Alle afleveringen
83 afleveringen, van nieuw naar oud
-
I found a bug that could hack ANY Microsoft 365 tenant - Here's what happened
24 oktober 2025 · 1 uur 1 min
In this episode, I chat with Dirk-jan Mollema, the legendary researcher behind some of the most important discoveries in Microsoft identity security. Lees meer
We go deep into how curiosity led him from tinkering with web tools to uncovering one of the biggest Entra ID vulnerabilities ever found.
He shares the story behind the CVE that rocked the cloud world, the stress of realizing what he’d uncovered, and the mindset that drives his relentless research. If you’ve ever wondered what it feels like to find a bug that could break the internet—this one’s for you.
PS: If you like this episode please leave a review on Apple Podcast or Spotify 🙏
Subscribe with your favorite podcast player or watch on YouTube 👇
About Dirk-jan Mollema
Dirk-Jan Mollema is a security researcher and consultant specializing in Microsoft Entra ID (Azure AD) and Active Directory security. He is the creator of popular offensive security tools including ROADtools and ROADrecon.
With seven years of Entra research and nearly a decade in AD security, Dirk-Jan has discovered numerous critical vulnerabilities and has played an important role in helping improve Microsoft’s cloud security posture. He provides training and consulting services through his company Outsider Security.
Twitter → https://twitter.com/_dirkjan
LinkedIn → https://www.linkedin.com/in/dirkjanm
Contact → https://outsidersecurity.nl
🔗 Related Links
* One Token to rule them all - obtaining Global Admin in every Entra ID tenant via Actor tokens - https://dirkjanm.io/obtaining-global-admin-in-every-entra-id-tenant-with-actor-tokens
* Dirk-Jan’s Blog - https://dirkjanm.io
* ROADtools - https://github.com/dirkjanm/ROADtools
📗 Chapters
00:00 Intro
02:11 Guest Journey into Security
07:13 Building ROADtools and ROADrecon
09:53 Research Tools & Methods
14:05 Top Discoveries Ranked
17:01 Windows Hello & PRT Deep Dive
26:07 The Cross-Tenant Actor Token Bug
35:34 Ethical Dilemmas of Big Finds
38:24 Disclosure, Impact & Community
45…
-
AI is Coming to Identity Governance! Meet the Entra Access Review Agent
18 oktober 2025 · 1 uur 8 min
In this episode, I sit down with Alexander Filipin, a Product Manager at Microsoft, to unpack the essentials of identity governance and why access reviews are a game-changer for security and compliance. Lees meer
We explore the pitfalls like rubber stamping that plague traditional methods and tease how the new AI-driven Access Review Agent is stepping in with smart recommendations and context to make decisions easier and more accurate.
Plus, we peek into exciting future possibilities where agents could automate access management entirely—tune in to see how this could reshape your org’s approach!
Subscribe with your favorite podcast player or watch on YouTube 👇
About Alexander Filipin
Alexander Filipin is a Product Manager at Microsoft in the Microsoft Entra ID Governance team.
With a background in consulting and identity security, he previously contributed to popular community projects like Conditional Access as Code and now leads features in Microsoft Entra, including the newly released Access Review Agent.
LinkedIn - https://www.linkedin.com/in/alexfilipin/
🔗 Related Links
* Microsoft Entra Access Review Agent Documentation - https://aka.ms/aragent
* Conditional Access Optimization Agent - https://learn.microsoft.com/en-us/entra/identity/conditional-access/agent-optimization
📗 Chapters
00:00 Intro
00:48 From Community Code to Microsoft Product Management
04:42 The 4 Drivers of Governance: Security, Compliance, & Cost Savings
06:45 Why Access Reviews are Critical for Guest and Licensing Cleanup
13:46 Licensing: Entra ID P2 vs. Entra Governance Capabilities
20:01 The Biggest Problem with Traditional Access Reviews Today
20:41 Introducing the Entra Access Review Agent
23:18 The Role of AI in Generating Reviewer Context
34:04 The Audit Trail and Compliance for AI Decisions
44:26 Future Vision: The Next Evolution of Identity Governance
Podcast Apps
🎙️ Entra.Chat - https://entra.chat
🎧 Apple Podcast → https://entra.chat/apple
📺 YouTube → https://entra.ch…
-
Why AI Is Breaking Identity Security – Experts Spill the Truth!
11 oktober 2025 · 32 min
Welcome back to Entra.Chat! In this rapid-fire Q&A, I’m joined by a team of brilliant CXE Identity Architects from Microsoft, and they’re answering the toughest questions on the future of identity. Lees meer
We dive deep into the security challenge posed by agentic AI that can spawn self-replicating identities and how Microsoft is creating tailored behavioral analytics to protect your environment.
The team also spills the details on the shift to phishing-resistant MFA through authentication strengths capabilities for Entra ID tenants—you’ll definitely want to listen before your next audit!
Subscribe with your favorite podcast player or watch on YouTube 👇
About The Panel
This episode features an incredible panel of experts from Microsoft’s Identity team:
* Tarek Dawoud: Lead Architect of the Architecture Team, focusing on AI for Security and Entra Resilience → https://www.linkedin.com/in/tarekdawoud/
* Tyler Chan: Architect focusing on the Zero Trust Workshop and the healthcare vertical → https://www.linkedin.com/in/chantylert/
* Ramiro Calderon: Architect on the team focusing on Identity and Access Management and helping customers move to the cloud → https://www.linkedin.com/in/ramirocalderon/
* Jas Suri: Architect for Customer Identity and Access Management (CIAM), including Entra External ID as well as passwordless technologies → https://www.linkedin.com/in/jas-suri-aa644a7b/
* Ehud Itshaki: Identity Architect focusing on AI’s impact on identity systems and government customers → https://www.linkedin.com/in/ehudi/
* Thomas Detzner: Architect focusing on Global Secure Access (GSA) and the network pillar of Zero Trust. → https://www.linkedin.com/in/thomasdetzner/
* Travis Gross: Manager and lead of the overall Identity CxE team at Microsoft → https://www.linkedin.com/in/travis-gross-536b3b9b/
* Keith Brewer: Architect for Entra authentication, identity security, and U.S. government customers → https://www.linkedin.com/in/keith-b-145519174/
🔗 Related Links
* Th…
-
Azure AD B2C to Entra External ID: Migration Strategies You Need to Know
4 oktober 2025 · 39 min
In this episode, I sit down with my longtime friends and colleagues, Jas Suri and Gayan Randeny, at Microsoft’s campus to unpack the biggest Microsoft consumer identity shift in years—Azure AD B2C’s sunset and the rise of Entra External ID. We talk about why B2C is going away, the crazy scale of tenants with 100M+ identities, the migration paths and what the future looks like for customer identity. Lees meer
Plus, stick around until the end because Gayan and Jas share a world premiere on the podcast about a groundbreaking new Just-In-Time migration approach that will make moving millions of users to Entra External ID simpler than you think. You don’t want to miss this scoop!
If you want to stay ahead of this massive transition, this is a must-listen.
Subscribe with your favorite podcast player or watch on YouTube 👇
About Jas Suri
Jas Suri is the CxE Architect PM for Microsoft Entra External ID and has a wealth of knowledge and experience in helping Microsoft customers deploy Azure AD B2C and Entra External ID. With extensive experience in Azure AD B2C and Entra External ID migrations, Jas has now taken on the CxE architect role for passkeys across both Entra ID and Entra External ID..
LinkedIn - https://www.linkedin.com/in/jas-suri-aa644a7b/
About Gayan Randeny
Gayan Randeny is a seasoned expert in customer identity and access management at Microsoft, with years of experience helping customers deploy Azure AD B2C and now leading efforts to migrate to Entra External ID. In addition to his work on Entra External ID, Gayan is now turning his attention to help enterprise customers deploy Global Secure Access.
LinkedIn - https://linkedin.com/in/gyanrandhani
🔗 Related Links
* Migrating users to Microsoft Entra External ID - https://learn.microsoft.com/en-us/entra/external-id/customers/how-to-migrate-users
* Microsoft Entra External ID deployment architectures with Microsoft Entra - https://learn.microsoft.com/en-us/entra/architecture/external-identity-deployment-archit…
-
Microsoft's Secret Weapon for M365 Admins: A 10x Faster Bulk Operations Tool
27 september 2025 · 32 min
On this episode of Entra Chat, I was thrilled to sit down with Yanyan and Sweta from the Entra UI experience team to dive deep into a feature that many of us have used but is now getting a massive refresh: Bulk Operations. Lees meer
We talked about how they took a critical legacy tool and completely re-engineered it for insane performance and scale, making it more reliable than ever.
