Entra.Chat

Alle afleveringen

83 afleveringen, van nieuw naar oud

1. Entra Multi-Tenant App Mistakes Every SaaS Builder and Admin Should Know, with Kelvin Tegelaar

   31 oktober 2026 · 43 min

   Afspelen
   Most SaaS vendors connect to your tenant with one multitenant app and one credential, shared by every customer. Kelvin Tegelaar, founder of CyberDrain and creator of CIPP (used by well over 10,000 MSPs), sees it from both sides, and his verdict is blunt: “This app is dangerous, period.” Lees meer

   Recorded on 14 October 2026, one day before the ConnectWise Cloud Backup app’s credential was used to sign in to customer tenants (173 confirmed by Huntress).

   Key takeaways

   The risk: one app, every tenant

   * One app registration, a service principal in every tenant. The credentials sit on the vendor’s app registration, so one leaked secret or certificate works in every tenant that consented, with whatever application permissions you granted. For MSP tools, GDAP widens it to every customer behind the partner.

   * You can’t put Conditional Access on a vendor’s app. Conditional Access for workload identities covers single-tenant apps only. Watch vendor apps’ sign-ins, ask vendors how they protect their credentials, and know where the Enabled for users to sign-in? switch is so you can disable an app fast.

   Fix the credentials

   * Retire client secrets; let certificates rotate themselves. Prefer managed identity or federation; otherwise use short-lived certificates. CIPP’s last 30 days and are replaced every two weeks with Microsoft Graph addKey/removeKey, not by granting the app Application.ReadWrite.All.

   * Turn on app management policies. Block new client secrets and cap credential lifetimes. The tenant default policy is off until you enable it.

   * Lock your app’s service principals. Builders: keep app instance property lock on (the default for new apps since June 2026), so customer tenants can’t add their own credentials to your app.

   Fix the architecture

   * Build one app per customer tenant. A leak in tenant A then stays in tenant A. It costs some engineering; one central app is “choosing convenience”, which is fine only if you choose it knowingly.

   * Keep the apps you ship out of …

2. Conditional Access Gaps and the App Back Door, with Brandon Colley

   24 oktober 2026 · 39 min

   Afspelen
   Most Conditional Access gaps aren’t exotic. They come from reading policies the wrong way: as firewall rules with an “allow”, as a list of platforms that seems complete, as an MFA exception for the office that made sense years ago. Brandon Colley has reviewed well over a thousand Conditional Access policies in customer assessments, and the same handful of mistakes come up in tenant after tenant. Lees meer

   Once those are fixed, the risk moves. Passkeys, privileged access and Conditional Access put more locks on the front door, the user sign-in. An app that was consented to years ago, holds a client secret and still has a stale redirect URI is a back door that none of those locks cover.

   Brandon is a Senior Security Consultant at TrustedSec and a Microsoft Security MVP. He came from systems administration, learned Active Directory security at Trimarc, and now spends his days on cloud and on-premises assessments and the remediation that follows. These are the gaps he checks first, and the app and consent settings he has moved on to.

   Security defaults can cover more admins than your policies

   The free tier can be stricter than the paid one. Security defaults require MFA for 16 administrator roles. The Microsoft-managed policy “Multifactor authentication for admins accessing Microsoft Admin Portals”, and the “Require MFA for admins” template it mirrors, cover 14. The two extra roles in security defaults are Authentication Policy Administrator and Identity Governance Administrator.

   If a small tenant is on security defaults, think hard before switching it off: the moment you do, you lose protections that you then have to rebuild in Conditional Access yourself.

   Sponsored by:

   ENow Software Introduces New Entra ID App Onboarding Experience

   As user requests for SaaS and AI applications increase, Entra ID and M365 teams face a growing volume of security reviews, added hours of manual research, and bottlenecks.

   New! ENow App Governance Accelerator 4.0 introduces App Onboarding, he…

3. Stop the Bleeding: Cleaning Up Apps, Secrets and Consent in Microsoft Entra

   17 oktober 2026 · 51 min

   Afspelen
   Most tenants have the same problem: hundreds of app registrations and service principals, client secrets that were set to expire in a hundred years, permission grants nobody remembers approving, and test tenants that were never cleaned up. It’s tempting to start fixing the scariest app on the list. Jeff Sakowicz argues for a different order: stop the problem from growing first, then remove the debt that gives you the most risk reduction for the least disruption. Lees meer

   Jeff isn’t describing someone else’s product. He has spent most of his 14 years at Microsoft as a product leader on the Entra application platform, shaping the application and service principal model and the OAuth permissions and consent model that every Entra tenant runs on today. Publisher verification and risk-based step-up consent came out of that work, and he now leads part of the team building the platform behind Microsoft Entra Agent ID. Inside Microsoft, he’s the person teams call when an app incident needs untangling. This is his playbook for securing non-human identities, from client secret burndown and unused apps to consent phishing and the protections Microsoft runs in every tenant by default.

   Prevention starts with policy

   The best medicine is prevention. Before you clean anything up, go through the policy controls you already have and set them to block insecure configuration that doesn’t fit your organization’s risk tolerance. This is a balance, not a switch. “If you want the most secure system in the world, unplug the server, bury it underground. Your job is done.” Lock things down too hard and developers and end users will find other ways to get work done, especially now that they have agents to help them. Shadow IT is almost always less secure than what you stopped. So whenever a control blocks self-service, make sure people know what to do next and how to get unblocked quickly.

   Treat high-value apps as production infrastructure

   Microsoft runs customer-facing apps in tenants separate f…

4. Stolen Tokens, Agents and Universal CAE: What Global Secure Access Adds to Entra ID

   9 oktober 2026 · 50 min

   Afspelen
   A phished and stolen refresh token is one of the most useful things an attacker can take from your tenant. It is a long-term artifact, which is why so many phishing attempts go after it. Alex Pavlovsky’s answer to that attack is a feature every Entra ID P1 tenant already owns. Lees meer

   Compliant network is part of Global Secure Access, and, like source IP restoration, it comes with Entra ID P1. Put the GSA client on your devices, add one Conditional Access policy that blocks access from anywhere outside the All Compliant Network locations named location, and a stolen refresh token or PRT cookie no longer works from the attacker’s own machine. As Alex puts it, the token itself does not become bound, but your use of it is gated by being on your organization’s compliant network.

   Merill is joined by two former colleagues who are Microsoft Entra PMs: Alexander (Alex) Pavlovsky from the Global Secure Access feature team, and Marilee Turscak, who works on helping customers adopt AI safely. They explain why Microsoft built networking into identity, walk through the compliant network policy and a BYOD sign-in with no client installed, and demo a network policy that stops an agent from deleting a file its user is allowed to delete.

   Why a stolen token stops working

   For phishing itself, Alex is clear that the main line of defence is still stronger credentials that do not involve passwords. Compliant network helps with what comes after: the newer attack patterns where refresh tokens are stolen and replayed.

   If your tenant-wide policy says you can only authenticate from a compliant network, you can also only replay refresh tokens from a compliant network. PRTs become unusable unless they are used from a device that has GSA, which means your organization’s device. Alex says the same applies to ROADtools-style attacks with PRT cookies: none of that works with compliant network in place. The signal is also tenant-specific. A GSA device in tenant B satisfies compliant network in tenant …

5. Your AI Coding Agent Is Creating Secrets You Don’t Know About

   2 oktober 2026 · 34 min

   Afspelen
   Ask a coding agent to build something that talks to another service and watch what it does. It creates a client secret. Then another one. As Arturo Lucatero puts it, next thing you know you have ten secrets that were created without you knowing about it. At the speed AI is moving, he thinks we could be cleaning up a few million new secrets within six months. Lees meer

   That would undo a lot of hard work. Under Microsoft’s Secure Future Initiative, Microsoft spent years removing secrets from its own estate and helping customers do the same with managed identities and workload identity federation. The agent era is the window to make secretless the default before the habit sets in.

   Arturo is a Principal Product Manager on Microsoft Entra Agent ID, and he helped launch Managed Service Identity, the feature we now call Managed Identities for Azure resources. In this episode he and Merill trace the whole path: why secrets break, how managed identity takes them away inside Azure, how workload identity federation extends that to AWS, GCP, Azure Arc and now AI vendors like Anthropic, and what that means for agents.

   Secrets work until they don’t

   A service principal with a client secret works. It works right up to the moment it gets leaked, expires in the middle of an important job, or turns out to have no clear owner, no rotation plan and no one who knows where it is stored. Managed identity moves that whole burden to the platform. The secret still exists, but the developer never sees it. The admin’s job shrinks to control-plane questions: which resource, which identity, and what it can access. Arturo also hints at what comes next: binding managed identity tokens to the resource so a leaked token is useless anywhere else.

   Beyond Azure

   Not every workload or data source lives in Azure. Workload identity federation lets a workload present a token from an identity provider you already trust, such as AWS, Google Cloud, GitHub or Kubernetes, and exchange it for an Entra token with no s…

6. Active Directory Security Testing in Maester 2.2

   17 september 2026 · 37 min

   Afspelen
   Active Directory is not dead. It is nearly thirty years old, Microsoft is still shipping new capabilities and new telemetry for it, and most of the forests running today will outlive the people currently administering them. What has changed is that you can now test it the same way you test your cloud tenant. Lees meer

   Maester, the open-source PowerShell testing framework, added Active Directory coverage: 269 opt-in checks across 19 areas, from users, groups, computers and service principal names through GPO state, DACLs, DNS, trusts, replication and schema. They run against your domain, not your tenant, and they are off unless you explicitly connect to Active Directory.

   Mike Soule, who wrote and validated that test suite, and Sam Erde, Microsoft MVP and author of DLLPickle, join Merill at HIP Conf in Nashville to go through what the tests cover, how to run them safely, and where the project is heading.

   Sponsored by:

   Is Each App in Entra ID Still Worth Governing?

   App registrations and enterprise applications accumulate. Owners change. Projects and pilots end. Credentials linger. And stale or unused apps and their permissions can continue adding risk and governance overhead long after their purpose is gone.

   ENow App Governance Accelerator helps you understand what’s in your Entra ID application estate, who owns it, which apps, permissions, and credentials need attention, and what can safely be cleaned up to reduce your attack surface on a continuous basis as your tenant grows and changes.

   Get the visibility and automated workflows you need to investigate application lifecycles at scale, clear out stale apps, and stop wasting time governing applications that shouldn’t still be there in the first place.

   Operational health is not the same as a security finding

   The design decision that makes these tests usable is the split between operational patterns and security controls. Six groups nested in a row is not a vulnerability. Nesting is an intentional, functional capability…

7. Microsoft Security Architect: Active Directory Is 10x Harder to Defend Than Entra

   7 september 2026 · 59 min

   Afspelen
   At Black Hat USA 2026, Microsoft’s David Weston put three numbers on a slide that anyone still running domain controllers should sit with. The Microsoft Security Response Center went from 80 patches in February to 1,142 at the July Patch Tuesday. The fastest observed breakout time dropped from 98 minutes to 27 seconds. And mean time-to-exploit flipped from 63 days after a patch shipped to seven days before the patch existed. Lees meer

   Tarek Dawoud, Lead Architect on the Technical Excellence Team in Microsoft Security, walks Merill through those slides and then draws the conclusion for identity teams in his own words: “Active Directory is like 10x harder to defend than Entra.” If you do not already have a plan to move off AD, he says, sit down and write one.

   He also says how Microsoft handles this itself. Most of Microsoft’s own servers run in the cloud, its front ends run with no domain at all, and on-prem AD survives mainly as a dial-tone service: the thing they need to bring Azure up from scratch, and not much else.

