GTconsult - Blog , Uncategorized

The Secure Score Improvement Trap (And How to Avoid It)

Thu, 05 Feb 2026 20:45:54 +0000

You know your Secure Score should be higher. You've read about configuration drift eating away at your security posture. You understand that lack of capacity is keeping your score stuck.

This is the trap most IT teams fall into: they start implementing recommendations in order of points or ease, without understanding which changes actually matter for their specific risk profile—or how to sustain improvements once they're made.

The result? Wasted effort on low-impact changes, broken workflows from poorly planned implementations, and scores that plateau or even decline despite your best efforts.

Why Most Secure Score Improvement Efforts Fail

The typical approach looks something like this: open the Microsoft Defender portal, see a list of recommendations, pick the ones worth the most points or that seem easiest, and start implementing.

Three months later, your score has barely moved. Or it moved briefly and then dropped back down. Or you've spent weeks on improvements that broke critical workflows and had to be rolled back.

The problem isn't lack of effort. It's lack of strategy.

Effective Secure Score improvement requires understanding three things most teams skip:

Which improvements actually address your organization's risk profile

A 10-point recommendation that protects against threats you don't face is wasted effort. Meanwhile, a 3-point recommendation that closes a critical gap specific to your industry might be essential. Points don't equal priority.

The sequence and dependencies between changes

Some security improvements need to happen in specific order. Others interact in ways that can break functionality if you don't understand the technical relationships. Implementing changes in the wrong sequence wastes time on rework and troubleshooting.

How to build monitoring and maintenance into your workflows

Configuration drift is inevitable. The question isn't whether your settings will drift from their intended state—it's whether you'll catch it when they do. Without systematic monitoring, improvements degrade over time and your score reflects it.

The Hidden Complexity of "Simple" Recommendations

Let's take what seems like a straightforward recommendation: enable MFA for all users.

Sounds simple, right? But actually implementing it requires understanding:

Which users already have MFA and which don't
Whether you have Conditional Access policies that conflict
Which applications might break with MFA enforcement
How to handle service accounts and automated processes
What exceptions might be legitimately needed
How to communicate changes to users effectively

Get any of these wrong and you'll spend more time fixing problems than you saved by implementing the recommendation.

This pattern repeats across every recommendation in your Secure Score. What looks like a configuration change on the surface requires strategic thinking about business impact, technical dependencies, and change management.

Why Quick Wins Aren't Always Quick

IT teams often start with "quick wins"—recommendations that promise high point values with supposedly minimal effort.

The problem is that "quick" depends entirely on your environment's current state and complexity. Blocking legacy authentication might take 15 minutes in one organization and require weeks of application modernization in another.

More importantly, chasing points without understanding impact leads to a dangerous pattern: implementing changes that raise your score but don't actually improve your security posture in meaningful ways for your specific risk profile.

The organizations that successfully improve their Secure Score don't focus on quick wins first. They focus on right wins—improvements that align with their actual threat landscape and business priorities, regardless of point value.

The Sustainability Problem

Here's what happens in most organizations: someone dedicates focused time to Secure Score improvements. Over a few weeks or months, the score increases. Victory!

Six months later, the score has drifted back down. Temporary exceptions became permanent. New users onboarded without inheriting security policies. Applications deployed without security review.

The improvements weren't sustained because they weren't integrated into operational processes. Security became a project with an end date, not an ongoing practice.

Sustainable Secure Score improvement requires building security into your regular workflows:

User onboarding processes that automatically apply security policies
Regular reviews of exceptions and elevated access
Monitoring that flags when configurations drift from baseline
Documentation that survives staff turnover

Without these processes, you're constantly fighting to maintain improvements instead of compounding them over time.

What Actually Works

Organizations that successfully improve and maintain their Secure Score approach it systematically:

They understand their current state before implementing anything. Where are the critical gaps? Which recommendations address real risks versus checking compliance boxes? What's the business impact of each change?

They prioritize strategically, not by points. High-impact security improvements for their specific environment come first, even if they're worth fewer points than easier changes.

They test before deploying widely. Pilot changes with a small group. Identify and address issues. Then expand systematically with proper change management.

They build monitoring into operations. Regular review processes catch drift before it becomes significant. Documentation ensures knowledge doesn't live in one person's head.

They know when to get help. Some improvements require specialized expertise most internal teams don't have time to develop. Recognizing this early prevents wasted effort on approaches that won't work.

The Path Forward Depends on Your Situation

Some organizations can improve their Secure Score significantly with internal resources—if they have the right strategic approach and dedicate consistent effort over time.

Others reach a plateau where further improvement requires either:

Specialized Microsoft 365 security expertise their team hasn't developed
Time investment their team genuinely doesn't have capacity for
Licensing and tools their current budget doesn't include

Neither scenario is wrong. The question is whether you're willing to accept your current risk level or invest in further improvement.

But regardless of which path you choose, attempting Secure Score improvement without a systematic approach leads to wasted effort, broken workflows, and minimal sustained progress.

See the Strategic Approach In Action

Understanding why most Secure Score improvement efforts fail is one thing. Knowing how to avoid those pitfalls and implement changes that actually stick is another.

Join our security analyst, Kyle Farr, on 10th of February 2026 for a live demonstration of strategic Secure Score improvement:

Current state analysis - How to assess your score breakdown and identify what actually matters for your risk profile (not just point values)
Prioritization framework - The decision criteria for determining which recommendations to tackle first based on business impact and technical dependencies
Live implementation walkthrough - Watch a real security control get configured with proper testing and rollback planning
Monitoring and sustainability - Building the processes that catch drift before it degrades your security posture
Q&A for your specific challenges - Get answers about your environment's blockers and constraints

This isn't theory or generic advice. It's a practical demonstration of the systematic approach that separates successful Secure Score improvement from wasted effort.