You’ll hear about some amazing new capabilities, like customizing the columns in your CSV exports and using UPNs instead of just Object IDs to add users, which is a huge time-saver.
We even get a behind-the-scenes look at the engineering that makes it possible to export over a million groups in just 10 minutes!
Subscribe with your favorite podcast player or watch on YouTube 👇
About Yanyan Ju
Yanyan Ju is a Principal Engineer Manager at Microsoft, where she is dedicated to delivering the best administrative experience for Microsoft customers. She focuses on creating value through user-friendly and consistent admin interfaces, shaping the future of AI-powered Entra Admin UX, and leading as part of a UX Engineering Center of Excellence.
* LinkedIn: https://www.linkedin.com/in/yanyan-ju-194545239/
About Sweta Kumari
Sweta Kumari is a Product Manager at Microsoft, focusing on identity and access management within Microsoft Entra. Sweta leads initiatives around Entra Admin feature enhancements, Customer feedback integration and Privileged Identity Management (PIM). Her work emphasizes improving user experience, and ensuring secure, compliant access for customers.
* LinkedIn: https://www.linkedin.com/in/sweta-kumari-557478127/
🔗 Related Links
* Bulk operations in Microsoft Entra ID (Preview) - https://learn.microsoft.com/en-us/entra/fundamentals/bulk-operations
📗 Chapters
00:01:20 What is Bulk Operations?
00:03:40 Supported Bulk Operations
00:06:34 Customizing Your Exports
00:08:45 How is it different from PowerShell?
00:11:29 Adding Members in Bulk (The Easy Way)
00:13:56 Bulk Delet…
-
How a Pharmacist Became a Pro Hacker (And What She Found in YOUR Tenant)
20 september 2025 · 1 uur 1 min
Cybersecurity expert Erica shares her incredible journey from pharmacist to becoming a professional hacker. She reveals how attackers are bypassing modern security controls like MFA and what you can do to protect your tenant. Lees meer
We talk about the most common configuration vulnerabilities that exist in almost every organization, the dangers of application onboarding, and the top five phishing vectors threat actors are using to gain initial access, including clever abuses of Microsoft Teams.
Subscribe with your favorite podcast player or watch on YouTube 👇
About Erica
Erica has an amazing career arc, starting in pharmacy before pivoting to cybersecurity. With a deep, hands-on understanding of offensive security gained from platforms like Hack the Box and real-world penetration testing, she specializes in protecting and defending Microsoft Cloud tenants. Erica is passionate about sharing her knowledge on how to better protect your tenant and what bad guys are looking for.
LinkedIn - https://www.linkedin.com/in/erica-z-b4169598/
🔗 Related Links
* Blog - https://ericazelic.medium.com/
* Hack The Box - https://www.hackthebox.com/
* Altered Security - https://www.alteredsecurity.com/
📗 Chapters
00:00:00 Intro
00:02:14 From Pharmacy to Cybersecurity
00:07:19 Learning to Hack with Hack The Box
00:11:45 The First Cloud Hack: M365 Public Groups
00:17:50 The Hidden Dangers of App Onboarding
00:25:53 The 5 Modern Phishing Attack Vectors
00:30:36 Bypassing MFA with Device Code Phishing
00:34:34 Adversary-in-the-Middle & Auth Downgrade Attacks
00:48:24 The Secret to Mastering Cybersecurity Skills
Podcast Apps
🎙️ Entra.Chat - https://entra.chat
🎧 Apple Podcast → https://entra.chat/apple
📺 YouTube → https://entra.chat/youtube
📺 Spotify → https://entra.chat/spotify
🎧 Overcast → https://entra.chat/overcast
🎧 Pocketcast → https://entra.chat/pocketcast
🎧 Others → https://entra.chat/rss
Merill's socials
📺 YouTube → youtube.com/@merillx
👔 LinkedIn → linkedin.co…
-
The Great Debate: P2 vs. Entra ID Governance for Guests
14 september 2025 · 44 min
Jeremy Conley, Product Manager on the Identity Governance team at Microsoft, demystifies the world of guest access in Microsoft Entra. We discuss the hidden security risks that accumulate as guests are invited into a tenant and the governance challenges this creates. Lees meer
We also do a deep dive into the different licensing tiers, from P2 to the new Entra ID Governance for Guests license, and explain the recently GA’d , cost-effective MAU-based billing model for guests. Jeremy provides actionable tips for admins to start cleaning up their tenants and implementing a robust governance strategy today.
Subscribe with your favorite podcast player or watch on YouTube 👇
About Jeremy Conley
Jeremy Conley is a Product Manager at Microsoft, focusing on identity governance. His work is centered on Entitlement Management and the governance of guest and external users within Microsoft Entra, helping customers secure their environments and manage user lifecycles effectively.
LinkedIn - https://www.linkedin.com/in/jeremy-conley-99552379/
🔗 Related Links
* Microsoft Entra ID Governance licensing for guest users • aka.ms/EntraIDGuestGovernance
* PowerShell tool to update guest sponsor info • Update-MsIdInvitedUserSponsorsFromInvitedBy
📗 Chapters
00:51 What are Guests & External Users?
03:51 The Hidden Security Risk of Guests
07:14 Understanding Licensing for Guest Governance
09:10 P2 Features: Entitlement Management & Access Reviews
15:19 Entra ID Governance: Lifecycle Workflows & Automation
20:33 The "Sponsor" Concept for Guest Accountability
25:49 The NEW Guest Licensing Model Explained
28:15 Demystifying the 1:5 Ratio vs. MAU Billing
35:18 Common Mistakes Admins Make with Guests
37:22 A Simple First Step to Clean Up Your Tenant
Podcast Apps
🎙️ Entra.Chat - https://entra.chat
🎧 Apple Podcast → https://entra.chat/apple
📺 YouTube → https://entra.chat/youtube
📺 Spotify → https://entra.chat/spotify
🎧 Overcast → https://entra.chat/overcast
🎧 Pocketcast → https://en…
-
The Hidden Risks of Non-Human Identities in Your Tenant
6 september 2025 · 49 min
In this episode of Entra.Chat, I dive into the critical world of app governance with experts Jay Gundotra and Sander Berkouwer, who unpack the hidden risks of non-human identities in Microsoft Entra. Lees meer
From shocking real-world breaches like Midnight Blizzard to a hilarious tale of a theme park’s water supply mishap, we explore why securing your cloud apps is more urgent than ever. Tune in to discover practical tips and tools to safeguard your organization without losing your giraffes!
Subscribe with your favorite podcast player or watch on YouTube 👇
About Jay Gundotra
Jay is the CEO and technical founder of E-Now. He has a long history as an Exchange and Active Directory engineer, which led him to found his company and focus on solving complex identity and application governance challenges for enterprises.
LinkedIn - https://www.linkedin.com/in/jay-gundotra-19079a/
About Sander Berkouwer
Sander Berkouwer is a 17-year Microsoft MVP veteran and an accomplished identity architect. With deep expertise from being "in the trenches," he partners with Jay to educate the community and build solutions for managing non-human identities and service principals.
LinkedIn - https://www.linkedin.com/in/sanderberkouwer/
🔗 Related Links
* AppGov Community - https://community.appgovscore.com/
* How Ownerless Apps in Entra ID Increase Your Attack Surface
* Securing Workload Identities in Entra ID: A Practical Guide for IT and Security Teams
📗 Chapters
00:00 Intro 01:55 What is App Governance? 04:02 The Origin Story of Focusing on App Governance 08:35 Why App Security is Critical Today 14:15 The Dangers of Over-Privileged Apps 20:38 The Giraffe Story: When Cleanup Goes Wrong 24:42 What Should a Successful Organization Do? 30:22 The Full Application Lifecycle: Onboarding to Offboarding 35:38 Building the AppGov Community 45:04 The Importance of Education and Automation
Podcast Apps
🎙️ Entra.Chat - https://entra.chat
🎧 Apple Podcast → https://entra.chat/apple
📺 YouTube → …
-
Red Team Secrets: How we bypass Conditional Access (and how you can fix it)
30 augustus 2025 · 58 min
In this episode of Entra.Chat, I dive deep with cybersecurity architect Fabian Bader into his research on bypassing poorly designed Microsoft Entra’s conditional access policies and what you can do about them. Lees meer
We also cover the game-changing new Group Source of Authority feature that lets you finally manage synced groups in the cloud, and share insights from Fabian’s work with MSRC to secure the platform—don’t miss this one if you want to stay ahead in cloud security!
