[{"data":1,"prerenderedAt":1825},["ShallowReactive",2],{"sc:header-data-fi":3,"sc:footer-data-fi":489,"post-fi--posts-2026-03-01-exchange-ad-split-permissions-hardening-d948cda78b15d":519,"authors_data":1237,"content-fi-list-7b291c2dd91a4":1591,"authors_data:Thorsten Kunzi":1822},{"lang":4,"home":5,"navigation":17,"meta":479,"contact":485},"de",{"name":6,"folderSwitch":7,"imgLight":10,"img":11,"languages":12},"home",[8,9],"authors","blog","/logos/gk-Logo-sw.svg","/logos/gk-Logo-rgb.svg",{"fi":13},{"title":14,"url":15,"alt":16},"Etusivu","/fi","glueckkanja Logo",[18,127,231,316,395,402],{"name":19,"languages":20,"children":24},"workplace",{"fi":21},{"title":22,"description":23},"Workplace","Microsoft 365 -pohjaiset älykkäät, turvalliset ja joustavat työympäristöt, jotka yhdistävät nykyaikaiset teknologiat ja identiteettipalvelut.",[25,55,91],{"name":26,"languages":27,"children":30},"portfolio",{"fi":28},{"title":29},"Portfolio",[31,37,43,49],{"name":32,"languages":33},"managed-intune",{"fi":34},{"title":35,"url":36},"Managed Intune","/fi/entra-intune/managed-intune",{"name":38,"languages":39},"managed-entra",{"fi":40},{"title":41,"url":42},"Managed Entra","/fi/entra-intune/managed-entra",{"name":44,"languages":45},"managed-workplace",{"fi":46},{"title":47,"url":48},"Managed Workplace","/fi/workplace/managed-workplace",{"name":50,"languages":51},"consulting-services",{"fi":52},{"title":53,"url":54},"Consulting Services","/fi/workplace/consulting-services",{"name":56,"languages":57,"children":60},"microsoft-365-endpoint",{"fi":58},{"title":59},"Microsoft 365 Endpoint",[61,67,73,79,85],{"name":62,"languages":63},"microsoft-entra-suite",{"fi":64},{"title":65,"url":66},"Microsoft Entra Suite","/fi/workplace/microsoft-entra-suite",{"name":68,"languages":69},"microsoft-intune",{"fi":70},{"title":71,"url":72},"Microsoft Intune","/fi/workplace/microsoft-intune",{"name":74,"languages":75},"microsoft-windows",{"fi":76},{"title":77,"url":78},"Microsoft Windows","/fi/workplace/microsoft-windows",{"name":80,"languages":81},"windows-365-cloud-pc",{"fi":82},{"title":83,"url":84},"Windows 365 Cloud PC","/fi/workplace/windows365-cloud-pc",{"name":86,"languages":87},"cloud-workplace-foundation",{"fi":88},{"title":89,"url":90},"Cloud Workplace Foundation","/fi/workplace/cloud-workplace-foundation",{"name":92,"languages":93,"children":96},"microsoft-365-collaboration",{"fi":94},{"title":95},"Microsoft 365 Collaboration",[97,103,109,115,121],{"name":98,"languages":99},"microsoft-copilot",{"fi":100},{"title":101,"url":102},"Microsoft 365 Copilot","/fi/workplace/microsoft-365-copilot",{"name":104,"languages":105},"microsoft-teams",{"fi":106},{"title":107,"url":108},"Teams","/fi/workplace/microsoft-teams",{"name":110,"languages":111},"sharepoint-powerplatform",{"fi":112},{"title":113,"url":114},"SharePoint & Power Platform","/fi/workplace/sharepoint-power-platform",{"name":116,"languages":117},"exchange-online",{"fi":118},{"title":119,"url":120},"Exchange Online","/fi/workplace/exchange-online",{"name":122,"languages":123},"information-protection-compliance",{"fi":124},{"title":125,"url":126},"Information Protection & Compliance","/fi/workplace/information-protection-compliance",{"name":128,"languages":129,"children":133},"azure",{"fi":130},{"title":131,"description":132},"Azure","Vauhdita kasvua Azurella: leikkaa pilvikustannuksia, paranna tehokkuutta ja edistä innovaatioita IaaS:n ja PaaS:n avulla.",[134,151,181],{"name":135,"languages":136,"children":138},"azure-portfolio",{"fi":137},{"title":29},[139,145],{"name":140,"languages":141},"azure-managed-services",{"fi":142},{"title":143,"url":144},"Azure Managed Services","/fi/azure/azure-managed-services",{"name":146,"languages":147},"azure-consulting",{"fi":148},{"title":149,"url":150},"Azure Consulting","/fi/azure/azure-consulting",{"name":152,"languages":153,"children":156},"azure-scenarios",{"fi":154},{"title":155},"Skenaariot",[157,163,169,175],{"name":158,"languages":159},"plan-your-cloud",{"fi":160},{"title":161,"url":162},"Suunnittele pilvesi","/fi/azure/plan-your-cloud",{"name":164,"languages":165},"migrate-to-the-cloud",{"fi":166},{"title":167,"url":168},"Siirry pilveen","/fi/azure/migrate-to-the-cloud",{"name":170,"languages":171},"innovate-your-business",{"fi":172},{"title":173,"url":174},"Uudista liiketoimintasi","/fi/azure/innovate-your-business",{"name":176,"languages":177},"vmware-exit",{"fi":178},{"title":179,"url":180},"Mieti VMware-strategiasi uudelleen","/fi/azure/vmware-exit",{"name":182,"languages":183,"children":186},"azure-practices",{"fi":184},{"title":185},"Practices",[187,193,199,202,208,213,219,225],{"name":188,"languages":189},"azure-foundation",{"fi":190},{"title":191,"url":192},"Azure Foundation","/fi/azure/azure-foundation",{"name":194,"languages":195},"azure-ai-foundation",{"fi":196},{"title":197,"url":198},"Azure AI Foundation","/fi/azure/azure-ai-foundation",{"name":86,"languages":200},{"fi":201},{"title":89,"url":90},{"name":203,"languages":204},"azure-data-foundation",{"fi":205},{"title":206,"url":207},"Azure Data Foundation","/fi/azure/azure-data-foundation",{"name":188,"languages":209},{"fi":210},{"title":211,"url":212},"Azure Container Foundation","/fi/azure/azure-container-foundation",{"name":214,"languages":215},"dark-tenant",{"fi":216},{"title":217,"url":218},"Managed Dark Tenant","/fi/azure/managed-dark-tenant",{"name":220,"languages":221},"azure-cloud-adoption-framework",{"fi":222},{"title":223,"url":224},"Cloud Adoption Framework","/fi/azure/cloud-adoption-framework",{"name":226,"languages":227},"azure-cloud-competence-center",{"fi":228},{"title":229,"url":230},"Cloud Competence Center","/fi/azure/cloud-competence-center",{"name":232,"languages":233,"children":242},"security",{"fi":234},{"title":235,"description":236,"emergency":237},"Tietoturva","Valppautta pilvessä palkitulla 24/7-hallintapalvelulla, häiriötilanteiden hallinnalla ja huippuluokan suojauksella infrastruktuurillesi.",{"text":238,"href":239,"skin":240,"icon":241},"Hyökkäyksen kohteena?","/fi/security/are-you-under-attack","primary","emergency",[243,268,289],{"name":244,"children":245},"security-security-consulting",[246,252,256,262],{"name":247,"languages":248},"managed-red-tenant",{"fi":249},{"title":250,"url":251},"Managed Red Tenant","/fi/security/managed-red-tenant",{"name":214,"languages":253},{"fi":254},{"title":255,"url":218},"Dark Tenant",{"name":257,"languages":258},"sentinel-data-lake",{"fi":259},{"title":260,"url":261},"Sentinel Data Lake","/fi/security/sentinel-data-lake",{"name":263,"languages":264},"security-consulting",{"fi":265},{"title":266,"url":267},"Security Consulting","/fi/security/security-consulting",{"name":269,"children":270},"security-cloud-security-operations-center",[271,277,283],{"name":272,"languages":273},"cloud-security-operations-center",{"fi":274},{"title":275,"url":276},"Cloud Security Operations Center","/fi/security/cloud-security-operations-center",{"name":278,"languages":279},"global-secure-access",{"fi":280},{"title":281,"url":282},"Global Secure Access","/fi/security/global-secure-access",{"name":284,"languages":285},"my-work-id",{"fi":286},{"title":287,"url":288},"MyWorkID","/fi/security/my-work-id",{"name":290,"children":291},"security-preventive-services",[292,298,304,310],{"name":293,"languages":294},"preventive-services",{"fi":295},{"title":296,"url":297},"Preventive Services","/fi/security/preventive-services",{"name":299,"languages":300},"data-security-services",{"fi":301},{"title":302,"url":303},"Data Security Service","/fi/security/data-security-service",{"name":305,"languages":306},"security-copilot-agents",{"fi":307},{"title":308,"url":309},"Security Copilot Agents","/fi/security/security-copilot-agents",{"name":311,"languages":312},"nis2",{"fi":313},{"title":314,"url":315},"NIS2:n käyttöönotto","/fi/security/red-dark-tenant-nis2",{"name":317,"languages":318,"children":322},"products",{"fi":319},{"title":320,"description":321},"Tuotteet","Innovatiiviset täydentävät tuotteet täysin turvalliseen, 100-prosenttisesti pilvipohjaiseen Microsoft-ympäristöön, jotka parantavat yhteistyötä, verkon todennusta ja ohjelmistojen hallintaa.",[323,360],{"name":324,"products":325,"children":326},"lorem ipsum 1",true,[327,336,344,352],{"name":328,"img":329,"target":330,"languages":331},"realmjoin","products/realmjoin/realmjoin-nav-logo.svg","_blank",{"fi":332},{"title":333,"url":334,"subtitle":335},"RealmJoin","https://www.realmjoin.com","Pilvipohjainen ohjelmistojen jakelu",{"name":337,"img":338,"target":330,"languages":339},"scepman","products/scepman/scepman-nav-logo.svg",{"fi":340},{"title":341,"url":342,"subtitle":343},"SCEPman","https://www.scepman.com","Varmenteiden jakelu pilvestä",{"name":345,"img":346,"target":330,"languages":347},"konnekt","products/konnekt/konnekt-nav-logo.svg",{"fi":348},{"title":349,"url":350,"subtitle":351},"KONNEKT","https://www.konnekt.io","Työskentele