[ microsoft 365 security ]
Microsoft 365 security, explained like it matters.
Labs, guides and field notes on identity, compliance and GRC. For the people who run Microsoft 365, and the ones getting there.
# quick Microsoft 365 tenant review
PS> Invoke-TenantBaseline
- [ok]Legacy authentication blocked
- [ok]Conditional Access for admins
- [!!]SMS MFA on privileged users
- [!!]DMARC at p=none
- [ok]Sensitivity labels published
- [!!]SharePoint sites shared with "Everyone"
3 findings · start with identity
PS>
// 9 Microsoft certifications, verifiable on Microsoft Learn
- SC-401
- SC-300
- SC-200
- MD-102
- PL-300
- DP-300
- DP-600
- AZ-900
- MS-900
- In progress: + SC-100 · SC-500 · AB-650 in progress
// what I teach
Five pillars, one tenant.
Every lab and article belongs to exactly one, so you always know what you're learning and what's missing. Number two is my specialty: I research how AiTM attacks get past traditional MFA.
- 01
01 · [hardening]
Microsoft 365 administration and hardening
Entra ID, Intune, Exchange Online, Defender, Secure Score, SPF/DKIM/DMARC.
- 02
02 · [identity] · flagship
Identity and anti-phishing
AiTM, passkeys, FIDO2, Conditional Access, token theft.
- 03
03 · [purview]
Compliance, Purview and GRC
DLP, sensitivity labels, retention, eDiscovery, ISO 27001, NIST CSF.
- 04
04 · [ai]
AI and Copilot security
Oversharing, data governance before Copilot, DSPM for AI.
- 05
05 · [career]
Career and certifications
SC-200, SC-300, SC-401 and MD-102 paths, home labs, résumés and remote work.
// from the blog
Latest posts.
- · [hardening]3 min
10 settings every new Microsoft 365 tenant needs on day one
The short list I check before anything else: identity first, then email, then sharing. With the PowerShell to verify each one.
- · [career]1 min
Why I started HackEC
What this blog covers, how it's written, and the one rule every post follows.
- coming soon
MFA isn't enough: how an AiTM attack works (in a lab)
[ 1:1 call ]
Need a hand?
Book a 1:1 call and we'll look at your specific case together.
or write to [email protected]
jhair@hackec:~$ whoami
Jhair Cedeno
- role
- Security & Compliance · M365
- certs
- 9 × Microsoft
- degree
- Computer Engineering
- langs
- EN · ES · PT
- tz
- GMT-5
jhair@hackec:~$
// who's behind this
Hi, I'm Jhair.
Since March 2025 I've worked on Microsoft 365 security and compliance at a Microsoft partner MSP, with clients in several countries, including financial services.
I'm a computer engineer and a Brazilian jiu-jitsu instructor. On the mat you learn position before submission. Security works the same way: fundamentals before tools.
I started HackEC to publish the guides I wish I'd had: practical, reproducible, no fluff.