AI Is Coming for Your Business — Will It Be Your Best Hire or Your Biggest Risk?

Last week I watched a business owner ask Copilot to summarise a forty-message email thread, draft a reply, and pull the three action items into a list — all before his coffee had cooled. He looked up and said, half-joking, “That’s better than the temp I hired last summer.” Then his face changed. “Wait. Is this thing safe? Where did all that just go?”

That single moment is the whole argument. The same tool that feels like your sharpest new employee can, in the wrong setup, feel like your most exposed liability. Both reactions are correct. The question isn’t whether AI is coming for your business — it already walked in the door the day you switched on Microsoft 365 Copilot. The question is which version of it you’ve actually hired.

The best hire you’ve ever made

Let me be honest about why people fall in love with this stuff. A good hire doesn’t need everything spelled out. They pick up context, remember what happened last quarter, and get on with it. That’s exactly what Copilot does when it’s grounded in your own data.

Ask it in Outlook to catch you up on a client you haven’t spoken to in a month, and it reads the thread history, the meeting notes in Teams, and the proposal sitting in SharePoint — then hands you a briefing. Drop a messy spreadsheet of sales numbers into Excel and ask which region slipped, and it tells you, with the reasoning, in seconds. Walk into a meeting late and Copilot in Teams gives you what you missed and what you’re expected to say.

This isn’t a chatbot answering trivia. It’s a capable assistant working across your inbox, your documents, your calendar — the same surfaces your team already lives in. For a small business that can’t afford a chief of staff, that’s genuinely levelling. I’ve seen one-person operations punch well above their size simply because the admin grind stopped eating their day.

The biggest risk you haven’t priced in

Here’s where I get less comfortable. The thing that makes Copilot powerful — it can see your data — is exactly the thing that should make you cautious. A new hire who can read every file in the building is only safe if the building has locks on the right doors.

Most small businesses don’t. Permissions sprawl over years. That old SharePoint site “everyone” can access. The shared mailbox nobody cleaned up. The folder of contracts a departing staff member could still open. For years that mess was survivable because nobody had the time to go digging through it. Copilot has all the time in the world, and it digs instantly. Ask it the wrong question and it might cheerfully surface salary figures, a confidential deal, or a client’s private details to someone who was never meant to see them.

That’s not Copilot misbehaving. That’s Copilot doing precisely what you asked, on top of a foundation you never tidied. The tool didn’t create the risk — it just made your existing mess searchable at the speed of conversation. Tools like Microsoft Purview and proper access reviews in Entra exist for this reason, but most businesses I talk to haven’t touched them.

So which one did you hire?

The uncomfortable truth is that you don’t get to choose between “best hire” and “biggest risk” as two different products. They’re the same product. The difference is entirely in the preparation you did before turning it loose.

A great new employee with no onboarding, no boundaries, and access to everything is a liability waiting to happen — that’s true of people and it’s true of AI. The businesses getting real value from Copilot are the ones that did the boring work first: cleaned up who can see what, set sensitivity labels on the documents that matter, and decided deliberately what the tool should and shouldn’t reach.

The ones treating it as a magic switch are the ones who’ll have a very bad day, probably one they won’t even notice until a client mentions seeing something they shouldn’t have.

I’m not in the camp that says slow down and wait. The advantage is real and the businesses that move now will pull ahead. But I am firmly in the camp that says you wouldn’t hand a new starter the keys to the entire business on day one without a single conversation about boundaries. Give your AI the same respect.

Hire it well, and it’s the best decision you’ll make this year. Hire it carelessly, and it’s the breach you’ll spend next year explaining.

Our Business Isn’t Too Small to Be a Target — It’s the Perfect One

I hear the same line at least once a month. It usually comes near the end of a conversation, after I’ve raised the idea of tightening up someone’s security. The owner leans back, gives a little shrug, and says some version of: “Mate, we’re tiny. Why would anyone bother with us?”