📅 February 10, 2026 | 4:00 PM - 5:00 PM SAST

If you've been stuck between understanding your security gaps and actually addressing them effectively, this is the bridge you need.

“Blocked by Policy”: The Day Defender Turned on Me

Mon, 15 Sep 2025 11:18:22 +0000

(And the SHA256 Hash That Did It)

You ever have one of those days where your emails vanish like a magician’s assistant, no bounce-back, no error, just poof into Defender’s shadow realm?

Yeah. That was me last week.

Internal users were sharing files via SharePoint, or receiving Planner tasks, or even just sending standard Outlook attachments — and bam, straight into quarantine. These were clean emails. Trusted senders. Internal communication. Not a hint of malware. Yet Microsoft Defender decided they were guilty until proven... SHA256.

Let’s unpack this.

The Mystery: When Even Internal Emails Get Slammed by Defender

Everything looked legit:

SPF, DKIM, DMARC all green
TNEF disabled to avoid winmail.dat issues
Mail flow rules in place with SCL -1
Users added to the Tenant Allow List
SharePoint-generated messages?

Still, these emails were being quarantined with the dreaded reason:

"Blocked by organization policy: Tenant Allow/Block List attachment blocked"

Naturally, I went full gorilla mode.

The Red Herrings: TNEF, Preset Policies, and Mail Flow Rules

I did what any email admin would do. I:

Global TNEF Disablement

Disabled TNEF globally

Verification of Preset Anti-Malware Policies

Checked preset anti-malware policies (Standard Preset, of course, because Microsoft likes keeping you safe and helpless)

Mail Flow Rule Configuration

Created mail flow rules to set SCL to -1

Allow List Updates (Senders & Domains)

Added senders and domains to the Allow list

Nothing.

Still quarantined. Still Defender screaming “BLOCKED!” like a bouncer at a VIP-only nightclub.

The Twist: A “Files” Entry in the Tenant Allow/Block List

Then I looked somewhere I hadn’t checked in a while:

Microsoft 365 Defender > Policies & Rules > Tenant Allow/Block List > Files

And there it was:

A blocked file hash. A SHA256 fingerprint sitting there silently ruining lives.

The hash matched a file that users were sharing via SharePoint. Meaning: any email containing that specific file — even internal — was nuked.

No error. No alert. Just gone.

This is the Defender equivalent of:

"I didn’t block your email. I blocked your vibe. And that file’s vibe was off."

The Fix: Yank the Hash, Free the Mail

Once I removed the blocked file from the Files tab of the Tenant Allow/Block List, the floodgates opened.

No more quarantines. No more silent blocks. Emails with that file attached were finally allowed through- because, turns out, SHA-based blocks override everything.

They’re like the final boss of Defender policies.

Lessons Learned (So You Don’t Suffer Like I Did)

Allow/Block List

Always check the Files tab in the Allow/Block List — not just Senders and Domains.

File Hash Blocking

Defender does not care if a file is internal or externally shared — if its hash is blocked, it's toast.

Preset Policy Limitations

Preset security policies are powerful, but they don’t honor Allow entries for internal senders with blocked file hashes.

Sender Identity vs. Trust

Just because the sender is "you" doesn't mean Defender trusts you — especially when SharePoint wraps your message in a system-generated hug and sends it with a blocked attachment.

Final Thoughts

Microsoft Defender does a lot of good things. But when it goes rogue, it’s like having a very enthusiastic security guard who tackles your CEO because they wore a red tie on a Tuesday.

If you’ve tried everything — rules, allow lists, even human sacrifice — and emails are still being quarantined… check the File hash block list. It may just save your sanity.

And if not? You can always go full MintyGorilla.

Barend Olivier is the Support Manager at GTconsult, managing a team that keeps Microsoft 365, SharePoint, and cloud environments secure and running smoothly. He started his career in telecommunications, explored the SOC space, and found his home in the Microsoft world. Growing up surrounded by computers and non stop gaming, he developed a love for building and fixing them and today, he continues to believe that technology is one of the best tools we have for making life more manageable in an ever-changing world.

The AI Revolution is Here: How GTconsult is Leading the Charge (Not Following the Hype)

Thu, 28 Aug 2025 06:02:25 +0000

By Bradley Geldenhuys, CEO, GTconsult

After decades in the tech industry- from scaring customers into filling up at my mom’s petrol station to navigating cruise ship bars, and eventually building GTconsult into a trusted Microsoft Gold Partner- I’ve witnessed countless “revolutionary” technologies come and go. But let me be crystal clear: the AI revolution happening right now is different. This isn’t a bubble. This is the biggest opportunity to leverage technology I’ve ever seen.

While others debate whether AI is overhyped, we’re putting our money where our mouth is. GTconsult is implementing three major AI transformations that will fundamentally change how we operate- and we’re going to show you exactly how we’re doing it.

Why This AI Wave is Different

I’ve been in tech long enough to spot the difference between genuine innovation and Silicon Valley smoke and mirrors. What makes AI different is its immediate, practical impact on everyday business operations. We’re not talking about flying cars or sci-fi fantasies- we’re talking about technology that can evaluate support tickets, generate proposals, and manage projects today.

The key? We’re not chasing shiny new tools. We’re leveraging our existing Microsoft 365 ecosystem- the same platforms our clients already use- to deliver transformational results.

Our Three AI Implementations: Real Solutions, Real ROI

1. AI-Powered Helpdesk: Keeping Support Lean and Responsive

Our first AI implementation targets our support operations. Instead of hiring more first-line support staff to meet growing demand, we’re deploying AI to evaluate, research, and respond to tickets—or intelligently escalate them when human expertise is needed.