paikallisten Office 365 -tietojesi kanssa",{"name":353,"img":354,"target":330,"languages":355},"realmigrator","products/realmigrator/realmigrator-nav-logo.svg",{"fi":356},{"title":357,"url":358,"subtitle":359},"RealMigrator","https://www.realmigrator.com","Siirrä tietosi palvelimelta toiselle",{"name":361,"products":325,"children":362},"lorem ipsum 2",[363,371,379,387],{"name":364,"img":365,"target":330,"languages":366},"terraprovider","products/terraprovider/terraprovider-nav-logo.svg",{"fi":367},{"title":368,"url":369,"subtitle":370},"TerraProvider","https://www.terraprovider.com","Terraform Provider Microsoft 365:lle",{"name":372,"img":373,"target":330,"languages":374},"radiusaas","products/radius/radius-nav-logo.svg",{"fi":375},{"title":376,"url":377,"subtitle":378},"RADIUSaaS","https://www.radius-as-a-service.com","Todennus verkollesi",{"name":380,"img":381,"target":330,"languages":382},"unifiedcontacts","products/unified-contacts/unifiedcontact-nav-logo.svg",{"fi":383},{"title":384,"url":385,"subtitle":386},"Unified Contacts","https://www.unified-contacts.com","Etsi yhteystietoja Microsoft Teamsista",{"name":388,"img":389,"target":330,"languages":390},"autopilotmonitor","products/autopilot-monitor/AutopilotMonitor-nav-logo.svg",{"fi":391},{"title":392,"url":393,"subtitle":394},"Autopilot Monitor","https://www.autopilotmonitor.com","Windows Autopilot -valvonta reaaliajassa",{"name":396,"languages":397},"casestudies",{"fi":398},{"title":399,"url":400,"description":401},"Asiakastarinat","/fi/casestudies","Pilven edelläkävijä: paras Microsoft-kumppanisi kattaviin pilviratkaisuihin Blueprint-pohjaisella lähestymistavalla ja Infrastructure-as-Code-osaamisella.",{"name":403,"languages":404,"children":407},"company",{"fi":405},{"title":406,"description":401},"Yritys",[408,438,462],{"name":409,"languages":410,"children":413},"company-about-us",{"fi":411},{"title":412},"Tietoa meistä",[414,420,426,432],{"name":415,"languages":416},"company-facts-figures",{"fi":417},{"title":418,"url":419},"Faktat ja luvut","/fi/company/facts-and-figures",{"name":421,"languages":422},"company-contact",{"fi":423},{"title":424,"url":425},"Yhteystiedot ja toimipisteet","/fi/company/contact-and-locations",{"name":427,"languages":428},"switzerland",{"fi":429},{"title":430,"url":431},"glueckkanja Sveitsi","/fi/company/switzerland",{"name":433,"languages":434},"austria",{"fi":435},{"title":436,"url":437},"glueckkanja Itävalta","/fi/company/austria",{"name":439,"languages":440,"children":443},"company-career",{"fi":441},{"title":442},"Ura",[444,450,456],{"name":445,"languages":446},"company-career-overview",{"fi":447},{"title":448,"url":449},"Urakatsaus","/fi/career",{"name":451,"languages":452},"company-young-professionals",{"fi":453},{"title":454,"url":455},"Young Professionals","/fi/young-professionals",{"name":457,"languages":458},"company-jobs",{"fi":459},{"title":460,"url":461},"Avoimet työpaikat","/fi/job-offers",{"name":463,"languages":464,"children":467},"company-latest",{"fi":465},{"title":466},"Uusimmat",[468,474],{"name":469,"languages":470},"company-blog",{"fi":471},{"title":472,"url":473},"Blogi","/fi/blog",{"name":469,"languages":475},{"fi":476},{"title":477,"url":478},"Tapahtumat","/fi/events",[480],{"name":481,"languages":482},"career-meta",{"fi":483},{"title":442,"url":449,"active":484},false,{"languages":486},{"fi":487},{"title":488,"url":425,"active":484},"Yhteystiedot",{"data":490},{"bgColor":491,"number":492,"mail":493,"brandLogos":494,"logos":495,"links":499,"linksFi":509},"var(--color-gk-mid-blue)","+49 69 4005520","info@glueckkanja.com",null,[496],{"img":10,"alt":16,"url":497,"class":498},"index.html","max-w-19rem",[500,503,506],{"title":501,"url":502},"Datenschutz","/de/privacy",{"title":504,"url":505},"Impressum","/de/imprint",{"title":507,"url":508},"No Cookies","/de/cookies",[510,513,516],{"title":511,"url":512},"Tietosuoja","/fi/privacy",{"title":514,"url":515},"Oikeudelliset tiedot","/fi/imprint",{"title":517,"url":518},"Ei evästeitä","/fi/cookies",{"id":520,"title":521,"author":522,"body":524,"cta":494,"description":1194,"eventid":494,"extension":1209,"hideInRecent":484,"layout":1210,"meta":1211,"moment":1215,"navigation":325,"path":1233,"seo":1234,"stem":1235,"tags":494,"webcast":484,"__hash__":1236},"content_fi/posts/2026-03-01-exchange-ad-split-permissions-hardening.md","Exchange AD Split Permissions ilman katumusta",[523],"Thorsten Kunzi",{"type":525,"value":526,"toc":1193},"minimal",[527,532,536,543,549,568,571,578,583,587,596,611,617,620,625,661,685,689,697,706,711,727,731,737,742,747,808,813,850,853,857,872,879,895,906,910,913,959,962,971,980,983,998,1015,1028,1040,1045,1104,1108,1113,1133,1140,1164,1168,1171,1174,1189],[528,529,531],"h2",{"id":530},"tldr-entä-jos-poistamme-haittapuolet","TLDR: entä jos poistamme haittapuolet?",[533,534,535],"p",{},"Löysin tavan myöntää AD- ja RBAC-oikeudet takaisin suoraan sinne, missä Exchangen käyttäjät, ryhmät ja yhteystiedot sijaitsevat, ilman muutoksia ylläpitäjille tai identiteetinhallintajärjestelmille. Kokemukseni mukaan juuri tämä kitka on ollut useimpien yritysten tärkein este. Ja säilytämme silti tietoturvahyödyt lateraalista liikettä ja toimialueen valtausta vastaan.",[533,537,538],{},[539,540],"img",{"alt":541,"src":542},"Active Directory","https://res.cloudinary.com/c4a8/image/upload/v1770991330/blog/pics/Blog_-_Exchange_AD_Split_Permissions_-_1.png",[533,544,545],{},[546,547,548],"strong",{},"Se toteutetaan kolmessa vaiheessa:",[550,551,553,562,565],"ol",{"style":552},"margin: 0.25rem 0",[554,555,556,557],"li",{},"Ota käyttöön ",[558,559,561],"a",{"href":560},"https://learn.microsoft.com/en-us/exchange/permissions/split-permissions/configure-exchange-for-split-permissions#switch-to-active-directory-split-permissions","AD split permission -malli",[554,563,564],{},"Myönnä Exchange-palvelimille menetetyt AD-oikeudet, mutta vain olennaisiin OU:ihin",[554,566,567],{},"Myönnä Exchange RBAC ottaaksesi puuttuvat PowerShell-cmdletit uudelleen käyttöön",[533,569,570],{},"Kaikki Microsoftin ohjeiden, AD ACL:ien tai Exchange RBAC -määritysten avulla.",[572,573],"video-frame",{"thumb":574,"alt":575,"id":576,":full-width":577},"/thumbs/thumb-exchange-ad-split-permissions-webcast.jpg","Esittäjä istuu kannettavan tietokoneen edessä ja selittää diaa, jonka otsikko on Step 1: Active Directory Permissions by glueckkanja. Dia käsittelee Microsoft Exchange AD Split Permissions -mallin käyttöönottoa, mukaan lukien PowerShell-komennot delegointiryhmän luomiseen (New-ADGroup, Add-ADGroupMember) ja oikeuksien soveltamiseen skriptillä Add-ExchangeADSplitPermissionOnOU.ps1.","soNZkNRopSQ","true",[579,580,582],"div",{"style":581},"background:var(--color-gk-light-grey); margin-top:0.5rem; padding:0.5rem 1rem; font-size:0.85rem; color:var(--color-gk-dark-blue)","Webcast: Exchange AD Split Permissions ilman katumusta. Vaiheittainen käyttöönotto-opas",[528,584,586],{"id":585},"miksi-tämä-kiinnostaa-nyt","Miksi tämä kiinnostaa (nyt)?",[533,588,589,590,593,595],{},"Se on suurelta osin jäänyt huomiotta tai sivuutettu siitä lähtien, kun se otettiin käyttöön Exchange 2010 SP1:n mukana. Oletuksena oleva jaettujen oikeuksien malli edustaa kuitenkin suurta tietoturvariskiä Active Directoryn valtaamiselle. Yhdistettynä siihen, että Exchange on viime vuosina ollut surullisenkuuluisa etähyökkäyksistä, on aika toimia.",[591,592],"br",{},[591,594],{},"\nOngelma juontuu oikeuksista, jotka on myönnetty toimialueen juureen ja jotka periytyvät läpi koko toimialueen.",[597,598,599,602,605,608],"ul",{"style":552},[554,600,601],{},"käyttäjien ja ryhmien oikeuksien muokkaus (käytännössä täysi pääsy)",[554,603,604],{},"ryhmän jäsenten muokkaus",[554,606,607],{},"käyttäjien salasanojen nollaus",[554,609,610],{},"käyttäjien ja ryhmien luonti/poisto",[533,612,613],{},[539,614],{"alt":615,"src":616},"Oikeudet","https://res.cloudinary.com/c4a8/image/upload/v1770991330/blog/pics/Blog_-_Exchange_AD_Split_Permissions_-_2.png",[533,618,619],{},"Vain tietyt korkeasti valtuutetut Tier 0 -käyttäjät ja -ryhmät ovat AdminSDHolder-prosessin suojaamia (attribuutti admincount=1), ja monissa ympäristöissä on suojaamattomia käyttäjiä tai ryhmiä, jotka voivat mahdollistaa toimialueen ja/tai metsän valtaamisen tai ainakin aiheuttaa vakavia seurauksia.",[533,621,622],{},[546,623,624],{},"Näkyviä esimerkkejä:",[597,626,627,630,650],{"style":552},[554,628,629],{},"Entra Connect Sync -tili käytettäessä Password Hash Synciä",[554,631,632,633],{},"Oletusryhmät",[597,634,636,639,647],{"style":635},"margin: 0",[554,637,638],{},"Allowed RODC Password Replication Group -ryhmä yhdessä Entra Connect -tilin kanssa (jos oikea Windows RODC on olemassa)",[554,640,641,642,646],{},"Katso myös ",[558,643,645],{"href":644,"target":330},"https://specterops.io/blog/2025/06/25/untrustworthy-trust-builders-account-operators-replicating-trust-attack-aorta","Untrustworthy