident.

Here’s the real win. When the guardrails go up first, makers still build. They just build inside lines you drew. Innovation doesn’t stop — it stops being a liability.

And for you as the MSP, that’s a conversation worth having. “We make sure your team’s AI agents are governed, owned and safe” is a service. A monthly line item. Not a favour you do at 11pm when one breaks.

Copilot agents don’t get tired, and they don’t ask permission. Govern them like staff, not like features.

My recommendation? Do the afternoon in the admin centre before your client’s first agent — not after their twelfth.

Agent governance isn’t there to slow your clients down. It’s there to make sure the thing someone built on Tuesday isn’t the thing you’re explaining to their lawyer on Friday.

The Invisible Business

image

I had a conversation recently with a business owner who told me they were “flat out.” Every week was packed. The team was busy. Revenue was coming in. But when I asked a simple question — what’s actually driving your growth right now? — the room went quiet.

Not because they didn’t care. Because they genuinely didn’t know.

This is more common than most people want to admit. You can run a business for years, keep the lights on, even grow a bit, all without really understanding which activities are pulling their weight and which ones are just filling the calendar. And the longer you go without that clarity, the harder it gets to make good decisions about where to invest next.

Busy Is Not the Same as Productive

There’s a comfortable illusion in being busy. If the inbox is full and the meetings are back-to-back, it feels like progress. But activity isn’t the same as impact. I’ve seen businesses pour hours into client work that barely breaks even while ignoring a service line that customers are quietly asking for. The information was there — buried in emails, mentioned in meeting notes, sitting in a spreadsheet nobody opened twice.

The problem isn’t a lack of data. Most businesses running Microsoft 365 are swimming in it. Every email thread, every Teams conversation, every shared document carries a signal about what matters and what doesn’t. The problem is that nobody’s stepping back to read the pattern.

Your Business Already Knows — You Just Haven’t Asked

This is where I think Copilot changes the equation in a way that actually matters. Not because it does the work for you, but because it helps you see what’s already happening inside your own organisation.

Think about it practically. You can open Excel, point Copilot at your last twelve months of client revenue, and ask it to show you which accounts grew, which ones shrank, and where the margin actually sits. That’s a conversation you can have in five minutes that most business owners never get around to having at all.

Or take something even simpler. Ask Copilot in Outlook to summarise what a particular client has been emailing about over the past quarter. Patterns emerge quickly — repeated questions, unmet needs, opportunities you’ve been walking past every day without noticing them.

In Teams, after a string of internal meetings, you can ask Copilot what decisions were made and what follow-ups were assigned. Not because you weren’t paying attention, but because the sheer volume of conversations makes it nearly impossible to hold the full picture in your head. Most of us don’t have a visibility problem. We have an attention bandwidth problem. The data is there. We just need a better way to surface it.

Clarity Before Growth

I’ve come to believe that the single biggest barrier to scaling a small business isn’t capital, or people, or even time. It’s visibility. If you can’t see where value is being created — and where it’s leaking — you end up scaling the wrong things. More staff on a service that doesn’t pay. More marketing for an offer nobody’s responding to. More meetings about problems that aren’t the real problem.

The businesses I see growing well right now aren’t necessarily working harder. They’re just clearer on what deserves their attention. And increasingly, that clarity comes from asking better questions of the tools they already have open on their screen every morning.

You don’t need a business intelligence platform or a consulting engagement to start. You need the habit of asking — regularly, specifically — what’s working and what isn’t. Copilot won’t run your business for you. But it will hold up a mirror. And sometimes, that’s exactly the thing you’ve been missing.