Tech Brandon

Father Engineer Learner Lurker | Microsoft MVP | AD, Entra & enterprise security specialist. Senior Security Consultant @trustedsec. Fellow Human Being.

[Tech Brandon @TechBrandon]

I'm shaving my head again this year. Please consider donating to this great cause. Help me raise money for #childhoodcancer research with @StBaldricks. https://t.co/ylcRZzIU8s

[Tech Brandon @TechBrandon]

@dnsinit @merill Technically true... 😂

[Tech Brandon @TechBrandon]

@m0bilej0n @merill Thank you Jon!

[Tech Brandon @TechBrandon]

Thanks for having me @merill ! Thanks for basically recording me rambling on my soapbox for an hour.

[Merill Fernando @merill]

Folks, @TechBrandon has reviewed well over a thousand Conditional Access policies.

The same gaps keep coming up, tenant after tenant.

New https://t.co/QZC4NErQam with Brandon on what he checks first, and the back door most admins forget.

Plus more https://t.co/EFSFUODK3C

[Tech Brandon @TechBrandon]

@Fahim_Samadi007 @merill I usually run a script that checks that every excluded group is specifically included in at least 1 policy.

[Tech Brandon @TechBrandon]

@merill @m19o__ @techspence

[Tech Brandon @TechBrandon]

@NathanMcNulty @merill This is how I feel about you too @NathanMcNulty

[Tech Brandon @TechBrandon]

@merill makes me look so much smarter than I am. He elevates everyone he talks to. We had a great time just chatting with no agenda.

[Merill Fernando @merill]

You are going to love this week's Entra Chat podcast episode with @TechBrandon

Subscribe on YouTube, Spotify and don't miss out when it drops!

[Tech Brandon @TechBrandon]

@m0bilej0n @merill @techspence @NathanMcNulty @derekmelber @gullett_d @Elie_Karkafy @JimSycurity @SamErde @Sanford_W @Santhosh_Sivara

[Tech Brandon @TechBrandon]

@IAMERICAbooted This is where I started... Ended up with the 96GB studio.

[Tech Brandon @TechBrandon]

This is the developer side of the Application. If you're the customer, you need a relationship with your vendors. Check for overly permitted apps and SPs in privileged roles. I'll be working on a write-up soon. In the meantime, Jeremy links Merills video which covers it briefly.

[Jeremy Kirk @Jeremy_Kirk]

Re: the ConnectWise incident. App Instance Lock is the default in Entra ID as of June 2026. It's a good idea to go back now make sure it is enabled for multi-tenant apps: https://t.co/0ucWZWZjtn

[Tech Brandon @TechBrandon]

@merill Ya, it doesn't take long to pivot or add persistence.
I had a fundamental lack of understanding about creds on multi tenant apps. There is no "synchronization", the customer SP uses the creds associated with the home tenant application (of which they have no visibility)

[Tech Brandon @TechBrandon]

Nice and quick explanation of the overlying issue with application credentials

[Merill Fernando @merill]

I made a short video that explains Entra app permissions and the part they played in the ConnectWise incident: how one app credential reached 173+ Microsoft 365 tenants with no password or MFA, and what to check today.

https://t.co/n5ewnUHA05

[Merill Fernando @merill]

Did you know that if you have Entra ID P1 there is a new way to block your stolen refresh token from being replayed by the attacker?

Find out 🧵👇
1/7

[Tech Brandon @TechBrandon]

@techspence @ThinkstCanary @haroonmeer I'm more jealous of this than all the pics from @WWHackinFest

[Tech Brandon @TechBrandon]

@Bandrel Sure...

[Horizon Secured @horizon_secured]

🔒 Secure Bits 💡
𝗔𝗿𝗲 𝘆𝗼𝘂 𝗽𝗹𝗮𝗻𝗻𝗶𝗻𝗴 𝘁𝗼 𝗿𝗼𝗹𝗹 𝗼𝘂𝘁 𝗽𝗮𝘀𝘀𝗸𝗲𝘆𝘀 𝗶𝗻 𝗠𝗶𝗰𝗿𝗼𝘀𝗼𝗳𝘁 𝗘𝗻𝘁𝗿𝗮 𝗜𝗗 𝗮𝗻𝗱 𝗱𝗼𝗻𝘁 𝗸𝗻𝗼𝘄 𝘄𝗵𝗲𝗿𝗲 𝘁𝗼 𝘀𝘁𝗮𝗿𝘁?