Subscribe with your favorite podcast player or watch on YouTube 👇
About Fabian Bader
Fabian Bader is a Cybersecurity Architect at glueckkanja, based in Hamburg, Germany. He is a well-known researcher in the Microsoft identity space, creator of the Cloud Brothers blog, and creator of the Maester and Token Tactics V2 tools. His work focuses on Microsoft Entra and the Defender suite, helping customers secure their cloud environments.
LinkedIn - https://www.linkedin.com/in/fabianbader/
🔗 Related Links
* Fabian’s Blog - https://cloudbrothers.info/
* Entra Scopes - https://entrascopes.com/
* Maester - https://maester.dev/
* Token Tactics V2 - https://github.com/f-bader/TokenTacticsV2
📗 Chapters
02:19 The Story of the "Cloud Brothers" Blog 03:32 The Origin Story of Maester 07:39 Token Tactics V2 & Continuous Access Evaluation 09:43 How Conditional Access Bypasses Are Found 12:05 What is FOCI (Family of Client IDs)? 18:04 Hardening Your Conditional Access Policies 29:59 V1 vs V2 Token Endpoints Explained 38:19 Using Graph Activity Logs in Defender XDR 42:45 The New Group Source of Authority (SOA) 54:59 Workplace Ninjas US Announcement
Podcast Apps
🎙️ Entra.Chat - https://entra.chat🎧 Apple Podcast → https://entra.chat/apple 📺 YouTube → https://entra.chat/youtube 📺 Spotify → https://entra.chat/spotify 🎧 Overcast → https://entra.chat/overcast 🎧 Pocketcast → https://entra.chat/pocketcast 🎧 Others → https://entra.chat/rss
Merill's socials
📺 YouTube → youtube.com/@merillx 👔 LinkedIn → linkedin.com/i…
-
Inside Entra Resilience: Microsoft's Outage War Stories, Backup Secrets and Preventing Global Outages
23 augustus 2025 · 1 uur 15 min
In this episode, I sit down with my boss, Tarek Dawoud, to pull back the curtain on what really happens during a major service outage. Lees meer
Tarek shares some incredible "war stories" from his time in the trenches, from the early days of DirSync where the team had to edit a sync file with a debugger to prevent an incident, to the massive outages of 2017 and 2018 that changed everything.
We'll give you a peek into the high-stakes, quick-thinking world of a "live site" incident and reveal the groundbreaking engineering principles like cell-based architecture and the backup authentication service that were born from these challenges, making Entra more resilient than ever before.
Subscribe with your favorite podcast player or watch on YouTube 👇
About Tarek Dawoud
Tarek Dawoud is a Lead Architect in the Customer Engineering team for Microsoft Entra. With years of experience growing up in Entra engineering, he has been involved in his share of outages and has a deep understanding of what it takes to build and maintain a resilient, hyperscale identity service.
LinkedIn - https://www.linkedin.com/in/tarekdawoud/
🔗 Related Links
* SLA performance for Microsoft Entra ID - aka.ms/entraidsla
* Microsoft Blames "Severe Weather" for Azure Cloud Outage
* Microsoft Probes Cause of Global Web Outage
* Microsoft's Azure AD authentication outage: What went wrong
📗 Chapters
00:57 What is a "Live Site"?
14:15 The Secret to Entra's Uptime: Cell-Based Architecture
18:09 How Entra Routes Your Login Request Globally
24:46 War Story #1: The 2017 Conditional Access Outage
29:52 War Story #2: How a Hurricane & an Office Bug Caused Chaos
43:39 The Backup Auth Service: Entra's Secret Weapon
57:54 Does the Backup Service Kick in Automatically?
01:04:16 Regional Isolation & The Power of Managed Identity
01:08:17 Anatomy of a Near-Outage in 2021
01:12:02 How Microsoft's Culture Learns From Mistakes
Podcast Apps
🎙️ Entra.Chat - https://entra.chat
🎧 Apple Podcast → https://entra.c…
-
Identity War Stories: Surviving the Domain Cutover Nightmare!
15 augustus 2025 · 1 uur 6 min
In this episode, I sit down with Conrad Murray, a seasoned expert who lives and breathes the complexities of IT migrations during mergers, acquisitions, and divestitures. Lees meer
We dive deep into the real-world challenges that companies face, from the political battles of deciding whose tenant to use, to the technical nightmares of migrating three-quarters of a petabyte of data for a major global firm.
Conrad shares some incredible "war stories" about the single hardest part of any migration—the domain cutover—and reveals why the success of a months-long project boils down to just the first four hours of the end-user experience on a Monday morning.
Subscribe with your favorite podcast player or watch on YouTube 👇
About Conrad Murray
Conrad Murray is an expert in the IT lifecycle, specializing in complex tenant-to-tenant migrations for mergers, acquisitions, and divestitures. With over 15 years of experience moving companies to the cloud, Conrad has seen it all, from early BPOS and Lotus Notes migrations to massive, petabyte-scale Microsoft 365 consolidations.
LinkedIn - Conrad Murray
🔗 Related Links
* Google to Microsoft 365 Migrations
* PowerSyncPro
📗 Chapters
00:00:00 Intro
00:05:40 The Politics of Merging Tenants
00:07:23 Greenfield Tenants: A Fresh Start
00:09:58 War Story: Migrating 750TB for S&P Global
00:19:13 The Nightmare of Domain Cutovers
00:25:14 The Critical Day-One User Experience
00:30:00 Reconfiguring Mobile Devices: The Hardest & Easiest Part
00:35:46 Multi-Tenant Orgs (MTO): A Long-Term Solution?
00:49:22 The Unique Challenges of Divestitures
00:55:17 Data Cleanup That Never Happens
01:01:06 Tools of the Trade for Migration Success
Podcast Apps
🎙️ Entra.Chat - https://entra.chat
🎧 Apple Podcast → https://entra.chat/apple
📺 YouTube → https://entra.chat/youtube
📺 Spotify → https://entra.chat/spotify
🎧 Overcast → https://entra.chat/overcast
🎧 Pocketcast → https://entra.chat/pocketcast
🎧 Others → https://entra.chat/rss
Merill's …
-
Don't Get Left Behind: The Future of Identity Governance
9 augustus 2025 · 50 min
In this episode we are joined by Jef Kazimer, Principal Product Manager at Microsoft to discuss the critical role of Microsoft Entra ID Governance. Lees meer
We explore the entire identity lifecycle from joiners, movers, and leavers (JML), the financial and security benefits of automated provisioning, and the pitfalls of legacy IGA solutions.
Jef shares his extensive experience, from deploying complex MIM solutions to helping shape the future of cloud-native governance, and provides key insights into how AI will drive the need for more robust governance and how Entra is leveraging technologies like Azure Logic Apps for supportable, long-term solutions.
Subscribe with your favorite podcast player or watch on YouTube 👇
About Jef Kazimer
Jef Kazimer is a PM on the Microsoft Entra team, specializing in Identity Governance. With a career spanning from help desk support and consulting to his current role in engineering, Jef has a deep understanding of the real-world identity and access management challenges that organizations face. He is passionate about helping customers secure their environments by leveraging the power of the cloud.
LinkedIn - https://www.linkedin.com/in/jefkazimer/
🔗 Related Links
• Entra ID Governance licensing docs - https://learn.microsoft.com/en-us/entra/id-governance/licensing-fundamentals
📗 Chapters
01:39 From Atari to Microsoft: A Hacker's Journey
09:14 What is Identity Governance (and Why You're Already Doing It)
13:16 The Hidden Costs of Poor Governance & Licensing
15:58 The Customization Trap: Why 'Simple' is Better
22:57 Common Challenges in Identity Governance
27:36 Governance for Small vs. Large Businesses
30:51 The Secret to Great User Experience
42:33 Demystifying Entra ID Governance Licensing
46:41 The Future: How AI Changes Everything
Podcast Apps
🎧 Apple Podcast → https://entra.chat/apple
📺 YouTube → https://entra.chat/youtube
📺 Spotify → https://entra.chat/spotify
🎧 Overcast → https://entra.chat/overcast
🎧 Pocketcast →…
-
The Zero Trust Mistakes 90% of Companies Are Making (Microsoft Insiders Reveal All)
2 augustus 2025 · 54 min
In this eye-opening episode, I sit down with Microsoft's Clay and Ramiro, two Customer Experience (CxE) architects who've collectively run over 150 Zero Trust workshops with enterprise customers. Lees meer
They reveal the shocking gaps they consistently find—like customers spending millions on compliance policies but forgetting to actually block non-compliant devices with conditional access.
