Alex and Jordan dismantle the password dependency and walk through every passwordless method Microsoft Entra supports — FIDO2 security keys, Windows Hello for Business, Microsoft Authenticator passkeys, and Temporary Access Pass. Covers authentication strength policies, combined registration, and how to phase out SMS and voice without breaking your helpdesk.

Alex and Jordan walk through BitLocker from the ground up — TPM trust models, startup PIN vs. silent encryption, Intune policy design, recovery key escrow to Entra ID, and the three failure modes that get admins fired. Covers the difference between hardware and software encryption, why XTS-AES 256 matters, and how to audit encryption status across your fleet without surprises.

Alex and Jordan break down EPM in Intune — eliminating standing local admin rights while letting standard users elevate specific apps through policy-controlled rules. Covers E3/E5 licensing with Add-on, Elevation Settings, all three rule types, and the removal-first approach most guides skip.

How Entra ID's Conditional Access evaluates every access request in real time — user identity, device compliance, location, sign-in risk — and grants, blocks, or challenges with MFA. They cover policy design, the Named Locations trap, and why blocking legacy auth is the first policy every tenant needs.

The first episode. Alex and Jordan cover Azure Key Vault end to end — what it stores (keys, secrets, certificates), access policies vs. RBAC, Private Endpoints for network isolation, soft-delete and purge protection, and the operational patterns that separate a secure vault from one that gets exploited.