Trust Builders: Account Operators Replicating Trust Attack (AORTA) - SpecterOps",", joka näyttää lisää polkuja (Account Operators -ryhmä on samankaltainen uhka)",[554,648,649],{},"Protected Users -ryhmän tyhjentäminen hyökkäysvektoreiden luomiseksi suojauksia poistamalla",[554,651,652,653],{},"Suojaamattomat mukautetut ryhmät tai järjestelmänvalvoja-/palvelutilit",[597,654,655,658],{"style":635},[554,656,657],{},"Kirjoitusoikeus GPO:ihin (jotka koskevat toimialueen ohjauskonetta)",[554,659,660],{},"AD-varmuuskopioiden, varmuuskopiopalvelimen, PKI-mallien, hypervisorin, ... pääsyn hallinta",[533,662,663,664,666,668,669,675,677,679,680],{},"Kaikkien näiden nykyisten ja tulevien mahdollisten polkujen rajoittaminen jälkikäteen on hyvin vaikeaa. _ADM-mukautetussa OU:ssa voisit poistaa ACL:n periytymisen käytöstä, mutta useimpia oletusobjekteja ei voi siirtää oletusarvoisesta Builtin-OU:sta tai Users-säiliöstä, joten ne pysyvät haavoittuvina.",[591,665],{},[591,667],{},"\nOn paljon parempi poistaa voimakkaat oikeudet juuresta, mikä tehdään ottamalla käyttöön Active Directory split permissions -malli. ",[558,670,674],{"href":671,"rel":672},"https://learn.microsoft.com/en-us/exchange/permissions/split-permissions/configure-exchange-for-split-permissions",[673],"nofollow","Configure Exchange Server for split permissions | Microsoft Learn",[591,676],{},[591,678],{},"\nJa Microsoft on samaa mieltä: “…kannustetaan ottamaan käyttöön Active Directory split permissions” ",[558,681,684],{"href":682,"rel":683},"https://techcommunity.microsoft.com/blog/coreinfrastructureandsecurityblog/active-directory-hardening-series---part-7-%E2%80%93-implementing-least-privilege/4366626",[673],"Active Directory Hardening Series - Part 7 – Implementing Least Privilege | Microsoft Community Hub",[528,686,688],{"id":687},"mutta-miksi-kukaan-ei-tee-sitä","Mutta miksi kukaan ei tee sitä?",[533,690,691,692,694,696],{},"Koska split permissions ei ollut saatavilla ennen Exchange 2010 SP1:tä, kaikki olivat siihen mennessä hyväksyneet tilanteen, eikä tietoturvatiimien näytä onnistuneen viemään sitä läpi sen jälkeen, kun se oli olemassa.",[591,693],{},[591,695],{},"\nJa se olisi pakottanut muutoksia ylläpito- ja IDM-prosesseihin, kuten käyttäjien tai jakelulistojen luomisen ensin AD:hen ja vasta sen jälkeen niiden “mail enable” -toiminnon Exchangessa.",[698,699,700],"blockquote",{},[533,701,702,705],{},[546,703,704],{},"Info:"," Seuraavat cmdletit eivät enää ole saatavilla tai toimi: Add-DistributionGroupMember, New-DistributionGroup, New-Mailbox, New-MailContact, New-MailUser, New-RemoteMailbox, Remove-DistributionGroup, Remove-DistributionGroupMember, Remove-Mailbox, Remove-MailContact, Remove-MailUser, Remove-RemoteMailbox, Update-DistributionGroupMember, Add-ADPermission, Remove-ADPermission",[533,707,708],{},[546,709,710],{},"Käyttöönottoesimerkkejä:",[597,712,713,724],{"style":552},[554,714,715,716],{},"New-Mailbox (jossa Exchange kirjoittaa AD:hen) olisi:",[597,717,718,721],{"style":635},[554,719,720],{},"New-ADUser (jossa adm.jdoe kirjoittaa AD:hen)",[554,722,723],{},"Enable-Mailbox",[554,725,726],{},"Add-ADPermission SendAs-oikeuksia varten pitäisi tehdä AD Users and Computers -työkalun suojausvälilehdellä, mikä usein vaatii lisää AD-oikeuksia tavallisille ylläpitäjille.",[528,728,730],{"id":729},"näytä-minulle-tämä-vaihtoehto-ilman-katumusta","Näytä minulle tämä vaihtoehto ilman katumusta",[533,732,733,736],{},[546,734,735],{},"Vastuuvapauslauseke",": Lue ja ymmärrä seuraavat linkit ja artikkelit kokonaan, tee tämä ensin testiympäristössä, varmista että AD-varmuuskopiot ovat ajantasaiset ja palautuskäytännöt on otettu käyttöön.",[738,739,741],"h3",{"id":740},"auditoi-nykyinen-käyttö","Auditoi nykyinen käyttö",[533,743,744],{},[546,745,746],{},"Tarkista ensin, mitkä vaikutuksen alaiset cmdletit ovat käytössä missäkin OU:issa:",[748,749,750,758,760,766,768],"code-block",{},[751,752,753,757],"span",{},[751,754,756],{"style":755},"color:var(--color-gk-orange)","$CsvPath"," = \"C:\\temp\\SplitPermissionAdminAuditLog.csv\"",[591,759],{},[751,761,762,765],{},[751,763,764],{"style":755},"$Cmdlets"," = \"Add-ADPermission\",\"Remove-ADPermission\",\"New-DistributionGroup\",\"Remove-DistributionGroup\",\"Add-DistributionGroupMember\",\"Update-DistributionGroupMember\",\"Remove-DistributionGroupMember\",\"New-Mailbox\",\"Remove-Mailbox\",\"New-RemoteMailbox\",\"Remove-RemoteMailbox\",\"New-MailUser\",\"Remove-MailUser\",\"New-MailContact\",\"Remove-MailContact\"",[591,767],{},[751,769,770,773,774,778,779,773,782,784,785,788,789,773,792,773,795,773,797,800,801,804,805],{},[751,771,772],{"style":755},"Search-AdminAuditLog"," ",[751,775,777],{"style":776},"color:var(--color-gk-mid-blue)","-ResultSize"," 99000 ",[751,780,781],{"style":776},"-Cmdlets",[751,783,764],{"style":755}," | ",[751,786,787],{"style":755},"Select-Object"," RunDate,Caller,ObjectModified,CmdletName,@{Name='CmdletParameters';Expression={[string]::join(\",\", ($\\_.CmdletParameters))}},succeeded,error | ",[751,790,791],{"style":755},"Export-Csv",[751,793,794],{"style":776},"-Path",[751,796,756],{"style":755},[751,798,799],{"style":776},"-Delimiter"," \";\" ",[751,802,803],{"style":776},"-Encoding"," Unicode ",[751,806,807],{"style":776},"-NoTypeInformation",[533,809,810],{},[546,811,812],{},"Kutsujan ja cmdlettien pika-analyysi:",[748,814,815,831,833,841,843],{},[751,816,817,820,821,773,824,773,826,773,828,830],{},[751,818,819],{"style":755},"$CSVs"," = ",[751,822,823],{"style":755},"Import-Csv",[751,825,794],{"style":776},[751,827,756],{"style":755},[751,829,799],{"style":776}," \";\"",[591,832],{},[751,834,835,784,837,840],{},[751,836,819],{"style":755},[751,838,839],{"style":755},"Group-Object"," Caller",[591,842],{},[751,844,845,784,847,849],{},[751,846,819],{"style":755},[751,848,839],{"style":755}," CmdletName",[533,851,852],{},"Analysoi CSV:stä, missä AD-oikeuksia tarvitaan. Voit halutessasi optimoida siirtämällä kaikki Exchangen kannalta olennaiset ryhmät omiin OU:ihinsa.",[528,854,856],{"id":855},"ota-split-permissions-malli-käyttöön","Ota Split Permissions -malli käyttöön",[533,858,859,860,863,864,868],{},"Seuraa Microsoftin ohjetta ",[546,861,862],{},"\"Switch to Active Directory split permissions\""," kohdassa\n",[558,865,674],{"href":866,"rel":867},"https://learn.microsoft.com/en-us/exchange/configure-exchange-server-for-split-permissions",[673],[869,870,871],"em",{},"(EI RBAC split permissions)",[533,873,874,875,878],{},"Käytännössä se poistaa vaaralliset oikeudet ",[546,876,877],{},"\"Exchange Windows Permissions\""," -ryhmältä ja poistaa myös Exchangen ryhmän jäsenyydestä.",[748,880,881],{},[751,882,883,773,886,773,889,773,892],{},[751,884,885],{"style":755},"Setup.exe",[751,887,888],{"style":776},"/IAcceptExchangeServerLicenseTerms_DiagnosticDataOFF",[751,890,891],{"style":776},"/PrepareAD",[751,893,894],{"style":776},"/ActiveDirectorySplitPermissions:true",[579,896,898,899,901,902],{"style":897},"background:#f4f4f4; border-left:4px solid var(--color-gk-petrol); border-radius:0 6px 6px 0; padding:0.75rem 1rem; margin:1rem 0; font-size:0.88rem; color:#000520;","\n  ",[546,900,704],{}," Palataksesi takaisin käytä yksinkertaisesti ",[903,904,905],"code",{},"/ActiveDirectorySplitPermissions:false",[738,907,909],{"id":908},"myönnä-ad-oikeudet","Myönnä AD-oikeudet",[533,911,912],{},"Luo mukautettu AD-ryhmä ja tee Exchange-palvelimista sen jäseniä.",[748,914,915,921,923,773,926,929,930,933,934,937,938,773,940,773,943,946,947,949,929,952,955,956],{},[751,916,917],{},[751,918,920],{"style":919},"color:var(--color-black-40)","# adjust OU Path first!",[591,922],{},[751,924,925],{"style":755},"New-ADGroup",[751,927,928],{"style":776},"-Name"," \"AD_Custom Exchange Split permissions replacement\" ",[751,931,932],{"style":776},"-GroupCategory"," Security ",[751,935,936],{"style":776},"-GroupScope"," DomainLocal ",[751,939,794],{"style":776},[546,941,942],{},"\"OU=Rights,OU=Groups,OU=T1,OU=_ADM,$((Get-ADDomain).DistinguishedName)\"",[751,944,945],{"style":776},"-Description"," \"replaces the permissions lost by split permissions on relevant OUs\"",[591,948],{},[751,950,951],{"style":755},"Add-ADGroupMember",[751,953,954],{"style":776},"-Members"," \"Exchange Trusted Subsystem\"\n",[751,957,958],{"style":919},"# reboot Exchange servers for permissions via group to work",[533,960,961],{},"Olen luonut skriptin, joka helpottaa AD-oikeuksien delegointia käyttötapauskohtaisesti.",[698,963,964],{},[533,965,966,967,970],{},"Ilman näitä oikeuksia Exchange-palvelin saisi AD:ltä virheen ",[903,968,969],{},"“INSUFF_ACCESS_RIGHTS”",".",[533,972,973,974,979],{},"Lataa ",[558,975,978],{"href":976,"rel":977},"https://github.com/glueckkanja/code-snippets/blob/main/ExchangeADSplitPermission/Add-ExchangeADSplitPermissionOnOU.ps1",[673],"Add-ExchangeADSplitPermissionOnOU.ps1"," glueckkanjan