Welcome to episode 419 of the Microsoft Cloud IT Pro podcast recorded live from Workplace Ninjas US in December 2025.

This is a show about Microsoft three sixty five in Azure from the perspective of IT pros and end users, where we discuss a topic or recent news and how it relates to you.

In today's episode, John Joyner, an eighteen year MVP, senior director of technology at Corsica Technologies, and a security professional extraordinaire joins Ben.

They discuss some of the announcements from Microsoft Ignite focused around Microsoft security, as well as diving deep into the new security store, AI agents, security compute units or SCUs, and how Microsoft is making enterprise AI security more accessible and affordable than ever.

Another interview from Workplace Ninjas.

I have done more interviews here this week than I have for a while, so another one without my co host, without Scott.

But I'm joined instead by Jon Joyner, another Microsoft MVP.

I'm assuming in the security space given the nature of the conference and our topic today.

But do you wanna introduce yourself a little bit, John?

Tell us who you are, what you do.

Do you like long walks on the beach?

Yeah.

Hi, Ben.

Thanks for inviting me here today.

I am a eighteen year Microsoft MVP.

Oh, congratulations on that.

So usually, you're like adding up the, like, the five year year bugs.

Blue disk, like, everywhere.

It's an amazing thing that you plan on it happening when you're early in your career, but it can happen.

Right?

And I am dual awarded right now in cloud security Okay.

And Azure management.

Oh, okay.

So Right.

And I'm here talking about Defender for IoT.

It's the topic I'm presenting at here at Workplace Ninjas.

Okay.

Very cool.

We might have to do another follow-up episode on that because that is not something I know much about either.

Not our topic for today, but Okay.

Yeah.

No.

Yeah.

It's exciting.

Mental note.

Future episode.

Yes, sir.

So today, this is we're gonna talk about some of the announcements that came out of Microsoft Ignite.

There were some really, I think, really exciting and really cool announcements there, specifically around in the general realm of Security Copilot and some things like the security store and it being included in e fives now.

So we're gonna dive into that a little bit.

So security store.

Again, brand new at Ignite couple weeks ago.

Do you wanna tell us a little bit about, like, what is the Security Store?

How does this change some of the things even?

Diving to some of those things.

Yeah.

Security Store is a effort by Microsoft to surface in the work space used by security professionals, services and products that that those cybersecurity people will find useful.

Okay.

There's currently until we had the security store, there was basically Azure Marketplace.

And Azure Marketplace is as broad as can be.

And there's tens of thousands of things in there.

Okay?

Yep.

And Microsoft identified the primary of that marketplace.

We're not the cyber staff.

They were more like the contracting staff and the Okay.

FinOps people and that kind of and they so we imagine place where security specific offer available.

You define exactly.

So they've created the security store.

And the security store can be found in the Defender XDR portal.

Okay.

And also securitystore.microsoft.com.

Okay.

And So does that take you, like, if you go securitystore.microsoft.com, does it just take you into the security store in the security portal?

There there's a there's a public public portal.

Okay.

Requires no login.

Got it.

Nice.

Right?

Right.

So you can actually browse it and see some of these solutions that are available without even having a Yes.

Subscription or having to And I think I think broadening access is was a good thing.

Yeah.

So I think about this store is security Copilot aware.

Right?

Okay.

If you have security you have SCUs, security computes Yep.

Allocated to your so things may become available to her.

And this is also true in Defender XDR that if you have there's a new capability for remediations, like fix it fix it now buttons.

Right?

And the but they're only available if you Got it.

If you don't have security Copilot, the button links to just a learn article.

But if you have security Copilot, it links to shall I do it now.

Right?

Oh, is this Yeah.

This is all quite new.

And same with security store, you have SCUs, then you have a a different experience.

Okay.

Logged in and all those other Got it.

And the security store is divided into categories like tabs at the top, and the newest one is agents.

Okay?

Surprise.

Right?

We get more agents.

AI.

I'm like, I don't think we're how many tattoo it on my forehead or my wrist?

Yeah.

And so the agents is a place to buy, and some of them are free.

Okay.

Like, some of them are free and some of them you buy, and they are partner created and Microsoft created, and they are AI agents.

Okay.

Right?

And they do specific things.

And so the concept is that you're a security profession, you're in the portal, and you're investigating a thing or you're doing a thing, and you're having trouble.

It's taking a lot of time, a lot of friction.

And you're like, gosh.

I wish there was a way to automate this.

And, like, you do the right searching and go to the right places, you're gonna see the partner offer.

Click here to add this agent to your environment.

