Entra.Chat

Afleveringen

1. Entra Multi-Tenant App Mistakes Every SaaS Builder and Admin Should Know, with Kelvin Tegelaar

   31 oktober 2026 · 43 min

   Afspelen
   Most SaaS vendors connect to your tenant with one multitenant app and one credential, shared by every customer. Kelvin Tegelaar, founder of CyberDrain and creator of CIPP (used by well over 10,000 MSPs), sees it from both sides, and his verdict is blunt: “This app is dangerous, period.” Lees meer

   Recorded on 14 October 2026, one day before the ConnectWise Cloud Backup app’s credential was used to sign in to customer tenants (173 confirmed by Huntress).

   Key takeaways

   The risk: one app, every tenant

   * One app registration, a service principal in every tenant. The credentials sit on the vendor’s app registration, so one leaked secret or certificate works in every tenant that consented, with whatever application permissions you granted. For MSP tools, GDAP widens it to every customer behind the partner.

   * You can’t put Conditional Access on a vendor’s app. Conditional Access for workload identities covers single-tenant apps only. Watch vendor apps’ sign-ins, ask vendors how they protect their credentials, and know where the Enabled for users to sign-in? switch is so you can disable an app fast.

   Fix the credentials

   * Retire client secrets; let certificates rotate themselves. Prefer managed identity or federation; otherwise use short-lived certificates. CIPP’s last 30 days and are replaced every two weeks with Microsoft Graph addKey/removeKey, not by granting the app Application.ReadWrite.All.

   * Turn on app management policies. Block new client secrets and cap credential lifetimes. The tenant default policy is off until you enable it.

   * Lock your app’s service principals. Builders: keep app instance property lock on (the default for new apps since June 2026), so customer tenants can’t add their own credentials to your app.

   Fix the architecture

   * Build one app per customer tenant. A leak in tenant A then stays in tenant A. It costs some engineering; one central app is “choosing convenience”, which is fine only if you choose it knowingly.

   * Keep the apps you ship out of …

2. Conditional Access Gaps and the App Back Door, with Brandon Colley

   24 oktober 2026 · 39 min

   Afspelen
   Most Conditional Access gaps aren’t exotic. They come from reading policies the wrong way: as firewall rules with an “allow”, as a list of platforms that seems complete, as an MFA exception for the office that made sense years ago. Brandon Colley has reviewed well over a thousand Conditional Access policies in customer assessments, and the same handful of mistakes come up in tenant after tenant. Lees meer

   Once those are fixed, the risk moves. Passkeys, privileged access and Conditional Access put more locks on the front door, the user sign-in. An app that was consented to years ago, holds a client secret and still has a stale redirect URI is a back door that none of those locks cover.

   Brandon is a Senior Security Consultant at TrustedSec and a Microsoft Security MVP. He came from systems administration, learned Active Directory security at Trimarc, and now spends his days on cloud and on-premises assessments and the remediation that follows. These are the gaps he checks first, and the app and consent settings he has moved on to.

   Security defaults can cover more admins than your policies

   The free tier can be stricter than the paid one. Security defaults require MFA for 16 administrator roles. The Microsoft-managed policy “Multifactor authentication for admins accessing Microsoft Admin Portals”, and the “Require MFA for admins” template it mirrors, cover 14. The two extra roles in security defaults are Authentication Policy Administrator and Identity Governance Administrator.

   If a small tenant is on security defaults, think hard before switching it off: the moment you do, you lose protections that you then have to rebuild in Conditional Access yourself.

   Sponsored by:

   ENow Software Introduces New Entra ID App Onboarding Experience

   As user requests for SaaS and AI applications increase, Entra ID and M365 teams face a growing volume of security reviews, added hours of manual research, and bottlenecks.

   New! ENow App Governance Accelerator 4.0 introduces App Onboarding, he…

3. Stop the Bleeding: Cleaning Up Apps, Secrets and Consent in Microsoft Entra

   17 oktober 2026 · 51 min

   Afspelen
   Most tenants have the same problem: hundreds of app registrations and service principals, client secrets that were set to expire in a hundred years, permission grants nobody remembers approving, and test tenants that were never cleaned up. It’s tempting to start fixing the scariest app on the list. Jeff Sakowicz argues for a different order: stop the problem from growing first, then remove the debt that gives you the most risk reduction for the least disruption. Lees meer

   Jeff isn’t describing someone else’s product. He has spent most of his 14 years at Microsoft as a product leader on the Entra application platform, shaping the application and service principal model and the OAuth permissions and consent model that every Entra tenant runs on today. Publisher verification and risk-based step-up consent came out of that work, and he now leads part of the team building the platform behind Microsoft Entra Agent ID. Inside Microsoft, he’s the person teams call when an app incident needs untangling. This is his playbook for securing non-human identities, from client secret burndown and unused apps to consent phishing and the protections Microsoft runs in every tenant by default.