We dive deep into their comprehensive Zero Trust Workshop framework that's become the "seventh wonder of the Excel world," discuss why partners are scrambling to get trained on their methodology, and explore how AI is about to reshape the entire Zero Trust landscape.
If you think your organization has Zero Trust figured out, this conversation might just change your mind.
Subscribe with your favorite podcast player or watch on YouTube 👇
About Clay and Ramiro
Clay and Ramiro are architects in Microsoft's customer experience (CXE) team. With over a decade of experience each at Microsoft, they specialize in helping the largest and most high-profile customers navigate complex deployments and security challenges. Ramiro has a background in engineering and was part of the team that built ADFS, while Clay focuses on the Intune side of things. They are the key figures behind the development and refinement of Microsoft’s Zero Trust Workshop.
* LinkedIn - Ramiro: https://www.linkedin.com/in/ramirocalderon/
* LinkedIn - Clay: https://www.linkedin.com/in/clay-p-55899912b/
🔗 Related Links
* Zero Trust Workshop - https://aka.ms/ztworkshop
📗 Chapters
00:24 The "Why" Behind the Zero Trust Workshop
08:16 How to Run the Workshop
14:15 How the Workshop Has Evolved
20:48 How Partners Can Use the Workshop
26:51 Evolution of the Roadmap
35:30 Real-World Customer Improvements
39:46 Zero Trust is a Team Sport
47:22 The Future: AI and the Workshop
49:10 Final Advice on Zero Trust
Podcast Apps
🎙️ Entra.Chat - https://entra.chat
🎧 Apple Podcast → https://entra.chat/apple
📺 YouTube → https://…
-
Building Entra's CA AI Agent: A Creator's Perspective
26 juli 2025 · 45 min
In this episode, I sit down with Jordan Dahl, a Product Manager on the Entra Conditional Access team, to discuss the newly GA'd Conditional Access Optimization Agent. Jordan shares the origin story of the agent, explaining how customer feedback about the difficulties of managing CA policies at scale led to its creation. We delve into how this AI-powered "digital colleague" works to identify and remediate security gaps, its future roadmap including Service Now integration and phased rollouts, and how you can get started with it in your own tenant. Lees meer
Subscribe with your favorite podcast player or watch on YouTube 👇
About Jordan
Jordan is a Product Manager on the Entra Conditional Access team at Microsoft. Her current focus is on the Conditional Access Optimization Agent. Previously, she was a PM for per-policy reporting in Conditional Access and for Groups within Entra.
LinkedIn - https://www.linkedin.com/in/jordan-dahl-840182127/
🔗 Related Links
* Conditional Access optimization agent in Microsoft Entra
📗 Chapters
00:00 Intro
01:31 The Origin of the CA Optimization Agent
05:08 How the Agent Works
07:40 Autonomous Policy Changes?
12:39 How to Deploy the Agent
16:12 Customizing the Agent's Behavior
23:59 Upcoming Agent Features: Phased Rollouts & ServiceNow
29:45 The Future: A "Digital Colleague"
35:08 How to Give Feedback
41:09 Getting Started: Your Action Items
Podcast Apps
🎙️ Entra.Chat - https://entra.chat
🎧 Apple Podcast → https://entra.chat/apple
📺 YouTube → https://entra.chat/youtube
📺 Spotify → https://entra.chat/spotify
🎧 Overcast → https://entra.chat/overcast
🎧 Pocketcast → https://entra.chat/pocketcast
🎧 Others → https://entra.chat/rss
Merill's socials
📺 YouTube → youtube.com/@merillx
👔 LinkedIn → linkedin.com/in/merill
🐤 Twitter → twitter.com/merill
🕺 TikTok → tiktok.com/@merillf
🦋 Bluesky → bsky.app/profile/merill.net
🐘 Mastodon → infosec.exchange/@merill
🧵 Threads → threads.net/@merillf
🤖 GitHub → github.com/merill
Get fu…
-
The Unpopular Opinion: Why I Actually LIKE Hybrid Join
18 juli 2025 · 55 min
In this exciting episode of Entra Chat, I dive into the world of Entra + Windows devices with the passionate and knowledgeable John Towles, a solution architect and MVP for Windows 365 and more. We unpack why Entra hybrid join is still relevant for some organizations, explore the ins and outs of Windows Autopilot, and reveal practical tips for navigating the complexities of modern device management. Plus, we share a sneak peek into the upcoming Workplace Ninjas US event and get a special announcement about the Workplace Ninjas US "Golden Clippy Awards", including the finalists for the "Entra IDol of the Year." Lees meer
Subscribe with your favorite podcast player or watch on YouTube 👇
About John Towles
John Towles is a Solutions Architect at WEI, a multi-award MVP (Windows 365, Intune), President of Workplace Ninjas US, and the proprietor of Mobile-John.com. With over a decade of experience as the face of VMware's Workplace One, John has a deep and unique perspective on endpoint management and cloud migration. He is passionate about helping organizations navigate complex technical challenges with pragmatic, real-world solutions.
LinkedIn
🔗 Related Links
* Microsoft Entra Hybrid Join: Not Dead Yet! (Jon’s blog)
* Workplace Ninjas US
* Microsoft's Entra Kerberos: Bridging Legacy AD to Cloud Auth + MAM on Edge with PM Jordan Gross
📗 Chapters
00:23 Entra Hybrid Join: To Do or Not to Do?
03:13 The Great Migration from VMware to Intune
06:23 Entra Join vs. Hybrid Join Explained
12:52 The Magic of Cloud Kerberos Trust
15:53 Demystifying Windows Autopilot
25:23 Making the Case for Hybrid Join with Autopilot
30:57 Why Cloud-Native is the Future
36:16 Introducing Workplace Ninjas US
39:06 The "Golden Clippy Awards"
41:31 Announcing the Entra IDol of the Year Finalists
Podcast Apps
🎙️ Entra.Chat - https://entra.chat
🎧 Apple Podcast → https://entra.chat/apple
📺 YouTube → https://entra.chat/youtube
📺 Spotify → https://entra.chat/spotify
🎧 Overcast → https://entra…
-
Entra Chat 🎙️ → A master class with Entra’s Identity Provisioning Wizard!
12 juli 2025 · 55 min
In this episode, I sit down with Chetan Desai, a Principal Product Manager on the Microsoft Identity Governance team. We dive deep into a side of Entra that many admins never see: the critical "first mile problem" of getting identities into your system in the first place. Lees meer
We talk about the evolution from on-prem scripts and MIM to specific connectors for Workday and SuccessFactors and then to the new powerful, generic API-driven approach that can handle any HR system and the architectural decisions behind it. Chetan also gives us a masterclass on how the provisioning engine differs from the Graph API and provides advice for anyone looking to migrate from a legacy Identity Governance and Administration (IGA) solution.
Subscribe with your favorite podcast player or watch on YouTube 👇
About Chetan Desai
Chetan Desai is a Principal Product Manager at Microsoft on the Entra team. For the past seven years, he has been a core part of the Entra Identity Governance and Provisioning team. Before his time at Microsoft, Chetan spent 17 years in consulting within the identity and access management domain , bringing a wealth of real-world deployment and integration experience to his product management role.
🔗 Related Links
* Application and HR provisioning documentation
* Provisioning with SCIM
* API-driven inbound provisioning concepts
📗 Chapters
00:34 The "First Mile Problem" in Identity
04:51 From AD Sync to HR-Driven Provisioning
09:52 The Entra Provisioning Service Architecture
16:17 Hybrid vs. Cloud-Only Identity Flows
19:17 Beyond Workday: The Need for a Generic Connector
27:43 The Great Debate: CSV vs. SQL vs. API
35:34 Provisioning API vs. Graph API: What's the Difference?
