[{"data":1,"prerenderedAt":1900},["ShallowReactive",2],{"sc:header-data-en":3,"sc:footer-data-en":492,"post-en--posts-2026-10-20-who-built-these-agents-9150b1838eacf":521,"authors_data":1256,"content-en-list-7b291c2dd91a4":1615,"authors_data:Andreas Hötzinger":1897},{"lang":4,"home":5,"navigation":17,"meta":482,"contact":488},"de",{"name":6,"folderSwitch":7,"imgLight":10,"img":11,"languages":12},"home",[8,9],"authors","blog","/logos/gk-Logo-sw.svg","/logos/gk-Logo-rgb.svg",{"en":13},{"title":14,"url":15,"alt":16},"Home","/en","glueckkanja Logo",[18,127,231,316,395,402],{"name":19,"languages":20,"children":24},"workplace",{"en":21},{"title":22,"description":23},"Workplace","Microsoft 365-powered for smart, secure, and flexible workspaces, seamlessly integrating cutting-edge technologies and identity services.",[25,55,91],{"name":26,"languages":27,"children":30},"portfolio",{"en":28},{"title":29},"Portfolio",[31,37,43,49],{"name":32,"languages":33},"managed-intune",{"en":34},{"title":35,"url":36},"Managed Intune","/en/entra-intune/managed-intune",{"name":38,"languages":39},"managed-entra",{"en":40},{"title":41,"url":42},"Managed Entra","/en/entra-intune/managed-entra",{"name":44,"languages":45},"managed-workplace",{"en":46},{"title":47,"url":48},"Managed Workplace","/en/workplace/managed-workplace",{"name":50,"languages":51},"consulting-services",{"en":52},{"title":53,"url":54},"Consulting Services","/en/workplace/consulting-services",{"name":56,"languages":57,"children":60},"microsoft-365-endpoint",{"en":58},{"title":59},"Microsoft 365 Endpoint",[61,67,73,79,85],{"name":62,"languages":63},"microsoft-entra-suite",{"en":64},{"title":65,"url":66},"Microsoft Entra Suite","/en/workplace/microsoft-entra-suite",{"name":68,"languages":69},"microsoft-intune",{"en":70},{"title":71,"url":72},"Microsoft Intune","/en/workplace/microsoft-intune",{"name":74,"languages":75},"microsoft-windows",{"en":76},{"title":77,"url":78},"Microsoft Windows","/en/workplace/microsoft-windows",{"name":80,"languages":81},"windows-365-cloud-pc",{"en":82},{"title":83,"url":84},"Windows 365 Cloud PC","/en/workplace/windows365-cloud-pc",{"name":86,"languages":87},"cloud-workplace-foundation",{"en":88},{"title":89,"url":90},"Cloud Workplace Foundation","/en/workplace/cloud-workplace-foundation",{"name":92,"languages":93,"children":96},"microsoft-365-collaboration",{"en":94},{"title":95},"Microsoft 365 Collaboration",[97,103,109,115,121],{"name":98,"languages":99},"microsoft-copilot",{"en":100},{"title":101,"url":102},"Microsoft 365 Copilot","/en/workplace/microsoft-365-copilot",{"name":104,"languages":105},"microsoft-teams",{"en":106},{"title":107,"url":108},"Teams","/en/workplace/microsoft-teams",{"name":110,"languages":111},"sharepoint-powerplatform",{"en":112},{"title":113,"url":114},"SharePoint & Power Platform","/en/workplace/sharepoint-power-platform",{"name":116,"languages":117},"exchange-online",{"en":118},{"title":119,"url":120},"Exchange Online","/en/workplace/exchange-online",{"name":122,"languages":123},"information-protection-compliance",{"en":124},{"title":125,"url":126},"Information Protection & Compliance","/en/workplace/information-protection-compliance",{"name":128,"languages":129,"children":133},"azure",{"en":130},{"title":131,"description":132},"Azure","Fuel growth with Azure: Cut cloud costs, boost efficiency, and drive innovation through IaaS and PaaS.",[134,151,181],{"name":135,"languages":136,"children":138},"azure-portfolio",{"en":137},{"title":29},[139,145],{"name":140,"languages":141},"azure-managed-services",{"en":142},{"title":143,"url":144},"Azure Managed Services","/en/azure/azure-managed-services",{"name":146,"languages":147},"azure-consulting",{"en":148},{"title":149,"url":150},"Azure Consulting","/en/azure/azure-consulting",{"name":152,"languages":153,"children":156},"azure-scenarios",{"en":154},{"title":155},"Scenarios",[157,163,169,175],{"name":158,"languages":159},"plan-your-cloud",{"en":160},{"title":161,"url":162},"Plan your Cloud","/en/azure/plan-your-cloud",{"name":164,"languages":165},"migrate-to-the-cloud",{"en":166},{"title":167,"url":168},"Migrate to the cloud","/en/azure/migrate-to-the-cloud",{"name":170,"languages":171},"innovate-your-business",{"en":172},{"title":173,"url":174},"Innovate your business","/en/azure/innovate-your-business",{"name":176,"languages":177},"vmware-exit",{"en":178},{"title":179,"url":180},"Rethink your VMware strategy","/en/azure/vmware-exit",{"name":182,"languages":183,"children":186},"azure-practices",{"en":184},{"title":185},"Practices",[187,193,199,202,208,213,219,225],{"name":188,"languages":189},"azure-foundation",{"en":190},{"title":191,"url":192},"Azure Foundation","/en/azure/azure-foundation",{"name":194,"languages":195},"azure-ai-foundation",{"en":196},{"title":197,"url":198},"Azure AI Foundation","/en/azure/azure-ai-foundation",{"name":86,"languages":200},{"en":201},{"title":89,"url":90},{"name":203,"languages":204},"azure-data-foundation",{"en":205},{"title":206,"url":207},"Azure Data Foundation","/en/azure/azure-data-foundation",{"name":188,"languages":209},{"en":210},{"title":211,"url":212},"Azure Container Foundation","/en/azure/azure-container-foundation",{"name":214,"languages":215},"dark-tenant",{"en":216},{"title":217,"url":218},"Managed Dark Tenant","/en/azure/managed-dark-tenant",{"name":220,"languages":221},"azure-cloud-adoption-framework",{"en":222},{"title":223,"url":224},"Cloud Adoption Framework","/en/azure/cloud-adoption-framework",{"name":226,"languages":227},"azure-cloud-competence-center",{"en":228},{"title":229,"url":230},"Cloud Competence Center","/en/azure/cloud-competence-center",{"name":232,"languages":233,"children":242},"security",{"en":234},{"title":235,"description":236,"emergency":237},"Security","Vigilance in the cloud with an award-winning 24/7 managed service, incident response and state-of-the-art protection for your infrastructure.",{"text":238,"href":239,"skin":240,"icon":241},"Under Attack?","/en/security/are-you-under-attack","primary","emergency",[243,268,289],{"name":244,"children":245},"security-security-consulting",[246,252,256,262],{"name":247,"languages":248},"managed-red-tenant",{"en":249},{"title":250,"url":251},"Managed Red Tenant","/en/security/managed-red-tenant",{"name":214,"languages":253},{"en":254},{"title":255,"url":218},"Dark Tenant",{"name":257,"languages":258},"sentinel-data-lake",{"en":259},{"title":260,"url":261},"Sentinel Data Lake","/en/security/sentinel-data-lake",{"name":263,"languages":264},"security-consulting",{"en":265},{"title":266,"url":267},"Security Consulting","/en/security/security-consulting",{"name":269,"children":270},"security-cloud-security-operations-center",[271,277,283],{"name":272,"languages":273},"cloud-security-operations-center",{"en":274},{"title":275,"url":276},"Cloud Security Operations Center","/en/security/cloud-security-operations-center",{"name":278,"languages":279},"global-secure-access",{"en":280},{"title":281,"url":282},"Global Secure Access","/en/security/global-secure-access",{"name":284,"languages":285},"my-work-id",{"en":286},{"title":287,"url":288},"MyWorkID","/en/security/my-work-id",{"name":290,"children":291},"security-preventive-services",[292,298,304,310],{"name":293,"languages":294},"preventive-services",{"en":295},{"title":296,"url":297},"Preventive Services","/en/security/preventive-services",{"name":299,"languages":300},"data-security-services",{"en":301},{"title":302,"url":303},"Data Security Service","/en/security/data-security-service",{"name":305,"languages":306},"security-copilot-agents",{"en":307},{"title":308,"url":309},"Security Copilot Agents","/en/security/security-copilot-agents",{"name":311,"languages":312},"nis2",{"en":313},{"title":314,"url":315},"Implementing NIS2","/en/security/red-dark-tenant-nis2",{"name":317,"languages":318,"children":322},"products",{"en":319},{"title":320,"description":321},"Products","Innovative companion products for a completely secure, 100% cloud-native Microsoft environment that enhance collaboration, network authentication and software management.",[323,360],{"name":324,"products":325,"children":326},"lorem ipsum 1",true,[327,336,344,352],{"name":328,"img":329,"target":330,"languages":331},"realmjoin","products/realmjoin/realmjoin-nav-logo.svg","_blank",{"en":332},{"title":333,"url":334,"subtitle":335},"RealmJoin","https://www.realmjoin.com","Cloudbased Software distribution",{"name":337,"img":338,"target":330,"languages":339},"scepman","products/scepman/scepman-nav-logo.svg",{"en":340},{"title":341,"url":342,"subtitle":343},"SCEPman","https://www.scepman.com","Certificate distribution from the cloud",{"name":345,"img":346,"target":330,"languages":347},"konnekt","products/konnekt/konnekt-nav-logo.svg",{"en":348},{"title":349,"url":350,"subtitle":351},"KONNEKT","https://www.konnekt.io","Work with your local office 365 data",{"name":353,"img":354,"target":330,"languages":355},"realmigrator","products/realmigrator/realmigrator-nav-logo.svg",{"en":356},{"title":357,"url":358,"subtitle":359},"RealMigrator","https://www.realmigrator.com","Migrate your data from one server to another",{"name":361,"products":325,"children":362},"lorem ipsum 2",[363,371,379,387],{"name":364,"img":365,"target":330,"languages":366},"terraprovider","products/terraprovider/terraprovider-nav-logo.svg",{"en":367},{"title":368,"url":369,"subtitle":370},"TerraProvider","https://www.terraprovider.com","Terraform