   Tarek is back on Entra.Chat, and he was privy to a small part of Project Glasswing, where Microsoft got early access to Anthropic’s Mythos-class models to find vulnerabilities in its own products before attackers could. The red-team community was cynical at the time; what Microsoft saw internally was, in his words, “very concerning. Those things were damn good.” From there he builds Weston’s argument: the whole security industry rests on an assumption of scarcity. Vulnerabilities are rare, exploits are expensive, and attackers have recognisable tactics, techniques and procedures. Patch-and-pray works when bugs arrive slowly. TTP-based detection works when a human crew reuses its playbook. When a risk is small, driving it smaller is worth the money; as Tarek puts it, “if something has a 95% possibility of happening, pushing it down to 80% doesn’t change anymore.” The Hugging Face intrusion (an OpenAI agent, and not a deliberate attack, as Merill is quick to n…

8. How General Motors Moved 200,000 People to Passkeys

   31 augustus 2026 · 44 min

   Afspelen
   Microsoft starts making passkeys the default in Microsoft Entra ID on 1 September 2026, and retires Microsoft-provided SMS and voice MFA on 1 February 2027. Every organisation with a large, messy population now has to answer a question that has nothing to do with passkey technology itself: how do you move a hundred thousand real people - office workers, factory floors, call centres and guests - without locking someone out? Lees meer

   In this episode, Merill sits down with the person who has already done it. Andrew Cameron is a Distinguished Engineer for Identity and Cybersecurity at General Motors, and he has spent roughly 25 years there, long enough to have started on the employee portal as a web architect in 2000, and then helped build the identity function that now carries one of the world’s largest passwordless deployments.

   The single biggest lever, Andrew says, was almost embarrassingly simple. GM treated Windows Hello as an optional convenience for years, then realised that an already-managed Windows device is a passkey. About 100,000 people were enabled through Windows Hello alone - no roaming key, no phone, no authenticator juggling. Platform SSO now extends the same idea to Mac through the secure enclave.

   The sequence matters as much as the tools. Admin roles came first, required to carry a device-bound passkey with Azure PIM forcing the stronger method through activation. Then Conditional Access did the rollout: a small group of eager users, audit mode, and then add apps and expand outward. Andrew’s practical tip is to target the big, heavily used apps before chasing every user - it often gets you to 80% coverage faster.

   Then the conversation turns to the corners most passkey explainers skip. Manufacturing workers who cannot use a phone and do not have a keyboard. Guest accounts - suppliers, dealerships and contractors - whose source tenant must also enable passkeys before the journey can complete. Call-centre users on unmanaged devices. And VDI, where certifica…

9. Microsoft Entra memberOf Retirement: What Admins Must Do

   25 augustus 2026 · 43 min

   Afspelen
   On 3 November 2026, the memberOf operator in Microsoft Entra dynamic membership groups stops working. Nothing errors. Nothing breaks loudly. Every dynamic group, dynamic administrative unit and entitlement management auto-assignment policy that uses it simply freezes in its last known state the people who should be added are not added, and the people who should be removed stay. Lees meer

   It was a preview feature for four years. It is in a lot of production tenants.

   In this episode of Entra.Chat, Merill is joined by three guests for the first time: Gregor Reimling, Chief Azure Technologist at adesso SE and Microsoft MVP for Azure and Security; René Wasel, a Microsoft 365 specialist and Microsoft MVP; and returning guest Eric Woodruff, Chief Identity Architect at Semperis. Gregor and René co-organise the Cloud Identity Summit, which happens to fall on the same date the deprecation lands.

   The conversation starts with the deadline and quickly becomes something more useful: an honest audit of what groups in Entra actually do, versus what administrators assume they do.

   The memberOf operator existed because Entra does not resolve nested groups the way Active Directory does. It was a flattening trick — take the members of several groups and produce one flat group that applications, licensing and policies could read. With it going away, the panel walks through the realistic replacements: move to supported attribute-based rules where an attribute exists, stamp an attribute with PowerShell where one does not, or convert the group to assigned membership and script it. Gregor and René both raise the version of this that is easy to forget — a rule written years ago that nobody documented, using a sync rule editor nobody wants to reopen.

   Then the discussion turns to the part that is not on any deprecation notice. Nested groups are supported in Conditional Access. They are not supported for group-based licensing, where only first-level members get a licence. They are not supported for …

10. Pass-the-Passkey: What Michael Grafnetter's Black Hat Research Means for Entra Admins

    17 augustus 2026 · 36 min

    Afspelen
    Passkeys are phishing-resistant. But that resistance is enforced by your browser, which binds every authentication to the origin that requested it. Skip the browser, and the guarantee weakens. Lees meer

    In this episode of Entra.Chat, I spoke with Michael Grafnetter, Principal Security Researcher at SpecterOps and Microsoft MVP, about the Pass-the-Passkey research he presented at Black Hat USA 2026. A family of attacks against passkey implementations across Windows, Microsoft Entra ID, browsers and password managers.

    Michael starts with the vulnerability chain he reported to Microsoft. Windows was writing the complete passkey assertion into the event log, and Microsoft Entra ID would accept a replay of that assertion for up to ten minutes. Any user able to read those logs including a member of Remote Desktop Users on a shared server, or unprivileged malware quietly reading event logs without tripping EDR could impersonate whoever had just signed in. If that person was a Global Administrator, so was the attacker. Windows now truncates the logged message, and Microsoft Entra ID checks authenticator signature counters to reject replays.

    One clarification Michael is emphatic about: private keys were never written to the event log. They stay bound to the TPM or never leave the security key at all. What leaked were the short-lived digital signatures made by those keys and for this attack, that was enough.

    We also covered the attacks that do not depend on any single bug. Malware running without administrator rights can call the native Windows WebAuthn APIs directly and raise a passkey prompt flood that keeps returning until the user gives in and approves it. Synced passkeys, exported from a password manager and decrypted with a keylogged password, hand an attacker a credential with no ten-minute limit at all. And a browser-hooking technique Michael calls a passkey detour attack quietly redirects a legitimate assertion into the attacker’s own session.

    The defensive thread runnin…

11. From SMS MFA to Passkeys: A Practical Microsoft Entra Migration Plan

    11 augustus 2026 · 53 min

    Afspelen
    Microsoft-managed SMS and voice MFA will stop working on February 1, 2027. That deadline makes passkey planning urgent, but enabling a new authentication method is only the first milestone. Lees meer

    In this episode of Entra.Chat, Merill speaks with Jai Maharaj, Product Manager at Microsoft, about the practical journey from legacy MFA to a passwordless Microsoft Entra environment. Jai explains what is actually being retired, why organizations can still use a customer-managed telecom provider, and how passkey profiles support synced and device-bound passkeys for different user personas.

    The user-experience case is compelling: Microsoft reports roughly 69 seconds for password plus traditional MFA compared with about three seconds for a synced passkey. The security case is stronger still. Passkeys resist phishing by design, but Jai stresses that deploying them does not make an organization phishing-resistant until it enforces the right authentication strength and addresses the passwords and legacy applications still in the environment.

    The conversation then follows the complete identity lifecycle. How do you ensure the right person receives a passkey during onboarding? How do you verify someone requesting a sensitive role? How do you recover an account without relying on knowledge-based help-desk questions? Jai connects those scenarios to Microsoft Entra Verified ID, verifiable credentials, Face Check, identity verification partners, and self-service account recovery.

    Sponsored by

    Scan, Score, and Secure Your Applications in Entra

    Application identities represent one of the largest attack surfaces in Entra and are often among the least consistently governed. ENow AppGov Score helps IT and identity teams understand where risk exists. Its 25-check assessment evaluates Entra ID application integrations against Microsoft-recommended governance practices, analyzing:

    * App registrations and enterprise apps for excessive permissions

    * Expired or unmanaged secrets and certifica…

12. The Ultimate Microsoft Entra Global Secure Access Migration Guide

    3 augustus 2026 · 49 min

    Afspelen
    An Entra GSA migration should not mean throwing away years of useful SSE policy work and rebuilding every application, segment, and rule by hand. Lees meer

    Existing configuration carries hard-won intent: which populations need access, which destinations should be blocked, and which exceptions keep the business running. Migrate2GSA creates a path to preserve the useful parts while making the migration a deliberate cleanup opportunity.

    In this episode of Entra.Chat, I spoke with Andres Canello, Principal Product Manager at Microsoft and creator of Migrate2GSA. Andres demonstrates how the open-source toolkit exports configuration from third-party products, converts it into a common CSV schema, gives administrators an intentional review step, and provisions the approved configuration into Global Secure Access through Microsoft Graph.

    The goal is not to configure the product end to end or remove human judgment. Andres describes it as a way to accelerate the repetitive 80%. Conflicting segments default to “do not provision,” existing applications are skipped, generated Conditional Access policies remain disabled, and there is no delete API call in the toolkit.

    The conversation also covers greenfield provisioning, backup and restore, reusable consultant baselines, and the unusual development story behind more than 30,000 lines of PowerShell. Andres explains why detailed, published specifications produced better AI-generated code than incremental prompting—and why the intent and edge cases in an open-source contribution matter more than who typed the implementation.

    Subscribe with your favorite podcast player or watch on YouTube.

    About Andres Canello

    Andres Canello is a Principal Product Manager at Microsoft, where he works at the intersection of modern identity and Secure Service Edge. Over his 15 years at Microsoft, he was a founding member of the Entra Global Secure Access team, helping shape the product before it launched, and has since guided some of the largest identity…

13. Why Entra Admins Need Microsoft Purview Now

    28 juli 2026 · 54 min

    Afspelen
    Conditional Access no longer begins and ends with identity signals. Lees meer

    Microsoft Purview can now influence the controls Entra administrators are asked to implement. From insider-risk conditions in Conditional Access to inline protection for sensitive data moving toward unsanctioned AI apps. That means Entra teams need enough Purview knowledge to understand what triggers a policy, how users experience it, and who should respond when an alert fires.

    In this episode of Entra.Chat, Merill speaks with Ray Reyes, Principal Security Consultant at Engage Squared and author of Mastering Microsoft Purview Deployment in the Era of AI. Ray explains Data Loss Prevention and Insider Risk Management in plain language, then follows their integrations into Microsoft Entra ID, Microsoft Defender XDR, and Global Secure Access.

    The conversation moves beyond product configuration. A policy can be technically simple and still require identity, network, data-security, HR, management, and data-owner teams to agree on scope, ownership, education, escalation, and remediation. Ray’s practical advice is to understand the neighbouring Microsoft security products at a high level and deploy Purview gradually: start in audit mode or with a limited group, learn from the impact, and expand with the business.

    Ray also shares the story of the charity he and his wife started in Nepal, how it grew from supporting roughly 30 street children to reaching thousands, and how that chapter changed his perspective on work and stress. He and Merill close with an honest discussion about burnout, layoffs, gratitude, personal branding, and building a career safety net outside any one employer.

    Sponsored by

    Recent layoffs have left a lot of strong professionals in limbo.

    That’s why we built Sponsor a Seeker, a simple way for the community to lift each other up.

    For just $29, you can gift a full 3-month Job-Hunt Pass packed with: • Unlimited resume & job description scans • AI-powered rewrites that actually bea…

14. How Xbox Secures 70+ Entra Tenants Every Night with Maester

    20 juli 2026 · 47 min

    Afspelen
    Xbox Security runs a gaming-specific Microsoft Entra baseline across more than 70 tenants every night. Lees meer

    The scale is striking: about 50 controls, dozens of independently operated game-studio tenants, and one parallel pipeline that checks whether each environment still matches Xbox’s security intent. When a Conditional Access policy moves to report-only or a required service principal loses a permission, the next run finds it.

    In this episode of Entra.Chat, Merill speaks with Audrey Long, Principal Cloud Security Architect in Xbox Security at Microsoft, and Sam Erde, SecureShield Architect at Patriot Consulting and a Maester maintainer. Audrey explains how Xbox Security extended Maester with custom PowerShell, GitHub Actions, a multi-tenant service principal, federated identity credentials, dashboards, ticketing, and time-bound exceptions.