And it'll do the thing.

Okay.

And in in the store right now, some agents have no charge to install essentially.

Others have a monthly charge that is payable to partner that developed.

Okay.

It's a way for partners to start to monetize and share their IP as it relates to AI.

It's a very lucrative potential for partners, and it's a great way for Microsoft to to democratize access to AI.

To help you out.

And so these agents these agents are paid for when they run by consuming security comps.

Right?

Okay.

SCUs are the foundation for running SecurePilot.

And when you have SCUs in your environment and you activate a Security Copilot instance, you are basically standing up a runtime, almost a rep an LLM replica that is just for you and is tuned to security and may or may not have access to your private company things you may have given Security Copilot access.

So it's basically a copy of all the LLM goodness that you have just talking to BingChat.

Uh-huh.

But it also has this extra access to all of your stuff and access to all the threat and vulnerability stuff.

So it's expensive to stand up this thing because it it's private to you.

And Microsoft must allocate iron in its data center just for you.

And so it costs them, and they've come up with a way to pay for it, SC.

Got it.

And SCUs have been around for a year or so since Security Copilot came out, and early adopters, did find that expensive site Yeah.

To make it useful, to make it responsive twenty four seven, you had to run SCUs all the time.

And there was multiple tens of thousands of dollars buy in, just start using Oh, yeah.

It was wild.

And some companies that went all in, they have found satisfaction.

Many others said this is too much right now.

K?

And Microsoft recognized this.

They're a smart company.

Yep.

And they came up with this way using this agentic model.

And now SCUs went or rather, security agents, when they run, they tap into your SCU.

Okay.

And when you go to the security store today and you look at the offerings, they list how many SCUs or how many frac subs Okay.

When you run them.

And some of them consume point one SCU.

Oh, wow.

Yeah.

Yeah.

So we've gone we've gone from, like, I need to allocate a five digit check to run this thing to it's just a couple of dollars.

Okay.

Okay?

And if that agent task that runs in that one tenth of an SCU, if it saves my analyst an hour or a day, it's well worth the three the $3 for that.

Actually, they changed security comp unit purchase.

You know, like, basically buy a discounted package of, like, $4, and then when you go over it, $6 over 6.

So they have they've slightly changed it to make it slightly more Yeah.

If you can predict how much you're gonna use.

So they made it a little bit cheaper, but the model is yeah.

You can still run it $24.07.

You'll still use it as a replacement or augmentation asset for junior and middle level security engineers.

Uh-huh.

You can still do that.

Now there's this new way to consume to take advantage of the Microsoft cloud.

Okay.

And so these and the most popular agent right now as I stand is a phishing triage.

I Right?

Yes.

And I've heard a lot of people asking about that one and talking about one.

Fishing is the number one vector for ransomware.

Yep.

And so anything that mitigates that is very high value.

And the phishing triage agent, frankly, I have I solved either.

Okay.

But I I know that it basically responds real time to mitigate the consequences of a phishing.

A phishing.

Right.

And, you know, we can do this now with logic apps, with Yeah.

And I've tried to build some of those there.

Thank you.

It takes a little bit of work.

It does.

And, like, is mine better than yours?

Like, is am I missing something?

Did I spend enough dev time?

Am I thought of everything?

When when you do it your on your own, it's gonna work the best.

And for example, the phishing triage agent was developed with Microsoft centrally to support many security professionals, and it's probably the best.

Probably.

It is I can guarantee you it's better than mine because I hit that with my logic app.

Like, I would have somebody click on an email, and I'd be like, try to build the logic app.

It's like, oh, well, this one didn't go to a user.

This went to a group.

So the data that came into the logic app was different to Microsoft three sixty five group before the user got it, or went through distribution list, or I had a Microsoft three sixty five group in the distribution list.

So that JSON that came into Logic apps, it felt like it was different every time somebody clicked on a phishing link, and it I banged my head against the wall trying to account, to your point, every single scenario to make this logic app work the way I wanted to based on the incoming data when a phishing event happened.

Exactly.

And another way that these agents help, they don't require you to know.

And, like, I know KQL.

You probably know KQL.

Yep.

I can sit down and go, well, did, you know, filter a go pipe, like and I can answer questions like, has this happened before?

Has this combination of things happened before?

I can whip it out generally in KQL.

But I'm a professional.

I've studied a long time.

Yeah.

Even though that's for eighteen plus years, probably.

Still, I have to go go check it out, and I may make mistakes.

And so the first season of professional time is creating a complex query to answer an important question involving historical analysis compared to something happening today.

