Tommi Hovi

Senior Cloud Security Consultant @ Zure

About

Tommi is an Microsoft Cloud Security generalist with cloud architect background. Core strengths are in identity security, modern authentication, device security, cloud governance, cloud security and detection engineering. He has done various IT-jobs before landing on a spot at public cloud which carried away instantly at the beginning of 2019. He's been part of large cloud migration projects to greenfield deployments to security assessments and cloud consultation. Tommi is an organizer in a Helsinki and Tampere-based Azure and Friends user group which arranges monthly in-person events and he authors a blog site tommihovi.com where he posts various cloud and identity security articles.

Book This Speaker

Sessions Available

Managing and monitoring Microsoft Entra ID as Code - Is it worth it?

In a corporate world we've used to our identity provider being something that is constantly changing due to the need to manage identities, groups and other objects. This has been traditionally done via ClickOps or later semi-automated using PowerShell scripts. In public cloud and in Microsoft Entra ID the same legalities apply. We still have most admins maintaining Entra ID from the Portal experience and some using PowerShell. What if there was another way to manage your tenant configuration? And monitor that it stays that way? In this session I will challenge the audience to think unconventionally about managing Microsoft Entra ID, something that is typically done via 'point-and-click' method inherited from Active Directory management. Topics included are: - Pros and cons of different methods of Microsoft Entra ID management - Seeing if there is a use case for IaC based management - Can IaC-based management help with resilience and business continuity? - Technical walk-through of setting up IaC best practices for Entra ID tenant - Current limitations of the Bicep in Entra management - Monitoring for configuration changes In the demo part I'm going to cover how to start managing your tenant as code and how to set up continuous monitoring.

Better safe than sorry - Emergency Access Jacked Up in Microsoft Entra ID

Emergency Access (EA) in public cloud is paramount. It's might be your last string of hope to get your Microsoft tenant back. Recently Microsoft has made changes to portal and command line tool access requiring strong authentication. Emergency Access accounts (a.k.a Break Glass accounts) were subject to this change also. Stories from around the world about lost tenant access are horrifying. You might end up battling with support for months. How many companies can afford to lose at least part of their business for months? Or even weeks? Emergency Access is your insurance, but only if it's done the right way. In this session I'll cover - What scenarios will get us locked out from tenant and when emergency access is to be used - How robust emergency access should be designed to cover all angles - How to monitor and secure these powerful accounts from credential abuse or privilege escalation - What processes are needed to create regarding emergency access - How to scale Emergency Access setup if company operations run on global scale We all hope we never need to use emergency access, the same way we hope that we never actually need a seat belt in action, but when we do need it, it's best to be prepared.

How versatile Microsoft Defender for Cloud is in 2025?

Already since way back in the days when it was called Azure Security Center we've seen its security recommendations, secure scores, inventory, regulatory compliance policies and we might have even seen some security alerts, if we were "lucky". And for most this image seems to have stuck in mind. But Microsoft has poured millions into the development of their security stack over the last 5 years and Defender for Cloud (as it is today called) has also learned a lot of new tricks. In this session I'm going to uncover the robustness of Defender for Cloud in 2025. You can expect to gain overall understanding of how sneaky good Microsoft Defender for Cloud (MDC) is and how you can even use it to secure your digital non-Azure assets via its multi-cloud support. We'll cover following features and scenarios: - Securing non-Azure workloads - Proactive hunting of misconfigurations with Cloud Security Explorer - Remediation handling using Governance Rules - Integration to Microsoft Purview - Securing Azure Repos with DevOps Security - Cloud Security Posture Management - Cloud Workload Protection's today This session does not dive deep into the code editor or command line, but rather explains how many different tricks MDC has up its sleeve and how you can benefit from them!

Preparing Your Microsoft Tenant for Emerging Threats and Trends

The threat landscape is accelerating — and Microsoft cloud environments are squarely in the crosshairs. In this session, we’ll take a strategic and tactical look at how identity-based threats have evolved in the public cloud, what defenders are facing today, and where the risks are shifting next. We’ll explore current and emerging trends such as large-scale token theft, MFA fatigue, and consent phishing — and examine how developments in AI, automation, and cybercrime-as-a-service are reshaping attacker capabilities. Looking ahead to 2026, we’ll identify key focus areas for defenders: which risks deserve priority, where budgets should be aligned, and how to think tactically about preparing your Microsoft tenant to meet the next wave of cyber threats. Key takeaways: • A strategic view of current and emerging threats in Microsoft cloud • Attack trends shaping 2025 and beyond (AI, Data, Identity...) • Tactical insights on where security leaders should focus next This session is designed for cloud architects, security strategists, and IT leaders seeking to stay ahead of evolving threats — without getting lost in low-level technical detail.

Fighting Identity-Based Attacks in Entra ID for Defenders

Identity is the primary perimeter to secure — and also the most targeted in public cloud. In this session, we’ll walk through today’s most common identity-based attacks in Microsoft Entra, including token theft, consent phishing, credential stuffing, and Business Email Compromise (BEC). Using real-world scenarios, we’ll explore how to defend against these threats using Microsoft 365 Business Premium, E3, and E5 — with a candid look at what’s actually possible across different licensing tiers. We’ll also reflect on how cybercrime has evolved into a professionalized industry, with identity now serving as the primary entry point for attackers. With over 345 million password-based attacks occurring daily and BEC losses in the billions, it’s no longer a matter of if you’ll be targeted — but when. What you’ll learn: • Key attack techniques targeting identities in Microsoft Entra • How Microsoft 365 licensing impacts your defense strategy • Actionable protection tactics for different business tiers This session is ideal for IT admins, cloud architects, and security defenders looking to strengthen their identity protection strategy with real-life practicality.