    The result is more than a posture report. Findings flow into an operational lifecycle with owners and deadlines. Studios get readable reports, deep links to the affected object, and remediation guidance. Security teams can answer audit questions without interrupting all the tenant admins, while the Maester pipeline keeps read-only observability separate from remediation authority.

    The conversation also covers why a Microsoft-wide baseline needs adapting for gaming acquisitions, how custom tests encode an organization’s intent, why security configuration deserves regression tests, the Investigate status Audrey’s team helped introduce, and how administrators can use AI as a first-draft assistant for PowerShell and CI/CD without outsourcing validation.

    Subscribe with your favorite podcast player or watch on YouTube

    Sponsor

    Maester Cloud turns every Maester and Microsoft Zero Trust Assessment run into a durable evidence trail. See new failures, fixes, accepted risks, and posture changes across every tenant—without digging through old HTML reports.

    * Keep 5+ years of tenant history in your chosen Azure region

    * Compare runs, sp…

15. One Compromised Agent ID Blueprint Can Cross Tenant Boundaries

    12 juli 2026 · 54 min

    Afspelen
    Microsoft Entra Agent ID uses familiar application and service-principal objects under the hood, but its one-to-many hierarchy creates a different security boundary. A blueprint can be associated with many agent identities. When that blueprint belongs to a third-party provider and is trusted across customer tenants, the provider’s credential security becomes part of every customer’s risk model. Lees meer

    In this episode of Entra.Chat, Merill speaks with Katie Knowles, Senior Security Researcher at Datadog, about her three-part security analysis of Microsoft Entra Agent ID. Katie explains the blueprint, blueprint principal, agent identity, and agent-user relationships before walking through a cross-tenant compromise demonstration: compromised blueprint credentials, enumeration of associated agents, token requests in trusting tenants, permission inspection, and selection of a useful target identity.

    That path does not automatically grant Global Administrator access. Its impact depends on what the target agent identity has been permitted to do. The important lesson is the control point: one blueprint can sit upstream of many identities, tenants, and permission sets.

    Katie and Merill also discuss tenant-owned versus vendor-owned blueprints, the Agent ID Administrator role, first-party agent creation through Microsoft platforms, why production client secrets compound the blast radius, workload identity federation, separating blueprints by risk, reusing app-registration detections, and Microsoft Entra ID Protection for agents.

    REGISTER: Hidden Risk of App Permissions in Entra ID

    Many Microsoft Entra ID environments contain third-party and custom applications with permissions that are broader than necessary, and most organizations lack visibility into how those permissions are being used. Excessive Microsoft Graph permissions and unused access increase the risk of OAuth abuse and privilege escalation.

    Join our live session on July 22 to learn how to:

    * Evaluate delegated ver…

16. Attackers Are Targeting The AI Ecosystem You Cannot See

    4 juli 2026 · 44 min

    Afspelen
    AI agent security is not just about attackers using AI. Lees meer

    It is also about attackers targeting the agent ecosystem most organizations cannot see clearly yet: MCP servers, agent skills, packages, API keys, prompts, tools, and the identity layer underneath all of it.

    In this episode, I sit down with Thomas Roccia, founder of Security Break and a former Microsoft threat researcher, to look at AI agents from the threat-intelligence side. Thomas explains why the easiest path for attackers may not be futuristic autonomous hacking. It may be the boring weak spots that already exist: malicious packages, untrusted MCP servers, hostile agent skills, leaked API keys, and AI-generated code that chooses the fastest path instead of the safest one.

    For Entra admins and security teams, this is where Agent ID, non-human identity, workload identity, logging, sponsorship, and governance start to matter. Entra Agent ID gives teams a way to identify and govern agents, but identity is only one part of the picture. You still need to understand what agents can discover, what tools they can call, what context they consume, and whether you can replay what they actually did.

    Thomas also breaks down his practical AI threat-intelligence work, including how teams can use agents for CTI, how adversarial prompts and context flooding change the risk model, and why defenders need to understand the attacker side of agent security before these systems become invisible production infrastructure.

    Sponsored by

    Secure BYOD Wi‑Fi Without MDM enrollment

    Keytos Connect is a new mobile and desktop app that makes it easy for users to connect personal and BYOD devices to enterprise and campus Wi‑Fi without shared passwords, manual certificate installs, or traditional MDM enrollment. Users simply download the app, sign in with their work or school account, and Keytos handles the rest. It also works alongside Intune, allowing organizations to continue managing corporate-owned devices while simplifying conne…

17. From Windows Core to Leading Agent ID: Vince Smith’s Microsoft Story

    28 juni 2026 · 47 min

    Afspelen
    Folks, every big thing in identity started as somebody’s late-night side quest and Vince Smith has been in the room for a lot of them. Lees meer

    In this episode of Entra Chat, Vince (the PM lead driving Microsoft Entra Agent ID) walks us back through a 25-year run at Microsoft: shipping beta products off a machine wired straight to the internet under a neighbor’s desk, owning the early RBAC and custom roles work that shaped Entra, surviving a couple of security incidents he mostly can’t talk about, and finally landing on the team building identity for AI agents.

    Along the way he owns up to the one feature name he’d take back if he could, and shares the dead-simple trick he used as a junior dev to get senior engineers to answer his questions every single time.

    But this isn’t just a war-stories episode. Vince breaks down why agents needed a brand-new kind of identity in the first place. An agent is a strange beast ‘as clumsy and unpredictable as a human, and as fast as a machine’ which means traditional anomaly detection looks at one and basically can’t tell if it’s a user or a workload gone rogue. His answer is the blueprint-and-instance model: one blueprint (think app registration) spinning up many scoped, least-privilege instances, instead of a bazillion app registrations or one over-permissioned service principal that can read everyone’s mailbox. And if you’re wondering why this matters now, Vince makes the case that as users move to passkeys, attackers just slide to the other end of the balloon: non-human identities and workloads. That’s the new frontier.

    So what should you actually do Monday morning? His advice is refreshingly un-precious: don’t wait for the perfect plan. Start green, set a standard for every new agent so you stop the bleeding from shadow AI, then stay green and slowly get green by cleaning up the mess behind you. Even just stamping a unique identifier on your agents today buys you the observability you’ll desperately want later.

    Be the river that f…

18. Shadow Admins: The Non-Human Identities Hiding in Your Entra Tenant

    20 juni 2026 · 1 uur 9 min

    Afspelen
    Not every admin in your tenant is a person. Service principals, app registrations, and the new wave of agent identities can quietly hold permissions powerful enough to own your entire environment and most orgs can’t even see them. In this episode of Entra Chat, we sits down again with Erika Zellig to expose the “shadow admins” hiding in your Entra tenant, and what to do about them. Lees meer

    What we get into:

    * Application vs. delegated API permissions and why both can be shadow admins

    * The most dangerous permissions to hunt for: Files.ReadWrite.All, Sites.FullControl.All and more.

    * How Midnight Blizzard turned secrets buried in email into full tenant compromise

    * Credential and secret sprawl why you should vault everything and move to managed identities

    * Agent identities explained, and why a “sponsor” is safer than an “owner”

    * App ownership as an attack path: lateral movement and privilege escalation

    * Locking down workload identities with conditional access

    * Deadlines that bite: EWS retirement and the ID CRL protocol retirement

    * Managed devices, and going from Zero Trust to “hero trust” without burying your help desk

    Subscribe with your favorite podcast player or watch on YouTube 👇

    Sponsored by:

    Avoiding Entra Credential Outages & Security Risks June 24 | Live Webinar | Register

    An expired client secret or certificate can break SSO, automation, integrations, and business-critical applications without warning.

    Do you know:

    ✔️ Which credentials have already expired?

    ✔️ Which applications depend on them?✔️Which credentials will expire next? ✔️Who owns those applications, and are they still used?

    Which applications should use Managed Identities instead of secrets?

    As organizations deploy more apps, automations, and AI-powered services, credential sprawl continues to grow across Entra. Join MVPs Alistair Pugin and Nicolas Blank as they walk through real-world credential failures, hidden risks, and practical strategies for identifying and remediating Ent…

19. How Microsoft Is Securing AI Agents in Entra - Conditional Access, Zero Trust & the "Block" Debate

    13 juni 2026 · 44 min

    Afspelen
    AI agents can make decisions and act faster than any human — which means your old identity security playbook no longer holds. In this episode of Entra Chat, [host name] sits down with Nikhil, a 10+ year Microsoft identity veteran from the Authentication Stack and Identity Protection team, to break down how Microsoft Entra, Conditional Access, Defender, and Purview are evolving to secure agentic AI. Lees meer

    We get into why “security = MFA” is dead, why the only recommended Conditional Access control for agents today is block (and why that’s actually good for your users), the missing “challenge” state in agent access, indirect prompt injection, and the unified risk model spanning identity, endpoint, and data layers. If you manage Microsoft Entra ID, run Zero Trust, or are figuring out how to govern AI agents in your tenant, this one’s for you.

    🔎 What you’ll learn:

    * Why agents are the new insider threat and why latency no longer protects you

    * How Conditional Access now targets agentic users and agents

    * Why “block” is the default control for agents (allow / block / challenge explained)

    * How unified risk works across Entra, Microsoft Defender & Microsoft Purview

    * Continuous Access Evaluation interrupting in-motion agent sessions

    * Why LLMs recommend insecure defaults (the device code flow problem)

    * The Conditional Access optimization agent, report-only mode & phased rollout

    * The #1 thing Entra admins and CISOs should do in the next 3–6 months

    Subscribe with your favorite podcast player or watch on YouTube 👇

    About Nikhil

    Nikhil Boreddy has spent over a decade at Microsoft, from the early Authentication Stack and Identity Protection team to the birth of Conditional Access. Today he works across Entra and Microsoft Security on one of the toughest challenges in the field: securing AI agents in the enterprise.

    LinkedIn - https://www.linkedin.com/in/nikhilboreddy/

    🔗 Related Links

    * Microsoft Entra - https://learn.microsoft.com/en-us/entra/id-protection/concept-…

20. The Learn-It-All Career Playbook for Identity and Security Pros

    6 juni 2026 · 35 min

    Afspelen
    In this episode of Entra Chat, we sit down with Christina Morillo, the Senior Director of Information Security for the New York Football Giants, to explore her inspiring transition from an identity specialist to a top-tier security leader. Christina shares her “ground floor” start at a technical help desk and her progression through network administration and specialized identity roles at Microsoft. Her story is a powerful testament to the “learn-it-all” mindset, illustrating how a deep baseline in Active Directory and a genuine curiosity about the broader security landscape paved the way for her current leadership role in a high-profile organization. Lees meer

    The conversation dives deep into the essential skills required to grow from a niche technical role into a broader Director or CISO position. Christina emphasizes that while technical proficiency is the foundation, “soft skills” such as storytelling and the ability to pitch security solutions as business value are what truly allow a leader to secure executive buy-in. She encourages professionals not to restrict themselves to one domain but to embrace both breadth and depth, leveraging community engagement to understand the shared struggles across different security verticals.

    Subscribe with your favorite podcast player or watch on YouTube 👇

    Sponsored by:

    Entra ID Credential Gaps That Cause Outages

    In Microsoft Entra ID, outages often start small: an expired client secret, or a lapsed certificate quietly breaks an integration. Traditional controls don’t easily track credential expiry, so issues surface only after something fails. Teams are left asking:

    * Which app secrets are expiring and when?

    * Which certificates are at risk?

    * How many integrations are we managing?

    Unanswered, these questions lead to avoidable outages, spikes in service desk tickets, and users losing access and bringing projects to a halt. ENow AppGov Credential Monitor continuously tracks expiring secrets and certificates across your Entra …

21. 5 Lessons from Rolling Out Passkeys to Millions of Users

    31 mei 2026 · 46 min

    Afspelen
    Passkeys are one of those technologies that sound simple on paper. Lees meer

    Turn them on.Users register them.Passwords go away.Everyone is more secure.

    But in the real world, passkey rollouts are not just an authentication setting. They are a product rollout, a user experience change, a support change, and an operational change all at once.