Provider for Microsoft 365",{"name":372,"img":373,"target":330,"languages":374},"radiusaas","products/radius/radius-nav-logo.svg",{"en":375},{"title":376,"url":377,"subtitle":378},"RADIUSaaS","https://www.radius-as-a-service.com","Authentication for your network",{"name":380,"img":381,"target":330,"languages":382},"autopilotmonitor","products/autopilot-monitor/AutopilotMonitor-nav-logo.svg",{"en":383},{"title":384,"url":385,"subtitle":386},"Autopilot Monitor","https://www.autopilotmonitor.com","Real-time Windows Autopilot monitoring",{"name":388,"img":389,"target":330,"languages":390},"sendman","products/sendman/Sendman-nav-logo.svg",{"en":391},{"title":392,"url":393,"subtitle":394},"Sendman","https://www.sendman.com","The SMTP relay for Microsoft 365",{"name":396,"languages":397},"casestudies",{"en":398},{"title":399,"url":400,"description":401},"Case Studies","/en/casestudies","Pioneer in the Cloud: Your top Microsoft partner for comprehensive cloud solutions with a Blueprint-based approach and Infrastructure-as-Code expertise.",{"name":403,"languages":404,"children":407},"company",{"en":405},{"title":406,"description":401},"Company",[408,444,465],{"name":409,"languages":410,"children":413},"company-about-us",{"en":411},{"title":412},"About us",[414,420,426,432,438],{"name":415,"languages":416},"company-facts-figures",{"en":417},{"title":418,"url":419},"Facts & Figures","/en/company/facts-and-figures",{"name":421,"languages":422},"company-contact",{"en":423},{"title":424,"url":425},"Contact & Locations","/en/company/contact-and-locations",{"name":427,"languages":428},"switzerland",{"en":429},{"title":430,"url":431}," glueckkanja Switzerland","/en/company/switzerland",{"name":433,"languages":434},"austria",{"en":435},{"title":436,"url":437},"glueckkanja Austria","/en/company/austria",{"name":439,"languages":440},"spain",{"en":441},{"title":442,"url":443},"glueckkanja Spain","/en/company/spain",{"name":445,"languages":446,"children":449},"company-career",{"en":447},{"title":448},"Career",[450,456,459],{"name":451,"languages":452},"company-career-overview",{"en":453},{"title":454,"url":455},"Career overview","/en/career",{"name":457,"languages":458},"company-young-professionals",{},{"name":460,"languages":461},"company-jobs",{"en":462},{"title":463,"url":464},"Job offers","/en/job-offers",{"name":466,"languages":467,"children":470},"company-latest",{"en":468},{"title":469},"Latest",[471,477],{"name":472,"languages":473},"company-blog",{"en":474},{"title":475,"url":476},"Blog","/en/blog",{"name":472,"languages":478},{"en":479},{"title":480,"url":481},"Events","/en/events",[483],{"name":484,"languages":485},"career-meta",{"en":486},{"title":448,"url":455,"active":487},false,{"languages":489},{"en":490},{"title":491,"url":425,"active":487},"Contact",{"data":493},{"bgColor":494,"number":495,"mail":496,"brandLogos":497,"logos":498,"links":502,"linksEn":512},"var(--color-gk-mid-blue)","+49 69 4005520","info@glueckkanja.com",null,[499],{"img":10,"alt":16,"url":500,"class":501},"index.html","max-w-19rem",[503,506,509],{"title":504,"url":505},"Datenschutz","/de/privacy",{"title":507,"url":508},"Impressum","/de/imprint",{"title":510,"url":511},"No Cookies","/de/cookies",[513,516,519],{"title":514,"url":515},"Privacy","/en/privacy",{"title":517,"url":518},"Imprint","/en/imprint",{"title":510,"url":520},"/en/cookies",{"id":522,"title":523,"author":524,"body":526,"cta":497,"description":591,"eventid":497,"extension":1146,"hideInRecent":487,"layout":1147,"meta":1148,"moment":1152,"navigation":325,"path":1247,"seo":1248,"stem":1249,"tags":1250,"webcast":487,"__hash__":1255},"content_en/posts/2026-10-20-who-built-these-agents.md","Who Built These Agents?",[525],"Andreas Hötzinger",{"type":527,"value":528,"toc":1136},"minimal",[529,533,550,555,558,566,569,573,575,578,581,853,856,859,993,996,999,1002,1006,1008,1011,1014,1017,1020,1024,1026,1029,1035,1038,1041,1044,1047,1050,1061,1065,1067,1079,1082,1086,1088,1091,1106,1109,1113,1115,1118,1122,1124,1127,1130,1133],[530,531,532],"style",{},"\n/* The Kusto grammar marks parse_json as deprecated (red, italic). The function is current, so render it neutrally. */\nhtml .richtext pre.shiki code .s7hpK{--shiki-default:#24292e;--shiki-default-font-style:normal;--shiki-dark:#e1e4e8;--shiki-dark-font-style:normal}\n",[534,535,536,537,541,542,545,546,549],"p",{},"In a customer tenant with ",[538,539,540],"span",{},"3,000"," users, our first inventory turned up ",[538,543,544],{},"280"," agents. ",[538,547,548],{},"170"," of them had no owner still at the company. Nobody malicious built them; they were built by business units that needed a quick fix. That is exactly how service principals came into being ten years ago, and nobody has cleaned those up either. Agents are repeating the pattern, just faster and at greater scale.",[551,552,554],"h2",{"id":553},"what-a-license-cant-do","What a License Can't Do",[534,556,557],{},"{: .h3-font-size}",[534,559,560,561,565],{},"E7 bundles E5, Copilot, the ",[562,563,564],"a",{"href":66},"Entra Suite"," and Agent 365. What is included in the package has been covered extensively elsewhere. A license does not clean up your tenant. It gives you the tools to see, identify and control agents. Whether a given agent should exist, who is accountable for it and what it is allowed to access are not questions a license answers.",[534,567,568],{},"Add to that the pace. Agents are being created today in the same places Excel macros used to be: inside business units, quickly and without a ticket. That is intentional, and we think it is the right way. It does mean, however, that the number of non-human accounts in the directory is growing faster than any other category.",[551,570,572],{"id":571},"what-the-registry-shows-and-what-it-doesnt","What the Registry Shows and What It Doesn't",[534,574,557],{},[534,576,577],{},"Agent 365 collects agents from Microsoft 365, Copilot Studio, Power Platform and Foundry in one place. Defender for Endpoint additionally finds locally installed AI agents on endpoints, including configured MCP servers. Both land in Advanced Hunting and can be evaluated together with KQL. Shadow AI in the most literal sense.",[534,579,580],{},"This query shows which agents are actually being invoked and which tools they use in the process:",[582,583,585],"div",{"style":584},"background: var(--color-bg-grey); border-radius: 6px; padding: 1rem; margin: 0.25rem 0",[586,587,592],"pre",{"className":588,"code":589,"language":590,"meta":591,"style":591},"language-kusto shiki shiki-themes github-light github-dark","CloudAppEvents\n| where ActionType in (\"InvokeAgent\", \"InferenceCall\", \"ExecuteToolBySDK\", \"ExecuteToolByGateway\")\n| extend RawEventData_parsed = parse_json(RawEventData)\n| extend\n    Workload          = coalesce(tostring(RawEventData_parsed[\"Workload\"]), \"Unknown\"),\n    TargetAgentName   = coalesce(tostring(RawEventData_parsed[\"TargetAgentName\"]), \"Unknown\"),\n    AgentName         = coalesce(tostring(RawEventData_parsed[\"AgentName\"]), \"Unknown\"),\n    AgentBlueprintId  = coalesce(tostring(RawEventData_parsed[\"AgentBlueprintId\"]), \"Unknown\"),\n    PlatformAgentType = coalesce(\n        tostring(RawEventData_parsed[\"PlatformAgentType\"]),\n        tostring(RawEventData_parsed[\"CopilotEventData\"][\"PlatformAgentType\"]),\n        \"Unknown\"\n    )\n| project-away RawEventData_parsed\n| summarize count() by ActionType, Workload, TargetAgentName, PlatformAgentType, AgentName, AgentBlueprintId\n","kusto","",[593,594,595,603,645,663,671,702,725,748,771,782,796,813,819,825,836],"code",{"__ignoreMap":591},[538,596,599],{"class":597,"line":598},"line",1,[538,600,602],{"class":601},"sVt8B","CloudAppEvents\n",[538,604,606,609,613,616,619,622,626,629,632,634,637,639,642],{"class":597,"line":605},2,[538,607,608],{"class":601},"| ",[538,610,612],{"class":611},"szBVR","where",[538,614,615],{"class":601}," ActionType ",[538,617,618],{"class":611},"in",[538,620,621],{"class":601}," (",[538,623,625],{"class":624},"sZZnC","\"InvokeAgent\"",[538,627,628],{"class":601},", ",[538,630,631],{"class":624},"\"InferenceCall\"",[538,633,628],{"class":601},[538,635,636],{"class":624},"\"ExecuteToolBySDK\"",[538,638,628],{"class":601},[538,640,641],{"class":624},"\"ExecuteToolByGateway\"",[538,643,644],{"class":601},")\n",[538,646,648,650,653,656,660],{"class":597,"line":647},3,[538,649,608],{"class":601},[538,651,652],{"class":611},"extend",[538,654,655],{"class":601}," RawEventData_parsed = ",[538,657,659],{"class":658},"s7hpK","parse_json",[538,661,662],{"class":601},"(RawEventData)\n",[538,664,666,668],{"class":597,"line":665},4,[538,667,608],{"class":601},[538,669,670],{"class":611},"extend\n",[538,672,674,677,681,684,687,690,693,696,699],{"class":597,"line":673},5,[538,675,676],{"class":601},"    Workload          = ",[538,678,680],{"class":679},"sj4cs","coalesce",[538,682,683],{"class":601},"(",[538,685,686],{"class":679},"tostring",[538,688,689],{"class":601},"(RawEventData_parsed[",[538,691,692],{"class":624},"\"Workload\"",[538,694,695],{"class":601},"]), ",[538,697,698],{"class":624},"\"Unknown\"",[538,700,701],{"class":601},"),\n",[538,703,705,708,710,712,714,716,719,721,723],{"class":597,"line":704},6,[538,706,707],{"class":601},"    TargetAgentName   = ",[538,709,680],{"class":679},[538,711,683],{"class":601},[538,713,686],{"class":679},[538,715,689],{"class":601},[538,717,718],{"class":624},"\"TargetAgentName\"",[538,720,695],{"class":601},[538,722,698],{"class":624},[538,724,701],{"class":601},[538,726,728,731,733,735,737,739,742,744,746],{"class":597,"line":727},7,[538,729,730],{"class":601},"    AgentName         = ",[538,732,680],{"class":679},[538,734,683],{"class":601},[538,736,686],{"class":679},[538,738,689],{"class":601},[538,740,741],{"class":624},"\"AgentName\"",[538,743,695],{"class":601},[538,745,698],{"class":624},[538,747,701],{"class":601},[538,749,751,754,756,758,760,762,765,767,769],{"class":597,"line":750},8,[538,752,753],{"class":601},"    AgentBlueprintId  = ",[538,755,680],{"class":679},[538,757,683],{"class":601},[538,759,686],{"class":679},[538,761,689],{"class":601},[538,763,764],{"class":624},"\"AgentBlueprintId\"",[538,766,695],{"class":601},[538,768,698],{"class":624},[538,770,701],{"class":601},[538,772,774,777,779],{"class":597,"line":773},9,[538,775,776],{"class":601},"    PlatformAgentType = ",[538,778,680],{"class":679},[538,780,781],{"class":601},"(\n",[538,783,785,788,790,793],{"class":597,"line":784},10,[538,786,787],{"class":679},"        tostring",[538,789,689],{"class":601},[538,791,792],{"class":624},"\"PlatformAgentType\"",[538,794,795],{"class":601},"]),\n",[538,797,799,801,803,806,809,811],{"class":597,"line":798},11,[538,800,787],{"class":679},[538,802,689],{"class":601},[538,804,805],{"class":624},"\"CopilotEventData\"",[538,807,808],{"class":601},"][",[538,810,792],{"class":624},[538,812,795],{"class":601},[538,814,816],{"class":597,"line":815},12,[538,817,818],{"class":624},"        \"Unknown\"\n",[538,820,822],{"class":597,"line":821},13,[538,823,824],{"class":601},"    )\n",[538,826,828,830,833],{"class":597,"line":827},14,[538,829,608],{"class":601},[538,831,832],{"class":611},"project-away",[538,834,835],{"class":601}," RawEventData_parsed\n",[538,837,839,841,844,847,850],{"class":597,"line":838},15,[538,840,608],{"class":601},[538,842,843],{"class":611},"summarize",[538,845,846],{"class":679}," count()",[538,848,849],{"class":611}," by",[538,851,852],{"class":601}," ActionType, Workload, TargetAgentName, PlatformAgentType, AgentName, AgentBlueprintId\n",[534,854,855],{},"One caveat applies: this query only shows part of the picture, primarily Microsoft-native agents and agents built on Microsoft platforms. Whatever is running alongside those is not visible here.",[534,857,858],{},"For local agents on endpoints, Defender for Endpoint Plan 2 is sufficient:",[582,860,861],{"style":584},[586,862,864],{"className":588,"code":863,"language":590,"meta":591,"style":591},"AgentsInfo\n| where Platform == \"LocalAgents\"\n| summarize arg_max(Timestamp, Name, Version, LifecycleStatus, RawAgentInfo) by AgentId\n| where LifecycleStatus !in~ (\"Deleted\", \"Uninstalled\")\n| extend AgentMetadata = RawAgentInfo.localAgentMetadata\n| extend Vendor = tostring(AgentMetadata.vendor),\n         Device = tostring(AgentMetadata.deviceName)\n| summarize DeviceCount = dcount(Device) by Agent = Name, Vendor\n| sort by DeviceCount desc\n",[593,865,866,871,883,901,925,934,948,958,978],{"__ignoreMap":591},[538,867,868],{"class":597,"line":598},[538,869,870],{"class":601},"AgentsInfo\n",[538,872,873,875,877,880],{"class":597,"line":605},[538,874,608],{"class":601},[538,876,612],{"class":611},[538,878,879],{"class":601}," Platform == ",[538,881,882],{"class":624},"\"LocalAgents\"\n",[538,884,885,887,889,892,895,898],{"class":597,"line":647},[538,886,608],{"class":601},[538,888,843],{"class":611},[538,890,891],{"class":679}," arg_max",[538,893,894],{"class":601},"(Timestamp, Name, Version, LifecycleStatus, RawAgentInfo) ",[538,896,897],{"class":611},"by",[538,899,900],{"class":601}," AgentId\n",[538,902,903,905,907,910,913,915,918,920,923],{"class":597,"line":665},[538,904,608],{"class":601},[538,906,612],{"class":611},[538,908,909],{"class":601}," LifecycleStatus ",[538,911,912],{"class":611},"!in~",[538,914,621],{"class":601},[538,916,917],{"class":624},"\"Deleted\"",[538,919,628],{"class":601},[538,921,922],{"class":624},"\"Uninstalled\"",[538,924,644],{"class":601},[538,926,927,929,931],{"class":597,"line":673},[538,928,608],{"class":601},[538,930,652],{"class":611},[538,932,933],{"class":601}," AgentMetadata = RawAgentInfo.localAgentMetadata\n",[538,935,936,938,940,943,945],{"class":597,"line":704},[538,937,608],{"class":601},[538,939,652],{"class":611},[538,941,942],{"class":601}," Vendor = ",[538,944,686],{"class":679},[538,946,947],{"class":601},"(AgentMetadata.vendor),\n",[538,949,950,953,955],{"class":597,"line":727},[538,951,952],{"class":601},"         Device = ",[538,954,686],{"class":679},[538,956,957],{"class":601},"(AgentMetadata.deviceName)\n",[538,959,960,962,964,967,970,973,975],{"class":597,"line":750},[538,961,608],{"class":601},[538,963,843],{"class":611},[538,965,966],{"class":601}," DeviceCount = ",[538,968,969],{"class":679},"dcount",[538,971,972],{"class":601},"(Device) ",[538,974,897],{"class":611},[538,976,977],{"class":601}," Agent = Name, Vendor\n",[538,979,980,982,985,987,990],{"class":597,"line":773},[538,981,608],{"class":601},[538,983,984],{"class":611},"sort",[538,986,849],{"class":611},[538,988,989],{"class":601}," DeviceCount ",[538,991,992],{"class":611},"desc\n",[534,994,995],{},"An agent acting on behalf of a user inherits that user's permissions. If that user has access to a SharePoint library that is shared far too broadly, so does the agent. The difference is that the agent is faster and more thorough than any human.",[534,997,998],{},"An autonomous agent with its own identity works with its own permissions. It needs someone accountable for it, a clean permission profile and an expiration date, just like any other account that touches company data.",[534,1000,1001],{},"The registry shows what is there. Whether it should be there is a judgment call, and that judgment is never finished.",[551,1003,1005],{"id":1004},"agents-need-identities-no-exceptions","Agents Need Identities, No Exceptions",[534,1007,557],{},[534,1009,1010],{},"Agents built with Entra Agent ID get their own managed identity. Agent Blueprints let you define how an agent is built and what permissions it receives before it even exists. And with Entra ID Governance, access reviews and lifecycle management apply to agents as well: create, approve, assign owners, review regularly, let expire.",[534,1012,1013],{},"Conditional Access can be applied to agent identities and blueprints, but not in the same way as for users. Policies scoped to \"all users\" do not cover agent accounts, and anything authenticating via API key bypasses Entra entirely. You need to know these gaps before you rely on the policy.",[534,1015,1016],{},"That sounds obvious. In practice it rarely is. We already see in many tenants how difficult this is with classic app registrations and service principals: orphaned secrets, permissions left over from some test phase, owners who moved on long ago. Agents don't improve this, because they are being created in larger numbers by far more people.",[534,1018,1019],{},"Organizations that don't have their service principals under control today will not have their agents under control tomorrow.",[551,1021,1023],{"id":1022},"governance-is-ongoing-work","Governance Is Ongoing Work",[534,1025,557],{},[534,1027,1028],{},"New agents arrive every week. Owners change roles or leave. Permissions creep upward, Conditional Access rules accumulate exceptions, and nobody maintains the sensitivity labels. None of this is a project with a go-live date; it is operations.",[534,1030,1031,1032,1034],{},"That is exactly how we approach it. With ",[562,1033,41],{"href":42}," we run Entra ID for our customers entirely as code. That sounds like a technical detail, but it is the actual reason operations stays reliable.",[534,1036,1037],{},"Many organizations have a clean change process following ITIL. The ticket describes what should be changed, then someone clicks through the portal. But who verifies that exactly that change was made and nothing else?",[534,1039,1040],{},"With us, it is not the description that gets reviewed but the change itself. The rules exist as code. Before anything happens, it is clear in black and white what will change. A second person approves exactly that, and only that is deployed, with a name and a date attached. If something goes wrong anyway, the last working state is restored in minutes, not during a night shift.",[534,1042,1043],{},"Exceptions follow the same path. If a customer needs a deviation from the standard, it lives in the repository, not in a spreadsheet or in an admin's memory. It is visible, versioned and reviewed like any other change. That way the baseline does not quietly erode over the months, and at the next audit the full record of how the tenant is configured and who changed what and when is already there.",[534,1045,1046],{},"We also hold ourselves to the same standards we require of agents. Our own automation is a non-human identity too. It authenticates to the customer tenant using federated credentials, with no stored secret. The permissions are separated: one identity may only read and plan, another may write. No password that can leak, no certificate that silently expires.",[534,1048,1049],{},"On the agent side we are in the middle of building this out. Conditional Access, access reviews and entitlement