ACE Networks

05/11/2026

A laptop marked Retired in the asset register can still sign in to Entra ID.

The register entry changes when the laptop is written off. The Entra ID device object stays enabled and the device certificate stays valid until it expires, so conditional access still treats it as a known device.

ACE Networks ties the retirement step to Entra ID device disablement and certificate revocation, so one status change in the register triggers both.

→ Get a free consultation

04/11/2026

A Microsoft Defender for Endpoint alert for a new service installed on a file server reaches the helpdesk as a ticket with Priority: Normal. It sits between a password reset and a printer request, and the technician works the queue by age.

Alert-to-ticket connectors, whether email rules or a webhook into the PSA, fill the required fields and leave the rest at defaults. Severity stays in the alert body while the priority field takes the queue default and starts the standard SLA clock. Credential dumping and a stopped backup service are often logged at low or medium severity on their own, so a mapping built on severity alone misses them too.

Nobody was paged and no escalation rule fired. Defender detected it correctly. The failure sits in the routing layer between the security tool and the ticketing system.

ACE Networks maps alert category and severity to ticket priority, assignment group and escalation, then sends a test alert through the connector to confirm it reaches the on-call engineer.

→ Get a free consultation

09/10/2026

09/10/2026

ACE Networks started in 2006, and last month we marked 20 years with customers, partners, colleagues and friends at The Landmark Nicosia.

Our Director, Andis Americanos, took a moment to look back on the two decades. The rest of the evening went to conversations, live music and exchanging gifts with people we have worked alongside for years.

Thank you to everyone who came and to everyone who has been part of the journey. Here's to what comes next.

🌐 https://acenetworks.eu/ace-networks-celebrates-20-years/

08/10/2026

The label activity report in Microsoft Purview shows sensitivity labels being applied every day, and the rollout is marked complete. The SharePoint libraries and OneDrive folders that existed before the policy was published still hold years of documents with no label on them.

A published label policy and a default label apply when a file is created or edited in an Office app. A file that nobody opens keeps the metadata it had before the policy existed. Labelling files at rest takes a separate auto-labelling policy running in the service, scoped to specific sites and matched on sensitive information types. That second policy tends to be missing from the plan once the client-side rollout is working.

Every control that keys on a label skips those files. A DLP rule written for Confidential evaluates nothing on a document that has no label, and encryption and usage rights are never applied to it.

ACE Networks scopes auto-labelling policies to the oldest SharePoint sites first, runs them in simulation, and compares the matched files against the DLP rules that depend on each label.

→ Get a free consultation

08/10/2026

A Teams guest is an Entra ID B2B account. The guest access switch in the Teams admin centre only sets what that account can do inside Teams: meetings, calling, messaging. Who can be invited, and how much of the directory a guest can see, is decided in Entra external collaboration settings and cross-tenant access. Lobby rules and anonymous join are meeting policies, configured in a third place.

Each layer has its own owner and its own defaults, so a tenant can have a tight meeting policy and loose invite permissions at the same time. Where access reviews are not configured, a guest account created for one call stays active and can rejoin the team long after the project ends. None of the three settings shows that gap on its own.

ACE Networks configures these layers together: invite rights restricted in Entra, cross-tenant access scoped to named partner tenants, lobby and guest calling policies set per meeting policy, and recurring access reviews that expire inactive guests.

→ Link in bio to book a free consultation

07/10/2026

A cyber insurance renewal form asks about MFA once, but MFA is enforced per account and per application. A Conditional Access policy that excludes a legacy VPN or a service account leaves the form saying yes while the Entra ID tenant says otherwise.

If a breach starts through one of those exclusions, the insurer can compare the signed answer with the configuration and deny the claim for material misrepresentation. EDR missing on servers and backups with no restore test create the same gap.

A signed questionnaire is a statement about configuration, and insurers can test it. ACE Networks checks each answer against Conditional Access coverage, EDR deployment by device and backup restore records before the form is signed.

→ Get a free consultation https://acenetworks.eu/

06/10/2026

20 Years of ACE Networks 🎉

On 11 September, we welcomed customers, partners, friends, and colleagues to our ACE Networks Street Party to celebrate a milestone that means so much to us: 20 years in business.

What began in 2006 as a vision to deliver reliable technology solutions has grown into a trusted IT and cybersecurity partner for organisations across Cyprus and beyond.

The evening was filled with great conversations, good food, cold beers, live music, and, most importantly, the people who have been part of our journey.

To everyone who supported us, trusted us, worked with us, and grew alongside us over the last two decades:

Thank you.

Here's to the next chapter.

05/10/2026

An asset register records where a laptop is. Intune and Entra ID record whether it is still trusted. When a device is marked retired in the register but nobody removes its device object, it stays enrolled, keeps its compliance state and can still hold the VPN profile and certificates issued to it.

The register and the tenant are updated by different people at different times, and the device never behaves abnormally, so a detection rule has nothing to flag. This is a lifecycle process failure, and it stays open until an audit finds it.

ACE Networks ties disposal to the tenant. A retirement ticket in the register triggers removal of the device object in Intune and Entra ID and revokes its certificates, and the ticket closes only after the tenant confirms.

→ Get a free consultation https://acenetworks.eu/

17/09/2026

A domain controller logged an account lockout at 03:11. A DNS server logged a spike in NXDOMAIN queries four minutes later. A file server logged unusual read volume at 03:19. All three entries sat in the SIEM, ingested correctly, each inside its own log stream.

Every sensor fired. Every entry existed in real time. The gap sat in the correlation layer — it only compared events within a single log source, not across the three systems. Cross-source correlation requires mapping field names, host identifiers, and time windows between each source. That step usually waits for phase two once ingestion is confirmed working.

The dashboard showed three green tiles and zero incidents. None of the three events merged into a single incident.

ACE Networks checks whether a SIEM's correlation layer spans the sources it ingests, not just whether those sources are logging.

→ Link in bio to book a free consultation