Couverture de Entra.Chat

Entra.Chat

Entra.Chat

De : Merill Fernando
Écouter gratuitement

Offres de saison | 0,99 € par mois pendant les 3 premiers mois

5,99 €/mois par la suite. Des conditions s’appliquent. Annulation mensuelle possible.
Entra Chat is a weekly podcast hosted by Merill Fernando and delivers practical insights for Microsoft administrators and security professionals through conversations with identity experts who've been in the trenches. Episodes feature seasoned Entra practitioners sharing real-world deployment experiences and Microsoft Entra team members who build the features you use daily. Get the inside track on best practices, implementation strategies, and upcoming capabilities directly from those who design and deploy Microsoft identity solutions. Join us for actionable takeaways you can apply immediately in your Microsoft 365, Azure, and Entra environments. --- Entra.Chat, its content and opinions are my (Merill Fernando) own and do not reflect the views of my employer (Microsoft). All postings are provided “AS IS” with no warranties and is not supported by the author. All trademarks and copyrights belong to their owners and are used for identification only.

entra.newsMerill & Joshua Fernando Politique et gouvernement
Épisodes
  • Conditional Access Gaps and the App Back Door, with Brandon Colley

    Conditional Access Gaps and the App Back Door, with Brandon Colley
    Oct 24 2026
    Most Conditional Access gaps aren’t exotic. They come from reading policies the wrong way: as firewall rules with an “allow”, as a list of platforms that seems complete, as an MFA exception for the office that made sense years ago. Brandon Colley has reviewed well over a thousand Conditional Access policies in customer assessments, and the same handful of mistakes come up in tenant after tenant.Once those are fixed, the risk moves. Passkeys, privileged access and Conditional Access put more locks on the front door, the user sign-in. An app that was consented to years ago, holds a client secret and still has a stale redirect URI is a back door that none of those locks cover.Brandon is a Senior Security Consultant at TrustedSec and a Microsoft Security MVP. He came from systems administration, learned Active Directory security at Trimarc, and now spends his days on cloud and on-premises assessments and the remediation that follows. These are the gaps he checks first, and the app and consent settings he has moved on to.Security defaults can cover more admins than your policiesThe free tier can be stricter than the paid one. Security defaults require MFA for 16 administrator roles. The Microsoft-managed policy “Multifactor authentication for admins accessing Microsoft Admin Portals”, and the “Require MFA for admins” template it mirrors, cover 14. The two extra roles in security defaults are Authentication Policy Administrator and Identity Governance Administrator.If a small tenant is on security defaults, think hard before switching it off: the moment you do, you lose protections that you then have to rebuild in Conditional Access yourself.Sponsored by:ENow Software Introduces New Entra ID App Onboarding ExperienceAs user requests for SaaS and AI applications increase, Entra ID and M365 teams face a growing volume of security reviews, added hours of manual research, and bottlenecks.New! ENow App Governance Accelerator 4.0 introduces App Onboarding, helping teams:* Accelerate app approvals with configurable, multistage workflows.* Evaluate security risks more efficiently with integrated Microsoft Defender for Cloud Apps risk scores.* Reduce manual work with centralized requests, reviews, and approvals.* Improve transparency with a self-service portal for requesters to track status and decisions.* Control app sprawl with an Internal App Catalog of approved applications.Go beyond Microsoft’s consent and approval capabilities with customizable, structured application governance, from the initial request through ongoing oversight.Faster Approvals. Less Admin Work. Better Security Posture.Learn More About ENow App Governance Accelerator 4.0See It In Action: Request a DemoDecide which roles are privileged yourself“We require MFA on privileged roles” is easy to say in an audit. An assessment asks a harder question: privileged by whose definition? Brandon’s own list is about 36 roles, grouped into tier 0 and tier 1, the same tiering model Active Directory admins used 20 years ago.Don’t lean on Microsoft’s mandatory MFA either. It covers the Azure portal, the Microsoft Entra admin center, the Intune admin center and the Microsoft 365 admin center, plus create, update and delete operations from Azure CLI, Azure PowerShell, the Azure mobile app and IaC tools. Microsoft Graph APIs are generally not in scope, so in some cases a single-factor sign-in can still reach Graph. Your Conditional Access still has to cover every app and every role you consider privileged.Every platform is not all platformsConditions inside one policy combine with AND. A policy that requires MFA when the user is risky, the sign-in is risky and the location is outside the United States only fires when all three are true at once, so it almost never fires. Put conditions that should act on their own into separate policies.The device platforms condition has the same trap. Ticking Android, iOS, Windows, macOS and Linux is not the same as “any device”. The platform comes from the user agent string, which isn’t verified and is easy to change, so a sign-in that claims an unknown platform matches none of your platform policies and walks past all of them. Microsoft’s recommended fix is a separate block policy: include Any device, exclude the platforms you support, and set the grant to Block access. Brandon covers how the spoofing works in his Petri article (linked below).Watch this episode…Conditional Access has no allow ruleCustomers often ask for a policy that will “allow finance access to the finance app”. Conditional Access has no allow rule. A policy is an if-then statement: if the users, target resources and conditions match, then require MFA, a compliant device or another control, or block. Anything the policy doesn’t match passes through untouched.So every time you narrow the users, the apps or the conditions to describe who should get in, you also shrink what the policy protects. Scope policies broadly and...
    Afficher plus Afficher moins
    39 min
  • Stop the Bleeding: Cleaning Up Apps, Secrets and Consent in Microsoft Entra