I understand the instinct. When you’re running a ten-person business out of a converted warehouse, the idea that someone in another country has you in their sights feels absurd. You’re not a bank. You’re not a government department. You’re just trying to get invoices out and keep the team paid. Surely the criminals are off chasing bigger fish.

That’s exactly the thinking they’re counting on.

Nobody Is Picking You by Name

Here’s the part most owners get wrong. They picture a hacker hunched over a keyboard, deliberately choosing their business out of all the businesses in the world. That’s not how it works. Almost none of it is personal.

Modern attacks are automated. Software quietly scans enormous ranges of the internet, day and night, knocking on every door it can find and noting which ones are unlocked. It doesn’t know you’re a plumbing supplier in Penrith or a three-person design studio. It only knows your front door opened when it shouldn’t have. To that software, “too small to matter” simply doesn’t exist as a category. There’s only “easy” and “hard.”

And small businesses, on the whole, are easy. No dedicated IT person. Passwords reused across half a dozen logins. Multi-factor authentication switched off because it felt like a hassle. That combination is gold to an attacker, because the effort is low and the payoff is real. A single compromised Microsoft 365 account can read every email, reset other passwords, and quietly send invoices with the bank details changed to theirs. You don’t need to be big to be worth a few thousand dollars of someone’s afternoon.

The Invisibility You Feel Is the Vulnerability They Want

The cruel irony is that the very feeling protecting your peace of mind — “we’re invisible, nobody’s looking” — is the thing that leaves you exposed. Because if you believe nobody’s looking, you don’t bother locking up. You stay on the basic plan. You skip the security review. You assume the defaults are fine.

I had a client go through exactly this last year. Small operation, well run, no reason to think they were on anyone’s radar. One staff member clicked a convincing email, typed their password into a fake login page, and that was it. The attacker sat inside the mailbox for the better part of a week — reading, watching, learning the rhythm of how money moved — before redirecting a genuine client payment. The owner’s first words to me were, “I didn’t think we were big enough for this to happen.”

That’s the trap, summed up in one sentence. Feeling small doesn’t make you safe. It just makes you slow to defend yourself.

The Good News: The Locks Are Already in the Building

Here’s what I tell people, and it’s the part worth holding on to. You don’t need an enterprise budget to stop the overwhelming majority of this. The tools are very likely sitting in the Microsoft 365 subscription you already pay for.

Turn on multi-factor authentication for every account — it’s the single biggest difference you can make, and it blocks the password-stealing attack I just described almost entirely. Switch on the security defaults in Microsoft Entra so the obvious gaps close themselves. Let Microsoft Defender do what it’s built to do: catch dodgy attachments and links before a tired staff member clicks them at 4pm on a Friday.

You can even put Copilot to work here. Ask it in plain English to summarise the recent sign-in activity across your tenant, or to walk you through what your current security settings actually mean. I’ve watched owners who’d never open an admin console suddenly understand their own exposure because Copilot explained it in language that made sense to them, sitting right there in their browser.

None of this is glamorous. None of it makes for an exciting Monday. But it’s the difference between being a hard door and an easy one — and easy is the only thing the software scanning the internet actually cares about.

So drop the idea that you’re too small to bother with. You’re not invisible. You’re convenient. The sooner you stop feeling safe and start being protected, the less interesting you become to the only audience that matters here — and that’s a very good place for a small business to sit.

Exchange Online Protection anti-spam / anti-phish policy stacking

Most people think email security in Microsoft 365 is a switch. It’s not. It’s a stack.

And the stack runs in an order you don’t get to vote on.

I see the same thing on tenant after tenant. Someone opened the anti-spam policy years ago, nudged a slider, ticked a box they’d read about on a forum, and walked away. The default phishing policy has never been touched. Connection filter? Empty. Then a dodgy invoice lands in the MD’s inbox and everyone’s surprised.

Here’s the part that catches people out. Those custom tweaks you made? They might be the reason the bad mail got through.

Stop hand-building policies. Turn on the presets and learn the order things fire in. That’s the whole job.

What is policy stacking, really?