    In this episode, I spoke with Vincent Delitz from Corbado, who has worked on large-scale passkey deployments in customer identity scenarios, including public-sector and consumer environments with millions of users. While the examples come from the CIAM world, many of the lessons apply directly to workforce identity and Microsoft Entra deployments as well.

    Sponsored by:

    Cloud RADIUS built for Entra + Intune environments

    EZRADIUS was designed and built by ex-Microsoft engineers with deep Entra and Intune experience. It integrates seamlessly into the Microsoft ecosystem, making it easy to migrate from your on-prem NPS server to a modern, zero-trust network with full support for cloud-first and hybrid environments.

    * Deploy in minutes: no on-prem servers, no Windows updates

    * Certificate-based auth: EAP-TLS support for Microsoft Cloud PKI or any CA

    * Intune compliance checks for zero-trust Wi-Fi and VPN access

    * Built for teams of 10 to 10,000: no minimums, no enterprise gatekeeping

    * Pay only for users that connect with usage-based pricing

    Start your 30-day trial (no credit card required) or book a demo to see how “EZ” it is.

    Here are five practical lessons from the conversation.

    1. Know why you are rolling out passkeys

    Before you start the rollout, be clear on the reason.

    Most organisations adopt passkeys for one or more of these reasons:

    SecurityPasskeys are phishing-resistant and remove many of the risks that come with passwords, SMS OTP, and other phishable methods.

    User experienceSigning in with Face ID, Touch ID, Windows Hello, or a security key can be faster and easier than typing passwords and completing MFA prompt…

22. The New Control Plane for Microsoft Entra Tenant Governance

    23 mei 2026 · 49 min

    Afspelen
    Microsoft had 7 million internal tenants and almost lost control of their environment and your org might be facing the same problem at a smaller scale. In this episode, we sit down with Jeff Staiman, PM Area Lead for Tenant Governance at Microsoft, to break down the feature born from the Midnight Blizzard attack. We cover discovery, drift detection, governance relationships, secure tenant creation, licensing, and exactly where admins should start. Lees meer

    What Can Your AI Applications Access?

    Organizations are investing heavily in AI-powered applications and agents, but many are discovering they lack the operational visibility and governance discipline needed to scale AI confidently and securely.

    With continuous visibility into Entra ID applications, permissions, OAuth access, secrets, certificates, and application ownership, ENow App Governance Accelerator can:

    * Reduce uncertainty around what SaaS apps can access

    * Accelerate application reviews and approval processes

    * Strengthen operational trust across security and leadership teams

    * Prevent unmanaged application growth from becoming operational risk

    * Enable lean IT teams to support AI expansion at scale

    * Demonstrate governance maturity required for enterprise AI adoption

    While most admins focus on securing their primary production environment, many organizations are sitting on hundreds of “test” or “shadow” tenants that were created by users with a simple Azure subscription. These unmanaged environments often lack proper security bars and can become entry points for sophisticated attackers.

    The Wake-Up Call: Midnight Blizzard

    The urgency for these new features was fueled by the 2024 Midnight Blizzard attack. In that instance, attackers compromised a legacy test tenant and used its old access rights to move laterally into Microsoft’s core environment. This highlighted a critical gap: securing one tenant isn’t enough if you don’t even know how many other tenants are connected to your organization.

    Three …

23. What’s New in Microsoft Entra - May 2026: Passkeys, Agents & Cloud Sync

    16 mei 2026 · 50 min

    Afspelen
    Fabian and Thomas join the podcast to share their extensive experience and unpack the massive wave of updates coming to Microsoft Entra. Lees meer

    We talk about the massive shift toward Passkeys and registration campaigns, the impending migration from Entra Connect Sync to Cloud Sync, and the rapidly evolving world of Agent IDs and AI workloads. We also cover how Entra admins can leverage new Defender XDR features and Security Copilot agents to secure their environments.

    Subscribe with your favorite podcast player or watch on YouTube 👇

    About Fabian and Thomas

    Fabian Bader is a Microsoft MVP and Cybersecurity Architect at glueckkanja, based in Hamburg, Germany. He is a well-known researcher in the Microsoft identity space, creator of the Cloud Brothers blog, and creator of the Maester and Token Tactics V2 tools. His work focuses on Microsoft Entra and the Defender suite, helping customers secure their cloud environments.

    Thomas Naunheim is a Microsoft MVP and a Cybersecurity Architect at glueckkanja. He specializes in Microsoft Entra, identity and access management, and cloud security posture.

    * Thomas LinkedIn - https://www.linkedin.com/in/thomasnaunheim/

    * Fabian LinkedIn- https://www.linkedin.com/in/fabianbader/

    🔗 Related Links

    * What’s New in Microsoft Entra: May 2026 - https://techcommunity.microsoft.com/blog/microsoft-entra-blog/whats-new-in-microsoft-entra-may-2026/4517884

    * Claude API Docs - https://platform.claude.com/docs/en/manage-claude/wif-providers/azure

    * Microsoft Graph - https://learn.microsoft.com/en-us/graph/api/resources/agentid-platform-overview?view=graph-rest-1.0

    📗 Chapters

    00:00 Intro

    01:18 The Year of Passkeys & Registration Campaigns

    08:49 Windows Hello & Passkey Syncing

    16:37 Migrating to Entra Cloud Sync

    22:27 The Rise of Agent IDs & AI Workloads

    28:21 Defender XDR Updates for Entra Admins

    38:32 Security Copilot & Conditional Access Agent

    45:48 Access Packages & New AI Admin Roles

    Podcast Apps

    🎙️ Entra.Chat - https://entra.cha…

24. If You Manage Entra Permissions, Watch This Before Deploying Agents

    9 mei 2026 · 45 min

    Afspelen
    Microsoft Entra Agent ID Just Went GA Here’s What You Need to Know About Agent Permissions Lees meer

    If you’ve been waiting for the dust to settle on Microsoft Entra Agent ID before diving in, the wait is over. Agent ID hit General Availability on May 1st, and in this episode of Entra Chat, Erin Greenlee, a PM in the the Entra AuthN team joins to break down one of the trickiest parts of the new model: how permissions actually work.

    The three-tier model you need to understand

    The biggest mental shift with Agent ID is moving from the familiar single app registration model to a three-tier hierarchy. Here’s the short version:

    * Agent Blueprint → the template for your agent. Think of it as a souped-up app registration that lives in one tenant and defines how the agent behaves. Every agent needs one, even if you’re only ever creating a single instance.

    * Blueprint Principle → the identity that represents the blueprint inside each tenant it’s deployed to. This is the middle tier, and it has a superpower: permissions granted here cascade down to all current and future agent identity instances automatically.

    * Agent Identity → the actual running instance of the agent. This is what authenticates, what shows up in your tenant logs, and what can hold its own individual permissions on top of whatever it inherits.

    Required Resource Access is a hint, not a grant

    One thing that trips people up early: adding permissions to the blueprint’s Required Resource Access (RRA) doesn’t actually grant anything. It’s a signal to admins adopting your agent. A polite list of “here’s what this agent will need to function.” The real grant happens later, either upfront during adoption or dynamically as the agent needs it. Expect agents to lean more on dynamic consent than traditional apps have, since agents evolve and request new permissions as tasks change.

    Inheritance only works if you set it up

    Permissions granted on the Blueprint Principle will only cascade down to agent identities if the reso…

25. How to Secure Copilot Agents, Azure DevOps & Defender (+ more) with Maester 2.1 (Full Breakdown)

    2 mei 2026 · 1 uur 2 min

    Afspelen
    Maester is back with one of its biggest release since launch. In this episode, we are joined by Sam Erde, Architect at Patriot Consulting and one of Maester’s core maintainers, to walk through everything that’s landed in Maester 2.1. Lees meer

    Since the December release, the community has shipped 540 new commits, grown the test suite from 128 to 168 tests, and added coverage across entirely new product areas.

    Here’s a taste of what’s covered:

    🤖 Securing Your AI Agents (Copilot Studio) With Microsoft’s Agent 365 going GA and organisations rapidly deploying Copilot Studio agents, Maester now includes tests based directly on Microsoft’s own recommendations for securing agents. Think orphaned agents with no owner, missing authentication on MCP connections, dormant agents, risky HTTP configurations, and agents shared too broadly. If you’re deploying agents in your tenant, these tests should be running.

    🔧 AI That Writes Its Own Security Tests One of the most exciting developments in this release isn’t a test, it’s a custom AI skill that writes Maester tests for you. Sam built a GitHub Copilot agent skill that understands Maester’s structure, coding conventions, and contributor guide. You describe a security check in plain English, and within minutes you get a properly structured test, helpers, and documentation. No VS Code required! You can do it straight from GitHub’s Agents tab or even the mobile app. The barrier to contributing to Maester just got a lot lower.

    🛡️ Defender for Endpoint Coverage Maester now includes 24 community-contributed MDE tests covering antivirus configuration, endpoint policy posture, cloud protection, behaviour monitoring, and PUA protection. Getting these tests into shape required the new AI skill to refactor months of pending work and it delivered.

    🔑 Azure DevOps Security (37+ New Tests) With AI-generated code accelerating supply chain risks, securing your DevOps pipeline has never been more critical. Maester 2.1 ships with 37+ new Azure DevOps te…

26. What an ID Governance Consultant Wishes You Knew About Entra

    25 april 2026 · 47 min

    Afspelen
    Identity Governance is often treated as a “nice-to-have” compliance checkbox, but as ID Governance expert Sandra Saluti reveals, it is actually the foundation of a secure, scalable environment. In this technical deep dive, we move past the marketing slides to discuss some of the common real-world “gotchas” that break Entra ID deployments. Lees meer

    In this episode, you will learn:

    * The Golden Rule of Automation: Why you must stop using “presentation data” (like UPNs or Email addresses) as your anchor. We explain why the Object ID is the only immutable truth for your automation.

    * The “Marriage Bug”: A cautionary tale of how a simple name change can break hybrid joins and lead to accidental laptop wipes and how to prevent it.

    * The “Unsexy” Side of Governance: Why the most important part of your job isn’t writing PowerShell, but interviewing HR and stakeholders to map out process flow diagrams before you ever touch the portal.

    * Closing the “Rehire Gap”: How to solve the common crisis where contractors lose access for 48 hours during a renewal because of lifecycle synchronization delays.

    * Directory Extensions vs. Exchange Attributes: Technical advice on where to store your identity metadata for the most reliable governance.

    Sponsored by:

    Entra ID Gaps That Cause Outages

    In Microsoft Entra ID, outages often start small: an expired client secret, a lapsed certificate, or a suddenly failing integration. Traditional controls don’t track credential expiry or enforce application ownership, so issues appear only after something breaks.

    Teams are left asking:

    * Which applications can access Microsoft 365 data?

    * Is that access still appropriate?

    * Who owns the app?

    Unclear answers stall reviews, weaken accountability, and slow delivery.

    ENow App Governance Accelerator closes these gaps by highlighting expiring credentials, surfacing permission risks, and identifying ownership gaps before they disrupt operations. New Standard Tier pricing makes it accessible for organ…

27. Stop Leaving the Door Open: The Entra ID Hardening Checklist Security Experts Actually Use

    18 april 2026 · 1 uur

    Afspelen
    Microsoft Entra security is evolving and the way organizations think about identity protection needs to evolve with it. In this episode, I’m joined by Sean Metcalf, one of the foremost identity security experts in the industry, whose work has helped shape how many organizations approach securing both Active Directory and Microsoft Entra.Sean shares the hardening steps many teams still overlook, and why advances in AI are making it easier for both defenders and attackers to work faster than ever before. From MFA and application controls to protecting privileged accounts and reducing unnecessary exposure, this conversation offers a practical look at where strong identity security starts and why getting the fundamentals right matters more than ever. Lees meer

    Subscribe with your favorite podcast player or watch on YouTube 👇

    About Sean Metcalf

    Sean Metcalf is the Identity Security Architect at TrustedSec and a renowned expert in Microsoft identity security. He holds the rare Certified Master in Active Directory certification and has spoken at major security conferences including Black Hat, DEF CON, and BlueHat on how to defend cloud and hybrid environments.