The Goal: Maintain our client SLAs without expanding headcount, while actually improving response quality and speed.

The Platform: Built entirely within our existing Office 365 environment and integrated support tools.

We’ll be documenting every step of this implementation, from initial setup to performance metrics, showing you exactly how a mid-sized consultancy can achieve enterprise-level support efficiency.

2. Presales Automation: From Weeks to Minutes

Here’s where things get exciting. GTconsult creates hundreds of proposals, work breakdown structures, technical specifications, and functional requirements every year. We have a detailed process refined over years and a treasure trove of successful project documentation.

The Transformation: We’re training AI on our entire knowledge base to automate proposal generation based on client pain points and requirements.

The Promise: Quote in the room, not weeks later.

This isn’t about replacing our expertise—it’s about amplifying it. Our team will spend less time on administrative tasks and more time where they add real value: building client relationships and solving complex business problems.

3. Project Management That Actually Manages Itself

Our third AI implementation focuses on project delivery—providing daily updates, sending automated client insights, scheduling meetings, and ensuring we hit milestones on time and on budget.

The Vision: Proactive project management that anticipates issues before they become problems and keeps clients informed without overwhelming our project managers.

The Platform: Again, built within Office 365 and our existing project management tools.

The Bottom Line: More Output, Same Salary Bill, Better Results

This isn’t about cutting jobs—it’s about strategic growth. We’re increasing our delivery capacity while maintaining our current salary structure, improving service quality, and positioning ourselves to scale rapidly in a competitive market.

Most importantly, we’re proving that AI implementation doesn’t require massive budget overhauls or risky technology bets. The tools are already in your Office 365 environment. The question is whether you’ll use them strategically or watch competitors pull ahead.

Coming With Us on the Journey

Over the coming weeks and months, we’ll be sharing every detail of our AI implementation journey—the successes, the failures, the unexpected challenges, and the breakthrough moments. You’ll see our actual performance metrics, implementation guides, and honest assessments of what works and what doesn’t.
This isn’t marketing content. This is real documentation of a real business transformation, shared in real-time.
Ready to follow along?

Connect with me on LinkedIn for daily updates, behind-the-scenes insights, and practical AI implementation advice you can use in your own business.

And if you’re in the UK, you might catch me sharing some of those petrol station and cruise ship stories at our Collabdays events—because the best technology discussions always happen over good conversation.

The AI revolution is here. The question isn’t whether you’ll participate—it’s whether you’ll lead or follow.

About GTconsult

We enable secure productivity, helping businesses worldwide leverage Office 365, SharePoint, and Teams to transform their operations. With offices in South Africa and the UK, we’re a Microsoft Gold Partner specializing in turning technology potential into business results.

Critical SharePoint Zero-Day Under Mass Exploitation: The ToolShell Campaign and Why Expert Monitoring Saves Organizations

Mon, 21 Jul 2025 10:34:42 +0000

A sophisticated zero-day exploit chain targeting Microsoft SharePoint servers has exploded into a global cybersecurity crisis. Eye Security's research team identified active, large-scale exploitation beginning on July 18, 2025, around 18:00 CET, with attackers compromising dozens of SharePoint servers worldwide within hours SharePoint Under Siege: ToolShell Mass Exploitation. This isn't opportunistic malware—it's surgical exploitation that demonstrates why organizations need dedicated cybersecurity expertise.

The ToolShell Exploit: From Proof-of-Concept to Global Weapon

The attack chain, dubbed "ToolShell," weaponizes a combination of CVE-2025-49706 and CVE-2025-49704, originally demonstrated at Pwn2Own Berlin 2025 SharePoint Under Siege: ToolShell Mass Exploitation. What makes this particularly alarming is the speed of weaponization—from academic proof-of-concept to active global exploitation in just 72 hours SharePoint Under Siege: ToolShell Mass Exploitation.

The sophistication of this attack cannot be overstated. Rather than deploying typical web shells, attackers are using stealthy .aspx files designed specifically to extract cryptographic secrets from SharePoint servers, including ValidationKey and DecryptionKey configurations SharePoint Under Siege: ToolShell Mass Exploitation. These stolen keys effectively turn any authenticated SharePoint request into a remote code execution opportunity.

Technical Deep Dive: How the Attack Works

The exploit targets the /_layouts/15/ToolPane.aspx endpoint, allowing attackers to write files to the server without any authentication SharePoint Under Siege: ToolShell Mass Exploitation. The malicious payload extracts the SharePoint server's MachineKey configuration through internal .NET methods, providing attackers with the cryptographic material needed to craft valid __VIEWSTATE payloads.

This mirrors the design weakness from CVE-2021-28474, but now packaged into a modern zero-day chain with automatic shell deployment, full persistence, and zero authentication requirements SharePoint Under Siege: ToolShell Mass Exploitation. The attack essentially turns SharePoint's trust in its own configuration into a weapon.

Global Scale of Compromise

Recent Shodan search data reveals the massive scope of potential targets. With 4,548 total results globally, the geographic distribution shows concerning exposure levels:

Top Countries by Exposure:

•United States: 3,903 exposed SharePoint instances

•United Kingdom: 566 exposed instances

•South Africa: 78 exposed instances

These numbers represent just the publicly discoverable SharePoint servers—the actual attack surface is likely much larger when considering internal systems and those behind additional security layers

Active Exploitation Indicators

Eye Security has identified specific indicators of compromise from the active campaign SharePoint Under Siege: ToolShell Mass Exploitation:

Attack Sources:

First wave: 107.191.58.76 (US-based, July 18 around 18:06 CET)

Second wave: 104.238.159.149 (US-based, July 19 around 07:28 CET)

User Agent String:

Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0

Exploit Path:

/_layouts/15/ToolPane.aspx?DisplayMode=Edit&a=/ToolPane.aspx

GTconsult's Global Response Capability

At GTconsult, our international presence across the UK, USA, and South Africa positions us uniquely to respond to global threats like the ToolShell campaign. Our distributed support teams provide:

24/7 Global Monitoring:

With operations spanning multiple time zones, our security specialists maintain continuous surveillance across all major geographic regions where SharePoint exposure is highest.