Every inbound message runs a gauntlet. Connection filtering checks the source IP. Anti-malware scans the payload. Anti-spam scores the content. Anti-phishing checks for spoofing and impersonation. Each layer has its own policy, and each policy has a priority number.

That’s not one setting. That’s five layers, each with its own verdict, stacked on top of each other.

The catch is precedence. When two policies could apply to the same person, only one wins — the one with the highest priority. Your hand-rolled custom policy beats the preset. The preset beats the default. So if you built a loose custom anti-spam policy back in 2021 and switched on the Standard preset last week, the custom one still wins. The preset you thought protected everyone is being skipped for those users.

Microsoft lays out the full order of precedence — read it once and it’ll save you a dozen support tickets.

Step-by-Step: turn on the stack

You do all of this in the Microsoft Defender portal. No PowerShell. No Exchange admin center.

Open the presets

Go to security.microsoft.com → Email & collaboration → Policies & rules → Threat policies → Preset Security Policies.

Turn on Standard for everyone

Flip Standard protection to On and apply it to All recipients. That covers anti-spam, anti-malware, anti-phishing — and, if you’re licensed for Defender, Safe Links and Safe Attachments — all on Microsoft’s recommended settings, all maintained for you.

Turn on Strict for the people who get targeted

Flip Strict protection on and scope it to the MD, finance, payroll, and anyone with signing authority. Strict catches more and complains more. That trade is worth it for the accounts attackers actually go after.

Add your impersonation names

In the Strict wizard, add the names and addresses of your VIPs to impersonation protection. This is the bit that stops “Hi, it’s the boss, can you buy some gift cards.”

Delete the cruft

Go back to your custom anti-spam and anti-phishing policies. Any old one that’s weaker than the preset is now a hole. Remove it, or you’ve armoured the front door and left a window wide open.

Notice what’s missing from that list?

Inbound mail flow:
  Connection filter → Anti-malware → Anti-spam → Anti-phishing

Standard preset  → All recipients
Strict preset    → VIPs + impersonation list

No sliders. No SCL thresholds. No ASF tick-boxes you read about once and never quite understood. The presets carry all of that, and Microsoft updates them as the threats move. You’re not tuning a spam filter any more. You’re choosing who gets the strong one.

Why this actually changes behaviour

“We’ve always had email security on.”

Sure. But “on” and “correctly ordered” are two different sentences. Most tenants I audit have layers fighting each other — a custom policy quietly overriding the preset, an exclusion nobody remembers, a default policy doing the bare minimum for half the staff.

Presets end that argument. Everyone gets a known-good baseline. Your VIPs get more. And because the settings aren’t yours to drift, the config still makes sense in two years when someone else opens it.

For an MSP, that’s gold. You deploy the same posture across every client in an afternoon, document it in one screenshot, and stop defending slider choices in a review. Consistency is a security control. Drift is the vulnerability.

If you’re still hand-tuning spam policies client by client, you’re doing unpaid work that makes them less safe.

Turn on the presets. Fix the order. Delete the rest.

That’s not a spam setting. It’s a security baseline — and it’s already in the licence you sold them.

The Gap Is The Point

Someone asked me last week what my goals were for the next twelve months. I gave the usual answer — bigger speaking calendar, more clients, a couple of certifications I’ve been putting off. Standard stuff. Then I drove home and realised the answer I’d just given was the version of me that exists today talking. Not the version I’m trying to become. There’s a difference, and most of us never sit with it long enough to feel it.

I’ve started thinking about my future self as a separate person. Not a fantasy figure, but the version of me five years from now who reads what I’m reading now, sits in the rooms I’m sitting in now, eats what I’m eating, wakes up with the habits I’m building today. That person already exists in outline. Every choice I’m making is voting for who they turn out to be.

The inputs are the outputs

The honest truth is that almost nobody wakes up in five years and accidentally becomes someone better. The reading you do, the people you stay close to, what you put on your plate at lunch, the routines you let calcify — those are the materials. There is no secret fifth ingredient. If you don’t like where you’re heading, change one of the four. That’s the whole lever.