    LinkedIn - https://www.linkedin.com/in/seanmmetcalf/

    🔗 Related Links

    * Securing Entra ID Administration: Tier 0 - https://trustedsec.com/blog/securing-entra-id-administration-tier-0

    * Managing Privileged Roles in Microsoft Entra ID: A Pragmatic Approach - https://trustedsec.com/blog/managing-privileged-roles-in-microsoft-entra-id-a-pragmatic-approach

    * Improve Entra ID Security More Quickly - https://adsecurity.org/?p=4825

    * Microsoft Graph Skill - https://graph.pm

    📗 Chapters

    00:04:05 AI and the Evolution of Attacks

    00:06:42 The Importance of Hardening Fundamentals

    00:12:03 Securing Entra ID Quickly

    00:16:24 Protecting Tokens with VBS and TPM

    00:19:58 Restricting Consent and Guest Users

    00:23:40 Managing Rogue Tenants

    00:27:36 Cloud Admin Workstation Strategies

    00:34:14 Delegated Admin Privileges

    00:44:32 T…

28. How to Design Bullet-Proof Conditional Access Policies in Microsoft Entra ID

    11 april 2026 · 57 min

    Afspelen
    If you can’t immediately name your break glass accounts and the last time you tested them → you’re already at risk. Lees meer

    In this episode of Entra Chat, Microsoft MVP Per Torben walks through the conditional access mistakes he sees even large enterprises making, and the practical framework he actually uses with customers.

    You’ll learn how to set up emergency access accounts the right way, why your CA policies should be built more like a firewall than a checklist, and the one naming convention that makes managing dozens of policies actually manageable.

    🎧 Hit play, your tenant will thank you.

    Sponsored by:

    Entra ID Gaps That Cause Outages

    In Microsoft Entra ID, outages often start small: an expired client secret, a lapsed certificate, or a suddenly failing integration. Traditional controls don’t track credential expiry or enforce application ownership, so issues appear only after something breaks.

    Teams are left asking:

    * Which applications can access Microsoft 365 data?

    * Is that access still appropriate?

    * Who owns the app?

    Unclear answers stall reviews, weaken accountability, and slow delivery.

    ENow App Governance Accelerator closes these gaps by highlighting expiring credentials, surfacing permission risks, and identifying ownership gaps before they disrupt operations. New Standard Tier pricing makes it accessible for organizations under 10,000 users, typically $3,500–$9,500 annually.

    Subscribe with your favorite podcast player or watch on YouTube 👇

    About Per Torben

    Per Torben is a Senior Architect at Crayon and a Microsoft MVP for Identity and Access. Based in Norway, he frequently writes highly-read posts featured on Entra.News and runs the collaborative tech blog “Agder in the Cloud”.

    LinkedIn - https://www.linkedin.com/in/pertorbensorensen/

    🔗 Related Links

    * Agder in the Cloud - https://agderinthe.cloud

    * I.D.E.A. for creating/configuring break-glass accounts

    * GitHub - https://github.com/Per-Torben/I.D.E.A.

    * Blog - https://agderinthe.cloud/20…

29. 5 Entra ID Updates You Can’t Afford to Ignore in 2026 (Backup, Governance, CA Agent & Risk Score Exposed)

    4 april 2026 · 1 uur

    Afspelen
    Microsoft just dropped a massive wave of features for Entra, and the rules of Tenant Governance have officially changed. Lees meer

    Join us as we talk to three world-class MVPs about their hands-on experience with the new Entra Backup and Recovery and Tenant Governance features.

    Our Microsoft MVP guests Nathan McNulty, Ru Campbell, and Thomas Naunheim break down the most exciting new features in Microsoft Entra.

    In this episode, we explore:

    * The “Shadow Tenant” Problem: One org found 700+ Entra tenants they didn’t know they had.

    * Version Control for Admins: Why “Difference Reports” are a total game-changer for troubleshooting.

    * Recovery Safeguards: How to protect your tenant from accidental deletions and “sneaky” background changes.

    * Backup & Recovery: The truth about Entra Backup vs. Third-Party ISV tools.

    Subscribe with your favorite podcast player or watch on YouTube 👇

    About The Guests

    Nathan, Ru, and Thomas are highly experienced MVPs specializing in identity security, governance, and Microsoft Entra.

    Nathan McNulty - LinkedIn - https://www.linkedin.com/in/nathanmcnulty/

    Ru Campbell - LinkedIn - https://www.linkedin.com/in/rlcam/

    Thomas Naunheim LinkedIn - https://www.linkedin.com/in/thomasnaunheim/

    🔗 Related Links

    * Microsoft Entra Backup and Recovery Documentation - https://learn.microsoft.com/en-us/entra/backup/overview

    * Microsoft Entra Tenant Governance - https://learn.microsoft.com/en-us/entra/id-governance/tenant-governance/overview

    * Synced Passkeys - https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-authentication-passkeys-fido2

    * Microsoft Work IQ CLI (Public Preview) - https://learn.microsoft.com/en-us/microsoft-365/copilot/extensibility/workiq-overview

    * Playwright https://playwright.dev/

    * Entra Auth Tracer (Chrome Extension) - https://github.com/darrenjrobinson/EntraAuthTracer

    * Unified Risk Score - https://learn.microsoft.com/en-us/defender-xdr/investigate-users#risk-score-tab-preview

    📗 Chapters

    00:00 Intro to…

30. Finding Every MFA Gap: Testing 250 Million Conditional Access Combinations in Under 20 Minutes

    28 maart 2026 · 1 uur 2 min

    Afspelen
    Emilien Socchi, Cloud Security Research Engineer at Storebrand, joins us to discuss CA Insight and AZTier. Lees meer

    Two open-source tools Emilien built to find gaps in Conditional Access policies and categorize Azure/Entra roles based on attack paths.

    Learn how CA Insight evaluates 250 million sign-in combinations offline in minutes instead of days, why the What If API doesn't scale, and how AZTier helps defenders and pen testers understand privilege escalation risks across Entra ID, Azure, and Microsoft Graph.

    Together, these projects help security teams move from reactive log monitoring to a proactive defense strategy.

    What’s Breaking and Slowing Your Entra ID Environment?

    In Microsoft Entra ID, the same visibility gaps cause two problems:

    * Things break

    * Work slows down

    Expired client secrets disrupt integrations. Certificates lapse and authentication fails. New apps appear with excessive permissions and no clear ownership. At the same time, teams struggle to answer basic questions, which applications have access to Microsoft 365 data, whether that access is still required, and who is responsible for it.

    When answers are not immediate, reviews stall and projects slow down.

    ENow App Governance Accelerator Credential Guard helps identify expiring credentials and expose permission and ownership gaps.

    For organizations under 10,000 users, pricing ranges from $3,500 to $9,500 annually through March 31, 2026.

    Subscribe with your favorite podcast player or watch on YouTube 👇

    About Emilien Socchi

    Emilien Socchi is a Cloud Security Research Engineer at Storebrand (Oslo, Norway) focusing on the proactive discovery of security issues. With an extensive background in application and cloud penetration testing, Emilien has published practical research and tooling used by defenders. He also maintains several open‑source projects, including Azure administrative tiering models and Entra ID role‑monitoring utilities.

    LinkedIn - https://www.linkedin.com/in/emilien-socchi

    🔗…

31. From FIM/MIM to Cloud Sync: Complete Identity Journey with Australia’s Top Identity MVP Darren “Doc” Robinson

    21 maart 2026 · 55 min

    Afspelen
    Darren Robinson, Identity and Zero Trust Strategy and Architecture Capability Lead at Increment, shares his extensive experience in identity governance and administration. Lees meer

    In this episode Merill sits down with Darren “Doc” Robinson – Microsoft MVP since 2017, former SailPoint Ambassador and one of Australia’s most experienced identity architects.

    Darren takes us on a 25+ year journey from Novell networks to modern Microsoft Entra ID, reveals why he’s building custom ECMA2 connectors, and shares the exact PowerShell tools he just open-sourced (Granfeldt uplift, ECMA2 Host Tools, Provision On-Demand module).

    We also compare Entra ID Governance vs SailPoint and dive into his latest obsession: MCPs for Entra News and personal AI agents.

    Whether you’re migrating legacy apps or levelling up your IGA strategy, this episode is pure gold.

    Sponsored by CoreView:

    Would you bet your reputation on your current Microsoft 365 security posture?

    Sure, you’ve checked Purview. Maybe tightened Conditional Access. We all do that.

    But it’s usually the quiet stuff that bites... permissions that expanded, policies that drifted, exceptions nobody revisited.

    You could assume it’s fine.

    Or you could run the Microsoft 365 Security Posture Check.

    It’s free.

    It runs locally.

    And no, it doesn’t send your tenant data back to us.

    We’ll even help you set it up.

    Subscribe with your favorite podcast player or watch on YouTube 👇

    About Darren Robinson

    Darren is highly accomplished in digital identity and cybersecurity specialising in Identity & Access Management for over three decades. Darren is renowned for driving Digital Identity innovation, building global offerings, and leading high-impact teams to deliver cutting-edge solutions that enhance security posture, operational efficiency, and business value.

    🔗 Related Links

    * Blog: https://blog.darrenjrobinson.com

    * GitHub: https://github.com/darrenjrobinson

    * LinkedIn: https://www.linkedin.com/in/darrenjrobinson/

    In this episode…
    …

32. How to Migrate from Legacy VPNs to Entra Private Access (Real Strategies from a Veteran)

    14 maart 2026 · 43 min

    Afspelen
    Richard Hicks wrote the book on DirectAccess. Then he wrote the one on Always On VPN. Now he’s here to tell you it’s time to move on from both (and other legacy VPNs). Over the last two years, Richard has helped numerous enterprise customers navigate the shift from legacy VPN to Microsoft Entra Private Access, and he’s collected some hard-learnt lessons along the way that most migration guides won’t tell you. Lees meer

    In this episode, Richard - enterprise security consultant and early Entra Private Access insider - breaks down why traditional VPN is fundamentally broken for today’s threat landscape, how Entra Private Access works under the hood, and the exact crawl-walk-run playbook he uses to migrate enterprise customers without disruption. Plus: his hot take on the Microsoft E7 announcement and why it just changed the pricing conversation forever.

    In this episode you’ll learn:

    * Why your VPN tunnel is a security liability — and how a single compromised device can expose your entire corporate network

    * How Entra Private Access works differently to traditional VPN, and why that architectural shift matters for security

    * The “Quick Access” migration strategy that lets you get off legacy VPN fast, without locking everything down on day one

    * How to deploy the Global Secure Access client alongside your existing VPN — so you can migrate field-based workers without a single disconnection

    * What most teams get wrong about the Entra Private Network Connector — and the scaling pitfalls that catch enterprises off guard

    * Why Conditional Access knowledge, not connectivity, is the real key to a successful zero trust migration

    * The current limitations of Entra Private Access and how to plan around them

    * We also discuss the new ‘E7’ which includes Entra Private Access

    Subscribe with your favorite podcast player or watch on YouTube 👇

    About Richard Hicks

    Richard Hicks is the founder and principal consultant at Richard M. Hicks Consulting, Inc. A Microsoft Most Valuable Prof…

33. Passkeys, Conditional Access, Hard-match updates, GSA BYOD: What Entra Admins Need To Know

    7 maart 2026 · 1 uur 9 min

    Afspelen
    I am back home in Melbourne today, and joining me are Nathan McNulty from Alaska and Daniel Bradley from the UK as we dive into all the massive Entra updates that dropped last month. We are breaking down the controversial shift to syncable passkeys , why your Conditional Access policies might suddenly start blocking apps , and the absolute necessity of moving privileged accounts away from on-prem AD. We’re also geeking out over some incredible new Global Secure Access (GSA) features and how AI is completely transforming the way we work with Graph API. You won’t want to miss the under-the-radar changes that could impact your tenant’s security architecture overnight. Lees meer

    Here’s a quick overview of all the topics we covered in this episode (links below).