It's possible, but it's requires a senior person.

Yep.

And they still may need a little time.

Okay?

So if now, like, you can write an agent yourself or as a partner and write an agent for other cost that does that thing without requiring any KQL.

And it's not like in like, it's a crutch.

You're like, oh, I don't wanna learn KQL.

I'm gonna I'm gonna just talk to the LON.

But when you think about it, we can't depend on every security analyst being a crack QL Right.

Guy or gal.

Right?

It's a person dependent thing, but we need security analysts really bad.

There's a shortage.

Okay.

Right?

So if we can come up with a way to have these people just talk to the SIM Yep.

Why not?

Right.

Makes sense.

So there's there the Microsoft's approach to making AI more affordable and more approachable and more understandable.

Again, when we cons when we buy an agent, we know exactly what we do.

We know exactly what it's gonna cost.

It's a box.

Yeah.

Our risk is minimal.

Yeah.

Whereas, like, oh, I'm gonna buy a stack of SCUs, and I'm gonna assign my developer two weeks, and we'll hope that he or she comes up with something that works afterwards.

Right.

Remove remove that doubt, remove that cost.

It's a great thing.

So check I encourage everybody to check out SecurityScore.

Okay.

Do you feel overwhelmed by trying to manage your Office three sixty five environment?

Are you facing unexpected issues that disrupt your company's productivity?

Intelligink is here to help.

Much like you take your car to the mechanic that has specialized knowledge on how to best keep your car running, Intelligent helps you with your Microsoft cloud environment because that's their expertise.

Intelligent keeps up with the latest updates in the Microsoft cloud to help keep your business running smoothly and ahead of the curve.

Whether you are a small organization with just a few users up to an organization of several thousand employees, they want to partner with you to implement and administer your Microsoft cloud technology.

Visit them at inteliginc.com/podcast.

That's intelligink.com/podcast for more information or to schedule a thirty minute call to get started with them today.

Remember, Intelligink focuses on the Microsoft cloud so you can focus on your business.

So I have a question with Security Store too.

Does this also provide any additional type of, like, third party integration?

Right.

Before with Security Copilot, you could go in and you could connect it to, like, Azure Firewalls and other services.

Does this also extend some of that, or is this really just focused on agents?

Well, the the agents can imagine.

Okay.

Imagine an Azure Logic app connect to a Security pilot prompt book of infinite Yep.

Density.

Like, anything you can imagine.

So it's not some partner or a company vendor, like, could write agents that makes their connection so much Got it.

And more meaningful.

And so a third party company that right now is just a a lonely connector in the 350 or 400 in the Sentinel catalog Yeah.

Can now become can stand out Okay.

And be more attractive and more usable because it's not just connecting to Sentinel the way Microsoft thought it best to connect connect the way you, the author of the software, will work best.

And you can put that into an agent, and then somebody get that agent in the security store and hit the button and maybe pay $2.02 s c two or three SCUs.

This is gonna be an expensive workflow.

It may cost $18 to run this workflow.

But when I'm done, I would have created optimized connectors, playbooks, workbooks, everything in my environment.

It's just gonna be aware of my environment.

Think about it.

I'd be able to Yeah.

Like, you know, creating a custom workbook right now.

Again, if if KQL Right.

You can do it, but it's It still takes some work.

Fifteen minutes on a good day for the simplest change, frankly, to crack open a workbook, find the widgets.

Oh, yeah.

Blah blah blah blah.

So imagine an agent reconfiguring the work, tailoring it just to your environment, knowing how many employees you have, what industry you work in, what your time zone is.

Right.

Like, all this stuff.

Asking all those questions and then building that knows these things because it lives you Yeah.

So so the it it yeah.

I think this I I haven't seen any of these yet.

There may be some in the store, but I think that in answer to your question, third parties will love this because it makes their stuff easier to consume and a better experience.

Yeah.

So when the SCUs, kinda talking about this came out at Ignite.

The announcement also came out with the SCUs now being included in Microsoft 55 e five, and like, I did the math, it comes up to like point four SCUs per month per e five user.

I'm assuming that these agents, going back to the fractional, you don't even have to go spin up a $4 a month SCU or a $6 a month SCU.

You're gonna be able to start leveraging the included SCUs to run these agents Yeah.

For a for a 1,000 employee organization Uh-huh.

400 SCUs will magically appear in your subscription every month.

Okay.

And if you don't use them, you lose them.

Yep.

And at the And if you don't use them or you lose them Yep.

And at the beginning of next month, you get another farm.

Get another farm.