The trap is thinking the future version of you is waiting for some big reinvention moment. A course, a milestone, a quiet six months. That moment never arrives. The future you is being built right now, in the tiny decisions you barely notice — the email you snap off in two seconds versus the one you take three minutes to write properly, the meeting you let drift versus the one you tighten with an agenda before walking in.

What would the better version do right now

This is the question I keep coming back to. Not what would I do — what would the sharper, calmer, more focused version of me do with this hour? The one I’m trying to become. It reframes everything. The reply I was about to send, the meeting I was about to accept, the rabbit hole I was about to fall into. Most of the time the answer is obvious; I just don’t want to hear it.

This is also where Copilot has quietly changed how I work. When I open Outlook in the morning and ask Copilot to summarise overnight threads, the better version of me actually has time to think instead of reacting to a triage queue. When I sit down to a Teams meeting and let Copilot handle the recap, I’m fully present in the conversation rather than half-scribbling notes. The point isn’t the feature — it’s that the friction keeping me stuck in version-of-me-today gets quietly removed. The future me has more room to show up.

Direction, not failure

Most people read the gap between who they are and who they want to be as evidence they’re falling short. I read it the other way. The gap is the only signal that tells you which way to walk. If there’s no gap, you’ve stopped growing. If the gap is huge, that’s not a problem — that’s a map.

So this week I’m watching what I read, who I sit with, what I put on my plate, and which habits I’m letting form by accident. Five years sounds like a long time. It isn’t. It’s about 1,800 versions of today, stacked on top of each other. The future me is being built in the next hour. So is yours.

Copilot audit logs in Purview

Most people ask the wrong question about Copilot.

They ask “is it safe?” What they mean is “can it leak our stuff?” Fair worry. But it’s the wrong place to start.

The real question a client should be asking is “can you show me what Copilot has been doing?” Because if the answer is no, safe or not doesn’t matter. You’re flying blind.

Here’s the thing nobody tells you in the licensing pitch. Every Copilot interaction is already being recorded. You don’t have to buy anything. You don’t have to flip a switch. It’s been sitting in the unified audit log the whole time, waiting for someone to go look.

Most MSPs never do.

What is Copilot audit logging, really?

It’s the receipt for every conversation your users have with Copilot.

When someone asks Copilot in Word to summarise a document, or asks Copilot in Teams what they missed, that interaction writes a record into Microsoft Purview. Who did it. When. Which Copilot app. And — this is the part that matters — which files and resources Copilot reached into to answer.

This happens automatically as part of Audit (Standard), which is on by default for business tenants. If auditing is running, Copilot logging is running. Microsoft spells it out in the audit logs for Copilot and AI applications docs: no extra steps, no separate config.

That’s not a feature you enable. That’s a feature you’ve been ignoring.

Step-by-Step: finding Copilot activity in Purview

Open the Audit solution

Go to the Microsoft Purview portal at purview.microsoft.com, sign in, and pick Audit from the Solutions list on the left. If you’ve got the Audit Logs or View-Only Audit Logs role, you’ll land on the search page. If you don’t, that’s your first job — sort the permissions, per the search the audit log guidance.

Set your date range and activity

Pick a start and end date. Then in the activities filter, search for the Copilot record type.

RecordType: CopilotInteraction
Activity:   Interacted with Copilot

Notice what’s missing? No prompt text in that filter. The audit row tells you that a conversation happened and what files it touched — it doesn’t hand you the back-and-forth wording. That content lives elsewhere, retained for eDiscovery and Communication Compliance, not in the row you’re reading. Knowing that distinction is what separates someone who’s read the docs from someone who’s guessing.

Run the search and read the resources

Start the job. It keeps running even if you close the browser, and finished searches stick around for 30 days. Open a result and look at the AccessedResources field. That’s the gold. It shows the actual files Copilot pulled in to ground its answer.