    Sponsored by:

    Scan, Score, and Secure Your Applications in Entra

    Application identities represent one of the largest attack surfaces in Entra and are often among the least consistently governed. AppGov Score helps IT and Security teams understand where risk exists. The 24-check assessment evaluates Entra ID application integrations against Microsoft-recommended governance practices, analyzing:

    * App registrations and enterprise apps for excessive permissions

    * Expired or unmanaged secrets

    * Ownerless apps

    * Risky consent grants, and

    * Privileged service principals

    Results are delivered as a clear, defensible risk score with actionable findings. No scripts. No manual inventory. Just a fast, read-only scan that reveals app sprawl, identity misconfigurations, and blast radius so you can prioritize remediation and strengthen your security posture with confidence.

    Subscribe with your favorite podcast player or watch on YouTube 👇

    About Nathan McNulty

    Senior Security Solutions Architect at Patriot Consulting and Microsoft MVP in security. Nathan is the practice lead for identity and has extensive experience with endpoint deployments and everything Entra.

    LinkedIn - https://www.linkedin.com/in/nathanmcnulty/

    About …

34. We Gave Away Our Microsoft Entra Masterclass Labs → Full Governance, Privileged Access & Agent ID Labs Walkthrough

    28 februari 2026 · 39 min

    Afspelen
    Hey folks, I have to start with a massive shout-out to Morten Knudsen and his entire team at Experts Live Denmark where I’m just returning from. Lees meer

    Organizing an event for over 1,200+ attendees is no small feat, and they pulled it off with incredible energy and precision. It was easily one of the most impressive community gatherings I’ve been a part of.

    Amidst that massive crowd, I had the privilege of co-leading a deep-dive Identity Masterclass alongside four exceptional Microsoft MVPs: Jan Vidar Elven, Pim Jacobs, Thomas Naunheim, and Klaus Bierschenk.

    We weren’t sure what to expect, but the response was overwhelming. We had over 120 dedicated attendees who stayed with us for the full 7-hour session - diving deep into the weeds of Entra ID, governance, privileged access, Agent ID and more. Instead of theory-heavy slides, we built a practical, end-to-end governance story.

    Because we believe this knowledge should be accessible, we are now giving away the labs for free so everyone can skill up, learn, and implement these patterns in their own environments.

    Here’s the core of what we covered, and what you will learn in this podcast walk through of the labs and what you can try out yourself today!

    Links to GitHub repo and YouTube video below.

    Sponsored by:

    If you’re a systems administrator, you already know – patching is painful. It’s time-consuming, risky, and one small mistake can mean downtime. So, it gets postponed. Again. And again. What if patching was just… Easy?

    Introducing Action1, a cloud-native patch management platform for Windows, macOS, Linux, and third-party apps. You’ll be up and running in five minutes. No infrastructure to maintain. No complexity.

    And here’s the best part: you can use Action1 on your first 200 endpoints for free. Forever. No feature limits. No credit card. No hidden tricks. Seriously, It’s NOT a disguised free trial. Too good to be true? Too good and actually true! Check for yourself, go to: on.action1.com/entrachat

    So, if yo…

35. They migrated 40,000 devices to Entra Join in 9 months

    21 februari 2026 · 1 uur 2 min

    Afspelen
    What does it take to migrate 40,000 devices to a cloud-native environment in a massive, complex enterprise? For most IT leaders, the prospect of moving away from 20 years of legacy infrastructure is enough to cause a sleepless night. Lees meer

    In our latest episode of Entra Chat, we sat down with enterprise veterans Michael Brunker and Prem Kothandapani to deconstruct their recent, massive rollout. They successfully converted nearly 40,000 devices from on-premises Active Directory to Entra Joined in just nine to ten months—all with a lean team of 10–15 people.

    Here are the high-stakes lessons they learned from the trenches of modern management.

    The “Nuclear Option”: Cleaning Up 20 Years of GPO Debt

    One of the most controversial decisions the team made was what they called the “nuclear option” regarding Group Policy Objects (GPOs). Instead of porting over decades of legacy policies that no one fully understood, they chose to start from scratch.

    By building a new security baseline from the ground up in Intune, they ensured the new environment was clean, modern, and free from the “stale” configurations that often plague legacy estates.

    Killing the “VPN Tax”

    For the end user, the primary driver for this migration was a radically improved experience. In a cloud-native world, the dependency on legacy VPN technology disappears.

    * Work from Anywhere: Users can sign on and get access without the friction of starting a VPN or worrying about office cabling.

    * Security at the Edge: Moving to Entra ID shrinks the attack surface by removing devices as a direct entry point to your core on-prem Active Directory.

    Sponsored by:

    If you’re a systems administrator, you already know – patching is painful. It’s time-consuming, risky, and one small mistake can mean downtime. So, it gets postponed. Again. And again. What if patching was just… Easy?

    Introducing Action1, a cloud-native patch management platform for Windows, macOS, Linux, and third-party apps. You’ll be up and running in fi…

36. Microsoft Is Auto-Enabling Passkeys in March 2026

    14 februari 2026 · 52 min

    Afspelen
    March 2026 is shaping up to be one of the most important months for Microsoft Entra ID administrators in recent memory. Lees meer

    Microsoft is automatically enabling passkey profiles in Entra ID, and if you don’t configure them yourself, your tenant will be migrated with default settings.

    In this episode of Entra Chat, I sat down with Microsoft Security MVPs Daniel Bradley and Ewelina Paskowska to break down what this really means for Microsoft 365 administrators.

    But passkeys aren’t the only story this month.

    1️⃣ Passkey Profiles Are Becoming the Default

    Starting March 2026:

    * Passkey profiles will be auto-enabled

    * Tenants that haven’t configured profiles will be migrated

    * Registration campaigns will shift from Authenticator-first to passkey-first

    This is a major shift toward phishing-resistant authentication.

    You’ll now be able to:

    * Separate hardware-backed vs synced passkeys

    * Apply granular group-based controls

    * Enforce stronger authentication for privileged users

    2️⃣ Source of Authority Conversion Is Finally GA

    For years, admins used messy delete-and-restore hacks to convert synced users to cloud-only.

    Now it’s officially supported.

    You can convert individual users from on-premises authority to cloud-managed — without breaking hybrid entirely.

    Why this matters:

    * Easier M&A transitions

    * Full access to Entra ID Governance features

    * Cleaner lifecycle management

    * Reduced dependency on legacy infrastructure

    For hybrid environments moving toward cloud-first identity, this is huge.

    Sponsored by:

    If you are a systems administrator managing endpoints every day, you’ve probably postponed patching at least once — not because you forgot… But because you didn’t feel like gambling with uptime. Meanwhile, the backlog grows, vulnerabilities pile up, and patching stays stuck in manual mode.

    Action1 fixes that.

    Action1 is a cloud-native patch management platform for Windows, macOS, Linux, and third-party apps — all from one place, no VPN needed. Curious…

37. Automating Governance: The New Standard for Microsoft 365 Tenant Snapshots and Remediation

    7 februari 2026 · 47 min

    Afspelen
    Governance in Microsoft 365 has always been hard. Not because the tools didn’t exist, but because scale, complexity, and change made consistency almost impossible. As tenants grow, so do the challenges of configuration drift, manual admin changes, and inconsistent environments. Lees meer

    For years, admins have relied on scripts, tribal knowledge, and community-led solutions like Microsoft 365 Desired State Configuration (M365DSC) to manage this “policy sprawl”. While M365DSC was a groundbreaking open-source effort, it often faced a steep learning curve and lacked official Microsoft support.

    Until now.

    In this episode of Entra Chat, we sit down with Nik Charlebois, Principal Program Manager at Microsoft and the original visionary behind M365DSC. Nik now leads the charge for one of the most significant platform shifts in Microsoft 365 administration: Tenant Configuration Management (TCM).

    Shadow IT and SaaS sprawl are outpacing IT teams

    It can feel impossible to tackle these app governance challenges:📦 Entra ID isn’t secure by default💥 SaaS adoption & sprawl isn’t slowing down⌨️ Citizen Development keeps rising (hello, Copilot Studio!)🗑️ Vendors often don’t remove apps after uninstall🔃 Offboarding is inconsistent or doesn’t happen at all🥔 App governance is passed around like a hot potato

    ENow AppGov Score shines a light on lurking risks, providing a free App Governance Benchmark Report for your Entra tenant. Reclaim control and protect against breach & disruptions. Free upgrade to Standard Tier for 7 days once you get your score.

    What is Tenant Configuration Management?

    TCM is Microsoft’s official “Config as Code” platform for M365. Built directly on top of the Microsoft Graph, it represents a new operating model for how tenants are governed.

    Key features discussed in this episode include:

    * Official Support: Moving beyond best-effort community maintenance to a fully supported Microsoft solution.

    * Simplified Experience: Transitioning from cryptic MOF files to human…

38. Mastering Microsoft Entra ID: Real-World Passkey Deployment Tips

    31 januari 2026 · 46 min

    Afspelen
    In this episode, we sit down with Eric Woodruff, Chief Identity Architect at Semperis, to discuss the reality of achieving a 100% phishing-resistant environment. Over the course of just three months, Eric led a 600-person organization through a complete rollout of passkeys, Windows Hello for Business, and Platform SSO. This conversation moves beyond the technical “knobs and dials” to explore why organizational change management and C-suite buy-in are the true foundations of a successful identity modernization project. Lees meer

    Eric shares the creative strategies his team used to drive adoption, including a custom self-enrollment portal built with Power Platform that allowed early adopters to “dogfood” the technology. We dive into the “voluntold” phase of the rollout, where voluntary participation transitioned into mandatory policy, and how they used Power BI to track progress and identify “stragglers”. The episode also provides a transparent look at the technical hurdles encountered, from legacy application exclusions to troubleshooting older Android devices and niche browsers.

    Looking ahead, we discuss the critical importance of protecting against “downgrade attacks,” where sophisticated phishing attempts try to bypass modern security by tricking users into traditional password entries. Eric emphasizes that the final mile of this journey—removing passwords entirely—is as much about supporting your helpdesk and documenting processes as it is about the technology itself. Whether you are managing a cloud-only tenant or navigating complex hybrid scenarios, this episode offers a practical roadmap for the future of enterprise identity.

    Subscribe with your favorite podcast player or watch on YouTube 👇

    About Eric Woodruff

    Throughout his 25-year career in the IT field, Eric has sought out and held a diverse range of roles. Currently the Chief Identity Architect for Semperis; Eric previously was a member of the Security Research and Product teams. Prior to Semperis, Eric worked…

39. Entra Agent Registry: The Corporate Yellow Pages for AI Agents

    16 januari 2026 · 51 min

    Afspelen
    Service principals worked for static apps, but AI agents are different—they make autonomous decisions using LLMs and require a new approach to identity and security. Lees meer

    In this episode of Entra Chat, Padma Parthasarathy, Product Manager for Microsoft Entra Agent Registry, explains why Microsoft created Entra Agent Registry and Agent ID, and how they provide identity, governance, and security for AI agents.

    We cover agent collections, discovery policies, integration with identity protection, and how custom security attributes automate AI agent governance at scale. You’ll also see how agents discover other agents by skills, how global and quarantine collections control visibility, and why these capabilities are critical for enterprise AI security.

    This is a must-watch (listen) for identity, security, and platform architects preparing for AI at scale.

    Subscribe with your favorite podcast player or watch on YouTube 👇

    About Padma

    With close to 20 years of experience in Identity, Security, and enterprise platforms, Padma Prasad Parthasarathy currently leads product and architecture for Security for AI and Agent Identity at Microsoft. He has built and scaled IAM and Zero Trust solutions across some of the world’s largest organizations, bridging deep technical expertise with real-world product impact.

