02x10-same_soc_new_socks.zip

Koos couldn’t help himself this month, so he’s brought two topics. First up is Microsoft’s ISOC announcement. It sounds like a brand-new product, but is it? He unpacks what it actually is, why everyone’s confused, and what it means for you. Then there’s a story from the field. A customer had to hand law enforcement “a copy” of their Sentinel workspace, and there’s no clone button in Azure. Koos walks through how he did it with Azure Monitor export jobs (currently in public preview), the gotchas he hit along the way, and the script he wrote to make it repeatable. Chris rounds things out with the EWS deprecation in Exchange Online: it didn’t just switch off on 1 October, and it’s worth paying attention to this one.

Full show notes available on our blog: https://df3ndr.io/episodes/2026/10/31/02x10-same_soc_new_socks.zip.html

Follow us on your favorite podcast platform or check us out at https://df3ndr.io