𝘒𝘰𝘰𝘴 𝘎𝘰𝘰𝘴𝘴𝘦𝘯𝘴

Microsoft Security MVP | Photographer | Watch nerd | Pinball enthusiast | BBQ Grillmaster

[𝘒𝘰𝘰𝘴 𝘎𝘰𝘰𝘴𝘴𝘦𝘯𝘴 @KoosGoossens]

@yellowhat_live Lets go!!!

[Jan Bakker @janbakker_]

I usually don't drink on weekdays, but hear me out:

Over the weekend, I thought about a common conditional access misconfiguration I often see in the wild. I decided to write a blog post about it, but that got me thinking: Is that the best way to reach as many tenant admins as possible?

That gave me the following idea: What if I write a 🔥Maester test for it?

Now, as a non-developer, that might be out of your comfort zone, but with the help of @merill and @Thomas_Live, I quickly got this new test added to the existing repository, ready to hit hundreds or thousands of tenants.

Dare to (th)(dr)ink different. 🔥

📖 [Blogpost] https://t.co/pOSGyIUv9n
🚀 [Contribute to Maester] https://t.co/X8dnnRAJSv

[Experts Live Denmark @ExpertsLiveDK]

✨ Session Announcement: Build your security data lake with Microsoft Sentinel & Data Explorer; a match made in Azure! ☁️🔐✨

🎤 Get ready for a VIP experience with the legendary @KoosGoossens, Microsoft Security MVP & Cloud Wizard @ Wortell! He's spilling the tea on turbo-charged, budget-friendly log storage tricks that'll have your data spinning into the future.

🗓️ March 5, 2025 - mark your calendars for an epic showdown of code and Hollywood glamour at VUE! 🎥💫

🎟️ VIPs, let's light up the cloud! 💥🚀 Tickets are flying - catch yours now and join the hype! 🎉👇 https://t.co/I1L4o1MhOz

#ELDK2025 #ExpertsLiveDK #Microsoft #Community #Security #Azure #AI #ModernWorkplace #Intune #DevOps #Automation #M365 #PowerPlatform #Data #Purview #Development #OpenAI #Copilot #AVD #W365 #Identity #Entra

ELDK2025 Organizers:
Morten Knudsen (@knudsenmortendk) Thomas Poppelgaard (@_POPPELGAARD) Martin Byskov (@ByzzByskov) Henrik Wojcik (@henrikwojcik) Heine Madsen (@HeineKoldbro) Kent Agerlund (@agerlund)

[Elli Shlomo @ellishlomo]

Investigating Microsoft 365? The Unified Audit Log (UAL) is your go-to for tracking user and admin activities. Learn how to leverage it for security insights and compliance.

🔍 Read more: https://t.co/OZkMoe6kun

[Matt Zorich @reprise_99]

@HEXiT___ I put some notes here that hopefully explain it - https://t.co/0IZpURUmy7

[Matt Zorich @reprise_99]

One of our very smart Active Directory experts has been putting together a series of blog posts about hardening AD. Already into its 7th installment, it covers SMB hardening, disabling NTLMv1, least privilege and more. Check the series out - https://t.co/KkKfarAX9a

[Matt Zorich @reprise_99]

Great reminder for anyone wanting to enrich their Kusto queries with additional information. If you are after enrichment such as geo info for IPs, ASN lookup info, tor exit node data and more, then have a look below. The KQL is already written for you - https://t.co/5GoSenHxDy

[Fabian Bader @fabian_bader]

A new dedicated resource application to enable Active Directory to Microsoft Entra ID sync using Microsoft Entra Connect Sync or Cloud Sync is coming 😱

In the announcement the mentioned reason is "upcoming security hardening"...

6bf85cfa-ac8a-4be5-b5de-425a0d0dc016

#EntraID

[Chris Goosen @chrisgoosen]

everyday df3ndr episode 01x01 is out now! https://t.co/vyVLhZeNAc /cc @KoosGoossens

[Chris Goosen @chrisgoosen]

@KoosGoossens and I have been working on this for a few months now and while he is away at ESPC24 in Stockholm this week, I thought I'd share this intro - https://t.co/ZorT1GCxp6

Join us for the first of many episodes, coming soon to your favorite podcast player.

[Bert-Jan 🛡️ @BertJanCyber]

For all #KQL fans, I had this list of community repos lying around, the list now consists of 33 repos for you to investigate. Happy hunting! 🏹

Feel free to send a PR if you miss repos! :)
https://t.co/oKNZi0vmRf

[Jan Bakker @janbakker_]

New blogpost! Learn how to register Yubikeys on behalf of your users!

https://t.co/LDbZVZie6x

[Chris Goosen @chrisgoosen]

The latest @TheCloudArch episode is now live - thanks to @KoosGoossens @jeroenniesen @maarten_goet for being our guests (and cooking dinner!) - Episode 92: Dutch! (https://t.co/WpILDZZz03)

[Experts Live Europe @ExpertsLiveEU]

Who doesn't want to learn about #security? 😃

Come to #ExpertsLiveEU to hear from @KoosGoossens and learn how to build your security data lake with #MicrosoftSentitel & #DataExplorer: a match made in #Azure.

📅 Sept 24-25 Main Conference
📌 Budapest, Hungary
🔗 https://t.co/8zMlJKvPFl

[James @JamesAgombar]

Wrote a new blog on how to set up Microsoft Defender for External Attack Surface Management. Hope it’s of use to someone out there.

https://t.co/YfetTjsxhe

[𝘒𝘰𝘰𝘴 𝘎𝘰𝘰𝘴𝘴𝘦𝘯𝘴 @KoosGoossens]

@nickchapsas I had the exact same issue! The requirements are incorrect. 15 characters max. #thecakeisalie 😉

[𝘒𝘰𝘰𝘴 𝘎𝘰𝘰𝘴𝘴𝘦𝘯𝘴 @KoosGoossens]

@mikecybersec @fabian_bader Because we cannot trigger Functions from Sentinel automation. And triggering a Function from a Logic Apps, and bringing back the response to that Logic App is even more ugly. 🙄

[𝘒𝘰𝘰𝘴 𝘎𝘰𝘰𝘴𝘴𝘦𝘯𝘴 @KoosGoossens]

@fabian_bader @olafhartong That’s easy. Deploy Logic Apps from code and make sure nobody had write access to the Logic Apps. Perhaps a good idea for all resource types capable of using Managed Identites. Oh; and don’t assign owner to those identities. 🤪

[Fabian Bader @fabian_bader]

Run PowerShell in a Logic Apps

That's a game changer and will make it possible to use logic apps even for more complex tasks

https://t.co/2eo7iUh5nl

[Maarten Goet 🥷🏻 @maarten_goet]

RansomCow 🐄