Regional Threat Intelligence:

Our teams in London, US operations centers, and South African facilities collaborate to track regional attack patterns and share intelligence about emerging threats.

Rapid Response Coordination:

When zero-day exploits like ToolShell emerge, our global infrastructure enables immediate protective measures across client environments, regardless of geographic location.

Local Compliance Expertise:

Each region brings specialized knowledge of local regulatory requirements and industry standards, ensuring comprehensive protection that meets regional security mandates.

Why This Attack Succeeded—And How We Prevent It

Eye Security's initial detection came through CrowdStrike Falcon EDR deployment, which flagged suspicious process chains on a legacy SharePoint server SharePoint Under Siege: ToolShell Mass Exploitation.

This highlights several critical factors:

Speed of Exploitation: The attack was designed to evade detection and gain long-term access, with exploitation occurring within 72 hours of the public demonstration SharePoint Under Siege: ToolShell Mass Exploitation.

Sophistication of Payload: Unlike typical web shells, the malicious .aspx files were specifically designed to extract cryptographic secrets rather than provide interactive command execution SharePoint Under Siege: ToolShell Mass Exploitation, making detection more challenging.

Scale of Campaign: Eye Security scanned over 1,000 public-facing SharePoint environments and confirmed dozens of compromised servers using the exact same payload SharePoint Under Siege: ToolShell Mass Exploitation.

GTconsult's Proactive Defense Strategy

Our approach to threats like ToolShell demonstrates why reactive security fails in today's threat landscape:

Predictive Threat Modeling:

We maintain comprehensive asset inventories and vulnerability assessments, enabling rapid identification of systems at risk when new exploits emerge.

Advanced EDR Integration:

Like the Eye Security detection that uncovered this campaign, our monitoring solutions include behavioral analysis that can identify zero-day exploitation patterns.

Rapid Patch Management:

Our teams coordinate immediate deployment of security updates across client environments, minimizing exposure windows during critical vulnerability periods.

Compromise Assessment:

When threats emerge, we conduct thorough sweeps to ensure no persistence mechanisms or additional compromises exist.

Immediate Action Items for Organizations

Given the active exploitation of this vulnerability, organizations must act immediately:

Deploy Microsoft's July 2025 Security Update for all SharePoint installations

Scan for Indicators of Compromise in _layouts/15/ directories and HTTP access logs from July 18-19

Rotate Credentials for any systems that may have been exposed

Implement Enhanced Monitoring for SharePoint environments

The Bottom Line

The ToolShell campaign represents a new evolution in cyber threats—sophisticated, rapidly weaponized, and globally coordinated. With Eye Security discovering "dozens of systems actively compromised" in their initial scan SharePoint Under Siege: ToolShell Mass Exploitation, this attack demonstrates that traditional reactive security approaches are insufficient.

Organizations need proactive cybersecurity partners with global reach, advanced threat detection capabilities, and the expertise to respond to zero-day threats within hours, not days. GTconsult's presence across the UK, USA, and South Africa—the regions showing highest SharePoint exposure—positions us to provide exactly this level of protection.

Don't wait for threat actors to target your SharePoint environment. Our support teams are actively monitoring for ToolShell indicators and can immediately assess your organization's exposure. Contact GTconsult today for emergency SharePoint security assessments and ongoing protection against evolving cyber threats.

For immediate assistance with SharePoint compromise assessment or emergency incident response across our UK, USA, and South African operations, contact our global support team at GTconsult.com.

Get Immediate Assistance

Reference: Shodan search data current as of July 2025, showing global SharePoint server exposure across GTconsult service regions.

How to spot a 'Phishing' email and Keep Your Business Safe

Wed, 11 Jun 2025 10:19:43 +0000

Watch Out: Think before you click

Phishing attacks have become increasingly deceptive— if you're not careful, it's easy to fall for one. Some prey on our tendency to skim emails, rely on visual cues like familiar logos or jargon, or respond hastily to anything marked as urgent. They’re not always complex— many are simple, but just convincing enough to earn your trust if you’re not paying attention.

Received something like this before?

Or maybe you've received a variation with subjects like:

"Your Zoom account is suspended"
"You missed a Zoom meeting"
"New Zoom message received"

Whatever variation you have (or have not received), these kinds of emails can be so easy to click on if you are not paying attention.

To answer the question,' How do I know if an email is a phishing email or a scam?' Let's have a look at what's wrong with this email that was recently received by one of our team members:

Platform

While this may not apply to all organizations, it's still something to consider. If your organization holds all internal meetings on a different platform (such as Teams). Receiving an email inviting you to a weekly meeting on Zoom might be an immediate red flag. Also, if you notice, it says 'accepted'- be careful not to click the link to find out what exactly you accepted.

Strange sender format

The format (O=EXCHANGELABS/OU=EXCHANGE...), is not how legit Zoom emails are structured.

Zoom emails should come from @zoom.us or @zoom.com- not from an Exchange server's internal address format.

The use of a legit logo to gain trust

When you first click open the email, the first thing that draws your attention is the Zoom logo. It's familiar/recognizable, so if you're skimming through, you may let your guard down and miss all the other red flags.