   Prevention starts with policy

   The best medicine is prevention. Before you clean anything up, go through the policy controls you already have and set them to block insecure configuration that doesn’t fit your organization’s risk tolerance. This is a balance, not a switch. “If you want the most secure system in the world, unplug the server, bury it underground. Your job is done.” Lock things down too hard and developers and end users will find other ways to get work done, especially now that they have agents to help them. Shadow IT is almost always less secure than what you stopped. So whenever a control blocks self-service, make sure people know what to do next and how to get unblocked quickly.

   Treat high-value apps as production infrastructure

   Microsoft runs customer-facing apps in tenants separate f…

4. Stolen Tokens, Agents and Universal CAE: What Global Secure Access Adds to Entra ID

   9 oktober 2026 · 50 min

   Afspelen
   A phished and stolen refresh token is one of the most useful things an attacker can take from your tenant. It is a long-term artifact, which is why so many phishing attempts go after it. Alex Pavlovsky’s answer to that attack is a feature every Entra ID P1 tenant already owns. Lees meer

   Compliant network is part of Global Secure Access, and, like source IP restoration, it comes with Entra ID P1. Put the GSA client on your devices, add one Conditional Access policy that blocks access from anywhere outside the All Compliant Network locations named location, and a stolen refresh token or PRT cookie no longer works from the attacker’s own machine. As Alex puts it, the token itself does not become bound, but your use of it is gated by being on your organization’s compliant network.

   Merill is joined by two former colleagues who are Microsoft Entra PMs: Alexander (Alex) Pavlovsky from the Global Secure Access feature team, and Marilee Turscak, who works on helping customers adopt AI safely. They explain why Microsoft built networking into identity, walk through the compliant network policy and a BYOD sign-in with no client installed, and demo a network policy that stops an agent from deleting a file its user is allowed to delete.

   Why a stolen token stops working

   For phishing itself, Alex is clear that the main line of defence is still stronger credentials that do not involve passwords. Compliant network helps with what comes after: the newer attack patterns where refresh tokens are stolen and replayed.

   If your tenant-wide policy says you can only authenticate from a compliant network, you can also only replay refresh tokens from a compliant network. PRTs become unusable unless they are used from a device that has GSA, which means your organization’s device. Alex says the same applies to ROADtools-style attacks with PRT cookies: none of that works with compliant network in place. The signal is also tenant-specific. A GSA device in tenant B satisfies compliant network in tenant …

5. Your AI Coding Agent Is Creating Secrets You Don’t Know About

   2 oktober 2026 · 34 min

   Afspelen
   Ask a coding agent to build something that talks to another service and watch what it does. It creates a client secret. Then another one. As Arturo Lucatero puts it, next thing you know you have ten secrets that were created without you knowing about it. At the speed AI is moving, he thinks we could be cleaning up a few million new secrets within six months. Lees meer

   That would undo a lot of hard work. Under Microsoft’s Secure Future Initiative, Microsoft spent years removing secrets from its own estate and helping customers do the same with managed identities and workload identity federation. The agent era is the window to make secretless the default before the habit sets in.

   Arturo is a Principal Product Manager on Microsoft Entra Agent ID, and he helped launch Managed Service Identity, the feature we now call Managed Identities for Azure resources. In this episode he and Merill trace the whole path: why secrets break, how managed identity takes them away inside Azure, how workload identity federation extends that to AWS, GCP, Azure Arc and now AI vendors like Anthropic, and what that means for agents.

   Secrets work until they don’t

   A service principal with a client secret works. It works right up to the moment it gets leaked, expires in the middle of an important job, or turns out to have no clear owner, no rotation plan and no one who knows where it is stored. Managed identity moves that whole burden to the platform. The secret still exists, but the developer never sees it. The admin’s job shrinks to control-plane questions: which resource, which identity, and what it can access. Arturo also hints at what comes next: binding managed identity tokens to the resource so a leaked token is useless anywhere else.