And so in that scenario, if we have 400, you know, I was just talking this yesterday.

Imagine that point one Right.

SCU You can run a lot of things.

Times Yeah.

In one month.

And and, like, so can and you it won't over consume.

Like, when you try to run the four thousand first time, it'll say you're out of this.

You Not let you go above that.

Yeah.

I I think you can actually tell it.

Yeah.

Go ahead go ahead and supercharge me, They're assuming that they normally you know, for most customers, they're gonna say, don't stop when I exhaust them.

So in in this scenario where you only got 400 in a month, use them.

I mean, this is a boom because Right.

It's lost money.

If you don't go to a security store and you don't find an agent that's attractive to you and affordable to you, you are missing the boat.

Yeah.

And you are going to become at an ever pretty competitive disadvantage to other people in your industry that that are seeing the light.

Right?

Yep.

In in the security world, attacks are driven by AI.

60, I believe, 60% Is it really that high already?

Of ransomware attacks are AI driven.

Okay.

I didn't realize that that high of a percentage of the statistic I learned at the security b day at Unite.

Oh, okay.

And, like, if you're not using AI, counter the 62% of the bad guys in AI against you, you will lose.

It Yeah.

It is foregone.

So it's really important to be an early adopter, I think, in these times.

In that space.

Microsoft has made a way for TOW in the agentic AI world, assuming you have e five Yep.

And at no risk.

Right.

So the combination, all these announcements is fantastic.

It's cool.

And I know the other agent, I would say, that I've started using or seen used a lot is I like the conditional access optimization agent.

I actually logged into my tenant yesterday or today, and I had, like, new conditional access policies.

They label them.

It's like, this was a Microsoft conditional access optimization agent.

I had new ones in my tenant already for agents.

Like, also at Ignite, they announced conditional access for agents.

This conditional access optimization agent is already going into my tenant and identifying, oh, you need to create a new initial access policy to help protect your agents.

And it's that type of stuff that I feel like security professionals aren't always thinking of, I gotta go do this right away.

Do you have these agents running?

It's like it's helping those security professionals secure their environment.

Absolutely.

It's cool.

So some of the road map, you talked about like the store was kind of the start at Ignite, but some benefits or some of the things you see with this release around just Microsoft's AI strategy in general, their road map.

Yeah.

The road map is exciting to talk about.

Microsoft has a road map.

Every known aspect to AI world today.

Right?

They have at the at the extreme high end using AI foundry and with the with developers on staff, you can create virtual instrumentality of an imagine, own it, cleat.

So Microsoft has the tools for the big shops, big vision Yep.

To build AI solutions properly, safe with guardrails of governance.

So and and then in the middle end, they have Copilot, security copilot, office, etcetera.

So Yeah.

I heard a 192.

It's like a 192 copilots or something.

Well, they're The hope in this number goes down, like, who can tell?

Maybe it's a little I'd rather have a 190 copilots.

I don't know if that's the number.

I don't either.

Then then zero.

Right?

They are an approachable, double way in the Microsoft across the spectrum.

And then and now we have at the level h Right.

So so we have ways to consume and use AI at every step of the way, and we have ways to secure all that.

Okay?

You another, announcement at Ignite was Eviving, which is an agenda AI security agent.

Right?

So, like, how do I we can consume a third party agent, but how do we know that it's safe?

As such, he has an answer.

We have another little agent Another agent.

That just looks at the AI agent.

We have agents monitoring.

If we have an answer, we have an answer because a legitimate reason to slow down AI adoption in an enterprise is the lack of governance.

What are the agents doing?

Who's getting shadow agents sprawl?

Oh, yeah.

So how do Microsoft has one c five agent.

They have an answer to clear that.

And then somewhere in that in above that middle layer of the existing Copilots and the advanced layer of you riding a custom solution in Foundry.

We have we have the MCP server, Microsoft MP server, and you can cry you Microsoft has published guidance.

In fact, I think there's prefab solutions.

For example, MCP server for Sentinel.

Yeah.

I've played with the MCP server for Sentinel.

It's it's it's cool stuff.

And so the and you know that there's a Defender cloud MCP server offering that's very Oh, is there?

I don't know that I've seen that one yet.

Yeah.

It's Ignite was, like, blasting full of announcements.

So we have a security solution for the server and a security solution for the Genentech.

For the API.

And so not only have we created the entry ramps at all these different levels, but also really security and governance controls at all the levels too.

And, again, I'm just nobody has this.

Yeah.

Nobody has this.

And at a lot of companies, I think that AI road map and adoption is aspirational.

