"Pizza's on me today, everyone! 🍕 Order whatever you like."

Posted in the team chat at 12:41. From Lisa's account.

At 12:41 Lisa was in a café, twelve steps from her laptop, discussing oat milk with a barista. Outlook open. The finance share open. A half-finished salary sheet open, because it's the end of the month. Screen unlocked. Right next to the window.

Three minutes. That's all it took.

And yes, you know 🪟 Win + L. Everybody knows 🪟 Win + L. It has been in every awareness training since the invention of the office chair. Nobody presses it every single time. Not because they're careless. Because they're human, and humans remember things right up until the moment they need to.

So I built something that presses it for them. It's called Win+Leave. 🚶🔒

The pitch is intoxicating. Open Microsoft 365 Copilot, describe in two sentences what you want, upload a couple of files, and thirty seconds later you have an agent. Your own little AI, wired into your SharePoint, ready to answer questions and do things. 🪄

So of course everyone wants one. The business wants a chatbot for the knowledge base. The pro-maker wants a flow that validates quotes. The developer wants a multi-agent orchestrator with their own model. Three people, three times the word "agent", three completely different products.

And here is the uncomfortable part: letting all of them just... build one, whenever they like, is a genuinely bad idea. 🧑‍🔬

You did everything right. Conditional Access requires a compliant device before anyone touches company data. You tested it, it worked, you closed the ticket, you felt good about yourself. ☕

Then one Tuesday you spot a device in the sign-in logs you have never seen before. Personal laptop. No management. No Intune. Nothing. And right next to it, in cheerful little green letters: Compliant.

Wait. What.

Most organisations don’t just have one type of device.
If you look closely, you can almost always split them into the same handful of categories — and each comes with its own quirks.

Once you understand those patterns, you can design an Autopilot framework that covers them all without overcomplicating your life.

It started with a ticket:

"Hi IT, I wiped my device because Teams stopped syncing. Can you fix it?"

Weird.
So you check — and sure enough, the device is gone from Intune. Just... gone.
No wipe, no retirement event, nothing in logs. It just vanished like a magician's assistant. 🎩✨

Turns out, the user simply went to:
Settings → Accounts → Access work or school → Disconnect

That's it. Two clicks. No password prompt. No MFA.
And poof — device is unmanaged.

Let’s face it: Break-the-Glass accounts are either your tenant's safety net — or a dangerous liability waiting to be forgotten.

And while many admins know they should have one, far fewer know how to do it right. Across tenants. Securely. Consistently.

So… that’s enough OneDrive for now 😅
5 policies. 2 groups. And one very real desire to never see another popup about “Your files are not backed up”.

As a few — and by now, many — of you know, I tend to show up regularly at various business partners.
Not just to drink coffee (although yes, that too ☕), but to spar about Microsoft configurations, smart policies, and the occasional “how-did-we-miss-this” setting.

And in those conversations, one thing keeps popping up:

💬 “We didn’t even know that was a thing…”