Suspicious sender email

Always, always, always check the sender email, majority of the time, it's the dead give away that something is fishy...or, you know, phishy.

In this case, the email is not a Zoom domain. It looks like a personal or small org email, which is unusual for a Zoom system-generated message.

Generic language

No meeting title, organizer name, or details. Often, emails like this will also contain urgency without much context.

Real Zoom invites usually include specifics like topic, time, and host name.

File size

This might not always be the case, but it's worth adding to the mix.

Legitimate Zoom or Outlook meeting invites usually include metadata like date, time, location, meeting link, agenda, and possibly attachments or participant info. This often results in a file size larger than 1 KB.

Attackers often use tiny files to avoid detection by email filters and to appear harmless to users.

While .ics calendar invites can be legit, the file size is small (1KB) and may indicate that it is a malicious redirect link or a script meant to exploit vulnerabilities in calendar applications when opened or imported.

Think before you click!

Odd Time

Though this one may not always be the case, coupled with the other clues, it becomes the cherry on top.

Look out for emails coming in after business hours or on the weekends, timezone mismatches or mismatched time stamps.

Other red flags to look out for

The red flags never end, but be on the lookout for poor grammar, punctuation, or formatting.

The takeaway?

Pay Attention. Pay Attention. Pay Attention.

The days of clicking on things without any consequences are long gone (were they ever there?)

The logo might look legit. The meeting title might sound important. But if you don’t slow down to examine the details, you could end up compromising your organization.

Before you click, check:

Who sent it?
What are they asking?
Does this align with how your organization usually communicates?

When in doubt- don’t click. Verify through a different channel.

Want to check if your MS365 Environment is prepared for the just in case?

We recommend getting a penetration test to ensure your organization is well-protected against potential vulnerabilities and attacks. A thorough assessment can uncover weaknesses before cybercriminals do, giving you the opportunity to strengthen your defences and train your team. Don't wait for a breach to take action!

Book a Consultation

Late Nights, Busy Weekends, & a Lot of Learning

Thu, 15 May 2025 09:21:33 +0000

Midnight’s Certification Journey

There’s a quiet kind of determination that often hides behind the scenes of IT support. It’s the kind that isn’t loud or boastful, but you see it in how someone shows up for the team, how they handle a difficult ticket, and how they quietly push themselves to grow. Midnight, one of our SharePoint Support Engineers, recently passed the Microsoft Certified: Security, Compliance, and Identity Fundamentals exam—and her story is a reminder that professional growth doesn’t always start with a formal plan. Sometimes, it starts with a nudge from leadership, a few too many tabs open, and a personal goal to prove something to yourself.

We sat down with Midnight to unpack her journey in full: the late nights, the surprises, the setbacks—and the sweet, surreal moment when she saw that she’d passed.

When you speak to Midnight about her latest achievement, her quiet confidence and curiosity shine through. As a SharePoint Support Engineer, she's always been interested in the mechanics behind her work—but now, with a new security certification under her belt, she’s got the theory to back it all up.

What exam did she pass?

The SC-900: Microsoft Security, Compliance, and Identity Fundamentals exam is designed to assess your foundational knowledge of security, compliance, and identity (SCI) concepts and related Microsoft solutions.

The SC-900 exam is intended for individuals who are looking to familiarize themselves with the fundamentals of SCI across cloud-based and related Microsoft services.This includes business stakeholders, new or existing IT professionals, and students.A basic understanding of Microsoft Azure and Microsoft 365 is recommended.

Key areas covered in the exam:

Concepts of security, compliance, and identity.
Capabilities of Microsoft Entra.
Capabilities of Microsoft security solutions.
Capabilities of Microsoft compliance solutions.

Why this exam?

The choice wasn’t random.

“It was part of the team's upskilling plan, identified by Brad for the support team.”

The certification was identified as a strategic step for the team, and Midnight leaned into it—recognizing that it wasn’t just about ticking a box, but about staying relevant and useful in a constantly evolving space.

Additionally, the certification wasn’t just a trophy; it was a tool. For Midnight, passing was just part of the mission. The real aim was to deepen her understanding of how security and compliance are embedded into hybrid infrastructure—something she works with every day.

Preparing for the exam

We asked how she prepared, and the answer was as real as it gets:

“A lot of sleepless nights, going through material on the laptop screen.”

No sugar-coating here. Midnight juggled her job and studies like many do—burning the midnight oil, quite literally. But the biggest challenge wasn’t the content itself.

“Sticking to the schedule and resisting the urge to play games.”

There’s something delightfully honest about that. When work and study take up all your hours, the call of an Xbox or a mobile game is loud. But she powered through.

Staying motivated

Every study journey has that moment where you ask, “Why am I doing this again?” For Midnight, the motivation came in an unexpected form:

“The upcoming long weekend and the prospect of rest.”

Sometimes, it's not a deep philosophical answer—it’s knowing that if you just keep going a little longer, there’s rest on the other side. That’s more relatable than most of us would like to admit.

Finding out she passed

When asked how it felt when she saw that “pass” on her screen.

“It felt unreal and surprising.”

“I gained the certification and more experience about the infrastructure being deployed for security and compliance.”

It’s more than just a certificate. For Midnight, it’s validation of her knowledge and a clearer understanding of the behind-the-scenes structure that supports secure business operations. It also deepens her ability to troubleshoot and support clients confidently.

How do you plan to apply what you’ve learned in your current role?

“Like I say, it's now—we're already working with these things. So now I just have a better understanding of why we implement these things.

Whereas, like I say, sometimes it was a case of your—management wants us to implement these things.

There's a very good reason why, but obviously I don't know quite the reason why beforehand.

And now I can actually know that this is—we need to implement this and do this because it can help us with this and this.”

