In the last part, we set the tenant-wide "Terms of Use" (ToU). In this part, we will look at solutions for applications connected to Entra. While Conditional Access ToU is often a good solution, even with the required Entra ID P1 license, you will quickly reach the limit of 40 possible ToUs if you define... » read more
New Vulnerability in Entra ID: Users were able to change their own Username Another Microsoft security vulnerability became known over the past week. It was possible for users and, under certain conditions, external users (guests) to change their so-called "User Principal Name (UPN)." The UPN is the primary sign-in attribute used in the Microsoft world... » read more
One of the most typical "German problems" is the need to feel secure in terms of data protection. We aim to have a contract with anyone who does anything. Everyone entering a building should sign something, and ideally, anyone we speak to should confirm, preferably with a wax seal, that we are allowed to communicate... » read more
After realising that I should really enable comments in my last post, I set out to do so in a way that fits my personal requirements. At the outset, the most obvious solution was adding Entra External ID Authentication and user management (as one does 😉). Entra External ID is a version of Entra ID... » read more
Windows 365 (and Azure Virtual Desktop) Conditional Access Deep-Dive Recently, I had the pleasure of troubleshooting Windows 365 Single Sign-On (SSO) – the issue was quite odd. When you open the Windows 365 website (windows365.microsoft.com) or the "Windows App", authentication is requested as expected. However, when establishing a session with one of the virtual desktops,... » read more
When I started learning Entra ID (then still Azure AD), my biggest challenge — aside from the seemingly endless products renamings in M365/Azure — was that "SSO" (= Single Sign-On) has almost become a buzzword. If you are currently looking for ways to standardize ldentities and less frequently interrupt a users work for logins, you... » read more
At time of writing (April 2024), adding and using Enterprise Applications in Admin Units is not Supported by Microsoft yet. In fact, I am not aware of any official Previews. This Article is purely me playing around, if you use any of this in Production it’s on you. I have written quite a few Articles... » read more
While working on my appeal against Application.ReadWrite.All, I stumbled upon a potential way to rotate an application’s authentication certificate without Graph API permissions. After some experimentation, I was unable to get it running in PowerShell, so I set it aside for the time being to finish the article. However, the topic continued to intrigue me,... » read more
When Microsoft first disclosed the January Midnight Blizzard attack and posted their subsequent deeper analysis I followed the resulting content with great interest – risks posed by Enterprise Applications are a topic near and dear to me. I will try to keep this article standalone, but it might be a good idea to skim the... » read more
This article is the practical part of the Theory – for the answer to the question "What’s the purpose of all this?", please refer to that Article. To ensure I’m not seen as someone who says "someone should" and then does nothing, here follows a (by my standards) "quick" proof of concept on how password... » read more
Raising the Curtain There are some things that regularly bother me – for example, I often wonder how all the Entra ID API rights demanded by applications are justified. I have spent quite some time with the Privileged Access Management piece – but let’s not get ahead of ourselves, first let’s get to know our... » read more
The Original Question I came here for an Answer, not some Blog Post! Okay geez, head directly to the GitHub Repo Maybe come back though, The journey is its own reward… One of my colleagues did not understand why Dynamic Groups were not being Processed and asked for help – Assumption being, that systemLabels referred... » read more