Interesting post - thanks Nick. The SSPR issue is an interesing one - there seems to be a split opinion as to whether 1 or 2 methods of Authentication should be required for SSPR, and there is a "Use for sign-in" setting in the SMS Authentication Method, which when unchecked only uses SMS for SSPR, and not as an Authentication method. With 2 methods required for SSPR, the 2nd option really boils down to SMS or Email (assuming MS Authenticator is the first), neither of which I think are secure. A compromised personal email account is I suspect equally if not more more likely than a manipulated SMS authentication, which makes me lean towards a single SSPR method, however counterintuative that may be. Do you know if the Passkey registration will trigger when SMS is configured but the "Use for sign-in" option is unchecked?

This is a great tool Nick. I assume it gets permissions at the top level? Would it detect if library permissions are set at a sub folder level (i.e. where inheritance is broken and explicit permissions are set)?

We are doing a few Purview deployments at the moment. Getting clarity at the outset of what the client wants to achieve and the drivers behind it is key. There are so many elements to DLP/Purview, which can be entirely overwhelming so breaking this down is fundamental to a successful deployment

Hi Nick - thanks for creating this guide - its really useful. One thing to note however is that Claude Cowork is no longer in research preview, which may have a material impact on when companies look to deploy the technology