GitHubista",[533,981,982],{},"Se voi myöntää seuraavat PermissionTypet:",[533,984,986,989,991,992,994],{"style":985},"background:#f5f5f5;padding:0.5rem 1rem;margin:0.25rem 0;border-left:3px solid #d8d8d8;",[546,987,988],{},"CreateUserAndContact",[591,990],{},"Käyttäjien ja yhteystietojen luonti/poisto, ResetPassword ja WriteAllProperties",[591,993],{},[995,996,997],"small",{},"Exchange-cmdletit: `New-Mailbox`, `New-RemoteMailbox`, `New-MailUser`, `New-MailContact` ja vastaavat `Remove-*`",[533,999,1001,1004,1006,1007,1009],{"style":1000},"background:#f5f5f5;padding:0.5rem 1rem;margin:0.25rem 0;border-left:3px solid #d8d8d8",[546,1002,1003],{},"GroupManage",[591,1005],{},"Ryhmien luonti/poisto, jäsenten muokkaus",[591,1008],{},[995,1010,1011,1012,1014],{},"Exchange-cmdletit: `New-DistributionGroup`, `Remove-DistributionGroup`, `Add-DistributionGroupMember`, `Update-DistributionGroupMember`, `Remove-DistributionGroupMember`",[591,1013],{},"Myös: käyttäjä hallitsee omistamiaan DistributionGroup-ryhmiä EAC:n kautta",[533,1016,1017,1020,1022,1023,1025],{"style":1000},[546,1018,1019],{},"UserSendAs",[591,1021],{},"AD-oikeuksien muokkaus käyttäjillä",[591,1024],{},[995,1026,1027],{},"Exchange-cmdlet: `Add-ADPermission`",[533,1029,1030,1033,1035,1036,1038],{"style":1000},[546,1031,1032],{},"GroupSendAs",[591,1034],{},"AD-oikeuksien muokkaus ryhmillä",[591,1037],{},[995,1039,1027],{},[533,1041,1042],{},[546,1043,1044],{},"Skriptin käyttö:",[748,1046,1047,773,1049,1052,1053,1056,1057,1060,1061,1064,1066,773,1068,1070,1071,1073,1074,1060,1076,773,1078,1070,1080,1082,1083,1060,1085,773,1087,1089,1090,1092,1093,1060,1095,773,1097,1089,1099,1101,1102,1060],{},[751,1048,978],{"style":755},[751,1050,1051],{"style":776},"-TargetOU"," \u003COU> ",[751,1054,1055],{"style":776},"-PermissionType"," \u003CGroupManage|UserSendAs|GroupSendAs|CreateUserAndContact> ",[751,1058,1059],{"style":776},"-Trustee"," \"AD_Custom Exchange Split permissions replacement\"\n",[751,1062,1063],{"style":919},"# For example",[591,1065],{},[751,1067,978],{"style":755},[751,1069,1051],{"style":776}," \"OU=ExchangeGroups,OU=HQ,OU=Alderaan,$((Get-ADDomain).DistinguishedName)\" ",[751,1072,1055],{"style":776}," GroupManage ",[751,1075,1059],{"style":776},[751,1077,978],{"style":755},[751,1079,1051],{"style":776},[751,1081,1055],{"style":776}," GroupSendAs ",[751,1084,1059],{"style":776},[751,1086,978],{"style":755},[751,1088,1051],{"style":776}," \"OU=Users,OU=HQ,OU=Alderaan,$((Get-ADDomain).DistinguishedName)\" ",[751,1091,1055],{"style":776}," UserSendAs ",[751,1094,1059],{"style":776},[751,1096,978],{"style":755},[751,1098,1051],{"style":776},[751,1100,1055],{"style":776}," CreateUserAndContact ",[751,1103,1059],{"style":776},[738,1105,1107],{"id":1106},"myönnä-exchange-rbac","Myönnä Exchange RBAC",[533,1109,1110],{},[546,1111,1112],{},"Ota -BypassSecurityGroupManagerCheck-parametri uudelleen käyttöön Add-DistributionGroupMember- ja Remove-DistributionGroupMember-cmdleteille:",[748,1114,1115],{},[751,1116,1117,773,1120,1122,1123,1126,1127,1129,1130,1132],{},[751,1118,1119],{"style":755},"New-RoleGroup",[751,1121,928],{"style":776}," \"SplitPermission Security Group Creation and Membership\" ",[751,1124,1125],{"style":776},"-Roles"," \"Security Group Creation and Membership\" ",[751,1128,954],{"style":776}," \"Organization Management\",\"Recipient Management\" ",[751,1131,945],{"style":776}," \"Brings back -BypassSecurityGroupManagerCheck to Add-DistributionGroupMember, but also needs AD ACL for Exchange Server on target DLs\"",[698,1134,1135],{},[533,1136,1137,1139],{},[546,1138,704],{}," Muuten saat viestin \"-BypassSecurityGroupManagerCheck parameter is not available\" tai \"You don't have sufficient permissions. This operation can only be performed by a manager of the group\"",[533,1141,1142,1144,1147,1149],{},[591,1143],{},[546,1145,1146],{},"Ota New-Mailbox, New-RemoteMailbox, New-MailContact, Remove-... -cmdletit uudelleen käyttöön tarvittavilla parametreilla:",[591,1148],{},[748,1150,1151,773,1153,1155,1156,1158,1159,1129,1161,1163],{},[751,1152,1119],{"style":755},[751,1154,928],{"style":776}," \"SplitPermission Mail Recipient Creation\" ",[751,1157,1125],{"style":776}," \"Mail Recipient Creation\" ",[751,1160,954],{"style":776},[751,1162,945],{"style":776}," \"Brings back New-Mailbox, New-RemoteMailbox, New-MailUser, New-MailContact and matching Remove-... cmdlets, but additionally Exchange needs AD ACL for Exchange Server on target OUs\"",[528,1165,1167],{"id":1166},"johtopäätökset","Johtopäätökset",[533,1169,1170],{},"Toivon, että tämä opas auttaa useampia organisaatioita ottamaan tärkeän askeleen Active Directoryn suojaamiseksi Exchangen kautta tapahtuvaa valtausta vastaan. Kokemukseni mukaan Exchange AD Split Permissions -mallin käyttöönotossa useilla asiakkailla en ole törmännyt ongelmiin ja käyttöönotto on sujunut mutkattomasti.",[533,1172,1173],{},"Toivon myös, että Microsoft tuo natiivisti OU-pohjaisen tavan saavuttaa tämä tarkkuustaso nykyisen kaikki-tai-ei-mitään-mallin sijaan, mikä helpottaisi laajaa käyttöönottoa merkittävästi.",[533,1175,1176,1177,1182,1183,1188],{},"Huomio AD-tasoituksesta (AD Tiering): Älä kirjaudu Exchange-palvelimille Domain Admin- tai muilla Tier 0 -tileillä. Käsittele Exchange-palvelimia Tier 1:nä ja ota AD Tiering käyttöön mahdollisimman pian. Ensimmäisenä askeleena suosittelen käyttämään ",[558,1178,1181],{"href":1179,"rel":1180},"https://www.pingcastle.com/",[673],"PingCastle"," tai ",[558,1184,1187],{"href":1185,"rel":1186},"https://www.semperis.com/purple-knight/",[673],"Purple Knight"," -työkalua AD:n tietoturvatilan arvioimiseksi ja hallintapolkujen altistumien tunnistamiseksi.",[1190,1191,1192],"style",{},"\ncode {\n  font-size: inherit\n}\n",{"title":1194,"searchDepth":1195,"depth":1195,"links":1196},"",2,[1197,1198,1199,1200,1204,1208],{"id":530,"depth":1195,"text":531},{"id":585,"depth":1195,"text":586},{"id":687,"depth":1195,"text":688},{"id":729,"depth":1195,"text":730,"children":1201},[1202],{"id":740,"depth":1203,"text":741},3,{"id":855,"depth":1195,"text":856,"children":1205},[1206,1207],{"id":908,"depth":1203,"text":909},{"id":1106,"depth":1203,"text":1107},{"id":1166,"depth":1195,"text":1167},"md","post",{"lang":1212,"seoTitle":1213,"titleClass":1214,"date":1215,"blogtitlepic":1216,"socialimg":1217,"customExcerpt":1218,"keywords":1219,"scripts":1220,"asideNav":1221,"maxContent":325,"published":325},"fi","Exchange AD Split Permissions: suojaa Active Directory vähimmäisoikeuksin","h2-font-size","2026-03-01","head-exchange-ad-split-permissions","/blog/heads/head-exchange-ad-split-permissions.jpg","Myös organisaatiot, jotka ovat siirtäneet postilaatikkonsa kokonaan pilveen, ajavat usein edelleen paikallisia Exchange-palvelimia ja niiden mukana aliarvioitua Active Directoryn tietoturvariskiä. \"AD Split Permissions\" -malli riisuu Exchangelta laajat AD-oikeudet, joita hyökkääjät voisivat käyttää koko toimialueen valtaamiseen. Tähän asti käyttöönotto on jäänyt suurelta osin toteutumatta niiden prosessimuutosten takia, joita se pakottaa ylläpitäjille. Tämä artikkeli näyttää, miten juuri tämä este ylitetään tyylikkäästi: skripti, joka myöntää menetetyt AD-oikeudet valikoivasti takaisin vain olennaisiin OU:ihin, säilyttää tutun ylläpitotyönkulun ja tuottaa silti täyden tietoturvahyödyn.","Exchange Server, Active Directory, AD split permissions, RBAC, Exchange-oikeudet, AdminSDHolder, vähimmäisoikeudet, AD ACL, PowerShell",{"slick":325,"form":325},{"menuItems":1222},[1223,1225,1227,1229,1231],{"href":1224,"text":531},"#tldr-entä-jos-poistamme-haittapuolet",{"href":1226,"text":586},"#miksi-tämä-kiinnostaa-nyt",{"href":1228,"text":688},"#mutta-miksi-kukaan-ei-tee-sitä",{"href":1230,"text":730},"#näytä-minulle-tämä-vaihtoehto-ilman-katumusta",{"href":1232,"text":1167},"#johtopäätökset","/posts/2026-03-01-exchange-ad-split-permissions-hardening",{"title":521,"description":1194},"posts/2026-03-01-exchange-ad-split-permissions-hardening","vvskpQsCt6ZG5Gigy24l_xkIMhOVPbGHJS9KWi1IglY",{"id":1238,"extension":1239,"meta":1240,"stem":8,"__hash__":1590},"authors_data/authors.json","json",{"path":1241,"Fritz Zurhorst":1242,"Alexander Schlindwein":1248,"Sophie Luna":1254,"Nadine Klein":1262,"Karsten Kleinschmidt":1268,"Julian Wendt":1276,"Holger Bunkradt":1281,"Ralf Mania":1287,"Oliver Kieselbach":1293,"Steffen Schwerdtfeger":1299,"Gunnar Winter":1307,"Jan Petersen":1312,"Thorsten Kunzi":1317,"Moritz Pohl":1320,"Thorben Pöschus":1325,"Christoph Hannebauer":1331,"Marco Scheel":1335,"Christopher Brumm":1340,"Florian Klante":1347,"Niklas Bachmann":1352,"Nils Krautkrämer":1357,"Patrick Treptau":1363,"Peter Beckendorf":1368,"Patrick Sobau":1373,"Jörg Wunderlich":1378,"Michael Breither":1382,"Christian Kanja":1387,"Zeba Hoffmann":1393,"Jochen Fröhlich":1398,"Jan Geisbauer":1402,"Gerrit Reinke":1414,"Christian