It's a desired goal, but, like, concrete adapted day and not unless you're in the Microsoft model, there's legitimate concerns.

So I I again, I think Oh, yeah.

There's an opportunity to gain a cut by diving into the AI world.

Stay ahead for the bad guys.

Stay ahead for the Yep.

Yeah.

And it is.

The governance, the controls, everything they're putting in place, from everything I've seen, far superior than what you're gonna get with some of the other third party AI services.

So Exactly.

Yeah.

That's awesome, John.

I'm thanks for walking through all of those.

I've there was so much at Ignite.

I've been able to digest some of it, looked at some of the headlines, but haven't had a chance to really dive into some of the security store, some of the security copilot stuff.

So appreciate it.

Anything else you wanna add to this security copilot, security store information that we've talked about so far before we wrap up and go find some more sessions?

Well, I just have one last little comment, which is the migration offender SDR portal for air all services.

Right?

Yeah.

I love this.

So this is a big deal.

It's very painful even for organizations that have invested heavily in Sentinel.

Yep.

And the other pieces of this resided outside the b.microsoft.com.

And my understanding is that Microsoft felt that they needed to do this both for marketing and on the marketing side as competitors, CrowdStrike Yep.

Have a single portal.

Okay.

And for some decision makers, that's that makes the decision.

Oh, 100%.

And so to be competitive with what customers expect, Microsoft is doing this consolidate.

But then under the covers, and this is where I personally come to Congress because I'm one who have been planting all of my seeds on the Azure portal side rather than this.

You don't like this as much as I do.

I came from the m three sixty five side.

So for me, it's like, oh, I finally get settled in with all my other Microsoft three sixty five security tools.

What the thing is that Sentinel lives in Azure subscription.

Yep.

And Defender SDR lives.

Right.

And another thing is that Sentinel works on a log analytics Yes.

Method.

You have a data lake or log analytics repository, you know, where your data is in, like like, the classics Splunk and Splunk enterprise cloud security.

You have a data reservoir that all your stuff works in, and then you run queries and stuff against it.

That's how Sentinel and log analytics work.

And that, Frank, has scaling limitations Yep.

And is not, again, keeping up with the latest best things they've done.

And so Defender XDR, number one, it lives in.

And number two, it runs off Microsoft resource graph rather than Azure login.

So for very large customers, scaling issues involving log analytics, having to decide what subscription, what region, what commitment model, all of these things were now abstracted from all of those because now all of our data stays in our tenant in Azure.

And then another reason, technically, is that the Sentinel model today depends on time queries.

Right?

Uh-huh.

It can go from one minute to one hour to one day.

Right.

It's not the real time alerting.

It's based on when you schedule your queries to run.

Correct.

And the but resource graph continuous.

It's always live.

And the behind the scenes, the threat action technology at Microsoft, they talk about security graph, which is different from Azure resource graph.

All the graphs.

Security graph is this recognition is that if I'm just looking at my firewall traffic and I'm just looking at my server sign on traffic and if I'm these silos information, and they may surface in a common investigation area, but there's still the data resides, like, places that have to be actively, you know, addressed.

Yep.

And resource graph or rather than Azure Microsoft security is not doesn't work that way pattern.

We're just looking for patterns because real security involved, like, a bad guy and a good guy.

Yeah.

A a protected destination and a hostile destination or a hostile behavior acting on a friendly so there there's always at least two components to every true security incident, and that Microsoft research security side is looking for those patterns.

So those got it.

Oh, it's looking for those patterns always, and that is much more meaningful than periodically searching stacks of data and looking for Right.

Relying on your KQ and then get going back to relying on your KQL queries to properly write them so that when they run, they're looking at the right information and all that.

Yeah.

So just Microsoft made the really competitive and real, incredible in the modern world where we can't we can't use the Splunk model anymore.

Yeah.

We need a new model.

Microsoft got one.

Very cool.

Well, awesome.

Thanks, John.

I appreciate it.

We'll get for those listening, we'll we'll get a bunch of links to these different announcements, different resources.

Any links you want to include, John, I'll get those from you.

If people wanna find you on social media or wherever you feel like being found, we can include those in the show notes.

Thank you very much.

Alright.

And we'll talk to you later.

Thank you, Ben.

Take care.

If you enjoyed the podcast, go leave us a five star rating in iTunes.

It helps to get the word out so more IT pros can learn about Office three sixty five and Azure.

If you have any questions you want us to address on the show, or feedback about the show, feel free to reach out via our website, Twitter, or Facebook.

Thanks again for listening, and have a great day.