management already run as code for us today. What we are currently building are agent templates in the repository, complete with identity, permissions, Conditional Access, owners and expiration dates, along with automated checks for orphaned agent identities using Maester checks from the community, among other things. With hundreds of agents, that is the difference between visibility and hope.",[534,1051,1052,1053,1056,1057,1060],{},"How ",[562,1054,1055],{"href":303},"Purview"," protects the data that agents read and pass on, and how our ",[562,1058,1059],{"href":276},"CSOC"," monitors their activity, we cover in a separate article on AI governance.",[551,1062,1064],{"id":1063},"what-about-agents-in-azure","What About Agents in Azure?",[534,1066,557],{},[534,1068,1069,1070,1073,1074,1078],{},"Agent 365 also sees agents running in Microsoft Foundry. But someone has to build and operate the platform underneath: models, networking, data connectivity, evaluation. That is what we built the ",[562,1071,1072],{"href":198},"AI Foundation"," for, entirely as code, so every new AI project starts with the same guardrails as the last one. More on that in our article on the three foundations: ",[562,1075,1077],{"href":1076},"/en/posts/2026-07-06-the-holy-trinity","The Holy Trinity",".",[534,1080,1081],{},"The most important point is the connection downward. Every agent from the AI Foundation gets its own identity in the same Entra as the rest of the environment, with exactly the permissions it needs. When it acts on behalf of a user, it sees only what that user is allowed to see. And it leaves a trail that can be audited. No special path with its own accounts and its own exceptions just because the agent runs in Azure rather than Microsoft 365.",[551,1083,1085],{"id":1084},"three-questions-for-tomorrow-morning","Three Questions for Tomorrow Morning",[534,1087,557],{},[534,1089,1090],{},"Anyone who wants to know where they stand can start with three questions:",[1092,1093,1095,1096,1095,1100,1095,1103],"ol",{"style":1094},"margin: 0.25rem 0","\n  ",[1097,1098,1099],"li",{},"Which agents no longer have an active owner or sponsor?",[1097,1101,1102],{},"Which service principals have secrets older than twelve months?",[1097,1104,1105],{},"Which agents authenticate via API key instead of through Entra?",[534,1107,1108],{},"Anyone who can answer all three quickly is ahead of most.",[551,1110,1112],{"id":1111},"where-we-start","Where We Start",[534,1114,557],{},[534,1116,1117],{},"With the current state, because the agents are already there. In our two-day Agent 365 Workshop we make visible which agents are running in your tenant and where they came from. You leave with an inventory, a risk picture and a governance plan with clear ownership.",[551,1119,1121],{"id":1120},"conclusion","Conclusion",[534,1123,557],{},[534,1125,1126],{},"E7 addresses a real problem. Seeing what is running, though, is not the same as having it under control. That requires someone looking every day, maintaining identities, trimming permissions and noticing when an agent suddenly behaves differently than it did yesterday.",[534,1128,1129],{},"The license is the starting point. Operations is what decides.",[534,1131,1132],{},"Already running E7, or noticing agents multiplying in your tenant and wondering who is actually keeping an eye on it? Get in touch. We will look together at what is running and what should stay. Microsoft supports the initial engagement through funding programs. We can clarify together whether that applies to your situation.",[530,1134,1135],{},"html pre.shiki code .sVt8B, html code.shiki .sVt8B{--shiki-default:#24292E;--shiki-dark:#E1E4E8}html pre.shiki code .szBVR, html code.shiki .szBVR{--shiki-default:#D73A49;--shiki-dark:#F97583}html pre.shiki code .sZZnC, html code.shiki .sZZnC{--shiki-default:#032F62;--shiki-dark:#9ECBFF}html pre.shiki code .s7hpK, html code.shiki .s7hpK{--shiki-default:#B31D28;--shiki-default-font-style:italic;--shiki-dark:#FDAEB7;--shiki-dark-font-style:italic}html pre.shiki code .sj4cs, html code.shiki .sj4cs{--shiki-default:#005CC5;--shiki-dark:#79B8FF}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":591,"searchDepth":605,"depth":605,"links":1137},[1138,1139,1140,1141,1142,1143,1144,1145],{"id":553,"depth":605,"text":554},{"id":571,"depth":605,"text":572},{"id":1004,"depth":605,"text":1005},{"id":1022,"depth":605,"text":1023},{"id":1063,"depth":605,"text":1064},{"id":1084,"depth":605,"text":1085},{"id":1111,"depth":605,"text":1112},{"id":1120,"depth":605,"text":1121},"md","post",{"lang":1149,"seoTitle":1150,"titleClass":1151,"date":1152,"categories":1153,"blogtitlepic":1154,"socialimg":1155,"customExcerpt":1156,"keywords":1157,"contactInContent":1158,"asideNav":1221,"maxContent":487,"published":325,"scripts":1246},"en","Who Built These Agents? E7, Agent 365 and the Question of Accountability","h2-font-size","2026-10-20",[235],"head-building-ai-agents.jpg","https://res.cloudinary.com/c4a8/image/upload/blog/heads/head-building-ai-agents.jpg","E7 bundles E5, Copilot, the Entra Suite and Agent 365. But a license doesn't clean up your tenant. Who is accountable for an agent and what it can access is a decision for operations, not procurement.","Microsoft 365 E7, Agent 365, Entra Agent ID, Agent Governance, Agent Blueprints, Entra ID Governance, Conditional Access Agents, Shadow AI, Service Principals aufräumen, Defender for Endpoint Local Agents, Advanced Hunting KQL Agents, Managed Entra, Entra ID as Code, Microsoft Foundry Agents, Agent 365 Workshop",{"quote":325,"infos":1159},{"bgColor":1160,"color":1161,"boxBgColor":494,"boxColor":1161,"headline":1162,"subline":1163,"level":551,"textStyling":1164,"flush":1165,"person":1166,"form":1181},"var(--color-gk-dark-blue)","var(--color-gk-white)","Get in Touch","Already running E7, or noticing that agents are multiplying in your tenant and wondering who's keeping track? Reach out and we'll take a look together at what's running and what should stay.","text-light","justify-content-end",{"image":1167,"cloudinary":325,"alt":1168,"name":1168,"quotee":1168,"quoteeTitle":1169,"quote":1170,"detailsHeader":1171,"details":1172},"/people/people-alexander-schlindwein.png","Alexander Schlindwein","Workplace Lead","In almost every tenant we take over, we find service principals that nobody owns anymore. We're watching the same thing happen with agents right now, except every department is building them. That's why we treat them like any other identity from day one: with a clear owner, defined permissions, an expiration date, managed as code, and fully auditable.","We look forward to\u003Cbr />hearing from you!",[1173,1177],{"text":495,"href":1174,"details":1175,"icon":1176},"tel:+49 69 4005520","Call us now","site/phone",{"text":1178,"href":1179,"icon":1180},"sales@glueckkanja.com","mailto:sales@glueckkanja.com","site/mail",{"ctaText":1182,"cta":1183,"method":1147,"action":1185,"fields":1186},"Submit",{"skin":1184},"primary on-surface","/send",[1187,1191,1196,1199,1203,1208,1213,1216,1219],{"type":1188,"id":1189,"value":1190},"hidden","_next","successful",{"label":1192,"type":1193,"id":1194,"required":325,"requiredMsg":1195},"Name*","text","name","Please enter your name.",{"label":1197,"type":1193,"id":403,"required":325,"requiredMsg":1198},"Company*","Please enter your company.",{"label":1200,"type":1201,"id":1201,"required":325,"requiredMsg":1202},"Email address*","email","Please enter your email address.",{"label":1204,"type":1205,"id":1206,"required":487,"requiredMsg":1207},"Your message","textarea","message","Please enter a message.",{"label":1209,"type":1210,"id":1211,"required":325,"requiredMsg":1212},"Your data will be stored to process and respond to your inquiry. For more information on data protection, please see our \u003Ca href=\"/en/privacy\">Privacy Policy\u003C/a>.","checkbox","dataprotection","Please confirm",{"type":1188,"id":1214,"value":1215},"_subject","Form: Agent 365 Governance | EN",{"type":1188,"id":1217,"value":1218},"inbox_key","default",{"type":1188,"id":1220},"_gotcha",{"menuItems":1222},[1223,1226,1229,1232,1235,1238,1241,1244],{"href":1224,"text":1225},"#what-a-license-cant-do","What a license can't do",{"href":1227,"text":1228},"#what-the-registry-shows-and-what-it-doesnt","What the registry shows and what it doesn't",{"href":1230,"text":1231},"#agents-need-identities-no-exceptions","Agents need identities, no exceptions",{"href":1233,"text":1234},"#governance-is-ongoing-work","Governance is ongoing work",{"href":1236,"text":1237},"#what-about-agents-in-azure","What about agents in Azure?",{"href":1239,"text":1240},"#three-questions-for-tomorrow-morning","Three questions for tomorrow morning",{"href":1242,"text":1243},"#where-we-start","Where we start",{"href":1245,"text":1121},"#conclusion",{"form":325},"/posts/2026-10-20-who-built-these-agents",{"title":523,"description":591},"posts/2026-10-20-who-built-these-agents",[235,1251,1252,1253,1254],"Microsoft Entra ID","Agent 365","AI","Identity Governance","QqsvJEa5FijLXeUDxBfensyFDLXVdRZgJa5F28GtCO8",{"id":1257,"extension":1258,"meta":1259,"stem":8,"__hash__":1614},"authors_data/authors.json","json",{"path":1260,"Fritz Zurhorst":1261,"Alexander Schlindwein":1267,"Sophie Luna":1272,"Nadine Klein":1280,"Karsten Kleinschmidt":1286,"Julian Wendt":1294,"Holger Bunkradt":1299,"Ralf Mania":1305,"Oliver Kieselbach":1311,"Steffen