   Beyond Azure

   Not every workload or data source lives in Azure. Workload identity federation lets a workload present a token from an identity provider you already trust, such as AWS, Google Cloud, GitHub or Kubernetes, and exchange it for an Entra token with no s…

6. Active Directory Security Testing in Maester 2.2

   17 september 2026 · 37 min

   Afspelen
   Active Directory is not dead. It is nearly thirty years old, Microsoft is still shipping new capabilities and new telemetry for it, and most of the forests running today will outlive the people currently administering them. What has changed is that you can now test it the same way you test your cloud tenant. Lees meer

   Maester, the open-source PowerShell testing framework, added Active Directory coverage: 269 opt-in checks across 19 areas, from users, groups, computers and service principal names through GPO state, DACLs, DNS, trusts, replication and schema. They run against your domain, not your tenant, and they are off unless you explicitly connect to Active Directory.

   Mike Soule, who wrote and validated that test suite, and Sam Erde, Microsoft MVP and author of DLLPickle, join Merill at HIP Conf in Nashville to go through what the tests cover, how to run them safely, and where the project is heading.

   Sponsored by:

   Is Each App in Entra ID Still Worth Governing?

   App registrations and enterprise applications accumulate. Owners change. Projects and pilots end. Credentials linger. And stale or unused apps and their permissions can continue adding risk and governance overhead long after their purpose is gone.

   ENow App Governance Accelerator helps you understand what’s in your Entra ID application estate, who owns it, which apps, permissions, and credentials need attention, and what can safely be cleaned up to reduce your attack surface on a continuous basis as your tenant grows and changes.

   Get the visibility and automated workflows you need to investigate application lifecycles at scale, clear out stale apps, and stop wasting time governing applications that shouldn’t still be there in the first place.

   Operational health is not the same as a security finding

   The design decision that makes these tests usable is the split between operational patterns and security controls. Six groups nested in a row is not a vulnerability. Nesting is an intentional, functional capability…

7. Microsoft Security Architect: Active Directory Is 10x Harder to Defend Than Entra

   7 september 2026 · 59 min

   Afspelen
   At Black Hat USA 2026, Microsoft’s David Weston put three numbers on a slide that anyone still running domain controllers should sit with. The Microsoft Security Response Center went from 80 patches in February to 1,142 at the July Patch Tuesday. The fastest observed breakout time dropped from 98 minutes to 27 seconds. And mean time-to-exploit flipped from 63 days after a patch shipped to seven days before the patch existed. Lees meer

   Tarek Dawoud, Lead Architect on the Technical Excellence Team in Microsoft Security, walks Merill through those slides and then draws the conclusion for identity teams in his own words: “Active Directory is like 10x harder to defend than Entra.” If you do not already have a plan to move off AD, he says, sit down and write one.

   He also says how Microsoft handles this itself. Most of Microsoft’s own servers run in the cloud, its front ends run with no domain at all, and on-prem AD survives mainly as a dial-tone service: the thing they need to bring Azure up from scratch, and not much else.

   Tarek is back on Entra.Chat, and he was privy to a small part of Project Glasswing, where Microsoft got early access to Anthropic’s Mythos-class models to find vulnerabilities in its own products before attackers could. The red-team community was cynical at the time; what Microsoft saw internally was, in his words, “very concerning. Those things were damn good.” From there he builds Weston’s argument: the whole security industry rests on an assumption of scarcity. Vulnerabilities are rare, exploits are expensive, and attackers have recognisable tactics, techniques and procedures. Patch-and-pray works when bugs arrive slowly. TTP-based detection works when a human crew reuses its playbook. When a risk is small, driving it smaller is worth the money; as Tarek puts it, “if something has a 95% possibility of happening, pushing it down to 80% doesn’t change anymore.” The Hugging Face intrusion (an OpenAI agent, and not a deliberate attack, as Merill is quick to n…

8. How General Motors Moved 200,000 People to Passkeys

   31 augustus 2026 · 44 min

   Afspelen
   Microsoft starts making passkeys the default in Microsoft Entra ID on 1 September 2026, and retires Microsoft-provided SMS and voice MFA on 1 February 2027. Every organisation with a large, messy population now has to answer a question that has nothing to do with passkey technology itself: how do you move a hundred thousand real people - office workers, factory floors, call centres and guests - without locking someone out? Lees meer

   In this episode, Merill sits down with the person who has already done it. Andrew Cameron is a Distinguished Engineer for Identity and Cybersecurity at General Motors, and he has spent roughly 25 years there, long enough to have started on the employee portal as a web architect in 2000, and then helped build the identity function that now carries one of the world’s largest passwordless deployments.