“So yeah, I would say it helps identify why we have certain technologies in place—and rules as well—for the company environment.”

Her answer shows how impactful training can be when it’s tied to real-world application. She’s not just doing the work—she now understands the why behind it.

What’s your next goal after this awesome win? What are you looking to achieve next?

“The next goal I would say being the best auntie to my brother's child because it's only—they're only like 6 weeks away.

But yeah… my next goal would be, I would like to, and I'll ask whether this would be possible, but I would like to get more experience in being able to assist the devs with support tickets that need to be escalated to the devs—not only to help them with their workload and all of that, but because I find it extremely interesting. So I would say that would be my next goal. But that is now not a certification goal. The certification goal—I’ll find out which one is next.”

Midnight’s passion for deepening her knowledge is contagious. Whether it’s supporting her family or her dev team, she’s all-in.

Advice for anybody who wants to pursue this exam

“Yes, I would actually say it's worthwhile to do it because in this day and age, security is everything.
Even like—for a very stupid example, but a very real one that I feel like everyone can resonate with—is you have a security gate or a security alarm in your house, or something, something to secure your physical environment.”

“So with this, it just—it gives you a better understanding of how to secure—basically how to understand the security system within your, obviously, your business environment.”

“So yeah, that's why I would say this is definitely a good one to do. And yeah, I'm actually very glad I did it.”

Midnight keeps it real—and relevant. Whether you’re in IT or just securing your home Wi-Fi, she makes the importance of this exam easy to relate to.

Final Thoughts

Midnight’s achievement is more than a line on her résumé—it’s a stepping stone to what’s next. From becoming the best auntie to diving deeper into technical support, she’s embracing the opportunity to grow, ask questions, and lift others while she learns.

“I'm actually very glad I did it.”

And so are we.

Congratulations, Midnight!

Is Your SharePoint Ready for Microsoft Copilot? 5 Key Factors You Need to Check

Mon, 24 Mar 2025 10:49:10 +0000

Before enabling Microsoft Copilot, ensure your SharePoint environment is AI-ready. Learn the 5 critical areas to assess for better security, compliance, and efficiency.

Why SharePoint Readiness is Critical for Copilot Success

Microsoft Copilot is revolutionizing workplace productivity by integrating AI into everyday tools. But here’s the catch: AI is only as good as the data it learns from.

If your SharePoint environment is cluttered, unstructured, or has poor governance, Copilot could surface outdated, irrelevant, or even sensitive data to the wrong people. Before enabling Copilot, you need to assess your SharePoint environment to avoid security risks and inefficiencies.

So, how do you know if your SharePoint is AI-ready? Let’s get into the five critical areas you need to check before rolling out Copilot.

1. Permissions & Security: Who Has Access to What?

The Risk:

Imagine Copilot suggesting a confidential HR file to the entire company- because of overly broad permissions.

When Microsoft Copilot processes data, it follows SharePoint’s existing permissions model. If access controls are too broad or misconfigured, users might get AI-generated insights based on sensitive or confidential data they weren’t supposed to see.

What to Check:

Are permissions properly assigned, or do too many people have access?

Are there anonymous or guest links that could expose sensitive data?

Are security groups structured correctly, or do users have unintended access?

Remember: A permissions audit helps ensure Copilot only pulls data from the right sources.

2. Data Quality: Cleaning Up Before AI Takes Over

The Risk:

AI learns from all your data, including outdated, duplicate, and irrelevant files- leading to poor recommendations.

Copilot relies on existing SharePoint content to generate responses. If the data is outdated, duplicated, or poorly structured, Copilot’s recommendations may be incorrect, misleading, or incomplete.

What to Check:

How much redundant or outdated content is in your SharePoint?

Are there duplicate files that could cause confusion?

Is content properly tagged and structured for easy retrieval?

Tip:A structured, well-maintained SharePoint ensures AI serves useful and relevant insights.

3. Compliance & Governance: Avoiding Costly Mistakes

The Risk:

AI-driven search and automation can accidentally expose non-compliant data, leading to legal and regulatory risks.

What to Check:

Are documents stored in compliance with data protection regulations (GDPR, POPIA, etc.)?

Do you have retention policies to prevent unauthorized exposure?

Are sensitive documents properly labelled with compliance tags?

Tip:Strong governance ensures Copilot aligns with your compliance strategy.

4. Metadata & Content Organization: AI Needs Structure

The Risk:

If files aren’t properly categorized, Copilot won’t understand what’s relevant- leading to unhelpful results.

What to Check:

Are files consistently labelled with metadata for easy discovery?

Do you have a clear folder structure that aligns with business needs?

Is SharePoint search optimized with keywords and content types?

FYI:AI works best when content is organized, searchable, and well-tagged.

5. Migration & Cleanup: Preparing for the Future

The Risk:

If your SharePoint is full of legacy data, orphaned files, and old SharePoint workflows, Copilot might surface information that’s no longer relevant.

What to Check:

Are there orphaned files left behind from past projects?

Is old data archived properly instead of cluttering active sites?

Are there unused workflows or outdated automation that need removal?

Tip:Decluttering SharePoint before enabling Copilot prevents unnecessary AI distractions.

In Summary

Final Thoughts: Protect Your SharePoint Before Deploying AI

Microsoft Copilot is a powerful tool, but AI is only as good as the data it accesses. By addressing permissions, data quality, compliance, metadata, and cleanup, you can ensure that:

Copilot respects security policies and only provides relevant results.
Employees get accurate AI-generated insights instead of outdated information.

Ensuring your SharePoint is ready for Copilot can feel overwhelming- but you don’t have to do it alone.

Want to test your SharePoint readiness?