43:24 The Latest Evolution: Custom Security Attributes
49:26 Advice for Migrating to Modern IGA
Podcast Apps
🎙️ Entra.Chat - https://entra.chat
🎧 Apple Podcast → https://entra.chat/apple
📺 YouTube → https://entra.chat/youtube
📺 Spotify → https://entra.chat/spotify
🎧 Overcast → …
-
The Secret to Great Tech Content? A Masterclass in Storytelling
4 juli 2025 · 1 uur 3 min
In this episode, I chat with the legendary Tony Redmond, a prolific writer and author of "Office 365 for IT Pros". Tony shares unfiltered insights from his career, critiques the state of technical writing and AI, and discusses the challenges with PowerShell and the future of AI agents in the Microsoft ecosystem. Lees meer
Subscribe with your favorite podcast player or watch on YouTube 👇
About Tony Redmond
Tony Redmond is a well-known and prolific writer in the Microsoft 365 space. After a long career in large tech companies like Digital, Compaq, and HP, where he rose to the level of Vice President, he became an independent consultant and author in 2010. He is the lead author of the widely respected and continuously updated e-book, "Office 365 for IT Pros," and "Automating Microsoft 365 with PowerShell."
LinkedIn - https://www.linkedin.com/in/tonyredmond/
🔗 Related Links
* Office 365 for IT Pros (Book) - https://office365itpros.com
* Practical 365 - https://practical365.com
📗 Chapters
00:00 Intro
03:50 Tony's career and lessons from corporate life
09:06 The story behind the "Office 365 for IT Pros" book
21:35 Tony's rules for great technical writing
25:31 The problem with duplicate content and AI summaries
36:31 A critique of the Graph PowerShell SDK
45:15 The dangers of AI and the need for guardrails
50:57 Microsoft's mistake: Rushing tech without guardrails
55:04 The cyclical nature of technology and IT challenges
Podcast Apps
🎙️ Entra.Chat - https://entra.chat
🎧 Apple Podcast → https://entra.chat/apple
📺 YouTube → https://entra.chat/youtube
📺 Spotify → https://entra.chat/spotify
🎧 Overcast → https://entra.chat/overcast
🎧 Pocketcast → https://entra.chat/pocketcast
🎧 Others → https://entra.chat/rss
Merill's socials
📺 YouTube → youtube.com/@merillx
👔 LinkedIn → linkedin.com/in/merill
🐤 Twitter → twitter.com/merill
🕺 TikTok → tiktok.com/@merillf
🦋 Bluesky → bsky.app/profile/merill.net
🐘 Mastodon → infosec.exchange/@merill
🧵 Threads → threads.ne…
-
The Ultimate Guide to App Consent in Microsoft Entra
27 juni 2025 · 1 uur 12 min
In this episode, I sit down with Erin Greenlee, the Product Manager for App Consent on Microsoft’s App Platform Team. We dive into the critical world of app consent and the upcoming Microsoft 365 secure-by-default changes. We explore the nuances of user and admin consent, the impact of the mid-July 2025, policy shift, and how admins can prepare for a more secure Entra environment. Lees meer
Subscribe with your favorite podcast player or watch on YouTube 👇
About Erin Greenlee
Erin Greenlee is a Product Manager at Microsoft, specializing in the App Platform Team within the Identity and Network Access division. With a decade of experience at Microsoft, including roles in B2C and domain services, Erin now focuses on consent, authorization, and app roles, helping organizations secure their applications while enabling productivity.
LinkedIn - https://www.linkedin.com/in/eringreenlee/
🔗 Related Links
* MC1097272 - Microsoft 365 Upcoming Secure by Default Settings Changes - https://mc.merill.net/message/MC1097272
* Entra Admin Consent Workflow - https://docs.microsoft.com/en-us/entra/identity/enterprise-apps/configure-admin-consent-workflow
* Configure how users consent to applications - https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/configure-user-consent
* Manage app consent policies - https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/manage-app-consent-policies
* Review App Consent audit logs - https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/app-perms-audit-logs
📗 Chapters
02:15 What is App Consent?
03:22 Delegated vs. Application Permissions
07:45 The User Consent Balancing Act
13:58 How Consent is Evaluated
17:33 Understanding Tenant Consent Policies
22:28 The Admin Consent Workflow
31:18 The Big Change: Microsoft's Secure-by-Default Update
41:35 How to Prepare for the Change
49:05 Advanced Delegation with Custom Policies
Podcast Apps
🎙️ Entra.Chat - https://entra.chat
🎧 Apple Podcast → https://entra.chat/…
-
Pushing Microsoft Entra to its Limits to Secure On-Prem AD
20 juni 2025 · 48 min
In this episode, we talk with an identity expert, ex-Microsoftie and Principal Domain Architect, Mark Renoden, about creating a modern Privileged Access Management (PAM) solution for on-premises Active Directory. Discover how to build a secure "Bastion Forest" architecture using Microsoft Entra. We talk about PIM for Groups, group write-back, phish-resistant credentials, Privileged Access Workstations (PAW), securing an Entra tenant from the ground up, and navigating challenges with Cloud Solution Provider (CSP) permissions. Lees meer
Watch on YouTube
PS. Can I ask a favor? If you enjoyed this episode please leave a review and rating! Thank you 🙏 - Merill
About Mark
As Principal Domain Architect for Identity at Increment, Mark leads the design and delivery of secure, scalable identity architectures grounded in Microsoft Entra ID and aligned with Zero Trust principles. He specializes in helping organisations modernise their infrastructure and navigate complex identity transformations.
Previous to Increment, Mark spent over 20 years at Microsoft in support, field engineering, mission critical and customer experience roles focused on Identity across a wide spectrum of industries in Australia and New Zealand, including Finance, Healthcare, Government, Education and Retail.
LinkedIn - https://www.linkedin.com/in/markrenoden/
🔗 Related Links
* DirectoryShield | Increment - https://www.increment.inc/directoryshield
* Entra Security Recommendations - https://aka.ms/EntraSecurityRecommendations
* Securing privileged access overview - https://learn.microsoft.com/en-us/security/privileged-access-workstations/privileged-access-overview
* MIM - Bastion environment - https://learn.microsoft.com/en-us/microsoft-identity-manager/pam/planning-bastion-environment
📗 Chapters
00:46 Securing Your Entra Tenant
02:09 The Quest for a Microsoft-Only PAM Solution
04:21 What is a "Bastion Forest"?
07:50 Reimagining the Bastion Forest for the Cloud
12:53 Architecting a "Secure-by-Defau…
-
From Active Directory to AI Agents: The 25-Year Saga of Microsoft's Identity
14 juni 2025 · 1 uur 4 min
In this very special episode, I sit down with the "Yoda of Entra" himself, Tarek Dawoud, who also happens to be my manager! Lees meer
We dig deep into the fascinating and often surprising history of Microsoft's identity platforms. Tarek, who has been on the team since 2007, takes us on a journey from the revolutionary launch of Active Directory in 1999, through the creation of the cloud services that battled Google Apps, to the formation of the identity division and the eventual rebrand to Entra.
You'll hear the inside story on how our customer experience team became a "secret weapon" and, most excitingly, we'll look at what the future holds for Identity and Access Management in the new age of AI agents.
Watch on YouTube
PS. Can I ask a favor? If you enjoyed this episode please leave a review and rating! Thank you 🙏 - Merill
About Tarek Dawoud
Tarek Dawoud is a long-time veteran at Microsoft, having been with the company for over 18 years. Tarek currently leads the architecture team within the customer engineering (CXE) organization, where he helps customers deploy Entra, gathers insights for the product group, and works to solve the hardest identity problems.
LinkedIn - https://www.linkedin.com/in/tarekdawoud/
🔗 Related Links
📗 Chapters
00:00 Intro
08:58 The Beginning: The Vision of Active Directory (AD)
14:51 The Consumer Side: Microsoft Passport & The Standards Debate
18:29 A Defensive Play: How Google Apps Sparked Microsoft's Cloud Identity
27:21 The First Merger: Active Directory & Cloud Teams Unite
32:03 The Birth of Conditional Access & The Authenticator App
42:52 The Security Re-org: Identity Moves to a New Home
45:30 A New Era: Rebranding to Entra
48:52 The Future is Now: AI, Agentic Identities, and the End of PowerShell?