Kordel":1420,"Stephan Wälde":1424,"Carolin Kanja":1429,"Adrian Ritter":1435,"Marvin Bangert":1440,"Thorsten Pickhan":1446,"Christian Lorenz":1452,"Denis Böhm":1457,"Fabian Bader":1462,"Juan Jose Fernandez Perez":1468,"Mahschid Sayyar":1473,"Benjamin Dassow":1478,"Markus Walschburger":1483,"Jonathan Haist":1488,"Daniel Rohregger":1493,"Thomas Naunheim":1498,"Florian Stöckl":1503,"Pascal Asch":1508,"Markus Kättner":1513,"Anna Ulbricht":1520,"Annette Brauns":1527,"body":1533,"title":1589},"/authors",{"display_name":1243,"avatar":1244,"permalink":1245,"linkedin":1246,"imageOffsetTop":1247},"Fritz Zurhorst","people/people-fritz-zurhorst.png","/authors/fritz-zurhorst","friedemann-z","72%",{"display_name":1249,"avatar":1250,"permalink":1251,"twitter":1252,"linkedin":1253},"Alexander Schlindwein","people/people-alexander-rudolph.png","/authors/alexander-schlindwein","AlexanderOnIT","schlindwein-alexander",{"display_name":1255,"avatar":1256,"permalink":1257,"twitter":1258,"linkedin":1259,"imageOffsetLeft":1260,"imageOffsetTop":1261},"Sophie Luna","people/people-sophie-luna.jpg","/authors/sophie-luna","glueckkanjagab","../company/glueckkanja-gab","58%","67%",{"display_name":1263,"avatar":1264,"permalink":1265,"twitter":1266,"linkedin":1267,"imageOffsetTop":1247},"Nadine Klein","people/people-nadine-kern.png","/authors/nadine-kern","nadineausRT","nadine-kern",{"display_name":1269,"avatar":1270,"permalink":1271,"twitter":1272,"linkedin":1273,"imageOffsetTop":1274,"imageOffsetLeft":1275},"Karsten Kleinschmidt","/c_pad,w_800,h_700/people/karsten-kleinschmidt.jpg","/authors/karsten-kleinschmidt","KarstenonIT","karstenkleinschmidt","60%","57%",{"display_name":1277,"avatar":1278,"permalink":1279,"linkedin":1280},"Julian Wendt","people/people-julian-wendt.png","/authors/julian-wendt","julian-wendt",{"display_name":1282,"avatar":1283,"permalink":1284,"linkedin":1285,"twitter":1286},"Holger Bunkradt","people/people-holger-bunkradt.png","/authors/holger-bunkradt","holger-bunkradt-12b5053b","hbunkradt",{"display_name":1288,"avatar":1289,"permalink":1290,"linkedin":1291,"twitter":1292},"Ralf Mania","people/people-ralf-mania.png","/authors/ralf-mania","ralf-mania-146a2757","RaMa1976",{"display_name":1294,"avatar":1295,"permalink":1296,"linkedin":1297,"twitter":1298},"Oliver Kieselbach","people/people-oliver-kieselbach.png","/authors/oliver-kieselbach","oliver-kieselbach-a4a3409","okieselbT",{"display_name":1300,"avatar":1301,"permalink":1302,"linkedin":1303,"twitter":1304,"imageOffsetTop":1305,"imageOffsetLeft":1306},"Steffen Schwerdtfeger","people/people-steffen-schwerdtfeger.png","/authors/steffen-schwerdtfeger","steffen-schwerdtfeger","SteffenAtCloud","79%","51%",{"display_name":1308,"avatar":1309,"permalink":1310,"twitter":1258,"linkedin":1311},"Gunnar Winter","people/people-gunnar-winter.jpg","/authors/gunnar-winter","company/glueckkanja-gab",{"display_name":1313,"avatar":1314,"permalink":1315,"twitter":1258,"linkedin":1316},"Jan Petersen","people/jan-petersen.png","/authors/jan-petersen","jan-petersen-26a901",{"display_name":523,"avatar":1318,"permalink":1319,"twitter":1258,"linkedin":1311,"imageOffsetTop":1247},"people/author-thorsten-kunzi.png","/authors/thorsten-kunzi",{"display_name":1321,"avatar":1322,"permalink":1323,"twitter":1258,"linkedin":1324},"Dr. Moritz Pohl","people/people-moritz-pohl.png","/authors/moritz-pohl","dr-moritz-pohl",{"display_name":1326,"avatar":1327,"permalink":1328,"twitter":1329,"linkedin":1330},"Thorben Pöschus","people/thorben.poeschus.png","/authors/thorben-poeschus","TPO901","thorben-pöschus-624693b7",{"display_name":1332,"avatar":1333,"permalink":1334,"twitter":1258,"linkedin":1311,"imageOffsetTop":1247},"Dr. Christoph Hannebauer","people/people-christoph-hannebauer.png","/authors/christoph-hannebauer",{"display_name":1336,"avatar":1337,"permalink":1338,"twitter":1339,"linkedin":1339},"Marco Scheel","people/people-marco-scheel.png","/authors/marco-scheel","marcoscheel",{"display_name":1341,"avatar":1342,"permalink":1343,"twitter":1344,"linkedin":1345,"imageOffsetTop":1346},"Christopher Brumm","people/people-christopher-brumm.jpg","/authors/christopher-brumm","cbrhh","christopherbrumm","66%",{"display_name":1348,"avatar":1349,"permalink":1350,"linkedin":1351,"twitter":1258},"Florian Klante","people/florian-klante.jpg","/authors/florian-klante","florian-klante-6031b31b",{"display_name":1353,"avatar":1354,"permalink":1355,"linkedin":1356,"twitter":1258},"Niklas Bachmann","people/niklas.bachmann.png","/authors/niklas-bachmann","niklas-bachmann-66a863158",{"display_name":1358,"avatar":1359,"permalink":1360,"twitter":1361,"linkedin":1362},"Nils Krautkrämer","people/nils-krautkraemer.png","/authors/nils-krautkraemer","KrauNils","nils-krautkrämer-8b04bb250",{"display_name":1364,"avatar":1365,"permalink":1366,"linkedin":1367,"twitter":1258},"Patrick Treptau","people/people-patrick-treptau.png","/authors/patrick-traptau","ptreptau",{"display_name":1369,"avatar":1370,"permalink":1371,"linkedin":1372,"twitter":1258,"imageOffsetTop":1247},"Peter Beckendorf","people/peter-beckendorf.png","/authors/peter-beckendorf","peter-beckendorf-29a239b1",{"display_name":1374,"avatar":1375,"permalink":1376,"linkedin":1377,"twitter":1258},"Patrick Sobau","people/patrick-sobau.png","/authors/patrick-sobau","patrick-sobau",{"display_name":1379,"avatar":1380,"permalink":1381,"twitter":1258},"Jörg Wunderlich","people/joerg-wunderlich.png","/authors/joerg-wunderlich",{"display_name":1383,"avatar":1384,"permalink":1385,"twitter":1258,"linkedin":1386},"Michael Breither","people/people-michael-breither.jpg","/authors/michael-breither","michaelbreither",{"display_name":1388,"avatar":1389,"permalink":1390,"twitter":1391,"linkedin":1392},"Christian Kanja","people/people-christian-kanja.png","/authors/christian-kanja","cekageka","christian-kanja",{"display_name":1394,"avatar":1395,"permalink":1396,"linkedin":1397,"twitter":1258},"Zeba Hoffmann","people/zeba-hoffmann.png","/authors/zeba-hoffmann","zebahoffmann",{"display_name":1399,"avatar":1400,"permalink":1401,"twitter":1258,"linkedin":1311},"Jochen Fröhlich","people/people-jochen-froehlich.png","/authors/jochen-froehlich",{"display_name":1403,"avatar":1404,"permalink":1405,"twitter":1406,"linkedin":1406,"imageOffsetTop":1247,"socials":1407},"Jan Geisbauer","people/people-jan-geisbauer-csoc.png","/authors/jan-geisbauer","JanGeisbauer",[1408,1411],{"text":1409,"href":1410},"Blog","https://emptydc.com",{"text":1412,"href":1413},"Podcast","https://hairlessinthecloud.com",{"display_name":1415,"avatar":1416,"permalink":1417,"twitter":1418,"linkedin":1419},"Gerrit Reinke","people/gerrit-reinke.png","/authors/gerrit-reinke","GLWRe","glwr",{"display_name":1421,"avatar":1422,"permalink":1423,"twitter":1258,"linkedin":1311},"Christian Kordel","people/christian-kordel.png","/authors/christian-kordel",{"display_name":1425,"avatar":1426,"permalink":1427,"twitter":1428,"linkedin":1311},"Stephan Wälde","people/people-stephan-waelde.png","/authors/stephan-waelde","stephanwaelde",{"display_name":1430,"avatar":1431,"permalink":1432,"twitter":1433,"linkedin":1434},"Carolin Kanja","people/people-carolin-kanja.jpg","/authors/carolin-kanja","fraukanja","carolin-kanja",{"display_name":1436,"avatar":1437,"permalink":1438,"twitter":1439,"linkedin":1439},"Adrian Ritter","people/people-adrian-ritter.png","/authors/adrian-ritter","adrianritter",{"display_name":1441,"avatar":1442,"permalink":1443,"twitter":1444,"linkedin":1445},"Marvin Bangert","people/people-marvin-bangert.png","/authors/marvin-bangert","marvinbangert","marvin-bangert",{"display_name":1447,"avatar":1448,"permalink":1449,"twitter":1450,"linkedin":1451},"Thorsten Pickhan","people/people-thorsten-pickhan.png","/authors/thorsten-pickhan","tpickhan","thorsten-pickhan",{"display_name":1453,"avatar":1454,"permalink":1455,"linkedin":1456,"twitter":1258},"Christian Lorenz","people/people-christian-lorenz.png","/authors/christian-lorenz","christianlorenz95",{"display_name":1458,"avatar":1459,"permalink":1460,"linkedin":1461,"twitter":1258},"Denis Böhm","people/people-denis-boehm.png","/authors/denis-boehm","denis-böhm-3bb834135",{"display_name":1463,"avatar":1464,"permalink":1465,"linkedin":1466,"twitter":1467},"Fabian Bader","people/people-fabian-bader.jpg","/authors/fabian-bader","fabianbader","fabian_bader",{"display_name":1469,"avatar":1470,"permalink":1471,"linkedin":1472},"Juan Jose Fernandez Perez","people/people-juan-jose-fernandez.jpg","/authors/juan-jose-fernandez-perez","juan-jose-fernandez-perez-8016055",{"display_name":1474,"avatar":1475,"permalink":1476,"linkedin":1477},"Mahschid Sayyar","people/people-mahschid-sayyar.jpg","/authors/mahschid-sayyar","mahschid-sayyar-97544463",{"display_name":1479,"avatar":1480,"permalink":1481,"linkedin":1482},"Benjamin Dassow","people/people-benjamin-dassow.jpg","/authors/benjamin-dassow","benjamin-dassow",{"display_name":1484,"avatar":1485,"permalink":1486,"linkedin":1487},"Markus