Get a Sharegate Copilot Readiness Assessment.

The Assessment:

Audits your permissions & security gaps

Identifies outdated & duplicate content

Ensures compliance & governance best practices

Optimizes metadata & SharePoint structure

Helps you prepare for AI-driven productivity

Before you enable Copilot, let’s make sure your SharePoint is secure, optimized, and AI-ready.

Get The Assessment

Quick Action Protects Company Data After Phone Theft

Tue, 11 Feb 2025 14:51:20 +0000

A blog on the critical role of security on employee mobile devices

Today, more than ever, employees rely on their smartphones to stay connected and productive. But with that convenience comes risk.

At GTconsult, a recent incident reinforced just how critical it is to have robust security measures in place. One of our team members experienced a frightening robbery in which their iPhone was stolen. While such situations are always distressing, we’re relieved that our company data remained fully protected- thanks to proactive security policies and swift response actions.

Strong Security Measures Made All the Difference

Long before this incident, our company implemented strict security protocols to safeguard sensitive information. Every company device must meet compliance policies, including:

Mandatory Multi-Factor Authentication (MFA)

Employees need to verify their identity before accessing company applications like Outlook, Teams, and SharePoint.

Mobile Device Management (MDM)

Our IT team can remotely manage and secure corporate data on employee devices.

Access Control with Microsoft Entra ID

Formerly known as Azure AD, this system ensures only authorized users can access company resources.

[Learn more about transitioning to Microsoft Entra ID here.]

These layers of protection meant that even with the physical loss of a device, our company data remained secure.

Rapid Response Prevented Unauthorized Access

As soon as the theft was reported, our IT team acted swiftly:

Immediate Sign-Out:Using Microsoft Entra ID, all active sign-in sessions were revoked, cutting off any potential access.
Removal of Authentication Methods:The Microsoft Authenticator app and associated phone number were unlinked from company accounts.
Remote Wipe:Microsoft Intune was used to erase all company data and applications from the stolen device.
Secure Re-Authentication:The affected employee had to complete a fresh MFA registration on their new device before regaining access to company systems.

These quick actions ensured that no unauthorized person could exploit the stolen device to access sensitive information.

You might also like:

SharePoint Intranets serve as central hubs for document management, collaboration, and communication, making them critical assets that require robust security measures. This blog post explores essential security best practices to fortify your SharePoint Intranet.

Security Steps Matter – Even When They Seem Inconvenient

This incident serves as a real-world example of why our security practices- like MFA prompts and compliance checks- are essential. While they may feel like minor inconveniences in day-to-day operations, they act as crucial safeguards in critical moments. Our investment in Microsoft 365’s security ecosystem continues to protect both our employees and our organization.

What to Do If You Experience a Similar Incident

If your company device is lost or stolen, take immediate action:

Report the incident to local law enforcement and provide details.
Notify your IT department as soon as possible so they can secure your accounts and device.
Follow security procedures for re-authentication and device replacement.

Speed is key when it comes to preventing unauthorized access. By acting quickly and relying on your established security measures, you can keep your company data safe- even in worst-case scenarios.

In conclusion, safeguarding your company data requires a holistic approach that encompasses user authentication, encryption, data loss prevention, auditing, backup procedures, and user education. By incorporating these security best practices into your security strategy, you can create a resilient and secure digital environment that protects your organization's valuable assets. Remember, proactive measures are key to staying ahead of potential threats in the ever-evolving landscape of cybersecurity.

Need our help? From penetration testing to hiring a hacker to conduct a real-world attack (without the consequences of course), we have an expert team ready for action.

Protect Your SharePoint Data

All about Sujata

Fri, 23 Aug 2024 11:11:30 +0000

Women of GTconsult

In honour of Women's Month, we are celebrating the stories of women at GTconsult who inspire us every day.

Sujata Majumdar- Quality Assurance Tester

Today, we spotlight Sujata, a dedicated QA Tester at GTconsult, whose career is fueled by a passion for quality and a deep commitment to helping others.

In her current role, Sujata is responsible for maintaining the quality of the solutions developed by GTconsult, ensuring that every user requirement is met with precision. Her keen eye for detail and relentless pursuit of excellence make her an exceptional investigator, always seeking out the root cause of any issue to ensure the best possible solution.

Beyond her testing duties, Sujata also takes on the role of Scrum Master, driven by her natural inclination to support and guide her team. This dual role allows her to combine her love for helping others with her passion for finding and fixing bugs, making her an invaluable asset to the team.

We asked Sujata to answer 10 questions to better understand her as well as the role she is in. Let's get to know this awesome lady!

1. What did you want to be when you grew up, and what led you to your current career path?

I wanted to be a traffic officer, as the traffic police have the power to stop anyone's car.

However, now I can stop any development from going to production if I am not happy with the quality.

2. Which women inspire you to be the best version of yourself, and why?

My grandmother, my father's mother. She was an awesome woman. She taught me that all women should be financially independent and, it does not matter which occupation you choose, as long as you are good at that job and you like that work, you will be happy. But a woman should have her own space and own identity.

3. Which women are your top three dinner party guests, and what would you ask them?

Marie Curie

When she came to know that she was sick because of her research with radioactive materials, what drove her to continue the work?

Kalpana Chawla

Is heaven near space?

Penny (the character from Big bang theory, not the actress)

Why did she tolerate Sheldon?

4. What do you think is the key to building a workplace where women thrive?

Equal Opportunities: Ensure that all employees have access to the same opportunities for advancement, professional development, and recognition. Implement fair hiring practices and unbiased performance evaluations.

5. What makes you a strong woman, and what fulfils you in your personal and professional life?

A balanced Life: My point is balancing both personal and professional life.