Podcast Apps
🎙️ Entra.Chat → https://entra.chat
🎧 Apple Podcast → https://entra.chat/apple
📺 YouTube → https://entra.chat/youtube
📺 Spotify → https://entra.chat/spotify
🎧 Overcast → https://entra.chat/overcast
🎧 Pocketcast …
-
From NetIQ to Cloud-Native Entra: A Decade-Long IAM Revolution
6 juni 2025 · 59 min
In this episode, we are joined by Maqsood Bhatti, the IAM Principal Engineer at Elkjøp Nordic, who takes us through their incredible journey of migrating from the legacy NetIQ platform to Microsoft Entra. Lees meer
What's fascinating is how they accomplished this years ago, completely bypassing traditional tools like Entra Connect and adopting a "production-only" environment. Maqsood shares how they built a truly cloud-native identity solution from the ground up, leveraging custom connectors, app roles, and automating everything, including moving off the legacy platform entirely.
You’ll also hear about their advanced use of Microsoft Identity Governance, Logic Apps for custom provisioning, and a strict modern authentication policy that has shaped their identity and access management (IAM) for nearly a decade.
Watch on YouTube
PS. Can I ask a favor? If you enjoyed this episode please leave a review and rating! Thank you 🙏 - Merill
About Maqsood
Maqsood is the IAM Principal Engineer at Elkjøp Nordic, a company that was an early adopter of access automation since 2006. He has been instrumental in their journey from legacy systems like NetIQ to a modern, cloud-native Microsoft Entra infrastructure , championing innovative approaches like custom API integrations and a "prod-only" development environment.
LinkedIn - https://www.linkedin.com/in/maqsoodbhatti/
🔗 Related Links
* Elkjøp Nordic unngår IT-floker med storskala automatisering
📗 Chapters
00:00 Intro
01:10 Early Days & NetIQ Automation
03:34 The Journey to Public Cloud & Microsoft 365
08:23 Custom Connectors and Real-Time Sync
15:08 Embracing Azure, App Roles & Modern Auth
19:29 Password Sync & Skipping Entra Connect
22:57 Decommissioning NetIQ: Challenges & Motivations
27:27 Leveraging Entra ID Domain Services as a Bridge
33:28 Mastering App Roles & Guiding Developers
44:27 Migrating to Entra ID Governance & Logic Apps
52:57 The "Prod-Only" Philosophy & Cloud-Native Mindset
Podcast Apps
🎙️ Entra.Chat…
-
Decommissioning On-Prem AD: Lessons Learned from We Are Era's Successful Migration
30 mei 2025 · 59 min
Tobias Binkert, Head of IT at We Are Era, and Yusuke Kodama, Product Manager at Microsoft (who specialises in cloud-first identity, among many other things), join us to discuss We Are Era’s successful migration from on-premises Active Directory to a fully cloud-native Microsoft Entra ID environment. Lees meer
We delve into the motivations behind this significant shift with practical strategies for migrating devices using Microsoft Autopilot, modernizing applications, managing user accounts and groups in the cloud, and overcoming challenges like legacy RADIUS dependencies. Tobias shares the tangible benefits We Are Era experienced, including enhanced security, a superior user experience and increased agility for adopting new technologies.
LinkedIn
* Tobias Binkert - https://www.linkedin.com/in/tobias-binkert-83844810a/
* Yusuke Kodama - https://www.linkedin.com/in/yusukekodama85/
On a related note we ran a poll a few weeks ago asking what your Identity plans were for 2030 and beyond. Nearly 90% of you were looking to go Entra ID first with more than half planning to go full cloud native with Entra ID.
So hopefully this episode with Tobias and Yusuke will help shed some light and help you start your journey to going cloud-first/cloud-native.
Watch on YouTube
PS. Can I ask a favor? If you enjoyed this episode please leave a review and rating! Thank you 🙏 - Merill
🔗 Related Links
* Road to the cloud: Introduction
* Cloud transformation posture
* Establish a Microsoft Entra footprint
* Implement a cloud-first approach
* Transition to the cloud
📗 Chapters
00:00 Intro
03:20 The Motivation: Why Decommission On-Prem Active Directory?
06:23 Gaining Buy-In: Negotiating with Business Units
09:56 The ROI & Cost Impact: Saving 70% on Infrastructure
14:47 Device Migration: Tackling Windows Workstations with Autopilot
25:31 Server & Application Challenges: RADIUS, Printing, and More
32:06 User Accounts & Groups: The Shift to Cloud-Only Identities
44:19 Addressing Secu…
-
Unmasking Entra ID Threats: A CrowdStrike Researcher's Early Career Insights with Sapir Federovsky
24 mei 2025 · 53 min
In this episode we chat with Sapir Federovsky, a Security Researcher at CrowdStrike, who shares her journey from military service to becoming an identity threat researcher. Lees meer
She discusses her learning methods, the importance of community, and the challenges of keeping up in the fast-paced world of Azure and Entra ID security.
Sapir also delves into specific Entra ID features she focuses on, the critical role of prevention alongside detection, and her experiences as a woman in the tech industry.
LinkedIn - https://www.linkedin.com/in/sapir-federovsky-a687491b0/
Watch on YouTube
PS. Can I ask a favor? If you enjoyed this episode please leave a review and rating! Thank you 🙏 - Merill
🔗 Related Links
* Sapir's blog - https://sapirxfed.com/
* Reportly - https://github.com/sap8899/reportly
📗 Chapters
00:00 Intro
01:17 Early Career Perspectives & Learning Journey
03:25 Transitioning from Military to Civilian Tech
04:25 Learning Cloud Security & The Power of Talks/Blogs
08:19 Building a Tool for Log Analysis
12:26 A Typical Day: Continuous Learning & Community Sharing
15:08 Balancing Learning Old & New in a Fast-Evolving Field
17:38 The Power of Teaching to Master a Topic
19:37 Learning by Answering Questions
21:17 Vision: Becoming the Ultimate Defender & Community Building
23:48 Deep Dive: Graph Activity Logs in Entra ID
27:33 Focusing on Hybrid Environments & Synchronization
29:37 Experiences as a Woman in Tech
36:29 The Shift from Detection to Prevention & Hardening
39:13 The Challenge of Updating Tenant Configurations
45:57 Navigating Organizational Change Management Cycles
50:29 Final Advice: Always Say Yes & Create Opportunities
Podcast Apps
🎙️ Entra.Chat - https://entra.chat
🎧 Apple Podcast → https://entra.chat/apple
📺 YouTube → https://entra.chat/youtube
📺 Spotify → https://entra.chat/spotify
🎧 Overcast → https://entra.chat/overcast
🎧 Pocketcast → https://entra.chat/pocketcast
🎧 Others → https://entra.chat/rss
Merill's socials
📺 Y…
-
Microsoft's Entra Kerberos: Bridging Legacy AD to Cloud Auth + MAM on Edge with PM Jordan Gross
17 mei 2025 · 52 min
In this episode we chat with Microsoft PM Jordan Gross about the exciting world of Entra Kerberos. Lees meer
Discover how this crucial feature bridges the gap between traditional on-premises Active Directory and the modern cloud, enabling seamless authentication for legacy applications in hybrid environments.
Jordan delves into the mechanics of Entra Kerberos, its different operational modes (up-level and down-level trust), and its significance for organizations migrating to the cloud.
We also explore MAM (Mobile Application Management) on Edge, another innovative solution Jordan worked on, which helps secure browser access on personal devices.
LinkedIn - https://www.linkedin.com/in/jordangross61/
PS. Can I ask a favor? If you enjoy this podcast please leave a review and rating on your podcast app! This helps more folks discover Entra.Chat - Thank you 🙏 - Merill
Watch on YouTube or get the podcast from the links below 👇
🔗 Related Links
Entra Kerboros
* How Azure AD Kerberos Works • Steve Syfuhs
* Cloud Kerberos trust deployment guide
* Use Kerberos for single sign-on (SSO) to your resources with Microsoft Entra Private Access
* Kerberos Constrained Delegation for single sign-on (SSO) to your apps with application proxy
* Enable Microsoft Entra Kerberos authentication for hybrid identities on Azure Files
* How Windows Authentication for Azure SQL Managed Instance is implemented with Microsoft Entra ID and Kerberos
* Configure single sign-on for Azure Virtual Desktop using Microsoft Entra ID
* Enable Kerberos SSO to on-premises Active Directory and Microsoft Entra ID Kerberos resources in Platform SSO (MacOS)
MAM
* Data protection for Windows MAM
📗 Chapters
00:00 Intro
01:24 Introducing Entra Kerberos & MAM on Edge
03:13 What is Entra Kerberos?
