From Active Directory to AI Agents: Luke Elston on the New Shape of Microsoft Security

How has Microsoft security evolved from the world of Active Directory and infrastructure into one defined by AI, data security, and non-human identities?

In this episode of Microsoft Mentors, Oli sits down with Luke Elston, Microsoft Practice Director at CyberONE, to explore both his personal journey and the wider evolution of Microsoft security over the last decade. From starting out in engineering roles at Microsoft during the early Azure years, to building deep expertise across identity, Defender, and Purview, to now shaping the roadmap for a specialist Microsoft-first MSSP, Luke shares a practical view of how the security conversation has changed — and where it is heading next.

This is a conversation about much more than certifications or tooling. Luke reflects on how identity has come full circle as a security priority, why Microsoft’s investment in security has changed the market, and what it takes to turn technical depth into commercial leadership. He also explains why CyberONE doubled down on Microsoft, how that specialisation has strengthened its relationship with Microsoft, and why leaders who want to grow their careers need to stop waiting for opportunities to happen by accident.

Along the way, the conversation explores Sentinel, Defender, Purview, MISA, MXDR, shadow AI, data governance, AI-powered attacks, voice cloning, non-human identities, and the growing importance of securing agents as organisations adopt Copilot and broader AI systems. For Microsoft partners, cyber leaders, technical specialists, and anyone trying to understand the new shape of Microsoft security, this episode offers a grounded look at what good security really looks like now.

If you enjoy this episode, don’t forget to like, follow, and subscribe on Spotify, Apple Podcasts, or YouTube.

💡 What You’ll Learn in This Episode

• How Luke’s career started in Microsoft engineering roles and why Active Directory gave him such a strong security foundation

• Why identity has come back to the centre of the security conversation in the age of AI and non-human identities

• How Microsoft’s security stack evolved from early Azure and Defender investment into the broader ecosystem we now see across Sentinel, Purview, and AI security

• What changed in Luke’s career when he moved from engineering into architecture, go-to-market, and commercial leadership

• Why CyberONE chose to specialise so deeply in Microsoft security and how that has accelerated its growth

• What MISA, MXDR verified status, and Microsoft’s security ecosystem actually mean for partners and customers

• Why any serious AI adoption needs to start with a data security mindset

• How organisations should think about agent sprawl, shadow AI, and the risks of unmanaged non-human identities

• Why data security remains one of the most overlooked parts of many organisations’ security posture

• Why Luke believes a SOC should be one of the first investments a business makes, not one of the last

• How CyberONE is using AI internally to strengthen human-led security operations rather than replace them

💬 Memorable Quotes

“identity is that is a key part of security.”

“any adoption of AI generally needs to come with a data security mindset.”

“organizations who were early adopters of the various copilot products likely have agents floating around that don't have an identity associated.”

“assume breach or assume compromise.”

“get a SOC. Just get a SOC. Don't make that the last thing you invest in.”

📬 Enjoyed the Episode?

Subscribe to the Microsoft Mentors Newsletter for insight-led conversations on cyber security, AI, leadership, partnerships, and scale across the Microsoft ecosystem.

🔗 Links & Resources

Connect with Luke Elston on LinkedIn

👉 https://www.linkedin.com/in/luelston/

Connect with Oli Ridley on LinkedIn

👉 https://www.linkedin.com/in/oli-ridley/

Follow Cloud Decisions on LinkedIn

👉 https://www.linkedin.com/company/clouddecisions