This is where oversharing shows up. If Copilot is referencing a payroll spreadsheet for someone in the warehouse, you didn’t find a Copilot problem. You found a permissions problem Copilot just made visible.

Export when you need a paper trail

Push the results to CSV. Now you’ve got evidence, not anecdotes.

Why this actually changes the client conversation

Walk into a renewal with “Copilot is secure, trust me” and you sound like every other reseller.

Walk in with “here’s a report of every file Copilot accessed last quarter, and here are the three oversharing issues we caught and fixed” — that’s a different meeting. That’s you doing governance, not selling a licence.

“Wait, so I can actually prove Copilot isn’t quietly reading files it shouldn’t?”

Yes. And that single sentence is worth more to a nervous business owner than any feature slide.

One caveat worth knowing. Retention isn’t infinite and it isn’t equal. On most Business Premium tenants you’re looking at 180 days. On E5, key workloads stretch to a year, and you can build longer audit log retention policies if compliance demands it. If a client needs to answer “what happened nine months ago,” check the retention before you promise the answer exists.

This is the stuff cyber insurance forms ask about. It’s what SMB1001 and Essential Eight assessors want to see. Not “do you have Copilot.” But “can you account for what it did.”

Copilot doesn’t forget. Make sure you can read what it remembers.

If you’ve rolled Copilot out to a client and you can’t pull this report, you haven’t finished the rollout. You’ve just started the part nobody bothered to do.

Copilot in Outlook

Most people meet Copilot in Outlook through the Draft button. They click it, type “write a reply saying yes”, watch it produce three paragraphs of corporate waffle, and quietly decide the whole thing is overrated.

I get why. That’s the demo everyone shows. It’s also the least interesting thing Copilot does in your inbox.

The real value isn’t writing email faster. It’s reading it faster.

Think about where your time actually goes. It’s not composing. It’s the forty-message thread you got CC’d on at 4pm — the one you have to scroll to the bottom of and reconstruct before you can say anything useful. That’s the tax.

So before you write a single prompt, flip the question. Don’t ask “what can Copilot write for me?” Ask “what am I wasting time reading?”

What is Copilot in Outlook, really?

It’s two jobs wearing one badge.

The first job is Summarize. Open a long thread and there’s a “Summary by Copilot” card sitting at the top. One click boils the thread down to who said what and what’s still outstanding — with little numbered references back to the actual messages, so you can check it didn’t invent anything.

The second job is Draft. You give it an instruction, it writes the email, you fix the bits it got wrong. Tone and length are dials, not destiny.

Notice the order I put those in. Summarize first. For most people that’s eighty percent of the value — and nobody demos it.

Step-by-Step: getting actual value out of it

Summarise before you read

Open any thread more than a few replies deep. Click Summary by Copilot at the top of the message. Read the summary, then jump straight to the messages it references. You’ve just skipped the scroll.

Draft by pointing, not pleading

Here’s the prompt pattern that works:

Reply to the client agreeing to the Tuesday 2pm slot,
confirm I'll send the agenda by Friday, keep it short and warm.

Notice what’s missing? No “please write a professional email that…”. No throat-clearing. You point at the decision and the facts, and Copilot handles the wording. Vague in, vague out — every time.

Set the tone, then get out of the way

Before you generate, open the tone and length options. Pick direct and short for internal mail. Save formal for the email going to a client’s lawyer. Microsoft’s own walkthrough covers drafting an email with Copilot if you want the full button tour.

Always read it before you send

Copilot will confidently add a detail you never gave it. The draft is a starting point, not an outbox.

The shared mailbox trap that catches everyone

Here’s the one that generates support tickets.

Your client runs everything out of info@ or accounts@. They turn on Copilot, open the shared mailbox, hit Summarize… and nothing. The button’s missing, or it tells them it has no knowledge of that mailbox.

For a long time, Copilot in Outlook only worked on your primary mailbox. Shared and delegate mailboxes were off-limits — the single most common “is this thing broken?” question I get.