04:14 Understanding Traditional Kerberos
06:39 Why Entra Didn't Just Use Kerberos Initially
07:36 The Lingering Importance of On-Prem AD
09:08 Where Entra Kerberos Fits: Solving Hybrid Problems
10:06 Use Cases…
-
Entra & Azure Power-Up: Secure Service Principal Impersonation with Simon Gottschlag
10 mei 2025 · 38 min
In this episode, Simon Gottschlag, CTO of Co-native and a Microsoft MVP in Azure, discusses his innovative prototype for implementing Azure service principal impersonation using Azure Functions and Key Vault. Lees meer
We explore the challenges of managing service principals, the journey to building a solution, and the potential for improving developer experience in platform building. Simon shares insights on the four-eyes principle, Entra ID's newer attribute-based access control (ABAC) vs the traditional RBAC model, and how his solution can enhance security and auditability in Azure environments.
LinkedIn - https://www.linkedin.com/in/simongottschlag
🔗 Related Links
* Azure Service Principal Impersonation - https://github.com/co-native-ab/azure-service-principal-impersonation
* pimctl - https://github.com/co-native-ab/pimctl
📗 Chapters
00:00 Intro
00:42 Meet Simon: CTO & Azure MVP
01:51 The Project: Azure Service Principal Impersonation
02:11 The Problem: Challenges in Managing Service Principals
03:47 Journey to the Solution: Building Platforms & Terraform Pain Points
06:50 The Challenge with Graph Permissions & Least Privilege
08:27 Improving Developer Experience in Platform Building
11:05 The Core Issue: Running Operations Locally vs. Service Principals
13:43 The Idea: Service Principal Impersonation
13:50 Four-Eyes Principle and PIM in Azure
15:40 Understanding Attribute-Based Access Control (ABAC)
18:58 Enforcing Role Delegation with ABAC and PIM
20:12 Clarifying Service Principal Access with PIM and Four-Eyes
21:26 The Local Development Dilemma with Security Principles
22:02 PIM CTL: A CLI Tool for PIM
22:42 New Challenge: Azure Managed Grafana & Terraform Authentication
23:36 AC Identity Terraform Provider: Getting Tokens from Entra
24:42 The Big Question: Securely Getting Service Principal Tokens Locally
25:21 What is Impersonation in This Context?
26:27 Building the Solution: Federated Credentials & Custom Token Exchange
28:42 How the Az…
-
Unlocking Entra ID's NEW QR Code Sign-In. Fast & Simple Authentication!
2 mei 2025 · 46 min
🎙️ Entra.Chat - https://entra.chat Lees meer
This episode of Entra Chat features Anju Singh, a Product Manager at Microsoft in the Microsoft Entra Authentication Experiences team. We discuss the newest authentication method in Entra: QR codes!
Anju answers heaps of questions in this deep dive including why Microsoft chose QR codes, how it works under the hood, what you should and shouldn't use it for, and the biggest question - is it considered MFA?
LinkedIn - https://www.linkedin.com/in/anjusingh29/
Prefer watching? Search for ‘Entra.Chat’ on YouTube
🔗 Related Links
* QR Code Announcement - https://techcommunity.microsoft.com/blog/microsoft-entra-blog/simplify-frontline-workers’-sign-in-experience-with-qr-code-authentication/3822034
* QR code authentication method - https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-qr-code
* Best practices to protect frontline workers - https://learn.microsoft.com/en-us/entra/identity-platform/security-best-practices-for-frontline-workers
* Set up optimized QR code authentication experience in Android app - https://learn.microsoft.com/en-us/entra/identity-platform/android-qr-code-pin-authentication
* Set up optimized QR code authentication experience in iOS/macOS app - https://learn.microsoft.com/en-us/entra/identity-platform/ios-qr-code-pin-authentication
📗 Chapters
00:00 Intro
02:58 Topic Intro: QR Code Authentication for Frontline Workers
03:30 The Problem: Why QR Code Sign-In?
04:09 Who Are Frontline Workers?
05:41 Challenges with Current Authentication (Username/Password)
07:29 Balancing Simplicity and Security
10:40 Target Scenario: Shared Devices
11:36 Other Use Cases: Education Sector
12:30 How It Works: User Sign-In Experience
15:34 QR Code Contents: More Than Just a Username
16:40 PIN & QR Code Relationship
17:13 Scenario: Lost Badge & Admin Actions
18:32 Replacing the PIN
19:10 Delegated Management: The My Staff Portal
22:11 Handling Forgotten Badges: Temporary QR Cod…
-
Entra @ McDonald's: Managing 2.2 million workforce identities in the cloud
25 april 2025 · 1 uur 8 min
George Roberts, Director of Identity Governance and Administration at McDonald's, shares his extensive experience in migrating the company's workforce identity platform from on-premises ADFS to Microsoft Entra. Lees meer
We also talk about challenges like handling unique frontline worker needs (including a creative paper-based MFA solution) and integrating with various applications.
About George
George Roberts is the Director of Identity Governance and Administration at McDonald's, where he leads a global team responsible for building and delivering the enterprise identity and access platform to support over 2 million employees, partners, franchisees, and restaurant staff users worldwide. George has over 25 years of experience delivering secure, scalable, and user-friendly solutions that help McDonald's to accelerate its business. All views expressed are his own.
* LinkedIn - https://linkedin.com/in/sirtwist
* Bluesky - https://bsky.app/profile/sirtwi.st
🔗 Related Links
* Custom claims provider - https://learn.microsoft.com/en-us/entra/identity-platform/custom-claims-provider-overview
* Manage an external authentication method in Microsoft Entra ID - https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-authentication-external-method-manage
📗 Chapters
00:00 Intro
00:30 Overcoming ADFS Custom Claims Roadblock
01:35 Global Footprint and MFA Challenges for Frontline Workers
03:20 Guest Introduction: George Roberts, McDonald's
04:07 George's Background and Role at McDonald's
06:42 McDonald's Identity Journey: Decentralization to Centralization
08:38 The Entra (Azure AD) Migration Begins
13:04 Operational Benefits and Challenges of Moving to Entra
16:55 Deep Dive: Custom Claims and the Virtual Directory Service
23:56 Shift to API-First Mindset and Standards (SCIM)
32:46 Major Challenge: MFA Solutions for Frontline Workers
37:27 The Paper-Based MFA Solution
40:03 Entra External Authentication Methods
46:02 Ideas for Device-less Frontline Aut…
-
Inside Entra Sync: Dhanyah, the Microsoft PM for Entra Connect & Cloud Sync Reveals All
18 april 2025 · 39 min
Join us for a conversation with Dhanyah Krishnamoorthy, Product Manager at Microsoft, as she discusses Microsoft Entra Connect Sync and Cloud Sync solutions for synchronizing on-premises Active Directory identities to Entra ID. Lees meer
Learn about Microsoft's overall strategy for syncing and what you can do to prepare for the future including security considerations and scaling guidance.
Subscribe with your favorite podcast player or watch on YouTube 👇
About Dhanyah
Dhanyah Krishnamurthy is a Principal Product Manager in the Microsoft Entra product group. For the past four years, Dhanyah has focused on hybrid identity scenarios, leading the product management for critical services that help organizations manage identities between on-premises Active Directory and the cloud. She specifically owns Microsoft Entra Connect Sync and the newer Microsoft Entra Cloud Sync capabilities, designing solutions to streamline identity provisioning, enhance security, and support complex scenarios like mergers and acquisitions.
LinkedIn - https://www.linkedin.com/in/dhanyah
🔗 Related Links
* Hybrid Identity - https://learn.microsoft.com/en-us/entra/identity/hybrid/
* Comparison between Microsoft Entra Connect and cloud sync - https://learn.microsoft.com/en-us/entra/identity/hybrid/cloud-sync/what-is-cloud-sync
* Topologies for Microsoft Entra Connect - https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/plan-connect-topologies
* Factors influencing the performance of Microsoft Entra Connect - https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/plan-connect-performance-factors
* Group writeback with Microsoft Entra Cloud Sync - https://learn.microsoft.com/en-us/entra/identity/hybrid/group-writeback-cloud-sync
📗 Chapters
00:00 Intro
03:16 Why Two Sync Solutions? Connect Sync vs Cloud Sync History
05:17 Benefits of Cloud Sync vs Connect Sync
06:23 Cloud Sync Advantage: Mergers & Acquisitions
08:16 Cloud Sync Advantages: Lightweight, High Availability, S…
-
Securing a Global Giant: Inside IKEA's Identity Strategy with Martin
11 april 2025 · 55 min
In this insightful discussion, Martin Sandren from IKEA joins Entra Chat to discuss the evolving landscape of IAM. Lees meer
The episode covers critical considerations for modern identity strategies, including the trade-offs between syncable and device-bound passkeys, the necessity of robust regression testing for Conditional Access, and advancements in identity proofing methods.