    LinkedIn - https://www.linkedin.com/in/padmaprasadp/

    🔗 Related Links

    * What is the Microsoft Entra Agent Registry? - https://learn.microsoft.com/en-us/entra/agent-id/identity-platform/what-is-agent-registry

    📗 Chapters

    00:00 Intro

    02:14 The Rise of Digital Workers

    07:13 Static Apps vs. AI Agents

    12:43 Introducing Entra Agent Registry

    17:28 Agent ID vs. Registry

    24:08 How Agents Collaborate

    30:29 Emerging Agent Standards

    35:24 Understanding Agent Collections

    42:05 Managing Risky Agents

    46:01 Automating Agent Security

    Podcast Apps

    🎙️ Entra.Chat - https://entra.chat

    🎧 Apple Podcast → https://entra.chat/apple

    📺 YouTube → https://entra.chat/youtube

    📺 Spotify →…

40. Global Secure Access Explained: Real-World Rollouts, Mistakes, and Best Practices

    10 januari 2026 · 55 min

    Afspelen
    In this episode, I’m joined by Christopher Brumm from glueckkanja to discuss real-world experiences deploying Microsoft Entra Global Secure Access (GSA).We go beyond the docs to talk about actual customer rollouts, scaling challenges, retiring VPNs, and what teams often underestimate when moving to Zero Trust Network Access. Lees meer

    Subscribe with your favorite podcast player or watch on YouTube 👇

    About Christopher Brumm

    Christopher Brumm is a Cyber Security Architect at glueckkanja AG in Germany. With more than 15 years of experience in IT security, Chris brings deep expertise and hands-on knowledge across the Microsoft Security portfolio and beyond. His career journey spans from network and data center technologies to Active Directory and Entra ID, with a strong focus on identity security.

    As a Microsoft MVP and CISSP, Chris is an active voice in the security community, regularly speaking at events and sharing insights through blog posts on identity and security topics. His latest passion is Global Secure Access, where identity, security, and networking converge to deliver a holistic Zero Trust approach.

    * LinkedIn - https://www.linkedin.com/in/christopherbrumm

    🔗 Related Links

    * Blog - https://chris-brumm.com

    📗 Chapters

    04:46 Proof of Concept vs Pilot

    12:19 Deployment Strategy: The Blue Pill Approach

    16:03 Solving Performance with Intelligent Local Access

    17:49 Navigating Networking Challenges

    25:14 The Hardest Part: Shutting Down Legacy VPNs

    27:38 Handling External Access and BYOD

    32:15 B2B Features and Tenant Switching

    46:05 Why You Need the Microsoft 365 Profile

    50:49 The Ultimate Admin Workstation Security

    Podcast Apps

    🎙️ Entra.Chat - https://entra.chat

    🎧 Apple Podcast → https://entra.chat/apple

    📺 YouTube → https://entra.chat/youtube

    📺 Spotify → https://entra.chat/spotify

    🎧 Overcast → https://entra.chat/overcast

    🎧 Pocketcast → https://entra.chat/pocketcast

    🎧 Others → https://entra.chat/rss

    Merill’s socials

    📺 YouTube → youtube.com/@merillx

    …

41. Cybersecurity First Principles: Lessons from a 20-Year Microsoft MVP

    4 januari 2026 · 44 min

    Afspelen
    Nicolas Blank, Founder of NBConsult and a 20-year Microsoft MVP, joins the show to dismantle the complexity around Zero Trust.Most Zero Trust conversations fail because they start with technology. Nicolas flips the script by using powerful everyday analogies (locking your car, protecting your newborn) to land the three core principles with executives. Lees meer

    Essential watching for anyone implementing Zero Trust, securing Microsoft 365/Entra ID, or needing leadership support in 2026.

    Subscribe with your favorite podcast player or watch on YouTube 👇

    About Nicholas Blank

    Nicolas is the founder, as well an architect, author and speaker focused on Office 365 and Azure at NBConsult in South Africa, England and Hong Kong. Nicolas is a Microsoft Certified Master, Dual Microsoft MVP - Microsoft Office Apps and Services, Microsoft Azure since March 2007.​

    Nicolas has co-authored the Microsoft Zero Trust Adoption Framework https://aka.ms/zero-trust-adopt, published by Microsoft; “Microsoft Exchange Server 2013: Design, Deploy and Deliver an Enterprise Messaging Solution”, published by Sybex and available on Amazon; as well as authoring “Azure Site Recovery: IaaS Migration and Disaster Recovery”, published by Pluralsight.

    Nicolas can be found on LinkedIn: https://www.linkedin.com/in/nicolasblank/

    Or via his Company Website:​ https://www.nbconsult.co

    🔗 Related Links

    * Microsoft Zero Trust Workshop - https://aka.ms/ztworkshop

    * Zero Trust Adoption Framework - https://aka.ms/zero-trust-adopt

    * Microsoft Digital Defense Report - http://aka.ms/mddr

    📗 Chapters

    01:52 The Why Behind Zero Trust

    04:17 The Baby Analogy: Explaining Least Privilege

    07:41 Debunking Security Myths

    11:43 Assume Breach vs Being Secure

    15:28 Getting Stakeholder Buy-in

    20:24 The Immune System Approach

    21:45 Ruining Attacker ROI 25:50 The

    96% Statistic You Can’t Ignore

    33:24 Where to Start: Practical Tools

    37:54 The Zero Trust Adoption Framework

    Podcast Apps

    🎙️ Entra.Chat - https://entra.chat

    🎧 …

42. Identity-Centric Network Security: Entra Global Secure Access Architecture & Benefits

    28 december 2025 · 57 min

    Afspelen
    Is the traditional VPN dead? In the latest episode of Entra Chat, we dive deep Microsoft Entra Global Secure Access (GSA).Joined by Karen Simmel from the GSA product team and Thomas from the Entra CXE Architecture team, we explore how Microsoft is bridging the gap between identity and network security.The Shift from VPN to SASEThe "good old days" of spinning up firewalls and DMZs are fading. Traditional controls are often too coarse-grained and lack identity awareness. As Thomas explains, the COVID-19 pandemic accelerated the need for change when traditional VPN gateways physically couldn't handle the load of remote workforces.This has paved the way for SASE (Secure Access Service Edge) and SSE (Security Service Edge), which move security controls to the cloud at hyperscale.What is Global Secure Access?The team breaks down the confusing terminology to help you understand the core products:* Microsoft Entra Private Access: This is the ZTNA (Zero Trust Network Access) solution, replacing the classic VPN for accessing on-prem and private resources.* Microsoft Entra Internet Access: This acts as a Secure Web Gateway (SWG), protecting outbound access to SaaS apps and the internet with URL filtering and DLP controls.* Microsoft Entra Suite: A bundle that combines these network capabilities with Verified ID, Identity Governance, and Identity Protection for a comprehensive solution.The "Secret Sauce"Why choose Microsoft's solution? The differentiator is that GSA isn't just integrated with the Identity Provider (IdP)—it *is* part of the IdP.This deep integration allows for near real-time security. For example, if a user's device is compromised, the SOC team can revoke the token, and Entra can immediately terminate the network tunnel or prompt for step-up authentication. It brings the power of Conditional Access directly to network traffic.Better Performance, Better PrivacyContrary to the belief that security slows things down, GSA often improves performance. By leveraging M… Lees meer

43. How to Kill SMS MFA in Entra ID Without a Single Script

    20 december 2025 · 52 min

    Afspelen
    Louis Mastelinck, a Microsoft MVP and Security Consultant at Proximus NXT, joins me to discuss the critical journey of moving organizations away from SMS-based MFA. Lees meer

    We deep dive into a practical strategy for migrating users to the Authenticator app, starting with “stopping the bleed” and managing user groups. We also explore a significant security blind spot regarding Email OTP for SharePoint guest access and how to resolve it.

    Finally, we debate the future of authentication with device-bound versus synced Passkeys and how to defend against downgrade attacks.

    Subscribe with your favorite podcast player or watch on YouTube 👇

    About Louis Mastelinck

    Louis Mastelinck is a Security Consultant at Proximus NXT and a recognized Microsoft MVP based in Belgium. Specializing in Incident Response and the full Microsoft Security stack (including MDE, MDO, Sentinel, and Identity Management), he is dedicated to neutralizing threats and securing digital environments. A GCFA-certified professional, Louis is known for his deep technical expertise in areas like Conditional Access and authentication methods.

    LinkedIn - https://www.linkedin.com/in/louismastelinck/

    🔗 Related Links

    * Microsoft: Hang up on SMS - http://aka.ms/hangup

    📗 Chapters

    00:00 Intro

    00:52 Props and PIM

    01:41 The Dangers of SMS MFA

    04:51 Strategy: Stopping the Bleed

    10:06 Migrating Existing Users off SMS

    19:20 Impact on Self-Service Password Reset

    22:39 The SharePoint Email OTP Security Gap

    25:13 Enabling Entra B2B Integration

    34:28 Passkeys: Device-Bound vs Synced

    44:40 Defending Against MFA Downgrade Attacks

    Podcast Apps

    🎙️ Entra.Chat - https://entra.chat

    🎧 Apple Podcast → https://entra.chat/apple

    📺 YouTube → https://entra.chat/youtube

    📺 Spotify → https://entra.chat/spotify

    🎧 Overcast → https://entra.chat/overcast

    🎧 Pocketcast → https://entra.chat/pocketcast

    🎧 Others → https://entra.chat/rss

    Merill’s socials

    📺 YouTube → youtube.com/@merillx

    👔 LinkedIn → linkedin.com/in/merill

    🐤 Twitte…

44. Extending Microsoft Entra: Logic Apps, Power Apps, and the Art of Tinkering with Entra ID

    13 december 2025 · 51 min

    Afspelen
    In this week’s episode Jan Bakker, Microsoft MVP and solution architect from the Netherlands, joins us for a masterclass in extending Microsoft Entra ID beyond out-of-the-box capabilities. This episode is your complete guide to building custom identity governance and lifecycle management using Power Apps, Logic Apps, and Azure automation. Lees meer

    You’ll learn the fundamental building blocks of automation in the Microsoft ecosystem and how to combine them creatively.

    Jan’s approach: treat Entra as a platform, not just a product.

    The automation stack he teaches:

    → Power Automate (everyday workflows)→ Logic Apps (enterprise automation)→ Dynamic Groups (intelligent triggers)→ Graph API (the foundation of everything)→ Event Hub (cost-effective event streaming)

    Key topics covered:

    * Understanding Power Automate vs Azure Logic Apps (and when to use each)

    * Managed identities and least privilege automation

    * Dynamic groups as automation triggers

    * Event Hub for cost-effective event-driven workflows

    * Custom authentication extensions and token augmentation

    * Real implementation costs ($50/month for enterprise solutions!)

    From the conversation:

    * Step-by-step temporary access pass automation

    * Automatic refresh token revocation on account disable

    * MFA method change notifications (like Gmail/Twitter)

    * Guest lifecycle management and approval flows

    * Conditional access policy monitoring

    Whether you’re new to automation or an experienced architect, you’ll walk away with actionable ideas and a new way of thinking about identity solutions.

    Subscribe with your favorite podcast player or watch on YouTube 👇

    About Jan Bakker

    Jan is a Microsoft MVP and Solution Architect based in the Netherlands. He is known for his ability to make complex DevOps and Entra concepts accessible and publishes extensive guides on his blog about extending Entra capabilities.

    LinkedIn: https://www.linkedin.com/in/jan-bakker/

    🔗 Related Links

    * Send an email on a new MFA method registration -…

45. Inside Microsoft’s Entra Tenant: The Internal App Governance Playbook

    6 december 2025 · 52 min

    Afspelen
    Khurram, a key member of the internal App Governance assessment team at Microsoft, joins the show to pull back the curtain on how Microsoft manages application security at a massive corporate scale and the rigorous internal security measures Microsoft employs to protect its corporate Entra ID tenant from risky applications. Lees meer

    In this deep dive, Khurram reveals Microsoft’s custom-built App Governance blueprint. He details the process for reviewing and consenting to the hundreds of new application requests the organization receives monthly.