If I can not manage my personal life and having problem that will affect my personal life and the opposite. I try not to the think about the office after hours and give my 100% to my family.

6. Why do you think it’s important for more women to join the tech industry?

Closing the Gender Gap: The tech industry has, historically, been male-dominated, leading to a significant gender gap. Increasing the representation of women helps promote equality and ensures that women have equal opportunities in a rapidly growing and influential field.

Economic Growth: Gender diversity can contribute to economic growth. When women are given equal opportunities, they can contribute significantly to innovation, productivity, and overall economic performance.

7. What advice would you give to yourself or someone else just starting out in your field?

Stay Curious and Keep Learning: Technology is constantly evolving. Cultivate a mindset of lifelong learning and stay updated with the latest trends, tools, and technologies. Online courses, certifications, and industry conferences can be great resources.

Set Clear Goals: Define your career goals and create a plan to achieve them. Whether it’s specializing in a particular technology, pursuing a leadership role, or working in a specific industry, having clear goals can help you stay focused and motivated.

8. What motivates you to excel?

I like Testing, when I start testing I forget everything. Then my only goal is finding the bug, And finding bug, gives me happiness. I feel like I am an investigator finding the truth to solve the case.

So, both helping others and finding root causes are my motivation.

9. What are your goals for the next few years, both professionally and personally?

Professionally: Become the Scrum Master, gain new knowledge in order to earn a higher salary so that I can buy a new car.

Being a part of Rainbow (my NGO) : Make a whole tribal village independent (financially), do more work and get more recognition.

Personally: Have a Europe trip.

10. What message or piece of advice would you like to share with other women pursuing similar careers?

As a woman, learn to rise and let your qualities be known, let go of what others think of you.

As a tester: Fight for your bug, do not listen to the developer if you are not 100% convinced.

Sujata has become an invaluable member of the GTconsult team, bringing together her sharp technical skills with a genuine passion for helping others. Her resilience and dedication to finding the best solutions have greatly strengthened our team's capabilities. We are inspired by her commitment to excellence and appreciate her sharing a bit of the person behind the work.

We eagerly anticipate all the great things Sujata will continue to accomplish here at GTconsult. Here’s to Sujata—a remarkable woman who exemplifies the qualities that drive our team forward.

SharePoint Online: The Upgrade Your Business Needs

Tue, 26 Sep 2023 09:40:28 +0000

Imagine you’re going on a road trip with your friend. They assure you that they can handle the task of getting you to your destination. On the day of your trip, you are surprised that instead of your friend searching for the destination on the GPS or the any of the map apps available on mobile phones, the whip out a map. Reading the shock on your face, your friend immediately assures you that maps have been used by travellers for years and have proven to be reliable.

Your first response might be," But it's 2023."

While the traditional map is effective, and works, it isn't the best option for navigating in 2023.

In that analogy alone, we may have answered the question: Do I really need to switch to SharePoint online?

The world is everchanging and the technology is constantly improving. Of course, we can't jump onto every single change that happens. Sometimes, we constantly keep up with changes and updates and other times we wait for significant changes before we jump on board with new technologies. While waiting is not a bad thing, there is such a thing as waiting too long.

This begs the question: Should we be switching to SharePoint online?

Let's dive into the meat of it all, by considering the benefits of SharePoint online.

Scalability and Flexibility: SharePoint Online offers near-infinite scalability. As a cloud-based solution, it can effortlessly adapt to a company's growth, whether it's expanding its workforce, adding more data, or increasing collaboration needs. This ensures that the platform remains future-proof.
Cost-Efficiency: SharePoint Online eliminates the need for significant upfront infrastructure investments, as it's a subscription-based service. Companies can avoid the expenses associated with maintaining on-premise servers, such as hardware, software, and IT support.
Access Anywhere, Anytime: With SharePoint Online, employees can access their files and collaborate from anywhere with an internet connection. This flexibility enhances productivity and enables remote work, a crucial aspect in today's business landscape.
Automatic Updates and Maintenance: Microsoft takes care of updates, security patches, and system maintenance in SharePoint Online. This reduces the burden on IT teams and ensures that the platform is always up-to-date and secure against evolving cyber threats.
Enhanced Collaboration Tools: SharePoint Online integrates seamlessly with the Microsoft 365 suite, offering a wide array of productivity and collaboration tools like Microsoft Teams, OneDrive, and Power Automate. This synergy fosters efficient teamwork and communication.
Advanced Security Features: SharePoint Online benefits from Microsoft's robust security infrastructure. It includes features like data loss prevention, threat protection, and compliance tools to safeguard sensitive company information, which is critical in an era of increasing data breaches.
Third-Party Integration: SharePoint Online supports integration with numerous third-party applications and services, allowing companies to tailor the platform to their specific needs. This flexibility enables marketing departments to leverage specialized tools and analytics for their campaigns.

While change can be challenging, it is often the key to staying relevant and competitive in today's dynamic business landscape. SharePoint Online represents a valuable evolution in information management and collaboration tools, offering organizations the opportunity to enhance their efficiency, security, and adaptability. So, when considering whether to make the switch, remember that in the world of technology, sometimes the "map" you're using could be due for an upgrade, and SharePoint Online might just be the right tool to ensure your organization stays ahead of the curve.

Here comes the good part...

Ready to make the switch to SharePoint Online and embrace the future of efficient collaboration and data management? GTconsult is your trusted partner in this journey. With our expertise in SharePoint solutions (including SharePoint Migrations) and a commitment to helping organizations thrive in the digital age, we can guide you through a seamless transition to SharePoint Online. Contact us today to explore how we can tailor SharePoint Online to meet your specific business needs and empower your team for success in 2023 and beyond.

Get Started Now