That’s finally changing. Microsoft now supports Copilot in shared and delegate mailboxes, but the fine print matters: the person using it needs the right level of access, the mailbox has to live in Exchange Online, and encrypted messages still can’t be read. So when a client says “it doesn’t work in our support inbox”, you can tell them why — and what to check — instead of shrugging.

That’s the difference between an MSP who resold Copilot and one who understands it.

Why this actually changes behaviour

“I’ll get to my inbox after lunch.”

That sentence is a productivity confession. Inbox triage gets deferred because it’s expensive — every thread is a small act of reconstruction before you can act.

Summarize makes that cost almost nothing. When reading a forty-message thread takes ten seconds instead of ten minutes, you stop quarantining email into a dreaded afternoon block and start clearing it in the gaps between meetings.

That’s not a feature. That’s a different relationship with your inbox.

Your inbox doesn’t pay you to read. It pays you to decide.

My recommendation? Teach clients Summarize first, Draft second. Draft is the headline. Summarize is the reason they’ll keep the licence.

If you’re not showing them both — and the shared mailbox gotcha — you’re leaving the best part of what they’re already paying for sitting in the box.

Defender for Endpoint Web Filtering

A client rings up. Staff are burning half the day on betting sites, or someone clicked something they shouldn’t have, and now they want you to “lock down the web.”

So you go and price a web filter. Cisco Umbrella, DNSFilter, a firewall add-on. Another line item, another agent, another renewal to babysit.

Stop.

If that client is on Microsoft 365 Business Premium, you already sold them a web filter. It’s been sitting inside Defender, switched off, the whole time.

That’s not an upsell. That’s a setting.

What is web content filtering, really?

It watches where your devices go on the web and lets you block whole categories of sites by name. Gambling. Adult content. Peer-to-peer. Hacking. You tick a category, and people in the groups you choose stop being able to reach it, whether they’re in the office or working from a café.

Microsoft calls it web content filtering, and it rides on protection that’s already on the machine. In Edge, the blocks are enforced by SmartScreen. In Chrome, Firefox, Brave and Opera, they lean on network protection. Both of those have to be switched on, or nothing happens.

Here’s the part most people miss. Any category you don’t block gets audited automatically. So before you stop a single site, you get a report of exactly where your client’s staff have been going.

You can’t filter what you can’t see. So start by seeing.

Step-by-Step: turn it on, then point it at something

Switch on the feature

In the Microsoft Defender portal, go to Settings > Endpoints > Advanced features and flip Web content filtering to On. Save.

Create a policy and just watch

Go to Settings > Endpoints > Rules > Web content filtering and add a policy. Target a device group. Don’t block your client’s contentious categories yet. Let the audit data build.

Read the report

Open Reports > Web protection and look at the Web activity by category card. Give it time, there’s up to a 12-hour lag before activity shows up. This is the bit that changes the conversation. You’re no longer guessing what staff do online. You’re looking at it.

Block what actually matters

Now edit the policy and tick the categories the report told you to care about.

Microsoft Defender portal → Settings → Endpoints
   Advanced features → Web content filtering = On
   Rules → Web content filtering → + Add policy
Reports → Web protection → Web activity by category

Notice what’s missing? No PowerShell. No third agent. No new licence. Every step lives in a portal your client is already paying for.

Why this actually changes behaviour

Because you walk into the renewal with evidence, not a hunch.

“Here are 4,000 hits to gambling sites last month, off three machines.” That’s a discussion the business owner can act on. A quote for Umbrella is just a number they’ll push back on.

“But we already quoted them a web filter.” Fine. Now you can show them what they’d be paying for, and that they already own it.

A few things will bite you if you’re not watching for them:

Edge uses SmartScreen, everything else uses network protection. If network protection is in audit mode or off, your blocks are theatre. Lovely report, no enforcement.
Non-Microsoft browsers won’t honour HTTPS category blocks unless QUIC and Encrypted Client Hello are disabled. Leave them on and Chrome quietly routes around you.
Expect lag. Up to 12 hours before activity lands in the report, up to two hours before a block bites. Don’t test it in the first five minutes and declare it broken.