   The single biggest lever, Andrew says, was almost embarrassingly simple. GM treated Windows Hello as an optional convenience for years, then realised that an already-managed Windows device is a passkey. About 100,000 people were enabled through Windows Hello alone - no roaming key, no phone, no authenticator juggling. Platform SSO now extends the same idea to Mac through the secure enclave.

   The sequence matters as much as the tools. Admin roles came first, required to carry a device-bound passkey with Azure PIM forcing the stronger method through activation. Then Conditional Access did the rollout: a small group of eager users, audit mode, and then add apps and expand outward. Andrew’s practical tip is to target the big, heavily used apps before chasing every user - it often gets you to 80% coverage faster.

   Then the conversation turns to the corners most passkey explainers skip. Manufacturing workers who cannot use a phone and do not have a keyboard. Guest accounts - suppliers, dealerships and contractors - whose source tenant must also enable passkeys before the journey can complete. Call-centre users on unmanaged devices. And VDI, where certifica…

9. Microsoft Entra memberOf Retirement: What Admins Must Do

   25 augustus 2026 · 43 min

   Afspelen
   On 3 November 2026, the memberOf operator in Microsoft Entra dynamic membership groups stops working. Nothing errors. Nothing breaks loudly. Every dynamic group, dynamic administrative unit and entitlement management auto-assignment policy that uses it simply freezes in its last known state the people who should be added are not added, and the people who should be removed stay. Lees meer

   It was a preview feature for four years. It is in a lot of production tenants.

   In this episode of Entra.Chat, Merill is joined by three guests for the first time: Gregor Reimling, Chief Azure Technologist at adesso SE and Microsoft MVP for Azure and Security; René Wasel, a Microsoft 365 specialist and Microsoft MVP; and returning guest Eric Woodruff, Chief Identity Architect at Semperis. Gregor and René co-organise the Cloud Identity Summit, which happens to fall on the same date the deprecation lands.

   The conversation starts with the deadline and quickly becomes something more useful: an honest audit of what groups in Entra actually do, versus what administrators assume they do.

   The memberOf operator existed because Entra does not resolve nested groups the way Active Directory does. It was a flattening trick — take the members of several groups and produce one flat group that applications, licensing and policies could read. With it going away, the panel walks through the realistic replacements: move to supported attribute-based rules where an attribute exists, stamp an attribute with PowerShell where one does not, or convert the group to assigned membership and script it. Gregor and René both raise the version of this that is easy to forget — a rule written years ago that nobody documented, using a sync rule editor nobody wants to reopen.

   Then the discussion turns to the part that is not on any deprecation notice. Nested groups are supported in Conditional Access. They are not supported for group-based licensing, where only first-level members get a licence. They are not supported for …

10. Pass-the-Passkey: What Michael Grafnetter's Black Hat Research Means for Entra Admins

    17 augustus 2026 · 36 min

    Afspelen
    Passkeys are phishing-resistant. But that resistance is enforced by your browser, which binds every authentication to the origin that requested it. Skip the browser, and the guarantee weakens. Lees meer

    In this episode of Entra.Chat, I spoke with Michael Grafnetter, Principal Security Researcher at SpecterOps and Microsoft MVP, about the Pass-the-Passkey research he presented at Black Hat USA 2026. A family of attacks against passkey implementations across Windows, Microsoft Entra ID, browsers and password managers.

    Michael starts with the vulnerability chain he reported to Microsoft. Windows was writing the complete passkey assertion into the event log, and Microsoft Entra ID would accept a replay of that assertion for up to ten minutes. Any user able to read those logs including a member of Remote Desktop Users on a shared server, or unprivileged malware quietly reading event logs without tripping EDR could impersonate whoever had just signed in. If that person was a Global Administrator, so was the attacker. Windows now truncates the logged message, and Microsoft Entra ID checks authenticator signature counters to reject replays.

    One clarification Michael is emphatic about: private keys were never written to the event log. They stay bound to the TPM or never leave the security key at all. What leaked were the short-lived digital signatures made by those keys and for this attack, that was enough.

    We also covered the attacks that do not depend on any single bug. Malware running without administrator rights can call the native Windows WebAuthn APIs directly and raise a passkey prompt flood that keeps returning until the user gives in and approves it. Synced passkeys, exported from a password manager and decrypted with a keylogged password, hand an attacker a credential with no ten-minute limit at all. And a browser-hooking technique Michael calls a passkey detour attack quietly redirects a legitimate assertion into the attacker’s own session.

    The defensive thread runnin…

Alle 83 afleveringen →