Walschburger","people/people-markus-walschburger.jpg","/authors/markus-walschburger","markus-walschburger",{"display_name":1489,"avatar":1490,"permalink":1491,"linkedin":1492,"imageOffsetTop":1247},"Jonathan Haist","people/people-jonathan-haist.jpg","/authors/jonathan-haist","jonathanhaist",{"display_name":1494,"avatar":1495,"permalink":1496,"linkedin":1497,"imageOffsetTop":1247},"Daniel Rohregger","people/people-daniel-rohregger.jpg","/authors/daniel-rohregger","drohregger",{"display_name":1499,"avatar":1500,"permalink":1501,"linkedin":1502,"imageOffsetTop":1346},"Thomas Naunheim","people/people-thomas-naunheim.jpg","/authors/thomas-naunheim","thomasnaunheim",{"display_name":1504,"avatar":1505,"permalink":1506,"linkedin":1507,"imageOffsetTop":1346},"Florian Stöckl","people/people-florian-stoeckl.jpg","/authors/florian-stoeckl","florianstoeckl",{"display_name":1509,"avatar":1510,"permalink":1511,"linkedin":1512,"imageOffsetTop":1346},"Pascal Asch","people/Pascal.Asch.648.jpg","/authors/pascal-asch","pascal-asch",{"display_name":1514,"avatar":1515,"permalink":1516,"linkedin":1517,"imageOffsetTop":1518,"imageOffsetLeft":1519},"Markus Kättner","people/markus-kaettner.jpg","/authors/markus-kaettner","markus-kättner-b600119","62%","63%",{"display_name":1521,"avatar":1522,"permalink":1523,"linkedin":1524,"imageOffsetTop":1525,"imageOffsetLeft":1526},"Anna Ulbricht","people/anna-katharina.ulbricht-09.png","/authors/anna-ulbricht","anna-katharina-u-a67702199","70%","50%",{"display_name":1528,"avatar":1529,"permalink":1530,"linkedin":1531,"imageOffsetTop":1532,"imageOffsetLeft":1274},"Annette Brauns","people/Annette-Brauns-8.jpg","/authors/annette-brauns","annette-brauns","95%",{"Fritz Zurhorst":1534,"Alexander Schlindwein":1535,"Sophie Luna":1536,"Nadine Klein":1537,"Karsten Kleinschmidt":1538,"Julian Wendt":1539,"Holger Bunkradt":1540,"Ralf Mania":1541,"Oliver Kieselbach":1542,"Steffen Schwerdtfeger":1543,"Gunnar Winter":1544,"Jan Petersen":1545,"Thorsten Kunzi":1546,"Moritz Pohl":1547,"Thorben Pöschus":1548,"Christoph Hannebauer":1549,"Marco Scheel":1550,"Christopher Brumm":1551,"Florian Klante":1552,"Niklas Bachmann":1553,"Nils Krautkrämer":1554,"Patrick Treptau":1555,"Peter Beckendorf":1556,"Patrick Sobau":1557,"Jörg Wunderlich":1558,"Michael Breither":1559,"Christian Kanja":1560,"Zeba Hoffmann":1561,"Jochen Fröhlich":1562,"Jan Geisbauer":1563,"Gerrit Reinke":1567,"Christian Kordel":1568,"Stephan Wälde":1569,"Carolin Kanja":1570,"Adrian Ritter":1571,"Marvin Bangert":1572,"Thorsten Pickhan":1573,"Christian Lorenz":1574,"Denis Böhm":1575,"Fabian Bader":1576,"Juan Jose Fernandez Perez":1577,"Mahschid Sayyar":1578,"Benjamin Dassow":1579,"Markus Walschburger":1580,"Jonathan Haist":1581,"Daniel Rohregger":1582,"Thomas Naunheim":1583,"Florian Stöckl":1584,"Pascal Asch":1585,"Markus Kättner":1586,"Anna Ulbricht":1587,"Annette Brauns":1588},{"display_name":1243,"avatar":1244,"permalink":1245,"linkedin":1246,"imageOffsetTop":1247},{"display_name":1249,"avatar":1250,"permalink":1251,"twitter":1252,"linkedin":1253},{"display_name":1255,"avatar":1256,"permalink":1257,"twitter":1258,"linkedin":1259,"imageOffsetLeft":1260,"imageOffsetTop":1261},{"display_name":1263,"avatar":1264,"permalink":1265,"twitter":1266,"linkedin":1267,"imageOffsetTop":1247},{"display_name":1269,"avatar":1270,"permalink":1271,"twitter":1272,"linkedin":1273,"imageOffsetTop":1274,"imageOffsetLeft":1275},{"display_name":1277,"avatar":1278,"permalink":1279,"linkedin":1280},{"display_name":1282,"avatar":1283,"permalink":1284,"linkedin":1285,"twitter":1286},{"display_name":1288,"avatar":1289,"permalink":1290,"linkedin":1291,"twitter":1292},{"display_name":1294,"avatar":1295,"permalink":1296,"linkedin":1297,"twitter":1298},{"display_name":1300,"avatar":1301,"permalink":1302,"linkedin":1303,"twitter":1304,"imageOffsetTop":1305,"imageOffsetLeft":1306},{"display_name":1308,"avatar":1309,"permalink":1310,"twitter":1258,"linkedin":1311},{"display_name":1313,"avatar":1314,"permalink":1315,"twitter":1258,"linkedin":1316},{"display_name":523,"avatar":1318,"permalink":1319,"twitter":1258,"linkedin":1311,"imageOffsetTop":1247},{"display_name":1321,"avatar":1322,"permalink":1323,"twitter":1258,"linkedin":1324},{"display_name":1326,"avatar":1327,"permalink":1328,"twitter":1329,"linkedin":1330},{"display_name":1332,"avatar":1333,"permalink":1334,"twitter":1258,"linkedin":1311,"imageOffsetTop":1247},{"display_name":1336,"avatar":1337,"permalink":1338,"twitter":1339,"linkedin":1339},{"display_name":1341,"avatar":1342,"permalink":1343,"twitter":1344,"linkedin":1345,"imageOffsetTop":1346},{"display_name":1348,"avatar":1349,"permalink":1350,"linkedin":1351,"twitter":1258},{"display_name":1353,"avatar":1354,"permalink":1355,"linkedin":1356,"twitter":1258},{"display_name":1358,"avatar":1359,"permalink":1360,"twitter":1361,"linkedin":1362},{"display_name":1364,"avatar":1365,"permalink":1366,"linkedin":1367,"twitter":1258},{"display_name":1369,"avatar":1370,"permalink":1371,"linkedin":1372,"twitter":1258,"imageOffsetTop":1247},{"display_name":1374,"avatar":1375,"permalink":1376,"linkedin":1377,"twitter":1258},{"display_name":1379,"avatar":1380,"permalink":1381,"twitter":1258},{"display_name":1383,"avatar":1384,"permalink":1385,"twitter":1258,"linkedin":1386},{"display_name":1388,"avatar":1389,"permalink":1390,"twitter":1391,"linkedin":1392},{"display_name":1394,"avatar":1395,"permalink":1396,"linkedin":1397,"twitter":1258},{"display_name":1399,"avatar":1400,"permalink":1401,"twitter":1258,"linkedin":1311},{"display_name":1403,"avatar":1404,"permalink":1405,"twitter":1406,"linkedin":1406,"imageOffsetTop":1247,"socials":1564},[1565,1566],{"text":1409,"href":1410},{"text":1412,"href":1413},{"display_name":1415,"avatar":1416,"permalink":1417,"twitter":1418,"linkedin":1419},{"display_name":1421,"avatar":1422,"permalink":1423,"twitter":1258,"linkedin":1311},{"display_name":1425,"avatar":1426,"permalink":1427,"twitter":1428,"linkedin":1311},{"display_name":1430,"avatar":1431,"permalink":1432,"twitter":1433,"linkedin":1434},{"display_name":1436,"avatar":1437,"permalink":1438,"twitter":1439,"linkedin":1439},{"display_name":1441,"avatar":1442,"permalink":1443,"twitter":1444,"linkedin":1445},{"display_name":1447,"avatar":1448,"permalink":1449,"twitter":1450,"linkedin":1451},{"display_name":1453,"avatar":1454,"permalink":1455,"linkedin":1456,"twitter":1258},{"display_name":1458,"avatar":1459,"permalink":1460,"linkedin":1461,"twitter":1258},{"display_name":1463,"avatar":1464,"permalink":1465,"linkedin":1466,"twitter":1467},{"display_name":1469,"avatar":1470,"permalink":1471,"linkedin":1472},{"display_name":1474,"avatar":1475,"permalink":1476,"linkedin":1477},{"display_name":1479,"avatar":1480,"permalink":1481,"linkedin":1482},{"display_name":1484,"avatar":1485,"permalink":1486,"linkedin":1487},{"display_name":1489,"avatar":1490,"permalink":1491,"linkedin":1492,"imageOffsetTop":1247},{"display_name":1494,"avatar":1495,"permalink":1496,"linkedin":1497,"imageOffsetTop":1247},{"display_name":1499,"avatar":1500,"permalink":1501,"linkedin":1502,"imageOffsetTop":1346},{"display_name":1504,"avatar":1505,"permalink":1506,"linkedin":1507,"imageOffsetTop":1346},{"display_name":1509,"avatar":1510,"permalink":1511,"linkedin":1512,"imageOffsetTop":1346},{"display_name":1514,"avatar":1515,"permalink":1516,"linkedin":1517,"imageOffsetTop":1518,"imageOffsetLeft":1519},{"display_name":1521,"avatar":1522,"permalink":1523,"linkedin":1524,"imageOffsetTop":1525,"imageOffsetLeft":1526},{"display_name":1528,"avatar":1529,"permalink":1530,"linkedin":1531,"imageOffsetTop":1532,"imageOffsetLeft":1274},"Authors","1csawlkJxRljy93GTOnXEkwLqAv9Lcj-apxRvoodAOY",{"list":1592,"authors":1809},[1593,1611,1625,1639,1655,1668,1681,1694,1706,1722,1736,1751,1769,1780,1793],{"id":1594,"title":1595,"author":1596,"cta":494,"description":1194,"hideInRecent":484,"layout":1210,"meta":1597,"moment":1603,"path":1604,"stem":1605,"tags":1606,"webcast":484},"content_fi/posts/2026-09-22-end-of-mfa-sms.md","MFA-tekstiviestin loppu",[1269],{"lang":1212,"date":1598,"categories":1599,"blogtitlepic":1601,"customExcerpt":1602},"2026-09-21",[1600],"Security","head-conditional-access.jpg","Miksi yritysten kannattaa nyt siirtyä phishing-kestäviin ja mahdollisimman salasanattomiin kirjautumistapoihin.","2026-09-22","/posts/2026-09-22-end-of-mfa-sms","posts/2026-09-22-end-of-mfa-sms",[1600,1607,1608,1609,1610],"Authentication","Microsoft Entra ID","MFA","Passkeys",{"id":1612,"title":1613,"author":1614,"cta":494,"description":1194,"hideInRecent":484,"layout":1210,"meta":1615,"moment":1598,"path":1619,"stem":1620,"tags":1621,"webcast":484},"content_fi/posts/2026-09-21-clickfix-prevent-detect.md","ClickFix. Kun käyttäjä on se exploit, ja miten te pysäytätte