Entra/Azure AD PIM may not be the security control you think it is.
Here's five common mistakes, limitations, and misunderstandings you want to avoid tripping up with.
Privileged Identity Management (PIM) – Common Microsoft 365 Security Mistakes Series: https://t.co/cVC04NbZR7
Simple problem:
Find all users who have email OTP configured in Entra ID
What you *might* be tempted to do:
Get-MgUser / Get-MgUserAuthenticationMethod
What you should do:
Get-MgReportAuthenticationMethodUserRegistrationDetail -Filter "methodsRegistered/any(i:i eq 'email')"
.@Office365 FWIW, I've updated my #PowerShell script to look for inactive guest accounts in #EntraID and report those that you might want to consider removing from the directory.
https://t.co/UgvOX1ffrj
#Microsoft365
It's way too easy to make mistakes in #entra#azuread Conditional Access. Over time, gaps happen. In this blog, I tackle five mistakes I see time and time again, and how you can start designing Conditional Access policies in a way that avoids them.
https://t.co/EpAgAVPK8h
1/ We recently had an interesting #Azure case where the TA, instead of creating a new Inbox Rule, added email addresses of interest to the list of blocked senders and domains.
The incoming emails will get flagged as spam and moved to the Junk email folder. 📂
🧵
.@Office365 Coming soon to #MicrosoftTeams near you... animated backgrounds for meetings. Will this make a difference to your world? No. Might it make some folks a little happier? Perhaps...
https://t.co/G74oIz1z1b
#Microsoft365
.@Office365#Microsoft365 DLP policies now support "oversharing" policy tips for when users try to share #Outlook email with external people and the messages (or attachments) have sensitivity labels.
https://t.co/6bopoVvN8z
.@Office365 Sometimes admins need to clean-up meetings on behalf of a user who's unavailable for some reason (like leaving the company). A cmdlet is available for this purpose, but maybe you didn't know about it. Now you do... https://t.co/08pNwwhMSe
#Microsoft365
.@Office365 How to annoy your #Microsoft365 users: send them organization messages to prompt them into better habits. They'll love you for this example of tender loving care.
https://t.co/4hS4EKsSwv
#Office365
.@Office365 As you upgrade #Microsoft365#PowerShell scripts to use the Graph SDK instead of the #AzureAD and MSOL modules, consider moving away from the Windows Scheduler and embrace Azure Automation instead
https://t.co/XoZOEnHoAY
.@Office365 Finally, the #MicrosoftTeams calendar accepts that not every time slot has to be accompanied by an online meeting. You can now book appointments through Teams, just like #Outlook.
https://t.co/xUqkktJVJO
#Microsoft365
As promised, here is my deep dive into the Microsoft Enterprise Single Sign On (SSO) plug-in for Apple devices
This works on all Apple devices including iOS, iPadOS & macOS!
Windows users have long enjoyed SSO, now you can bring that experience to your Apple users 😍
Read on⬇️
.@Office365 the #MicrosoftTeams restriction on anonymous participants in meetings being able to send chats now extends to reading chats...
https://t.co/af6tiHqmJK
#Microsoft365