Subscribe with your favorite podcast player or watch on YouTube 👇
About Martin Sandren
Martin Sandren is the IAM Lead at Inter IKEA, overseeing the systems that support IKEA's worldwide presence. His extensive background includes over twenty years of experience as an IAM product lead, architect, engineering manager, and developer.
Beyond his role at IKEA, he is actively involved in the identity community as a frequent speaker at international conferences and a founder of the Digital Identity Amsterdam meetup and the Amsterdam chapter of IdentiBeer, and is active within the idNext foundation and IDPro.
LinkedIn - https://linkedin.com/in/martinsandren/
🔗 Related Links
• IAM Conferences in Europe
📗 Chapters
00:00 Intro
02:51 Martin's Journey into Entra & Early IAM Experiences
05:35 Early Entra Wins: Simplified Sign-in Logging
07:02 Value of Microsoft's Preview Feature Model (Private/Public/GA)
09:39 Evolution of Federation: SAML/OIDC Then vs Now
13:22 The Rise of SCIM for User Provisioning
14:47 Cloud Standardization vs On-Prem Customization Trade-offs
16:48 Identity Governance & Multi-Tenant Organizations (MTO)
19:01 The Power & Complexity of Conditional Access
20:23 Resilience & Offline Scenarios in IAM
23:12 Challenges with Guest User Management & Governance
26:16 Cross-Tenant Sync vs Connected Organizations
27:49 The "Schrodinger's Cat" Problem with Guest Accounts
30:58 Mastering Conditional Access Policies: Best Practices & Pitfalls
32:41 Shifting Security Focus: From Network to Identity Defense-in-Depth
34:04 Adapting Security for Different User Populations (Frontline Wor…
-
What nobody tells you about managing Microsoft 365 guest access with Samantha
4 april 2025 · 1 uur 6 min
In this episode we discuss the evolution of guest access from SharePoint to Entra ID, the challenges of managing guest identities, and the importance of security and governance. Lees meer
Our conversation covers key topics including cross-tenant access settings, identity governance, B2B direct connect, and licensing considerations.
Samantha also shares practical advice and best practices for organizations to secure their tenants and streamline external collaboration.
Subscribe with your favorite podcast player or watch on YouTube 👇
LinkedIn - https://www.linkedin.com/in/samkloos/
🔗 Related Links
* Overview: Cross-tenant access with Microsoft Entra External ID
* Cross-tenant access activity workbook
* B2B direct connect overview
* Entra Security Recommendations
📗 Chapters
00:00 The Evolution of Guest Access
04:49 Guest Access Settings and Best Practices
23:00 Cross Tenant Access Settings Demystified
36:06 B2B Direct Connect
48:09 Guest Licensing: Key Considerations
56:10 Entitlement Management and Guest Users
Podcast Apps
🎧 Apple Podcast → https://entra.chat/apple
📺 YouTube → https://entra.chat/youtube
📺 Spotify → https://entra.chat/spotify
🎧 Overcast → https://entra.chat/overcast
🎧 Pocketcast → https://entra.chat/pocketcast
🎧 Others → https://entra.chat/rss
Merill's socials
📺 YouTube → youtube.com/@merillx
👔 LinkedIn → linkedin.com/in/merill
🐤 Twitter → twitter.com/merill
🕺 TikTok → tiktok.com/@merillf
🦋 Bluesky → bsky.app/profile/merill.net
🐘 Mastodon → infosec.exchange/@merill
🧵 Threads → threads.net/@merillf
🤖 GitHub → github.com/merill
Get full access to Entra.News - Your weekly dose of Microsoft Entra at entra.news/subscribe
-
Operational Groups in Entra with Nathan McNulty
27 maart 2025 · 47 min
Entra.Chat Podcast - https://entra.chat Lees meer
In this insightful episode, Nathan McNulty, Senior Security Solutions Architect at Patriot Consulting, shares his extensive experience deploying and securing Microsoft Entra environments. With a background spanning civil engineering, education, and critical infrastructure, Nathan brings practical wisdom from managing environments with 50,000+ users and 90,000+ devices.
Subscribe with your favorite podcast player or watch on YouTube 👇
The conversation explores realistic approaches to securing BYOD, building effective conditional access policies using a "castle" framework, and leveraging administrative units to partition permissions efficiently. Nathan reveals his innovative "operational groups" automation technique that helps classify users by authentication methods, enabling granular security controls without manual effort. The episode also covers authentication methods migration strategies, extension attributes, and modern cloud automation approaches that replace traditional server-based scripts.
Whether you're looking to improve your conditional access strategy, smoothly migrate authentication methods, or automate Entra management tasks, Nathan's field-tested insights will help you secure your environment more effectively while reducing administrative overhead.
Nathan McNulty
* Web - https://nathanmcnulty.com/
* LinkedIn - https://www.linkedin.com/in/nathanmcnulty/
* Bluesky - https://bsky.app/profile/nathanmcnulty.com
* X - https://x.com/nathanmcnulty
Related Links
* Operational Groups scripts - https://github.com/nathanmcnulty/nathanmcnulty/tree/master/Entra/operational-groups
* Maester DevOps - https://maester.dev/docs/monitoring/github
* Authentication Methods Migration - https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-authentication-methods-manage
* Administrative units - https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/administrative-units
* Restricted ma…
-
Bypassing MFA with Kuba, the Evilginx guy!
19 maart 2025 · 54 min
Episode Summary Lees meer
In this episode, we dive into the sophisticated world of phishing attacks with Kuba Gretzky, creator of the renowned Evilginx framework. He shares insights on how Evilginx operates as a reverse proxy, capturing authentication tokens in real-time, and discusses the ethical considerations of creating such a powerful tool. Most importantly, Kuba provides valuable guidance on protection strategies that organizations can implement to defend against these advanced phishing techniques.
Chapters
00:00 - Introduction to Kuba and Evilginx
- Creator of Evilginx, a phishing framework demonstrating MFA vulnerabilities
- 15+ years in cybersecurity, started with MMO game hacking
- Transitioned through reverse engineering to cybersecurity
02:03 - Understanding Phishing Fundamentals
- Phishing presents fake sign-in pages to capture user credentials
- Even 7-year-olds now learn about phishing dangers in school
03:39 - How Evilginx Works Technically
- Functions as a reverse proxy between user and legitimate server
- Creates dual TLS connections to intercept all communications
- Captures authentication tokens for complete account takeover
05:55 The Evolution of Phishing Tools
- Evolved from experiments with cookie manipulation
- Improved upon older tools that required malware installation
- Developed from Nginx with Lua scripting to standalone Go application
10:37 Evilginx's Impact and Popularity
- Gained traction through demonstrating MFA vulnerabilities
- Creates "shock factor" when users see how easily accounts are compromised
- Emerged alongside other tools but distinguished by ease of demonstration
12:25 Real-World Phishing Examples
- Sophisticated attacks use browser-in-browser techniques
- High-profile victims include Linus Tech Tips YouTube channel
- Attackers leverage urgency and fear to bypass security awareness
16:23 Protecting Against Evilginx Attacks
- Implement domain verification checks through JavaScript
- Deploy "shadow toke…
-
From Okta to Entra: Migrating 700 Apps in 90 Days
10 maart 2025 · 1 uur 4 min
In this very first episode of the Entra Chat podcast I sat down with Ben Wolfe, my former manager and ex-Microsoft, who is now the Head of Security Solutions at Increment. Lees meer
How to get in touch with Ben:
Ben Wolfe - https://www.linkedin.com/in/benjaminwillwolfe/
Increment - https://www.increment.inc/
Mentions during the episode:
Graph X-Ray - https://graphxray.merill.net/
Get full access to Entra.News - Your weekly dose of Microsoft Entra at entra.news/subscribe