AMITPC – June 2025 Meetup

As promised, here are the links and slide decks for the topics covered during the Adelaide Microsoft IT Pro Community User Group from 5th June 2025.

In addition, here is the recording, which includes Skye Davis’ presentation: Threat Intelligence Integration and Security Automation: https://youtu.be/txKaml7S7-0

Speaker Bio: Skye Davis

Skye is a Threat Hunter and Endpoint Security Lead from the University of South Australia.
Skye has been working in the IT industry for over a decade and has been in the security industry for about 4 years.
Starting her security career as a Security Operations Centre and Network Operations Centre lead at an MSSP, she pivoted to work in a more technical role at the University of South Australia where she has learned a lot of skills that support automation and integration efforts that are necessary to have a functioning security practice in such a large enterprise.

Skye’s passion is working with different security platforms and squeezing the most out of those platforms, particularly when it comes to integration and automation efforts.
Working in a large enterprise and being responsible for the security of over 10000 endpoints demands a strong grasp of implementing security at scale, and ensuring that time is spent on the right areas to ensure efficient management of the security of our environment.

Skye has also spoken at numerous events, in schools, and even lectured some courses for UniSA during SP2 2024.
She learns best by teaching others, so she always has time to show someone how to do something or to explain how a certain solution has been reached.

What’s New? – Podcast!

ps://www.linkedin.com/company/oobcasts
https://www.youtube.com/@OOBCasts
https://open.spotify.com/show/6OIu5urlxDy26s3ia7ihLU
https://podcasts.apple.com/podcast/id1789671447

https://linktr.ee/andrewoyoung
https://linktr.ee/shehanjp
https://linktr.ee/antoporter

What’s New? – Windows

•Windows 10 End of Support – 14^th October 2025

•New M365 Copilot App

•Researcher and Analyst agents – GA

What’s New? – Entra

•Microsoft Entra Agent ID

What’s New? – Purview

•DSPM now GA

•Pay As You Go billing available for some services

Audit – logging certain kinds of Copilot data
Communication Compliance – for support of GenAI interactions
eDiscovery – data storage of non-M365 AI data in cases
Insider Risk Management – support GenAI-related indicators

•Data Lifecycle Management

New Retention Policy locations expanded support for Copilots and AI apps

•Microsoft Purview triage agents

DLP and IRM (preview)

What’s New? – Intune

•Multiple Administrative Approval (MAA)

•Vulnerability Remediation Agent for Security Copilot in Intune (preview)

Pre-requisites: Intune P1, Security Copilot with SCUs, MDVM, Intune Suite

• New Video Series:

aka.ms/MicrosoftIntuneProtection

What’s New? – Microsoft Defender for O365

•Auto-Remediation of Malicious Messages in Automated Investigation & Response (AIR) – GA

What’s New? – Defender XDR

•2 Attack Surface Reduction Rules are now in GA

Block rebooting machine in Safe Mode: Prevents execution of commands to restart in Safe Mode
Block use of copied or impersonated system tools: Blocks use of executable file identified as Windows System tools copied or duplicated

Configuration management – Effective settings in device investigations