Schwerdtfeger":1317,"Gunnar Winter":1325,"Jan Petersen":1330,"Thorsten Kunzi":1335,"Moritz Pohl":1339,"Thorben Pöschus":1344,"Christoph Hannebauer":1350,"Marco Scheel":1354,"Christopher Brumm":1359,"Florian Klante":1366,"Niklas Bachmann":1371,"Nils Krautkrämer":1376,"Patrick Treptau":1382,"Peter Beckendorf":1387,"Patrick Sobau":1392,"Jörg Wunderlich":1397,"Michael Breither":1401,"Christian Kanja":1406,"Zeba Hoffmann":1412,"Jochen Fröhlich":1417,"Jan Geisbauer":1421,"Gerrit Reinke":1432,"Christian Kordel":1438,"Stephan Wälde":1442,"Carolin Kanja":1447,"Adrian Ritter":1453,"Marvin Bangert":1458,"Thorsten Pickhan":1464,"Christian Lorenz":1470,"Denis Böhm":1475,"Fabian Bader":1480,"Juan Jose Fernandez Perez":1486,"Mahschid Sayyar":1491,"Benjamin Dassow":1496,"Markus Walschburger":1501,"Jonathan Haist":1506,"Daniel Rohregger":1511,"Thomas Naunheim":1516,"Florian Stöckl":1521,"Pascal Asch":1526,"Markus Kättner":1531,"Anna Ulbricht":1538,"Annette Brauns":1545,"Andreas Hötzinger":1551,"body":1556,"title":1613},"/authors",{"display_name":1262,"avatar":1263,"permalink":1264,"linkedin":1265,"imageOffsetTop":1266},"Fritz Zurhorst","people/people-fritz-zurhorst.png","/authors/fritz-zurhorst","friedemann-z","72%",{"display_name":1168,"avatar":1268,"permalink":1269,"twitter":1270,"linkedin":1271},"people/people-alexander-rudolph.png","/authors/alexander-schlindwein","AlexanderOnIT","schlindwein-alexander",{"display_name":1273,"avatar":1274,"permalink":1275,"twitter":1276,"linkedin":1277,"imageOffsetLeft":1278,"imageOffsetTop":1279},"Sophie Luna","people/people-sophie-luna.jpg","/authors/sophie-luna","glueckkanjagab","../company/glueckkanja-gab","58%","67%",{"display_name":1281,"avatar":1282,"permalink":1283,"twitter":1284,"linkedin":1285,"imageOffsetTop":1266},"Nadine Klein","people/people-nadine-kern.png","/authors/nadine-kern","nadineausRT","nadine-kern",{"display_name":1287,"avatar":1288,"permalink":1289,"twitter":1290,"linkedin":1291,"imageOffsetTop":1292,"imageOffsetLeft":1293},"Karsten Kleinschmidt","/c_pad,w_800,h_700/people/karsten-kleinschmidt.jpg","/authors/karsten-kleinschmidt","KarstenonIT","karstenkleinschmidt","60%","57%",{"display_name":1295,"avatar":1296,"permalink":1297,"linkedin":1298},"Julian Wendt","people/people-julian-wendt.png","/authors/julian-wendt","julian-wendt",{"display_name":1300,"avatar":1301,"permalink":1302,"linkedin":1303,"twitter":1304},"Holger Bunkradt","people/people-holger-bunkradt.png","/authors/holger-bunkradt","holger-bunkradt-12b5053b","hbunkradt",{"display_name":1306,"avatar":1307,"permalink":1308,"linkedin":1309,"twitter":1310},"Ralf Mania","people/people-ralf-mania.png","/authors/ralf-mania","ralf-mania-146a2757","RaMa1976",{"display_name":1312,"avatar":1313,"permalink":1314,"linkedin":1315,"twitter":1316},"Oliver Kieselbach","people/people-oliver-kieselbach.png","/authors/oliver-kieselbach","oliver-kieselbach-a4a3409","okieselbT",{"display_name":1318,"avatar":1319,"permalink":1320,"linkedin":1321,"twitter":1322,"imageOffsetTop":1323,"imageOffsetLeft":1324},"Steffen Schwerdtfeger","people/people-steffen-schwerdtfeger.png","/authors/steffen-schwerdtfeger","steffen-schwerdtfeger","SteffenAtCloud","79%","51%",{"display_name":1326,"avatar":1327,"permalink":1328,"twitter":1276,"linkedin":1329},"Gunnar Winter","people/people-gunnar-winter.jpg","/authors/gunnar-winter","company/glueckkanja-gab",{"display_name":1331,"avatar":1332,"permalink":1333,"twitter":1276,"linkedin":1334},"Jan Petersen","people/jan-petersen.png","/authors/jan-petersen","jan-petersen-26a901",{"display_name":1336,"avatar":1337,"permalink":1338,"twitter":1276,"linkedin":1329,"imageOffsetTop":1266},"Thorsten Kunzi","people/author-thorsten-kunzi.png","/authors/thorsten-kunzi",{"display_name":1340,"avatar":1341,"permalink":1342,"twitter":1276,"linkedin":1343},"Dr. Moritz Pohl","people/people-moritz-pohl.png","/authors/moritz-pohl","dr-moritz-pohl",{"display_name":1345,"avatar":1346,"permalink":1347,"twitter":1348,"linkedin":1349},"Thorben Pöschus","people/thorben.poeschus.png","/authors/thorben-poeschus","TPO901","thorben-pöschus-624693b7",{"display_name":1351,"avatar":1352,"permalink":1353,"twitter":1276,"linkedin":1329,"imageOffsetTop":1266},"Dr. Christoph Hannebauer","people/people-christoph-hannebauer.png","/authors/christoph-hannebauer",{"display_name":1355,"avatar":1356,"permalink":1357,"twitter":1358,"linkedin":1358},"Marco Scheel","people/people-marco-scheel.png","/authors/marco-scheel","marcoscheel",{"display_name":1360,"avatar":1361,"permalink":1362,"twitter":1363,"linkedin":1364,"imageOffsetTop":1365},"Christopher Brumm","people/people-christopher-brumm.jpg","/authors/christopher-brumm","cbrhh","christopherbrumm","66%",{"display_name":1367,"avatar":1368,"permalink":1369,"linkedin":1370,"twitter":1276},"Florian Klante","people/florian-klante.jpg","/authors/florian-klante","florian-klante-6031b31b",{"display_name":1372,"avatar":1373,"permalink":1374,"linkedin":1375,"twitter":1276},"Niklas Bachmann","people/niklas.bachmann.png","/authors/niklas-bachmann","niklas-bachmann-66a863158",{"display_name":1377,"avatar":1378,"permalink":1379,"twitter":1380,"linkedin":1381},"Nils Krautkrämer","people/nils-krautkraemer.png","/authors/nils-krautkraemer","KrauNils","nils-krautkrämer-8b04bb250",{"display_name":1383,"avatar":1384,"permalink":1385,"linkedin":1386,"twitter":1276},"Patrick Treptau","people/people-patrick-treptau.png","/authors/patrick-traptau","ptreptau",{"display_name":1388,"avatar":1389,"permalink":1390,"linkedin":1391,"twitter":1276,"imageOffsetTop":1266},"Peter Beckendorf","people/peter-beckendorf.png","/authors/peter-beckendorf","peter-beckendorf-29a239b1",{"display_name":1393,"avatar":1394,"permalink":1395,"linkedin":1396,"twitter":1276},"Patrick Sobau","people/patrick-sobau.png","/authors/patrick-sobau","patrick-sobau",{"display_name":1398,"avatar":1399,"permalink":1400,"twitter":1276},"Jörg Wunderlich","people/joerg-wunderlich.png","/authors/joerg-wunderlich",{"display_name":1402,"avatar":1403,"permalink":1404,"twitter":1276,"linkedin":1405},"Michael Breither","people/people-michael-breither.jpg","/authors/michael-breither","michaelbreither",{"display_name":1407,"avatar":1408,"permalink":1409,"twitter":1410,"linkedin":1411},"Christian Kanja","people/people-christian-kanja.png","/authors/christian-kanja","cekageka","christian-kanja",{"display_name":1413,"avatar":1414,"permalink":1415,"linkedin":1416,"twitter":1276},"Zeba Hoffmann","people/zeba-hoffmann.png","/authors/zeba-hoffmann","zebahoffmann",{"display_name":1418,"avatar":1419,"permalink":1420,"twitter":1276,"linkedin":1329},"Jochen Fröhlich","people/people-jochen-froehlich.png","/authors/jochen-froehlich",{"display_name":1422,"avatar":1423,"permalink":1424,"twitter":1425,"linkedin":1425,"imageOffsetTop":1266,"socials":1426},"Jan Geisbauer","people/people-jan-geisbauer-csoc.png","/authors/jan-geisbauer","JanGeisbauer",[1427,1429],{"text":475,"href":1428},"https://emptydc.com",{"text":1430,"href":1431},"Podcast","https://hairlessinthecloud.com",{"display_name":1433,"avatar":1434,"permalink":1435,"twitter":1436,"linkedin":1437},"Gerrit Reinke","people/gerrit-reinke.png","/authors/gerrit-reinke","GLWRe","glwr",{"display_name":1439,"avatar":1440,"permalink":1441,"twitter":1276,"linkedin":1329},"Christian Kordel","people/christian-kordel.png","/authors/christian-kordel",{"display_name":1443,"avatar":1444,"permalink":1445,"twitter":1446,"linkedin":1329},"Stephan Wälde","people/people-stephan-waelde.png","/authors/stephan-waelde","stephanwaelde",{"display_name":1448,"avatar":1449,"permalink":1450,"twitter":1451,"linkedin":1452},"Carolin Kanja","people/people-carolin-kanja.jpg","/authors/carolin-kanja","fraukanja","carolin-kanja",{"display_name":1454,"avatar":1455,"permalink":1456,"twitter":1457,"linkedin":1457},"Adrian Ritter","people/people-adrian-ritter.png","/authors/adrian-ritter","adrianritter",{"display_name":1459,"avatar":1460,"permalink":1461,"twitter":1462,"linkedin":1463},"Marvin Bangert","people/people-marvin-bangert.png","/authors/marvin-bangert","marvinbangert","marvin-bangert",{"display_name":1465,"avatar":1466,"permalink":1467,"twitter":1468,"linkedin":1469},"Thorsten Pickhan","people/people-thorsten-pickhan.png","/authors/thorsten-pickhan","tpickhan","thorsten-pickhan",{"display_name":1471,"avatar":1472,"permalink":1473,"linkedin":1474,"twitter":1276},"Christian Lorenz","people/people-christian-lorenz.png","/authors/christian-lorenz","christianlorenz95",{"display_name":1476,"avatar":1477,"permalink":1478,"linkedin":1479,"twitter":1276},"Denis Böhm","people/people-denis-boehm.png","/authors/denis-boehm","denis-böhm-3bb834135",{"display_name":1481,"avatar":1482,"permalink":1483,"linkedin":1484,"twitter":1485},"Fabian Bader","people/people-fabian-bader.jpg","/authors/fabian-bader","fabianbader","fabian_bader",{"display_name":1487,"avatar":1488,"permalink":1489,"linkedin":1490},"Juan Jose Fernandez Perez","people/people-juan-jose-fernandez.jpg","/authors/juan-jose-fernandez-perez","juan-jose-fernandez-perez-8016055",{"display_name":1492,"avatar":1493,"permalink":1494,"linkedin":1495},"Mahschid Sayyar","people/people-mahschid-sayyar.jpg","/authors/mahschid-sayyar","mahschid-sayyar-97544463",{"display_name":1497,"avatar":1498,"permalink":1499,"linkedin":1500},"Benjamin Dassow","people/people-benjamin-dassow.jpg","/authors/benjamin-dassow","benjamin-dassow",{"display_name":1502,"avatar":1503,"permalink":1504,"linkedin":1505},"Markus