And when you genuinely need an exception, you don’t loosen the whole category. You carve out one site with a custom indicator, which sits above the filter in the order of precedence. Allow always wins over block. That’s your release valve when the boss insists on one specific site.

Run the audit, read the Web protection report, then block with proof in hand.

Web content filtering isn’t there to add a product to your stack. It’s there to delete one.

If you’re billing a client for a separate web filter on top of Business Premium, you’re charging them for something they already own. Show them the report instead.

That’s not filtering. That’s value you can prove.

Defender for Endpoint device control (USB / removable media)

Walk into most small businesses and ask how they stop someone walking out the door with a USB stick full of client data. You’ll get one of two answers.

Either “we glued the ports shut” or “we don’t.”

Both are wrong. One is a sledgehammer. The other is a shrug. And the worst part? The tool that does this properly is already sitting in the licence they’re paying for every month.

If your clients are on Microsoft 365 Business Premium, they have Defender for Business. And device control comes with it. You’re not buying anything. You’re just not turning it on.

Let’s fix that.

What is device control, really?

Forget “blocking USB sticks.” That framing is what gets people stuck.

Device control isn’t a switch. It’s a set of rules about who can do what with which device. Read. Write. Execute. You can let the finance PC read a USB drive but never copy to it. You can allow one approved brand of encrypted stick and deny every other. You can leave Bluetooth alone and only police removable storage.

That’s the part people miss. It’s not on or off. It’s a dial.

And here’s the bit that actually matters for an SMB: it watches before it blocks. Every time someone plugs something in, Defender logs it — the device, the serial number, the user, the machine. You get a record without enforcing a single rule.

You can’t block what you can’t see. So start by looking.

Step-by-Step: turning it on without breaking anything

Open the right blade

Head to the Microsoft Intune admin center and go to Endpoint security > Attack surface reduction. That’s where device control lives. Not where you’d guess, I know.

Audit first, always

Don’t block anything yet. Enable device control in audit mode and leave enforcement alone. Let it run for a week or two across a pilot ring. You’re collecting evidence, not making arrests.

Read the report

In the Microsoft Defender portal, open the device control report and Advanced hunting. Here’s the query that tells you everything that’s been plugged in:

DeviceEvents
| where ActionType == "PnpDeviceConnected"
| extend parsed = parse_json(AdditionalFields)
| extend MediaClass = tostring(parsed.ClassName)
| extend MediaSerialNumber = tostring(parsed.SerialNumber)
| project Timestamp, DeviceName, AccountName, MediaClass, MediaSerialNumber
| order by Timestamp desc

Notice what’s missing? There’s no block in there. That’s a visibility query. You’ll be surprised what shows up — personal phones, dodgy giveaway sticks from a conference, the bookkeeper’s external drive.

Set the dial

Now you write the actual policy: default deny on removable storage, then carve out exceptions for the devices you trust. Scope it to removable media only so you don’t accidentally fight with printers or webcams.

Roll it in rings

Pilot group first. Then a wider ring. Then everyone. Same three-ring discipline you’d use for anything that touches the endpoint. Never enforce tenant-wide on day one.

Why this actually changes behaviour

Here’s the real win. It’s not the block. It’s the conversation the block lets you have.

When a client asks “can someone steal our data on a USB?”, “we glued the ports” sounds paranoid and “we don’t” sounds negligent. Neither builds trust.

“We allow encrypted drives, we log every device that connects, and we can show you exactly what plugged in last month” — that’s a different conversation. That’s the answer that wins the renewal.

Before: “USB is a risk we just live with.” After: “USB is a risk we measure, scope, and report on.”

And it costs nothing extra. You already sold them the licence. This is value you left in the box.

Device control isn’t there to lock the door. It’s there to tell you the door was open the whole time — and let you decide, device by device, who gets a key.

If you’re not showing your clients this, you’re leaving it on the table for someone else to find.