John Meyer — WritingScripts, queries, and project notes from John Meyer. Security engineering, Azure, and AI experiments.https://uwa.one/en-usCheck Intune configuration drift with Microsoft365DSChttps://uwa.one/blog/intune-microsoft365dsc-azure-pipelines/https://uwa.one/blog/intune-microsoft365dsc-azure-pipelines/A read-only Azure Pipeline pattern for testing a compiled DSC configuration and saving the results for review.Thu, 10 Sep 2026 00:00:00 GMTSecurityIntuneMicrosoft365DSCAzure PipelinesConfiguration as codeAssign owners to Defender for Cloud findingshttps://uwa.one/blog/defender-for-cloud-posture-backlog/https://uwa.one/blog/defender-for-cloud-posture-backlog/Use Resource Graph to join unhealthy assessments to resource owners and keep remediation and exceptions in a trackable backlog.Wed, 09 Sep 2026 00:00:00 GMTSecurityDefender for CloudAzure Resource GraphAzure PolicyKeep Defender XDR custom detections in Githttps://uwa.one/blog/defender-xdr-detection-as-code/https://uwa.one/blog/defender-xdr-detection-as-code/A mail-volume query and a review process for changing custom detections without losing the query, settings, or rollback record.Tue, 08 Sep 2026 00:00:00 GMTSecurityDefender XDRMicrosoft GraphKQLDetection engineeringReview MFA registration events in Defender XDRhttps://uwa.one/blog/defender-xdr-mfa-method-tampering/https://uwa.one/blog/defender-xdr-mfa-method-tampering/Find authentication-method events in CloudAppEvents and collect the account, IP, and audit details needed for review.Mon, 07 Sep 2026 00:00:00 GMTSecurityDefender XDRKQLEntra IDDetection engineering