Walschburger","people/people-markus-walschburger.jpg","/authors/markus-walschburger","markus-walschburger",{"display_name":1507,"avatar":1508,"permalink":1509,"linkedin":1510,"imageOffsetTop":1266},"Jonathan Haist","people/people-jonathan-haist.jpg","/authors/jonathan-haist","jonathanhaist",{"display_name":1512,"avatar":1513,"permalink":1514,"linkedin":1515,"imageOffsetTop":1266},"Daniel Rohregger","people/people-daniel-rohregger.jpg","/authors/daniel-rohregger","drohregger",{"display_name":1517,"avatar":1518,"permalink":1519,"linkedin":1520,"imageOffsetTop":1365},"Thomas Naunheim","people/people-thomas-naunheim.jpg","/authors/thomas-naunheim","thomasnaunheim",{"display_name":1522,"avatar":1523,"permalink":1524,"linkedin":1525,"imageOffsetTop":1365},"Florian Stöckl","people/people-florian-stoeckl.jpg","/authors/florian-stoeckl","florianstoeckl",{"display_name":1527,"avatar":1528,"permalink":1529,"linkedin":1530,"imageOffsetTop":1365},"Pascal Asch","people/Pascal.Asch.648.jpg","/authors/pascal-asch","pascal-asch",{"display_name":1532,"avatar":1533,"permalink":1534,"linkedin":1535,"imageOffsetTop":1536,"imageOffsetLeft":1537},"Markus Kättner","people/markus-kaettner.jpg","/authors/markus-kaettner","markus-kättner-b600119","62%","63%",{"display_name":1539,"avatar":1540,"permalink":1541,"linkedin":1542,"imageOffsetTop":1543,"imageOffsetLeft":1544},"Anna Ulbricht","people/anna-katharina.ulbricht-09.png","/authors/anna-ulbricht","anna-katharina-u-a67702199","70%","50%",{"display_name":1546,"avatar":1547,"permalink":1548,"linkedin":1549,"imageOffsetTop":1550,"imageOffsetLeft":1292},"Annette Brauns","people/Annette-Brauns-8.jpg","/authors/annette-brauns","annette-brauns","95%",{"display_name":525,"avatar":1552,"permalink":1553,"linkedin":1554,"imageOffsetTop":1555},"people/at-andreas-hoetzinger.png","/authors/andreas-hoetzinger","andreashoetzinger","75%",{"Fritz Zurhorst":1557,"Alexander Schlindwein":1558,"Sophie Luna":1559,"Nadine Klein":1560,"Karsten Kleinschmidt":1561,"Julian Wendt":1562,"Holger Bunkradt":1563,"Ralf Mania":1564,"Oliver Kieselbach":1565,"Steffen Schwerdtfeger":1566,"Gunnar Winter":1567,"Jan Petersen":1568,"Thorsten Kunzi":1569,"Moritz Pohl":1570,"Thorben Pöschus":1571,"Christoph Hannebauer":1572,"Marco Scheel":1573,"Christopher Brumm":1574,"Florian Klante":1575,"Niklas Bachmann":1576,"Nils Krautkrämer":1577,"Patrick Treptau":1578,"Peter Beckendorf":1579,"Patrick Sobau":1580,"Jörg Wunderlich":1581,"Michael Breither":1582,"Christian Kanja":1583,"Zeba Hoffmann":1584,"Jochen Fröhlich":1585,"Jan Geisbauer":1586,"Gerrit Reinke":1590,"Christian Kordel":1591,"Stephan Wälde":1592,"Carolin Kanja":1593,"Adrian Ritter":1594,"Marvin Bangert":1595,"Thorsten Pickhan":1596,"Christian Lorenz":1597,"Denis Böhm":1598,"Fabian Bader":1599,"Juan Jose Fernandez Perez":1600,"Mahschid Sayyar":1601,"Benjamin Dassow":1602,"Markus Walschburger":1603,"Jonathan Haist":1604,"Daniel Rohregger":1605,"Thomas Naunheim":1606,"Florian Stöckl":1607,"Pascal Asch":1608,"Markus Kättner":1609,"Anna Ulbricht":1610,"Annette Brauns":1611,"Andreas Hötzinger":1612},{"display_name":1262,"avatar":1263,"permalink":1264,"linkedin":1265,"imageOffsetTop":1266},{"display_name":1168,"avatar":1268,"permalink":1269,"twitter":1270,"linkedin":1271},{"display_name":1273,"avatar":1274,"permalink":1275,"twitter":1276,"linkedin":1277,"imageOffsetLeft":1278,"imageOffsetTop":1279},{"display_name":1281,"avatar":1282,"permalink":1283,"twitter":1284,"linkedin":1285,"imageOffsetTop":1266},{"display_name":1287,"avatar":1288,"permalink":1289,"twitter":1290,"linkedin":1291,"imageOffsetTop":1292,"imageOffsetLeft":1293},{"display_name":1295,"avatar":1296,"permalink":1297,"linkedin":1298},{"display_name":1300,"avatar":1301,"permalink":1302,"linkedin":1303,"twitter":1304},{"display_name":1306,"avatar":1307,"permalink":1308,"linkedin":1309,"twitter":1310},{"display_name":1312,"avatar":1313,"permalink":1314,"linkedin":1315,"twitter":1316},{"display_name":1318,"avatar":1319,"permalink":1320,"linkedin":1321,"twitter":1322,"imageOffsetTop":1323,"imageOffsetLeft":1324},{"display_name":1326,"avatar":1327,"permalink":1328,"twitter":1276,"linkedin":1329},{"display_name":1331,"avatar":1332,"permalink":1333,"twitter":1276,"linkedin":1334},{"display_name":1336,"avatar":1337,"permalink":1338,"twitter":1276,"linkedin":1329,"imageOffsetTop":1266},{"display_name":1340,"avatar":1341,"permalink":1342,"twitter":1276,"linkedin":1343},{"display_name":1345,"avatar":1346,"permalink":1347,"twitter":1348,"linkedin":1349},{"display_name":1351,"avatar":1352,"permalink":1353,"twitter":1276,"linkedin":1329,"imageOffsetTop":1266},{"display_name":1355,"avatar":1356,"permalink":1357,"twitter":1358,"linkedin":1358},{"display_name":1360,"avatar":1361,"permalink":1362,"twitter":1363,"linkedin":1364,"imageOffsetTop":1365},{"display_name":1367,"avatar":1368,"permalink":1369,"linkedin":1370,"twitter":1276},{"display_name":1372,"avatar":1373,"permalink":1374,"linkedin":1375,"twitter":1276},{"display_name":1377,"avatar":1378,"permalink":1379,"twitter":1380,"linkedin":1381},{"display_name":1383,"avatar":1384,"permalink":1385,"linkedin":1386,"twitter":1276},{"display_name":1388,"avatar":1389,"permalink":1390,"linkedin":1391,"twitter":1276,"imageOffsetTop":1266},{"display_name":1393,"avatar":1394,"permalink":1395,"linkedin":1396,"twitter":1276},{"display_name":1398,"avatar":1399,"permalink":1400,"twitter":1276},{"display_name":1402,"avatar":1403,"permalink":1404,"twitter":1276,"linkedin":1405},{"display_name":1407,"avatar":1408,"permalink":1409,"twitter":1410,"linkedin":1411},{"display_name":1413,"avatar":1414,"permalink":1415,"linkedin":1416,"twitter":1276},{"display_name":1418,"avatar":1419,"permalink":1420,"twitter":1276,"linkedin":1329},{"display_name":1422,"avatar":1423,"permalink":1424,"twitter":1425,"linkedin":1425,"imageOffsetTop":1266,"socials":1587},[1588,1589],{"text":475,"href":1428},{"text":1430,"href":1431},{"display_name":1433,"avatar":1434,"permalink":1435,"twitter":1436,"linkedin":1437},{"display_name":1439,"avatar":1440,"permalink":1441,"twitter":1276,"linkedin":1329},{"display_name":1443,"avatar":1444,"permalink":1445,"twitter":1446,"linkedin":1329},{"display_name":1448,"avatar":1449,"permalink":1450,"twitter":1451,"linkedin":1452},{"display_name":1454,"avatar":1455,"permalink":1456,"twitter":1457,"linkedin":1457},{"display_name":1459,"avatar":1460,"permalink":1461,"twitter":1462,"linkedin":1463},{"display_name":1465,"avatar":1466,"permalink":1467,"twitter":1468,"linkedin":1469},{"display_name":1471,"avatar":1472,"permalink":1473,"linkedin":1474,"twitter":1276},{"display_name":1476,"avatar":1477,"permalink":1478,"linkedin":1479,"twitter":1276},{"display_name":1481,"avatar":1482,"permalink":1483,"linkedin":1484,"twitter":1485},{"display_name":1487,"avatar":1488,"permalink":1489,"linkedin":1490},{"display_name":1492,"avatar":1493,"permalink":1494,"linkedin":1495},{"display_name":1497,"avatar":1498,"permalink":1499,"linkedin":1500},{"display_name":1502,"avatar":1503,"permalink":1504,"linkedin":1505},{"display_name":1507,"avatar":1508,"permalink":1509,"linkedin":1510,"imageOffsetTop":1266},{"display_name":1512,"avatar":1513,"permalink":1514,"linkedin":1515,"imageOffsetTop":1266},{"display_name":1517,"avatar":1518,"permalink":1519,"linkedin":1520,"imageOffsetTop":1365},{"display_name":1522,"avatar":1523,"permalink":1524,"linkedin":1525,"imageOffsetTop":1365},{"display_name":1527,"avatar":1528,"permalink":1529,"linkedin":1530,"imageOffsetTop":1365},{"display_name":1532,"avatar":1533,"permalink":1534,"linkedin":1535,"imageOffsetTop":1536,"imageOffsetLeft":1537},{"display_name":1539,"avatar":1540,"permalink":1541,"linkedin":1542,"imageOffsetTop":1543,"imageOffsetLeft":1544},{"display_name":1546,"avatar":1547,"permalink":1548,"linkedin":1549,"imageOffsetTop":1550,"imageOffsetLeft":1292},{"display_name":525,"avatar":1552,"permalink":1553,"linkedin":1554,"imageOffsetTop":1555},"Authors","ByqFp0GQyhHZsbtcA_HFJk8O1buC5lC502rPVTWDQDs",{"list":1616,"authors":1883},[1617,1622,1646,1667,1688,1711,1731,1750,1770,1788,1811,1825,1840,1858,1869],{"id":522,"title":523,"author":1618,"cta":497,"description":591,"hideInRecent":487,"layout":1147,"meta":1619,"moment":1152,"path":1247,"stem":1249,"tags":1621,"webcast":487},[525],{"lang":1149,"date":1152,"categories":1620,"blogtitlepic":1154,"customExcerpt":1156},[235],[235,1251,1252,1253,1254],{"id":1623,"title":1624,"author":1625,"cta":497,"description":591,"hideInRecent":487,"layout":1147,"meta":1626,"moment":1639,"path":1640,"stem":1641,"tags":1642,"webcast":487},"content_en/posts/2026-09-22-end-of-mfa-sms.md","The End of MFA via SMS",[1287],{"lang":1149,"date":1627,"categories":1628,"blogtitlepic":1629,"customExcerpt":1630,"hreflang":1631},"2026-09-21",[235],"head-conditional-access.jpg","Why organizations should move to phishing-resistant and passwordless authentication now.",[1632,1634,1636],{"lang":4,"href":1633},"/de/posts/2026-09-22-end-of-mfa-sms",{"lang":1149,"href":1635},"/en/posts/2026-09-22-end-of-mfa-sms",{"lang":1637,"href":1638},"es","/es/posts/2026-09-22-end-of-mfa-sms","2026-09-22","/posts/2026-09-22-end-of-mfa-sms","posts/2026-09-22-end-of-mfa-sms",[235,1643,1251,1644,1645],"Authentication","MFA","Passkeys",{"id":1647,"title":1648,"author":1649,"cta":497,"description":591,"hideInRecent":487,"layout":1147,"meta":1650,"moment":1627,"path":1661,"stem":1662,"tags":1663,"webcast":487},"content_en/posts/2026-09-21-clickfix-prevent-detect.md","ClickFix. When