    Key Takeaways

    * Permission Risk Rating: Learn how Microsoft’s team assesses and assigns a severity rating—Low, Moderate, Important, or Critical—to permissions. This rating is based on the permission’s capability, whether it’s delegated or application, and its potential for PII exposure (e.g., Application permission or a .all scope will score higher).

    * The Weighting Model: Discover how the Microsoft app assessment team has proactively risk-rated between 3,000 and 3,500 permissions. This approach dictates when an app is automatically approved (for low-risk requests like User.Read) versus when it is flagged for manual, scenario-based review.

    * Holistic Risk Review: Khurram explains how the app’s overall risk is calculated beyond just permissions. This includes mandatory security controls like banning high-risk reply URLs (e.g., azurewebsites.net and aka.ms) , enforcing the use of certificates over secrets , and requiring multiple owners.

    * Multi-Team Veto Power: Understand the critical approval workflow where requests for higher-risk permissions are routed to specific organizational data owners (like the DLP, Identity, or Exchange teams). All teams must approve the request as a whole, giving each team a critical veto power over access to their services.

    Subscribe with your favorite podcast player or watch on YouTube 👇

    About Khurram Chaudhary

    Khurram is a Principal Security Assurance Eng on the internal assessment team at Micr…

46. The "Secret Sauce" Behind Microsoft's New MCP Server

    29 november 2025 · 55 min

    Afspelen
    Luca Spolidoro from the Microsoft Entra AI Innovations team joins us to unveil the new Microsoft MCP Server for Enterprise. We discuss how this innovation allows admins and AI agents to interface with their tenant using natural language, bridging the gap between LLMs and the complexity of Microsoft Graph. Lees meer

    We also talk about the technical challenges of token limits, the patented “three-tool” solution that optimizes queries, and the roadmap for write operations and PowerShell script generation.

    Subscribe with your favorite podcast player or watch on YouTube 👇

    About Luca Spolidoro

    Luca is a Product Manager on the Entra AI Innovations team at Microsoft. Formerly working on advanced queries for Microsoft Graph, he now focuses on enabling AI agents to interact securely and efficiently with directory objects and tenant data. LinkedIn - https://www.linkedin.com/in/lucaspolidoro/

    🔗 Related Links

    * Microsoft MCP Server for Enterprise - https://aka.ms/mcp/entra

    Sponsored by:

    Shadow IT and SaaS sprawl are outpacing IT teams

    It can feel impossible to tackle these app governance challenges:📦 Entra ID isn’t secure by default💥 SaaS adoption & sprawl isn’t slowing down⌨️ Citizen Development keeps rising (hello, Copilot Studio!)🗑️ Vendors often don’t remove apps after uninstall🔃 Offboarding is inconsistent or doesn’t happen at all🥔 App governance is passed around like a hot potato

    ENow AppGov Score shines a light on lurking risks, providing a free App Governance Benchmark Report for your Entra tenant. Reclaim control and protect against breach & disruptions. Free upgrade to Standard Tier for 7 days once you get your score.

    Secure & Govern Entra Apps Now

    📗 Chapters

    03:36 The Hackathon Origin Story

    05:55 What is the Model Context Protocol?

    09:22 The Token Limit Problem

    15:45 Microsoft’s “Secret Sauce” Solution

    19:54 Current Limitations & Future Scope

    23:57 Future: Write Operations & Scripts

    30:12 Security & Admin Controls

    42:43 Security Copilot vs. Standalone MCP

    …

47. Entra Ignite Recap: Synced Passkeys, Agent ID & The Future of Identity

    23 november 2025 · 1 uur 17 min

    Afspelen
    This week, I’m joined by a stellar panel of Nathan McNulty, Ru Campbell, Martin Sandren, and Thomas Naunheim to break down the firehose of news from Microsoft Ignite related to Entra. Lees meer

    We dive straight into the hot debate over synced passkeys versus device-bound credentials and why consumer adoption might force our hand in the enterprise. We also explore the new Account Recovery features that could save companies thousands in helpdesk costs and unpack the massive shift toward “Agentic AI” with the launch of Entra Agent ID, a feature that fundamentally changes how we think about non-human identities.

    If you are feeling overwhelmed by the pace of AI and identity changes, you are not alone. Listen in as we figure this out together.

    Subscribe with your favorite podcast player or watch on YouTube 👇

    About our guests

    * Nathan McNulty: Nathan is a Senior Security Solutions Architect at Patriot Consulting and a Microsoft Security MVP. He has been working with Microsoft cloud identity solutions since the days of Live@edu and Office 365 in 2010.

    * https://www.linkedin.com/in/nathanmcnulty/

    * Ru Campbell: Ru is a Microsoft Security MVP who leads Microsoft Security at Threatscape. He describes himself as a “jack of all trades” when it comes to Microsoft 365 security, getting involved in a wide range of security topics.

    * https://www.linkedin.com/in/rlcam/

    * Martin Sandren: Martin is the Product Lead for Identity Access at Inter IKEA, where he manages identity solutions across the globe. He offers a unique perspective as a practitioner running identity for a massive enterprise.

    * https://www.linkedin.com/in/martinsandren/

    * Thomas Naunheim: Thomas is a Cloud Security Architect at glueckkanja and a Microsoft Security MVP. He specializes in cloud security architecture and actively tracks new features and announcements in the Microsoft ecosystem.

    Sponsored by:

    Shadow IT and SaaS sprawl are outpacing IT teams

    It can feel impossible to tackle these app governance challen…

48. Zero Trust Assessment: Secure your tenant

    15 november 2025 · 44 min

    Afspelen
    This week, I’m so excited to share the inside story of a project I’ve been working on for over a year: the new Zero Trust assessment. I’m joined by some of the key folks from the team: Tarek, who’s leading the charge; Sarah and John, who are crushing docs; and Ravi, who’s owning Intune. Lees meer

    We unpack the wild breach that sparked it all, geek out over those Sankey charts that spotlight sneaky unmanaged devices and privileged access landmines, and tease why even “expired” app creds could be your silent killer. If you’re tired of silos between identity and endpoints, this is your wake-up call—tune in to see how to make Zero Trust practical before the next attack hits.

    Subscribe with your favorite podcast player or watch on YouTube 👇

    About Our Guests

    Sarah Lipsey

    Sarah Lipsey has been with Microsoft for almost four years and writes about monitoring and health, ID Protection, and Security Copilot in Microsoft Entra. Sarah has worked as a technical writer and instructional designer for around 20 years, and for a university, a telecommunications firm, and a railroad. She lives in the woods with her family where she loves to knit, play video games, hike, and ski. Yes, she spends way too much time trying to close out every dot on a video game map. Still working on the Skellige map for The Witcher 3.

    LinkedIn - https://www.linkedin.com/in/sarah-lipsey-b53b746/

    John Flores

    John is a Senior Content Developer at Microsoft, where he has worked for over eight years. He specializes in creating high-impact technical content for identity security within Microsoft Entra, focusing on areas like Conditional Access, MFA, ID Protection, and device identity. John also leads the documentation efforts for Zero Trust content across Microsoft 365 and Identity teams. He actively collaborates with engineers and PMs to test pre-release features and engages with customers to refine technical guidance.

    LinkedIn - https://www.linkedin.com/in/johnbflores/

    Ravi Kalwani

    Ravi is a Senior Program…

49. Hacking Entra ID: Bypassing AppLocks & Creating ‘Immortal’ Users

    8 november 2025 · 52 min

    Afspelen
    In this episode, I sit down with security researcher Katie Knowles to unpack the hidden layers of identity systems inside Microsoft Entra. We get into real-world attack paths like backdooring service principals, restricted administrative units that can accidentally create unstoppable accounts, and OAuth phishing in Copilot Studio. Lees meer

    Katie also shares how she approaches deep technical research, what defenders often overlook, and why identity security is only becoming more complex. This is one of those conversations where you walk away thinking differently.

    Subscribe with your favorite podcast player or watch on YouTube 👇

    About Katie Knowles

    Katie Knowles is a Senior Security Researcher at Datadog specializing in Microsoft Azure and Entra ID security. She has extensive experience across security engineering, penetration testing, and incident response. Katie is known for her thorough research that connects complex technical vulnerabilities to practical defensive guidance, publishing regularly on Datadog Security Labs and speaking at major security conferences.

    LinkedIn - https://www.linkedin.com/in/kaknowles/

    🔗 Related Links

    * Katie’s Datadog security posts - https://securitylabs.datadoghq.com/articles/?author=Katie_Knowles

    * Katie’s personal blog - https://kknowl.es

    * Katie’s conference talks - https://kknowl.es/external-content/

    * Creating immutable users through a bug in Entra ID restricted administrative units - https://securitylabs.datadoghq.com/articles/creating-immutable-users-entra-id-administrative-units/

    * I SPy: Escalating to Entra ID’s Global Admin with a first-party app - https://securitylabs.datadoghq.com/articles/i-spy-escalating-to-entra-id-global-admin/

    * CoPhish: Using Microsoft Copilot Studio as a wrapper for OAuth phishing - https://securitylabs.datadoghq.com/articles/cophish-using-microsoft-copilot-studio-as-a-wrapper/

    📗 Chapters

    02:08 The Immortal User Bug in Restricted Admin Units

    04:23 Attacker Impact: The Un-deletable Malicious Ac…

50. Hacking Entra ID: Inside the Attack & Defense Playbook with its Creators

    1 november 2025 · 58 min

    Afspelen
    Sami Lamppu and Thomas Naunheim, the creators of the Entra ID Attack and Defense Playbook, join me to discuss their incredible 5-year community project. Lees meer

    We talk about the most complex attacks they’ve researched, including the “black box” token and PRT attacks, and their shocking findings related to TPM and device compliance. We also dive deep into their brand-new chapter on the new Microsoft Entra Connect Application Based Authentication model and the critical steps you must take to secure it.

    Subscribe with your favorite podcast player or watch on YouTube 👇

    About Sami & Thomas

    Sami Lamppu is a Microsoft Security MVP and a Principal Cloud Security Lead at Elisa with a strong focus on the blue team side, helping organizations proactively prevent attacks.

    Thomas Naunheim is a Cybersecurity Architect at glueckkanja and a Microsoft Security MVP. He specializes in Microsoft Entra, identity and access management, and cloud security posture.

    * Sami LinkedIn - https://www.linkedin.com/in/sami-lamppu/

    * Thomas LinkedIn - https://www.linkedin.com/in/thomasnaunheim/

    🔗 Related Links

    * Entra ID Attack and Defense Playbook - https://github.com/Cloud-Architekt/AzureAD-Attack-Defense

    📗 Chapters

    02:35 Origin Story of the Playbook

    07:08 Overview of the Attack Chapters

    09:53 Who is the Playbook For?

    13:59 The Hardest Chapter to Write: Tokens

    21:48 Shocking PRT & TPM Findings

    24:43 NEW Chapter: Hacking Entra Connect (ABA)

    29:10 How to Secure the New Sync Account

    36:53 HSCAR: The Posture Analyzer Tool

    45:09 Keeping the Playbook Updated & Community

    53:12 What’s Next & Final Advice

    Podcast Apps

    🎙️ Entra.Chat - https://entra.chat

    🎧 Apple Podcast → https://entra.chat/apple

    📺 YouTube → https://entra.chat/youtube

    📺 Spotify → https://entra.chat/spotify

    🎧 Overcast → https://entra.chat/overcast

    🎧 Pocketcast → https://entra.chat/pocketcast

    🎧 Others → https://entra.chat/rss

    Merill’s socials

    📺 YouTube → youtube.com/@merillx

    👔 LinkedIn → linkedin.com/in/merill

    🐤 Twit…