    Stop the Bleeding: Cleaning Up Apps, Secrets and Consent in Microsoft Entra
    Oct 17 2026
    Most tenants have the same problem: hundreds of app registrations and service principals, client secrets that were set to expire in a hundred years, permission grants nobody remembers approving, and test tenants that were never cleaned up. It’s tempting to start fixing the scariest app on the list. Jeff Sakowicz argues for a different order: stop the problem from growing first, then remove the debt that gives you the most risk reduction for the least disruption.Jeff isn’t describing someone else’s product. He has spent most of his 14 years at Microsoft as a product leader on the Entra application platform, shaping the application and service principal model and the OAuth permissions and consent model that every Entra tenant runs on today. Publisher verification and risk-based step-up consent came out of that work, and he now leads part of the team building the platform behind Microsoft Entra Agent ID. Inside Microsoft, he’s the person teams call when an app incident needs untangling. This is his playbook for securing non-human identities, from client secret burndown and unused apps to consent phishing and the protections Microsoft runs in every tenant by default.Prevention starts with policyThe best medicine is prevention. Before you clean anything up, go through the policy controls you already have and set them to block insecure configuration that doesn’t fit your organization’s risk tolerance. This is a balance, not a switch. “If you want the most secure system in the world, unplug the server, bury it underground. Your job is done.” Lock things down too hard and developers and end users will find other ways to get work done, especially now that they have agents to help them. Shadow IT is almost always less secure than what you stopped. So whenever a control blocks self-service, make sure people know what to do next and how to get unblocked quickly.Treat high-value apps as production infrastructureMicrosoft runs customer-facing apps in tenants separate from its corporate tenant. Tenant-level isolation is a useful form of segmentation, and some large organizations do the same for their production assets. But a second tenant brings its own operational overhead, and a tenant that falls into chaos can leave you worse off than before.Whatever you decide, treat your multitenant apps and high-value line-of-business apps as production infrastructure, the same way you would protect a database or a high-value Azure subscription. A good middle ground is to keep a close eye on the owners and sponsors of your high-value apps and agent identities. They are the people who can change those identities’ authentication configuration, so their accounts need good hygiene.The easier win is test, demo and staging. If they still live in your productivity or production tenant, move them out. Midnight Blizzard showed how small dominoes lead to big consequences: Microsoft’s own write-up describes a password spray against a legacy, non-production test tenant account, followed by a legacy test OAuth application that had elevated access to the corporate environment.Sponsored byMany of the app and consent problems in this episode are exactly what Maester checks for: it runs security tests against your Microsoft Entra and Microsoft 365 configuration and tells you what passed and what failed.Maester Cloud turns those results into a workflow your team can run every day:* Assign an owner to each finding and link it to a ticket, instead of tracking remediation in a spreadsheet.* See what got fixed since the last run, and record accepted risks.* Catch drift with daily history and alerts when a setting changes.* Every tenant in one place, without switching sign-ins.Subscribe with your favorite podcast player or watch on YouTubeMap your surface area, then think in three dimensionsBefore buying a new inventory tool, use the one you already have. If your organization already tracks production assets or other identities, bring your non-human identities into that system instead of running a parallel process. Then answer three questions: how many of these do I have, what categories of identity are in the portfolio, and what are the big categories of risk?Jeff looks at risk in three dimensions:* Active threats. Priority zero. Hand them to the SOC immediately.* Posture. Surface area from misconfiguration, or configuration that was state of the art five years ago, such as the implicit flow for a single-page app. Weak credentials, insecure redirect URIs, unused identities and legacy protocols all live here.* Blast radius. How much privilege each identity has, whether it’s used or not.Most organizations end up with a huge list of high-privilege apps and posture issues. You will never get every risk to zero at that scale, so the job is to prioritise by risk and by return on effort.Burn down secrets: stop the bleeding firstSay you’ve read the Solorigate reports and want to get client secrets off your non-human identities. Step ...
    Afficher plus Afficher moins
    51 min
  • Stolen Tokens, Agents and Universal CAE: What Global Secure Access Adds to Entra ID