the user is the exploit, and how to stop it",[1262,1281],{"lang":1149,"date":1627,"categories":1651,"blogtitlepic":1652,"customExcerpt":1653,"hreflang":1654},[235],"head-clickfix.jpg","ClickFix turns users into their own attacker: a fake CAPTCHA, a copy-paste, and malware runs in memory with nothing on disk to scan. How Microsoft Defender detects the attack, where it falls short, and how to close the gap with a RunMRU hunt and four layers of prevention.",[1655,1657,1659],{"lang":4,"href":1656},"/de/posts/2026-09-21-clickfix-prevent-detect",{"lang":1149,"href":1658},"/en/posts/2026-09-21-clickfix-prevent-detect",{"lang":1637,"href":1660},"/es/posts/2026-09-21-clickfix-prevent-detect","/posts/2026-09-21-clickfix-prevent-detect","posts/2026-09-21-clickfix-prevent-detect",[1664,1665,1666],"Defender","SOC","Endpoint Security",{"id":1668,"title":1669,"author":1670,"cta":497,"description":591,"hideInRecent":487,"layout":1147,"meta":1671,"moment":1627,"path":1682,"stem":1683,"tags":1684,"webcast":487},"content_en/posts/2026-09-21-red-tenant-dark-tenant-cio.md","Admin Work and Everyday Work on One Machine? Game Over.",[1422],{"lang":1149,"date":1627,"categories":1672,"blogtitlepic":1673,"customExcerpt":1674,"hreflang":1675},[235],"head-game-over-en.jpg","Why one tenant is not enough for CIOs, and why the second one is rarely part of the plan. The Managed Red Tenant separates administrative work from the office environment architecturally, the Managed Dark Tenant keeps the business able to act when the defenses fall anyway. What that means for the operating model, the SOC signal and the evidence obligations under NISG 2026.",[1676,1678,1680],{"lang":4,"href":1677},"/de/posts/2026-09-21-red-tenant-dark-tenant-cio",{"lang":1149,"href":1679},"/en/posts/2026-09-21-red-tenant-dark-tenant-cio",{"lang":1637,"href":1681},"/es/posts/2026-09-21-red-tenant-dark-tenant-cio","/posts/2026-09-21-red-tenant-dark-tenant-cio","posts/2026-09-21-red-tenant-dark-tenant-cio",[235,1685,1686,1687],"Privileged Access","Zero Trust","NIS2",{"id":1689,"title":1690,"author":1691,"cta":497,"description":1692,"hideInRecent":487,"layout":1147,"meta":1693,"moment":1694,"path":1706,"stem":1707,"tags":1708,"webcast":487},"content_en/posts/2026-08-08-isg-germany-2026.md","Four Times Leader. glueckkanja in the ISG Study Germany 2026",[1448],"ISG renamed its study this year. The Microsoft Cloud Ecosystem became the Microsoft AI and Cloud Ecosystem, and the yardstick moved with the name: the study no longer assesses who adopts Microsoft platforms but who runs Copilot, agents, and AI workloads under control. The new yardstick has not changed our position. The ISG Provider Lens® study Germany 2026 positions us as a Leader in four quadrants: Microsoft Productivity and Business Process Services and Azure Managed Services, each in the large market and the mid market. After 2021, 2023, 2024, and 2025, it is our fifth Leader rating in Germany, and in Switzerland, the jump into the Leader quadrant came two weeks earlier.",{"lang":1149,"date":1694,"categories":1695,"blogtitlepic":1697,"customExcerpt":1698,"hreflang":1699},"2026-08-08",[1696],"Corporate","head-isg-de-2026.png","The ISG Provider Lens® study 2026 positions glueckkanja as a Leader in Germany in four quadrants: Microsoft Productivity and Business Process Services and Azure Managed Services, each in the large and mid market. The study is now called Microsoft AI and Cloud Ecosystem, and the yardstick has shifted: what counts is who runs AI and agent workloads under control.",[1700,1702,1704],{"lang":4,"href":1701},"/de/posts/2026-08-08-isg-germany-2026",{"lang":1149,"href":1703},"/en/posts/2026-08-08-isg-germany-2026",{"lang":1637,"href":1705},"/es/posts/2026-08-08-isg-germany-2026","/posts/2026-08-08-isg-germany-2026","posts/2026-08-08-isg-germany-2026",[1709,1710],"Award","ISG",{"id":1712,"title":1713,"author":1714,"cta":497,"description":1715,"hideInRecent":487,"layout":1147,"meta":1716,"moment":1717,"path":1728,"stem":1729,"tags":1730,"webcast":487},"content_en/posts/2026-07-31-isg-switzerland-2026.md","From Rising Star to Leader. glueckkanja in the ISG Study Switzerland 2026",[1448],"In 2024, we founded glueckkanja Switzerland AG and moved into an office at zentroom, Bahnhofplatz 10b, in Bern. In 2025, ISG named us a Rising Star in the Swiss market, the provider its analysts expected to reach the Leader quadrant. Now that leap is on record: the ISG Provider Lens® study 2026 positions us as a Leader in Switzerland in the Microsoft AI and Cloud Ecosystem quadrant, in the areas of Azure Managed Services and Microsoft Productivity and Business Process Services.",{"lang":1149,"date":1717,"categories":1718,"blogtitlepic":1719,"customExcerpt":1720,"hreflang":1721},"2026-07-31",[1696],"head-isg-ch-2026.png","The ISG Provider Lens® study 2026 positions glueckkanja as a Leader in Switzerland in the Microsoft AI and Cloud Ecosystem quadrant, for Azure Managed Services and Microsoft Productivity and Business Process Services. Two years after entering the market in Bern, one year after being named Rising Star.",[1722,1724,1726],{"lang":4,"href":1723},"/de/posts/2026-07-31-isg-switzerland-2026",{"lang":1149,"href":1725},"/en/posts/2026-07-31-isg-switzerland-2026",{"lang":1637,"href":1727},"/es/posts/2026-07-31-isg-switzerland-2026","/posts/2026-07-31-isg-switzerland-2026","posts/2026-07-31-isg-switzerland-2026",[1709,1710],{"id":1732,"title":1733,"author":1734,"cta":497,"description":591,"hideInRecent":487,"layout":1147,"meta":1735,"moment":1736,"path":1747,"stem":1748,"tags":1749,"webcast":487},"content_en/posts/2026-07-24-outbreak-openai-hugging-face.md","Outbreak. What the OpenAI/Hugging Face incident reveals and what it doesn't",[1422],{"lang":1149,"date":1736,"categories":1737,"blogtitlepic":1738,"customExcerpt":1739,"hreflang":1740},"2026-07-24",[235],"head-outbreak.jpg","An AI agent breaks out of its test environment, finds a zero-day, and hacks another company. Sounds like a movie script, but it actually happened in July 2026. Time for a sober assessment: with a bit of psychology, two security veterans, and the question of what this means for your defense.",[1741,1743,1745],{"lang":4,"href":1742},"/de/posts/2026-07-24-outbreak-openai-hugging-face",{"lang":1149,"href":1744},"/en/posts/2026-07-24-outbreak-openai-hugging-face",{"lang":1637,"href":1746},"/es/posts/2026-07-24-outbreak-openai-hugging-face","/posts/2026-07-24-outbreak-openai-hugging-face","posts/2026-07-24-outbreak-openai-hugging-face",[1253,1665,1686],{"id":1751,"title":1752,"author":1753,"cta":497,"description":1754,"hideInRecent":487,"layout":1147,"meta":1755,"moment":1756,"path":1767,"stem":1768,"tags":1769,"webcast":487},"content_en/posts/2026-07-22-isg-cybersecurity-2026.md","Leader and Rising Star. glueckkanja in the ISG Cybersecurity Study 2026",[1448],"New to the quadrant and straight in as a Leader: The ISG Provider Lens® study \"Cybersecurity – Services and Solutions 2026\" positions glueckkanja as a Leader in Next-Gen SOC/MDR Services for the German midmarket. In the overall market for Next-Gen SOC/MDR Services, ISG names us the Rising Star, the provider its analysts expect to reach the Leader quadrant within the next 12 to 24 months.",{"lang":1149,"date":1756,"categories":1757,"blogtitlepic":1758,"customExcerpt":1759,"hreflang":1760},"2026-07-22",[1696],"head-isg-cybersecurity-2026.png","The ISG Provider Lens® study Cybersecurity 2026 names glueckkanja a Leader in the Next-Gen SOC/MDR Services (Midmarket) quadrant. In the overall market for Next-Gen SOC/MDR Services, we are the Rising Star. ISG credits us with above-average growth, deep Microsoft security expertise, and a 24/7 SOC operated from Germany.",[1761,1763,1765],{"lang":4,"href":1762},"/de/posts/2026-07-22-isg-cybersecurity-2026",{"lang":1149,"href":1764},"/en/posts/2026-07-22-isg-cybersecurity-2026",{"lang":1637,"href":1766},"/es/posts/2026-07-22-isg-cybersecurity-2026","/posts/2026-07-22-isg-cybersecurity-2026","posts/2026-07-22-isg-cybersecurity-2026",[1709,1710,235],{"id":1771,"title":1772,"author":1773,"cta":497,"description":1774,"hideInRecent":487,"layout":1147,"meta":1775,"moment":1776,"path":1785,"stem":1786,"tags":1787,"webcast":487},"content_en/posts/2026-07-06-the-holy-trinity.md","The Holy Trinity: What AI Actually Needs to Get to Work",[1448],"A manufacturing company wants to know which of its 14,000 SKUs actually turn a profit. The answer sits in three systems that have never exchanged a single data point. Until recently, getting it required three departments, two weeks and a good deal of goodwill. Since early 2026, an AI can answer that question in minutes: search the data, draw connections, produce a recommendation. Provided, that is, it has access.",{"lang":1149,"date":1776,"categories":1777,"blogtitlepic":1778,"hreflang":1779},"2026-07-06",[131],"head-the-holy-trinity",[1780,1782,1783],{"lang":4,"href":1781},"/de/posts/2026-07-06-the-holy-trinity",{"lang":1149,"href":1076},{"lang":1637,"href":1784},"/es/posts/2026-07-06-the-holy-trinity","/posts/2026-07-06-the-holy-trinity","posts/2026-07-06-the-holy-trinity",[1253,131],{"id":1789,"title":1790,"author":1791,"cta":497,"description":1792,"hideInRecent":487,"layout":1147,"meta":1793,"moment":1794,"path":1805,"stem":1806,"tags":1807,"webcast":487},"content_en/posts/2026-07-01-onboarding-process.md","Contract