sen",[1243,1263],{"lang":1212,"date":1598,"categories":1616,"blogtitlepic":1617,"customExcerpt":1618},[1600],"head-clickfix.jpg","ClickFix tekee käyttäjästä oman hyökkääjänsä: väärennetty CAPTCHA, yksi copy-paste, ja haittakoodi ajaa muistissa ilman että mitään päätyy levylle. Miten Microsoft Defender tunnistaa hyökkäyksen, missä tunnistus tulee rajoilleen ja miten te suljette aukon RunMRU-huntilla ja neljällä suojauslayerilla.","/posts/2026-09-21-clickfix-prevent-detect","posts/2026-09-21-clickfix-prevent-detect",[1622,1623,1624],"Defender","SOC","Endpoint Security",{"id":1626,"title":1627,"author":1628,"cta":494,"description":1194,"hideInRecent":484,"layout":1210,"meta":1629,"moment":1598,"path":1633,"stem":1634,"tags":1635,"webcast":484},"content_fi/posts/2026-09-21-red-tenant-dark-tenant-cio.md","Admin ja arki samalla koneella? Game Over.",[1403],{"lang":1212,"date":1598,"categories":1630,"blogtitlepic":1631,"customExcerpt":1632},[1600],"head-game-over-en.jpg","Miksi yksi tenant ei riitä CIO:lle, ja miksi toista harvoin ajatellaan mukaan. Managed Red Tenant erottaa hallinnollisen työn arkkitehtonisesti toimistoympäristöstä, Managed Dark Tenant pitää yrityksen toimintakykyisenä silloinkin, kun puolustus kaatuu. Mitä se tarkoittaa toimintamallille, SOC-signaalille ja NISG 2026:n näyttövelvollisuuksille.","/posts/2026-09-21-red-tenant-dark-tenant-cio","posts/2026-09-21-red-tenant-dark-tenant-cio",[1600,1636,1637,1638],"Privileged Access","Zero Trust","NIS2",{"id":1640,"title":1641,"author":1642,"cta":494,"description":1643,"hideInRecent":484,"layout":1210,"meta":1644,"moment":1645,"path":1650,"stem":1651,"tags":1652,"webcast":484},"content_fi/posts/2026-08-08-isg-germany-2026.md","Neljä kertaa Leader. glueckkanja ISG-tutkimuksessa Saksa 2026",[1430],"ISG nimesi tutkimuksensa tänä vuonna uudelleen. Microsoft Cloud Ecosystemistä tuli Microsoft AI and Cloud Ecosystem, ja nimen mukana mittapuu on siirtynyt: arvioitavana ei ole enää se, kuka ottaa Microsoft-alustat käyttöön, vaan se, kuka ylläpitää Copilotia, agentteja ja tekoälyworkloadeja hallittavasti. Asemaamme uusi mittapuu ei muuttanut. ISG Provider Lens® -tutkimus Saksa 2026 asemoi meidät Leaderiksi neljässä kvadrantissa: Microsoft Productivity and Business Process Services ja Azure Managed Services, kummassakin Large Market ja Mid Market. Vuosien 2021, 2023, 2024 ja 2025 jälkeen tämä on viides Leader-luokitus Saksassa, Sveitsissä hyppy Leader-kvadranttiin tapahtui kaksi viikkoa aiemmin.",{"lang":1212,"date":1645,"categories":1646,"blogtitlepic":1648,"customExcerpt":1649},"2026-08-08",[1647],"Corporate","head-isg-de-2026.png","ISG Provider Lens® -tutkimus 2026 asemoi glueckkanjan Saksassa Leaderiksi neljässä kvadrantissa: Microsoft Productivity and Business Process Services ja Azure Managed Services, kummassakin Large ja Mid Market. Tutkimuksen nimi on nyt Microsoft AI and Cloud Ecosystem, ja mittapuu on siirtynyt: arvioidaan, kuka ylläpitää tekoäly- ja agenttiworkloadeja hallittavasti.","/posts/2026-08-08-isg-germany-2026","posts/2026-08-08-isg-germany-2026",[1653,1654],"Award","ISG",{"id":1656,"title":1657,"author":1658,"cta":494,"description":1659,"hideInRecent":484,"layout":1210,"meta":1660,"moment":1661,"path":1665,"stem":1666,"tags":1667,"webcast":484},"content_fi/posts/2026-07-31-isg-switzerland-2026.md","Rising Starista Leaderiksi. glueckkanja ISG-tutkimuksessa Sveitsi 2026",[1430],"Vuonna 2024 perustimme glueckkanja Switzerland AG:n ja otimme käyttöön toimiston zentroomissa osoitteessa Bahnhofplatz 10b Bernissä. Vuonna 2025 ISG luokitteli meidät Sveitsin markkinassa Rising Stariksi, toimittajaksi, jonka analyytikot uskovat hyppäävän Leader-kvadranttiin. Nyt hyppy on dokumentoitu: ISG Provider Lens® -tutkimus 2026 asemoi meidät Sveitsissä Leaderiksi kvadrantissa Microsoft AI and Cloud Ecosystem, alueilla Azure Managed Services ja Microsoft Productivity and Business Process Services.",{"lang":1212,"date":1661,"categories":1662,"blogtitlepic":1663,"customExcerpt":1664},"2026-07-31",[1647],"head-isg-ch-2026.png","ISG Provider Lens® -tutkimus 2026 asemoi glueckkanjan Sveitsissä Leaderiksi kvadrantissa Microsoft AI and Cloud Ecosystem, alueilla Azure Managed Services ja Microsoft Productivity and Business Process Services. Kaksi vuotta Bernin markkinoilletulon jälkeen, vuosi Rising Star -tunnustuksen jälkeen.","/posts/2026-07-31-isg-switzerland-2026","posts/2026-07-31-isg-switzerland-2026",[1653,1654],{"id":1669,"title":1670,"author":1671,"cta":494,"description":1194,"hideInRecent":484,"layout":1210,"meta":1672,"moment":1673,"path":1677,"stem":1678,"tags":1679,"webcast":484},"content_fi/posts/2026-07-24-outbreak-openai-hugging-face.md","Outbreak. Mitä OpenAI/Hugging-Face-tapaus paljastaa ja mitä ei",[1403],{"lang":1212,"date":1673,"categories":1674,"blogtitlepic":1675,"customExcerpt":1676},"2026-07-24",[1600],"head-outbreak.jpg","AI-agentti murtautuu ulos testiympäristöstään, löytää nollapäivähaavoittuvuuden ja hakkeroi toisen yrityksen. Kuulostaa käsikirjoitukselta, mutta tapahtui todella heinäkuussa 2026. Aika asettaa asia raittiiseen kehykseen: hieman psykologiaa, kaksi tietoturvaveteraania ja kysymys siitä, mitä tämä merkitsee teidän puolustuksellenne.","/posts/2026-07-24-outbreak-openai-hugging-face","posts/2026-07-24-outbreak-openai-hugging-face",[1680,1623,1637],"AI",{"id":1682,"title":1683,"author":1684,"cta":494,"description":1685,"hideInRecent":484,"layout":1210,"meta":1686,"moment":1687,"path":1691,"stem":1692,"tags":1693,"webcast":484},"content_fi/posts/2026-07-22-isg-cybersecurity-2026.md","Leader ja Rising Star. glueckkanja ISG:n Cybersecurity-tutkimuksessa 2026",[1430],"Uutena kvadrantissa ja heti Leader: ISG Provider Lens® -tutkimus \"Cybersecurity – Services and Solutions 2026\" asemoi glueckkanjan Leaderiksi Next-Gen SOC/MDR Services -alueella Saksan keskisuurten yritysten markkinassa. Next-Gen SOC/MDR Services -kokonaismarkkinassa ISG palkitsee meidät Rising Starina, eli toimittajana, jonka analyytikot uskovat hyppäävän Leader-kvadranttiin seuraavien 12–24 kuukauden aikana.",{"lang":1212,"date":1687,"categories":1688,"blogtitlepic":1689,"customExcerpt":1690},"2026-07-22",[1647],"head-isg-cybersecurity-2026.png","ISG Provider Lens® -tutkimus Cybersecurity 2026 palkitsee glueckkanjan Leaderina kvadrantissa Next-Gen SOC/MDR Services (Midmarket). Next-Gen SOC/MDR Services -kokonaismarkkinassa olemme Rising Star. ISG toteaa meille keskimääräistä paremman kasvun, syvän Microsoft-tietoturvaosaamisen ja 24/7-SOC:n Saksasta.","/posts/2026-07-22-isg-cybersecurity-2026","posts/2026-07-22-isg-cybersecurity-2026",[1653,1654,1600],{"id":1695,"title":1696,"author":1697,"cta":494,"description":1698,"hideInRecent":484,"layout":1210,"meta":1699,"moment":1700,"path":1703,"stem":1704,"tags":1705,"webcast":484},"content_fi/posts/2026-07-06-the-holy-trinity.md","The Holy Trinity: mitä tekoäly todella tarvitsee tehdäkseen työtä",[1430],"Valmistava yritys haluaa tietää, mitkä sen 14 000 SKU:sta ovat todella kannattavia. Vastaus on kolmessa järjestelmässä, jotka eivät ole koskaan vaihtaneet keskenään yhtäkään datapistettä. Vielä vähän aikaa sitten sen selvittäminen vaati kolme osastoa, kaksi viikkoa ja aimo annoksen hyvää tahtoa. Vuoden 2026 alusta tekoäly pystyy vastaamaan tähän kysymykseen minuuteissa: käymään datan läpi, luomaan yhteyksiä, tuottamaan suosituksen. Edellyttäen, että sillä on pääsy.",{"lang":1212,"date":1700,"categories":1701,"blogtitlepic":1702},"2026-07-06",[131],"head-the-holy-trinity","/posts/2026-07-06-the-holy-trinity","posts/2026-07-06-the-holy-trinity",[1680,131],{"id":1707,"title":1708,"author":1709,"cta":494,"description":1710,"hideInRecent":484,"layout":1210,"meta":1711,"moment":1712,"path":1716,"stem":1717,"tags":1718,"webcast":484},"content_fi/posts/2026-07-01-onboarding-process.md","Sopimus allekirjoitettu: näin perehdytyksesi meillä etenee",[1521],"Miten teidän perehdytyksenne oikeastaan etenee? Kysymys, joka tulee vastaan yhä uudelleen keskusteluissa hakijoiden kanssa, sillä moni on jo kerran kokenut takkuisen perehdytyksen. Sitäkin tärkeämpää meille on antaa sinulle hyvä tunne alusta alkaen.",{"lang":1212,"date":1712,"categories":1713,"blogtitlepic":1714,"customExcerpt":1715},"2026-07-01",[1647],"Onboarding_Blogheader","Sopimus on allekirjoitettu, ensimmäinen suuri askel on otettu. Mutta miten tästä eteenpäin? Otamme sinut mukaan kulissien taakse perehdytykseemme, PreBoardingista ensimmäiseen viikkoon tiimissä.","/posts/2026-07-01-onboarding-process","posts/2026-07-01-onboarding-process",[1719,1720,1721],"Employer Branding","Onboarding","Unternehmenskultur",{"id":1723,"title":1724,"author":1725,"cta":494,"description":1726,"hideInRecent":484,"layout":1210,"meta":1727,"moment":1728,"path":1732,"stem":1733,"tags":1734,"webcast":484},"content_fi/posts/2026-06-26-frontier-partner.md","Microsoft Frontier Partner: kuulumme joukkoon",[1430],"Microsoftin kumppaniekosysteemissä on koko joukko