I put together a step-by-step guide that will help you configure Passkeys from the perspective of System Administrator.

𝟭. 𝗖𝗵𝗼𝗼𝘀𝗲 𝘁𝗵𝗲 𝗽𝗮𝘀𝘀𝗸𝗲𝘆 𝘁𝘆𝗽𝗲𝘀
It will guide you on passkey types, what are they good for, what are the main differences between them and how to use each type.

𝟮. 𝗘𝗻𝗮𝗯𝗹𝗲 𝘁𝗵𝗲 𝗺𝗲𝘁𝗵𝗼𝗱 𝗮𝗻𝗱 𝗰𝗿𝗲𝗮𝘁𝗲 𝘁𝗵𝗲 𝗽𝗿𝗼𝗳𝗶𝗹𝗲𝘀
⚙️ Authentication methods > Policies > Passkey (FIDO2)
It will show you how to set up Passkey profiles. Each profile has its own attestation setting, passkey types and specifies allowed passkey hardware.

𝟯. 𝗦𝗲𝘁 𝘂𝗽 𝗧𝗲𝗺𝗽𝗼𝗿𝗮𝗿𝘆 𝗔𝗰𝗰𝗲𝘀𝘀 𝗣𝗮𝘀𝘀
It shows how to configure TAP so helpdesk can use it to onboard new users or recover lost or stolen passkeys.

𝟰. 𝗖𝗿𝗲𝗮𝘁𝗲 𝗮 𝗖𝗼𝗻𝗱𝗶𝘁𝗶𝗼𝗻𝗮𝗹 𝗔𝗰𝗰𝗲𝘀𝘀 𝘁𝗵𝗮𝘁 𝗿𝗲𝗾𝘂𝗶𝗿𝗲𝘀 𝗣𝗵𝗶𝘀𝗵𝗶𝗻𝗴-𝗿𝗲𝘀𝗶𝘀𝘁𝗮𝗻𝘁 𝗠𝗙𝗔
Finally it will guide you how to create Conditional Access policy that requires authentication strength, aka how to enforce the configured Passkey profiles with 𝗣𝗵𝗶𝘀𝗵𝗶𝗻𝗴-𝗿𝗲𝘀𝗶𝘀𝘁𝗮𝗻𝘁 𝗠𝗙𝗔

Also, check the client requirements before the pilot: iOS 17 or Android 14 and newer, a current Authenticator build, and Bluetooth turned on for both devices.

The guide has the exact settings, the requirements and the screenshots. Full PDF Link in the comments.

📢 Big shout out to @TechBrandon for his website Passkey Path:
https://t.co/wAiBI6obIC
Some of the practical tips are based on his work.

Are you already running passkeys in Entra? Which types did you pick for the admins, and which for the standard users?

𝘈𝘶𝘵𝘩𝘰𝘳: Martin Strnad

#SecureBits #EntraID #Passkeys #FIDO2 #PhishingResistantMFA #Microsoft365 #CyberSecurity

[Sober in Cyber @SoberInCyber]

Mosey on up and join @SoberInCyber at the Deadwood Soda Saloon tonight from 6-9:00 PM during the Sponsor Stampede at @BHinfoSecurity @WWHackinFest!

🥤 Handcrafted sodas & a sparkling good time await ya.

https://t.co/JDvStRYt0a

#WWHFDeadwood2026

[Tech Brandon @TechBrandon]

I blogged again! That's like 3 blogs in 3 weeks ... And I'm working on another one for October.

[TrustedSec @TrustedSec]

Logging isn't a switch to flip; it's something to tune and maintain. In our new blog, @TechBrandon outlines a four-step #ActiveDirectory logging framework covering log sizing, audit policies, detection goals, and gap analysis. Read it now! https://t.co/9AzZMQkIyI

[Tech Brandon @TechBrandon]

@AletheDenis @JackRhysider @bsidespeoria I was already having fomo just knowing Alethe was there... Now Jack?!?