Signed: Here's How Your Onboarding Works",[1539],"How does onboarding work at your company? A question that comes up again and again in conversations with applicants, because many have already experienced an onboarding that felt bumpy. That's exactly why it matters to us to give you a good feeling right from the start.",{"lang":1149,"date":1794,"categories":1795,"blogtitlepic":1796,"customExcerpt":1797,"hreflang":1798},"2026-07-01",[1696],"Onboarding_Blogheader","Your contract is signed, the first big step is done. But what happens now? We take you behind the scenes of our onboarding, from pre-boarding to your first week with the team.",[1799,1801,1803],{"lang":4,"href":1800},"/de/posts/2026-07-01-onboarding-process",{"lang":1149,"href":1802},"/en/posts/2026-07-01-onboarding-process",{"lang":1637,"href":1804},"/es/posts/2026-07-01-onboarding-process","/posts/2026-07-01-onboarding-process","posts/2026-07-01-onboarding-process",[1808,1809,1810],"Employer Branding","Onboarding","Company Culture",{"id":1812,"title":1813,"author":1814,"cta":497,"description":1815,"hideInRecent":487,"layout":1147,"meta":1816,"moment":1817,"path":1821,"stem":1822,"tags":1823,"webcast":487},"content_en/posts/2026-06-26-frontier-partner.md","Microsoft Frontier Partner: we are among the few",[1448],"The Microsoft partner ecosystem holds a long list of recognitions, and yet the Frontier Partner Badge sets itself apart from the others by design. It cannot be applied for but is awarded on Microsoft's own initiative to an exclusive circle of partners who have to prove themselves in several disciplines in parallel, rather than shine in a single one. Microsoft examines demonstrated capability across Cloud & AI Platforms, AI Business Solutions, and Security in equal measure, and in doing so addresses companies that do not treat AI as an add-on to existing IT but as the outcome of an end-to-end architecture that holds from identity through the endpoint all the way into productive AI operations.",{"lang":1149,"date":1817,"categories":1818,"blogtitlepic":1819,"customExcerpt":1820},"2026-06-26",[1696],"head-frontier-partner-badge.jpg","Microsoft has recently introduced a new top-tier recognition within its AI Cloud Partner Program: the Frontier Partner Badge. It is awarded exclusively to a select circle of partners worldwide who have demonstrated in practice that they can deliver AI projects across the entire Microsoft stack, from workplace and cloud platform to security and the AI application itself. In DACH, only a handful of companies belong to this group, and we are one of them.","/posts/2026-06-26-frontier-partner","posts/2026-06-26-frontier-partner",[1709,1824,1253],"Microsoft Partner",{"id":1826,"title":1827,"author":1828,"cta":497,"description":1829,"hideInRecent":487,"layout":1147,"meta":1830,"moment":1831,"path":1835,"stem":1836,"tags":1837,"webcast":487},"content_en/posts/2026-06-09-vair-run.md","160 Kilometers for a Good Cause",[1546],"Sunday morning, 8:30 am, Holbeinsteg on the Main. Eleven colleagues in matching NinjaCat shirts, ready for the Frankfurter Runden. Rain, lightning, and thunder included. Running for a good cause turned out to be all the motivation anyone needed to lace up despite the weather.",{"lang":1149,"date":1831,"categories":1832,"blogtitlepic":1833,"customExcerpt":1834},"2026-06-08",[1696],"frankfurter-runden.png","Eleven colleagues, 16 laps, 160 kilometers, a thunderstorm, and a podium finish: glueckkanja took part in the Frankfurter Runden 2026 and donated to VAIR e.V. for every lap completed, supporting an inclusive sports and cultural park in Offenbach.","/posts/2026-06-09-vair-run","posts/2026-06-09-vair-run",[1838,1808,1839],"Top Employer","Social Engagement",{"id":1841,"title":1842,"author":1843,"cta":497,"description":1844,"hideInRecent":487,"layout":1147,"meta":1845,"moment":1846,"path":1850,"stem":1851,"tags":1852,"webcast":487},"content_en/posts/2026-04-10-incident-to-intelligence.md","Anatomy of an Unknown AMOS Stealer: From Alert to Immunity in Hours",[1527],"When an alert fires in our SOC, the clock starts. But not just for the affected customer, for every customer we protect. In the modern threat landscape, the most dangerous moment for any organization is the intelligence gap: that window of time between a new malware variant being deployed and the rest of the world finding out it exists.",{"lang":1149,"date":1846,"categories":1847,"blogtitlepic":1848,"customExcerpt":1849},"2026-04-10",[235],"head-amos-stealer.png","A previously undocumented AMOS stealer variant compromised a macOS endpoint. No known hashes, no C2 data in any public database. Our SOC dismantled six layers of obfuscation, extracted every indicator, and pushed protection to all SOC customers within hours, before the wider industry had even seen the sample.","/posts/2026-04-10-incident-to-intelligence","posts/2026-04-10-incident-to-intelligence",[1853,1854,1855,1856,1857],"Threat Intelligence","Incident Response","macOS Security","Malware Analysis","Cyber Security Operations Center",{"id":1859,"title":1860,"author":1861,"cta":497,"description":1862,"hideInRecent":487,"layout":1147,"meta":1863,"moment":1864,"path":1867,"stem":1868,"tags":497,"webcast":487},"content_en/posts/2026-03-21-microsoft-edge-corporate-browser.md","Why Edge Should Be Your Only Corporate Browser",[1318],"In today's enterprise environments, choosing the right browser is more than a matter of preference. It's a strategic decision that impacts security, manageability, and user productivity. While Google Chrome has long been a popular choice, Microsoft Edge has evolved into an enterprise-ready browser that offers compelling advantages, especially when using Microsoft 365 and managed through Microsoft Intune.",{"lang":1149,"date":1864,"blogtitlepic":1865,"customExcerpt":1866},"2026-03-21","head-microsoft-edge-default-browser.jpg","The browser nobody satisfies chose became the one everybody manages. Most companies never made a deliberate decision for Chrome; it just showed up, brought its own sync logic, its own account layer, its own policy surface. Meanwhile, Microsoft Edge matured into a browser that plugs directly into the infrastructure enterprises already run: Entra ID, Intune, Defender. This post shows how to make that switch official, redirect Chrome to a landing page via Intune policy, and retire the complexity that comes with maintaining two browsers in parallel.","/posts/2026-03-21-microsoft-edge-corporate-browser","posts/2026-03-21-microsoft-edge-corporate-browser",{"id":1870,"title":1871,"author":1872,"cta":497,"description":1873,"hideInRecent":487,"layout":1147,"meta":1874,"moment":1875,"path":1879,"stem":1880,"tags":1881,"webcast":487},"content_en/posts/2026-03-20-stryker-attack-intune-privilege.md","No Malware Needed. Just One Admin Account.",[1422],"Wednesday, March 11, 2026. Employees at Stryker offices across 79 countries switched on their computers and found them blank. Login screens replaced by a logo. Corporate laptops, company phones, personal devices enrolled in the company's BYOD program. All wiped simultaneously, overnight. No ransomware. No malware signatures. Nothing for an endpoint detection tool to catch.",{"lang":1149,"date":1875,"categories":1876,"blogtitlepic":1877,"customExcerpt":1878},"2026-03-20",[235],"head-stryker.jpg","On March 11, 2026, Handala wiped devices across 79 countries using nothing but a compromised Intune admin account. No malware, no exploit, just legitimate management tooling turned into a weapon. Here is what happened, why it worked, and how the two architectural gaps that made it possible can be closed.","/posts/2026-03-20-stryker-attack-intune-privilege","posts/2026-03-20-stryker-attack-intune-privilege",[1882,71,1685,1686],"Red Tenant",{"Andreas Hötzinger":1884,"Karsten Kleinschmidt":1885,"Fritz Zurhorst":1886,"Nadine Klein":1887,"Jan Geisbauer":1888,"Carolin Kanja":1892,"Anna Ulbricht":1893,"Annette Brauns":1894,"Pascal Asch":1895,"Steffen Schwerdtfeger":1896},{"display_name":525,"avatar":1552,"permalink":1553,"linkedin":1554,"imageOffsetTop":1555},{"display_name":1287,"avatar":1288,"permalink":1289,"twitter":1290,"linkedin":1291,"imageOffsetTop":1292,"imageOffsetLeft":1293},{"display_name":1262,"avatar":1263,"permalink":1264,"linkedin":1265,"imageOffsetTop":1266},{"display_name":1281,"avatar":1282,"permalink":1283,"twitter":1284,"linkedin":1285,"imageOffsetTop":1266},{"display_name":1422,"avatar":1423,"permalink":1424,"twitter":1425,"linkedin":1425,"imageOffsetTop":1266,"socials":1889},[1890,1891],{"text":475,"href":1428},{"text":1430,"href":1431},{"display_name":1448,"avatar":1449,"permalink":1450,"twitter":1451,"linkedin":1452},{"display_name":1539,"avatar":1540,"permalink":1541,"linkedin":1542,"imageOffsetTop":1543,"imageOffsetLeft":1544},{"display_name":1546,"avatar":1547,"permalink":1548,"linkedin":1549,"imageOffsetTop":1550,"imageOffsetLeft":1292},{"display_name":1527,"avatar":1528,"permalink":1529,"linkedin":1530,"imageOffsetTop":1365},{"display_name":1318,"avatar":1319,"permalink":1320,"linkedin":1321,"twitter":1322,"imageOffsetTop":1323,"imageOffsetLeft":1324},{"id":1257,"extension":1258,"meta":1898,"stem":8,"__hash__":1614},{"Andreas Hötzinger":1899},{"display_name":525,"avatar":1552,"permalink":1553,"linkedin":1554,"imageOffsetTop":1555},1792437780784]