tunnustuksia, ja silti Frontier Partner -merkki erottuu rakenteeltaan muista palkinnoista. Sitä ei voi hakea, vaan Microsoft myöntää sen omasta aloitteestaan pienelle joukolle kumppaneita, joiden on vakuutettava useammalla osa-alueella rinnakkain sen sijaan, että loistaisivat vain yhdellä. Microsoft arvioi tässä osoitettua osaamista Cloud & AI Platforms-, AI Business Solutions- ja Security-alueilla yhtä lailla ja puhuttelee näin yrityksiä, jotka eivät ymmärrä tekoälyä olemassa olevan IT:n päälle liimattuna lisänä vaan yhtenäisen arkkitehtuurin tuloksena, joka kantaa identiteetistä päätelaitteen kautta tuotannolliseen tekoälykäyttöön asti.",{"lang":1212,"date":1728,"categories":1729,"blogtitlepic":1730,"customExcerpt":1731},"2026-06-26",[1647],"head-frontier-partner-badge.jpg","Microsoft AI Cloud Partner Program -ohjelmaan on hiljattain tullut uusi huipputunnustus, Frontier Partner -merkki. Microsoft myöntää sen ainoastaan pienelle joukolle kumppaneita maailmanlaajuisesti, jotka toimittavat tekoälyprojekteja kestävästi koko Microsoft-stackin läpi, työpaikasta pilvialustaan ja tietoturvaan sekä itse tekoälysovellukseen asti, ja jotka ovat osoittaneet tämän käytännössä. DACH-alueella tähän joukkoon kuuluu vain kourallinen yrityksiä, ja me olemme yksi niistä.","/posts/2026-06-26-frontier-partner","posts/2026-06-26-frontier-partner",[1653,1735,1680],"Microsoft Partner",{"id":1737,"title":1738,"author":1739,"cta":494,"description":1740,"hideInRecent":484,"layout":1210,"meta":1741,"moment":1742,"path":1746,"stem":1747,"tags":1748,"webcast":484},"content_fi/posts/2026-06-09-vair-run.md","160 kilometriä hyvän asian puolesta",[1528],"Sunnuntaiaamu, klo 8:30, Holbeinsteg Main-joen varrella. Yksitoista kollegaa yhtenäisissä NinjaCat-paidoissa, valmiina Frankfurter Runden -tapahtumaan. Sateen, salamoiden ja ukkosen kera. Hyvän asian puolesta juokseminen oli riittävä motivaatio nyöritä juoksukengät huonosta säästä huolimatta.",{"lang":1212,"date":1742,"categories":1743,"blogtitlepic":1744,"customExcerpt":1745},"2026-06-08",[1647],"frankfurter-runden.png","Yksitoista kollegaa, 16 kierrosta, 160 kilometriä, ukkosmyrsky ja palkintopallisija: glueckkanja osallistui Frankfurter Runden 2026 -tapahtumaan ja lahjoitti jokaisesta juostusta kierroksesta VAIR e.V.:lle, joka rakentaa Offenbachiin inklusiivista liikunta- ja kulttuuripuistoa.","/posts/2026-06-09-vair-run","posts/2026-06-09-vair-run",[1749,1719,1750],"Top Arbeitgeber","Soziales Engagement",{"id":1752,"title":1753,"author":1754,"cta":494,"description":1755,"hideInRecent":484,"layout":1210,"meta":1756,"moment":1757,"path":1761,"stem":1762,"tags":1763,"webcast":484},"content_fi/posts/2026-04-10-incident-to-intelligence.md","Tuntemattoman AMOS Stealerin anatomia: alertista immuniteettiin tunneissa",[1509],"Kun SOC:ssamme laukeaa alert, kello alkaa käydä: ei vain kyseiselle asiakkaalle vaan kaikille organisaatioille suojamme alla. Vaarallisin hetki nykyaikaisessa uhkaympäristössä on Intelligence Gap, se aikaikkuna uuden haittaohjelmavariantin ensimmäisen käytön ja sen päivän välillä, jona ala saa siitä tiedon.",{"lang":1212,"date":1757,"categories":1758,"blogtitlepic":1759,"customExcerpt":1760},"2026-04-10",[1600],"head-amos-stealer.png","Tähän asti dokumentoimaton AMOS-stealerin variantti kompromentoi macOS-endpointin. Ei tunnettuja hasheja, ei C2-tietoja julkisissa tietokannoissa. SOC:mme purki kuusi obfuskointikerrosta, poimi kaikki indikaattorit ja jakoi suojauksen kaikille SOC-asiakkaille tunneissa, jo ennen kuin ala oli edes nähnyt samplea.","/posts/2026-04-10-incident-to-intelligence","posts/2026-04-10-incident-to-intelligence",[1764,1765,1766,1767,1768],"Threat Intelligence","Incident Response","macOS Security","Malware Analysis","Cyber Security Operations Center",{"id":1770,"title":1771,"author":1772,"cta":494,"description":1773,"hideInRecent":484,"layout":1210,"meta":1774,"moment":1775,"path":1778,"stem":1779,"tags":494,"webcast":484},"content_fi/posts/2026-03-21-microsoft-edge-corporate-browser.md","Miksi Edgen pitäisi olla ainoa Corporate Browserinne",[1300],"Selaimen valinta on yritysympäristöissä strateginen päätös: se vaikuttaa suoraan siihen, kuinka paljon turvallisuutta ja hallintatyötä teillä todellisuudessa on. Google Chrome oli pitkään ilmeinen valinta, mutta Microsoft Edge on kehittynyt selaimeksi, joka kytkeytyy suoraan olemassa olevaan stackiin, etenkin kun Microsoft 365 on käytössä ja hallinta hoidetaan Intunen kautta.",{"lang":1212,"date":1775,"blogtitlepic":1776,"customExcerpt":1777},"2026-03-21","head-microsoft-edge-default-browser.jpg","Mikään yritys ei ole oikeasti valinnut Chromea; se oli vain siellä, omalla synkronointilogiikallaan, omalla tilinhallinnallaan, omalla käytäntöjen käyttöliittymällään. Microsoft Edge sen sijaan kytkeytyy suoraan infrastruktuuriin, joka on jo muutenkin käytössä: Entra ID, Intune, Defender. Tämä artikkeli näyttää, miltä vaihto näyttää, miten Chrome uudelleenohjataan Intune-käytännöllä laskeutumissivulle ja mikä jää pois, kun lakkaa käyttämästä kahta selainta rinnakkain.","/posts/2026-03-21-microsoft-edge-corporate-browser","posts/2026-03-21-microsoft-edge-corporate-browser",{"id":1781,"title":1782,"author":1783,"cta":494,"description":1784,"hideInRecent":484,"layout":1210,"meta":1785,"moment":1786,"path":1790,"stem":1791,"tags":1792,"webcast":484},"content_fi/posts/2026-03-20-stryker-attack-intune-privilege.md","Yksi admin-tili oli kaikki, mitä siihen tarvittiin.",[1403],"Keskiviikko 11. maaliskuuta 2026. Stryker-toimistojen työntekijät 79 maassa käynnistivät tietokoneensa ja löysivät ne tyhjinä. Kirjautumisnäytöt korvattuina logolla. Yrityksen kannettavat, työpuhelimet, yksityiset laitteet, jotka oli rekisteröity yrityksen BYOD-ohjelmaan – kaikki pyyhitty yhtä aikaa, yhden yön aikana. Ei kiristysohjelmaa, ei haittaohjelmasignatuureja, ei mitään, minkä päätelaitteiden suojaustyökalu olisi voinut havaita.",{"lang":1212,"date":1786,"categories":1787,"blogtitlepic":1788,"customExcerpt":1789},"2026-03-20",[1600],"head-stryker.jpg","11. maaliskuuta 2026 Handala pyyhki laitteita 79 maassa, ja siihen tarvittiin vain yksi kaapattu Intunen admin-tili. Ei haittaohjelmia, ei exploittia, pelkkiä laillisia hallintatyökaluja käännettynä niiden omistajia vastaan. Mitä tapahtui, miksi se toimi ja mitkä kaksi arkkitehtuurin aukkoa on suljettava.","/posts/2026-03-20-stryker-attack-intune-privilege","posts/2026-03-20-stryker-attack-intune-privilege",[71,1636,1637],{"id":1794,"title":1795,"author":1796,"cta":494,"description":1797,"hideInRecent":484,"layout":1210,"meta":1798,"moment":1799,"path":1803,"stem":1804,"tags":1805,"webcast":484},"content_fi/posts/2026-03-16-ai-agent-hackathon.md","Kuusi agenttia. Neljä viikkoa. Aitoa tuotantokäyttöä.",[1430],"Kuinka monta tuntia viikossa IT-osastonne käyttää tehtäviin, jotka agentti hoitaisi minuuteissa?",{"lang":1212,"date":1799,"categories":1800,"blogtitlepic":1801,"customExcerpt":1802},"2026-03-16",[1647],"head-ai-agent-hackathon.jpg","Kuusi yritystä, neljän viikon rakennusvaihe, kuusi toimivaa AI-agenttia – siitä oli kyse ensimmäisessä glueckkanja AI Agent Hackathonissa. Kiekert, Dr. Oetker, Eckes-Granini, igefa ja lila logistik rakensivat Copilot Studiossa agentteja, jotka ovat tänään tuotannossa. Mitä siinä syntyi ja miten formaatti toimii.","/posts/2026-03-16-ai-agent-hackathon","posts/2026-03-16-ai-agent-hackathon",[1680,1806,1807,1808],"Copilot Studio","Hackathon","AI Agents",{"Karsten Kleinschmidt":1810,"Fritz Zurhorst":1811,"Nadine Klein":1812,"Jan Geisbauer":1813,"Carolin Kanja":1817,"Anna Ulbricht":1818,"Annette Brauns":1819,"Pascal Asch":1820,"Steffen Schwerdtfeger":1821},{"display_name":1269,"avatar":1270,"permalink":1271,"twitter":1272,"linkedin":1273,"imageOffsetTop":1274,"imageOffsetLeft":1275},{"display_name":1243,"avatar":1244,"permalink":1245,"linkedin":1246,"imageOffsetTop":1247},{"display_name":1263,"avatar":1264,"permalink":1265,"twitter":1266,"linkedin":1267,"imageOffsetTop":1247},{"display_name":1403,"avatar":1404,"permalink":1405,"twitter":1406,"linkedin":1406,"imageOffsetTop":1247,"socials":1814},[1815,1816],{"text":1409,"href":1410},{"text":1412,"href":1413},{"display_name":1430,"avatar":1431,"permalink":1432,"twitter":1433,"linkedin":1434},{"display_name":1521,"avatar":1522,"permalink":1523,"linkedin":1524,"imageOffsetTop":1525,"imageOffsetLeft":1526},{"display_name":1528,"avatar":1529,"permalink":1530,"linkedin":1531,"imageOffsetTop":1532,"imageOffsetLeft":1274},{"display_name":1509,"avatar":1510,"permalink":1511,"linkedin":1512,"imageOffsetTop":1346},{"display_name":1300,"avatar":1301,"permalink":1302,"linkedin":1303,"twitter":1304,"imageOffsetTop":1305,"imageOffsetLeft":1306},{"id":1238,"extension":1239,"meta":1823,"stem":8,"__hash__":1590},{"Thorsten Kunzi":1824},{"display_name":523,"avatar":1318,"permalink":1319,"twitter":1258,"linkedin":1311,"imageOffsetTop":1247},1791383928225]