    Stolen Tokens, Agents and Universal CAE: What Global Secure Access Adds to Entra ID
    Oct 9 2026
    A phished and stolen refresh token is one of the most useful things an attacker can take from your tenant. It is a long-term artifact, which is why so many phishing attempts go after it. Alex Pavlovsky’s answer to that attack is a feature every Entra ID P1 tenant already owns.Compliant network is part of Global Secure Access, and, like source IP restoration, it comes with Entra ID P1. Put the GSA client on your devices, add one Conditional Access policy that blocks access from anywhere outside the All Compliant Network locations named location, and a stolen refresh token or PRT cookie no longer works from the attacker’s own machine. As Alex puts it, the token itself does not become bound, but your use of it is gated by being on your organization’s compliant network.Merill is joined by two former colleagues who are Microsoft Entra PMs: Alexander (Alex) Pavlovsky from the Global Secure Access feature team, and Marilee Turscak, who works on helping customers adopt AI safely. They explain why Microsoft built networking into identity, walk through the compliant network policy and a BYOD sign-in with no client installed, and demo a network policy that stops an agent from deleting a file its user is allowed to delete.Why a stolen token stops workingFor phishing itself, Alex is clear that the main line of defence is still stronger credentials that do not involve passwords. Compliant network helps with what comes after: the newer attack patterns where refresh tokens are stolen and replayed.If your tenant-wide policy says you can only authenticate from a compliant network, you can also only replay refresh tokens from a compliant network. PRTs become unusable unless they are used from a device that has GSA, which means your organization’s device. Alex says the same applies to ROADtools-style attacks with PRT cookies: none of that works with compliant network in place. The signal is also tenant-specific. A GSA device in tenant B satisfies compliant network in tenant B and nowhere else.In the demo, Alex builds the policy in a few clicks: all users, all resources (so the primary refresh token, Entra ID itself and Microsoft Graph are covered), any network except compliant network locations, then block. Start it in report-only mode, watch who is not coming through compliant network, pilot with a smaller group and expand. You do not need the advanced GSA licences for this, but you do need the GSA client on your devices or a remote network sending the traffic.And exclude your break glass accounts. Alex has taken many panicked customer calls from admins who forgot, and Marilee locked herself out of a test tenant this way recently.One engine for identity and networkWhen Merill joined Microsoft, he couldn’t see why networking belonged to the identity team. Alex explains the reasoning. When identity picks up a signal that a user, session or token is at risk, the network has to hear about it quickly, and passing those signals between separate systems through traditional APIs is too slow at this scale. So Microsoft made the identity engine and the network engine one engine.That design shows up in source IP restoration. Behind a typical proxy or security service edge, every user looks like they signed in from the provider’s shared IP range. GSA sends the user’s original source IP to Entra securely, so sign-in logs are accurate, Conditional Access can evaluate the user’s own IP, and Identity Protection’s location and impossible travel detections work again. It is also why compliant network works at all: the GSA edge shares a security engine with Entra ID, so it can tell Entra that this is a legitimate GSA device from a specific tenant, and Entra can trust that signal.The network can tell agents from users“Agents are super deterministic. They are very resourceful. They do not give up.” Alex also argues that saying no to agents means falling behind your competitors, so the question becomes how to protect their use.GSA can detect when network access comes from an agent, and its policy rules can match on the HTTP method, the destination and whether a user or an agent is acting. Marilee’s baseline recommendation is to block sensitive actions by agents. In her demo, the Zava helper agent tries to remove a document from Dropbox and gets an “agent is not authorized” error, because a policy called “block agents from destructive actions” blocks the DELETE method for agents only. The user checkbox is left clear, so the person can still delete the file themselves. The logs show the same attribution, which Alex says is valuable even before you apply any policy.Alex also describes Copilot Studio agents running through GSA with no client anywhere. A Copilot Studio admin checks one box to enable the GSA integration, and with Internet Access and a policy in place, that agent traffic flows through GSA and your policies apply.BYOD without the clientMarilee shows a user on a personal device with no GSA client. When ...
    Afficher plus Afficher moins
    50 min
adbl_web_anon_alc_button_suppression_t1
Aucun commentaire pour le moment