Event banner
Event details
What would be your suggestion when stuff in an organisation are encouraged to use their personnal devices. Incident where account was comprmosied through the use of personal device, what would be the right approach. Some policies on Defender or conditional access? Suggestions?
eolsonMicrosoft
Conditional access for sure! Hopefully these devices are onboarded to Defender for Endpoint. From an incident response perspective, getting personal devices when there's a compromise is going to be a tough one... so when it gets to that point you probably want to have a discussion with your legal team.