Father Engineer Learner Lurker | Microsoft MVP | AD, Entra & enterprise security specialist. Senior Security Consultant @trustedsec. Fellow Human Being.
Joined August 2011
- Tweets3K
- Following430
- Followers1.3K
- Likes7.7K
Thanks Erica! Appreciate your support on this. Agreed that we've probably been saying the same things for the last 3-5 years.
I usually run a script that checks that every excluded group is specifically included in at least 1 policy.
Thanks for having me @merill ! Thanks for basically recording me rambling on my soapbox for an hour.
Folks, @TechBrandon has reviewed well over a thousand Conditional Access policies.
The same gaps keep coming up, tenant after tenant.
New Entra.Chat with Brandon on what he checks first, and the back door most admins forget.
Plus more youtu.be/NB8lmJJ6qWA
@merill makes me look so much smarter than I am. He elevates everyone he talks to. We had a great time just chatting with no agenda.
You are going to love this week's Entra Chat podcast episode with @TechBrandon
Subscribe on YouTube, Spotify and don't miss out when it drops!
This is the developer side of the Application. If you're the customer, you need a relationship with your vendors. Check for overly permitted apps and SPs in privileged roles. I'll be working on a write-up soon. In the meantime, Jeremy links Merills video which covers it briefly.
Re: the ConnectWise incident. App Instance Lock is the default in Entra ID as of June 2026. It's a good idea to go back now make sure it is enabled for multi-tenant apps: learn.microsoft.com/en-us/en…
Ya, it doesn't take long to pivot or add persistence.
I had a fundamental lack of understanding about creds on multi tenant apps. There is no "synchronization", the customer SP uses the creds associated with the home tenant application (of which they have no visibility)
Great post Merill. Question about how the credential flow works. I understand that a revoked certificate would break the chain for all tenants but would the same work for removing a client secret? Same with adding in the home tenant. Do those changes flow down and how quickly?
Nice and quick explanation of the overlying issue with application credentials
I made a short video that explains Entra app permissions and the part they played in the ConnectWise incident: how one app credential reached 173+ Microsoft 365 tenants with no password or MFA, and what to check today.
youtube.com/watch?v=Q36aL_HI…
Tech Brandon retweeted
Did you know that if you have Entra ID P1 there is a new way to block your stolen refresh token from being replayed by the attacker?
Find out 🧵👇
1/7
Tech Brandon retweeted
🔒 Secure Bits 💡
𝗔𝗿𝗲 𝘆𝗼𝘂 𝗽𝗹𝗮𝗻𝗻𝗶𝗻𝗴 𝘁𝗼 𝗿𝗼𝗹𝗹 𝗼𝘂𝘁 𝗽𝗮𝘀𝘀𝗸𝗲𝘆𝘀 𝗶𝗻 𝗠𝗶𝗰𝗿𝗼𝘀𝗼𝗳𝘁 𝗘𝗻𝘁𝗿𝗮 𝗜𝗗 𝗮𝗻𝗱 𝗱𝗼𝗻𝘁 𝗸𝗻𝗼𝘄 𝘄𝗵𝗲𝗿𝗲 𝘁𝗼 𝘀𝘁𝗮𝗿𝘁?
I put together a step-by-step guide that will help you configure Passkeys from the perspective of System Administrator.
𝟭. 𝗖𝗵𝗼𝗼𝘀𝗲 𝘁𝗵𝗲 𝗽𝗮𝘀𝘀𝗸𝗲𝘆 𝘁𝘆𝗽𝗲𝘀
It will guide you on passkey types, what are they good for, what are the main differences between them and how to use each type.
𝟮. 𝗘𝗻𝗮𝗯𝗹𝗲 𝘁𝗵𝗲 𝗺𝗲𝘁𝗵𝗼𝗱 𝗮𝗻𝗱 𝗰𝗿𝗲𝗮𝘁𝗲 𝘁𝗵𝗲 𝗽𝗿𝗼𝗳𝗶𝗹𝗲𝘀
⚙️ Authentication methods > Policies > Passkey (FIDO2)
It will show you how to set up Passkey profiles. Each profile has its own attestation setting, passkey types and specifies allowed passkey hardware.
𝟯. 𝗦𝗲𝘁 𝘂𝗽 𝗧𝗲𝗺𝗽𝗼𝗿𝗮𝗿𝘆 𝗔𝗰𝗰𝗲𝘀𝘀 𝗣𝗮𝘀𝘀
It shows how to configure TAP so helpdesk can use it to onboard new users or recover lost or stolen passkeys.
𝟰. 𝗖𝗿𝗲𝗮𝘁𝗲 𝗮 𝗖𝗼𝗻𝗱𝗶𝘁𝗶𝗼𝗻𝗮𝗹 𝗔𝗰𝗰𝗲𝘀𝘀 𝘁𝗵𝗮𝘁 𝗿𝗲𝗾𝘂𝗶𝗿𝗲𝘀 𝗣𝗵𝗶𝘀𝗵𝗶𝗻𝗴-𝗿𝗲𝘀𝗶𝘀𝘁𝗮𝗻𝘁 𝗠𝗙𝗔
Finally it will guide you how to create Conditional Access policy that requires authentication strength, aka how to enforce the configured Passkey profiles with 𝗣𝗵𝗶𝘀𝗵𝗶𝗻𝗴-𝗿𝗲𝘀𝗶𝘀𝘁𝗮𝗻𝘁 𝗠𝗙𝗔
Also, check the client requirements before the pilot: iOS 17 or Android 14 and newer, a current Authenticator build, and Bluetooth turned on for both devices.
The guide has the exact settings, the requirements and the screenshots. Full PDF Link in the comments.
📢 Big shout out to @TechBrandon for his website Passkey Path:
techbrandon.github.io/passke…
Some of the practical tips are based on his work.
Are you already running passkeys in Entra? Which types did you pick for the admins, and which for the standard users?
𝘈𝘶𝘵𝘩𝘰𝘳: Martin Strnad
#SecureBits #EntraID #Passkeys #FIDO2 #PhishingResistantMFA #Microsoft365 #CyberSecurity
Tech Brandon retweeted
Mosey on up and join @SoberInCyber at the Deadwood Soda Saloon tonight from 6-9:00 PM during the Sponsor Stampede at @BHinfoSecurity @WWHackinFest!
🥤 Handcrafted sodas & a sparkling good time await ya.
soberincyber.org/events-1/so…
#WWHFDeadwood2026
ALT Sober in Cyber “Deadwood Soda Saloon” event graphic with a Western theme and Wild West Hackin’ Fest logo. Text reads: “Wednesday • October 7 • 6–9:00 PM,” “Located in the back of Miss Kitty’s Mercantile,” and “649 Main Street, Deadwood, SD.” Center photo shows people seated at the Deadwood Soda Saloon bar on novelty stools shaped like the backs of horses.