Daniel Bradley

Microsoft MVP, blogger and I write a little PowerShell

[Daniel Bradley @DanielatOCN]

Check out 𝐄𝐧𝐭𝐫𝐚𝐃𝐨𝐜𝐬𝐓𝐫𝐚𝐜𝐤𝐞𝐫 to stay always up to date with everything Microsoft Entra > https://t.co/l0ASxpwNga

𝐓𝐡𝐢𝐬 𝐢𝐬 𝐝𝐞𝐟𝐢𝐧𝐢𝐭𝐞𝐥𝐲 𝐚 𝐩𝐚𝐠𝐞 𝐭𝐨 𝐛𝐨𝐨𝐤𝐦𝐚𝐫𝐤

One way I stay up to date with all changes in Microsoft Entra is by monitoring updates to the Microsoft documentation, which often gets updated before official announcements of new features. Previously, I did this privately, but here I have turned it into an easy-to-use website, with a sprinkle of AI to summarise often difficult-to-read large commits.

Let me know what you think!

#Microsoft #Entra #EntraDocsTracker

[Daniel Bradley @DanielatOCN]

@merill You have my full support, this is awesome! Can't wait to use it.

[Daniel Bradley @DanielatOCN]

Education is difficult... we partner with some universities with 50k+ student identities. It's a challenge, but it's certainly doable. Although most primary-age education environments I have been in are on traditional AD. It's a bit more manageable when you get to secondary and higher ed.

[Daniel Bradley @DanielatOCN]

🔔 Stop bypassing MFA by adding your Office IP addresses to Conditional Access exclusions 🔔

Read this now on why you shouldn't do this > https://t.co/RgnRLurmGR

Modern threats have evolved, and your justification for why you have done this no longer matters.

𝐘𝐨𝐮 𝐦𝐚𝐲 𝐭𝐡𝐢𝐧𝐤 𝐢𝐭 𝐚𝐝𝐝𝐬 𝐭𝐨 𝐦𝐮𝐜𝐡 𝐟𝐫𝐢𝐜𝐭𝐢𝐨𝐧 𝐰𝐡𝐢𝐥𝐞 𝐢𝐧 𝐭𝐡𝐞 𝐨𝐟𝐟𝐢𝐜𝐞?
No, misconception. Microsoft invented their own token to solve this, called a PRT (or Primary Refresh Token). It works for AD Joined, Hybrid, or Entra-only devices, so no excuses.

𝐘𝐨𝐮 𝐦𝐚𝐲 𝐭𝐡𝐢𝐧𝐤 𝐮𝐬𝐞𝐫𝐬 𝐝𝐨𝐧'𝐭 𝐡𝐚𝐯𝐞 𝐬𝐮𝐩𝐩𝐨𝐫𝐭𝐞𝐝 𝐝𝐞𝐯𝐢𝐜𝐞𝐬 (𝐨𝐫 𝐢𝐭𝐬 𝐭𝐨𝐨 𝐢𝐦𝐩𝐚𝐜𝐭𝐟𝐮𝐥)
No, misconception. Plenty of platforms let you to federate your logins to offer custom authentication options. Like QR code badges, which satisfy MFA through your webcam.

𝐃𝐢𝐝 𝐲𝐨𝐮 𝐟𝐨𝐫𝐠𝐞𝐭 𝐚𝐛𝐨𝐮𝐭 𝐩𝐨𝐰𝐞𝐫𝐟𝐮𝐥 𝐝𝐞𝐯𝐢𝐜𝐞-𝐛𝐚𝐬𝐞𝐝 𝐂𝐨𝐧𝐝𝐢𝐭𝐢𝐨𝐧𝐚𝐥 𝐀𝐜𝐜𝐞𝐬𝐬 𝐟𝐞𝐚𝐭𝐮𝐫𝐞𝐬?
Requiring device compliance in Conditional Access is non-interruptive for users, but acts as a highly impactful "second factor".

#Entra #Microsoft

[Daniel Bradley @DanielatOCN]

@IAMERICAbooted Yes! I made https://t.co/eQyaaDmv93 around this and I use it with so many work related projects :)

[Daniel Bradley @DanielatOCN]

Microsoft are adding native time-bound access to Purview Role Groups this month! Check it out > https://t.co/jkaeamGCHj

Role Groups in Purview don't support PIM natively, but they are necessary for admins and compliance teams to operate Purview or manage specific, time-limited compliance cases. While it's not a full PIM integration, you'll soon be able to assign role groups on a limited, time-bound basis.

I explore this a little in my blog post linked above. While the UX isn't ready for this feature, you can still configure it using PowerShell.

#Microsoft #Purview #Entra

[Daniel Bradley @DanielatOCN]

@Alex_Pearce But what about the other 3 sub processors that where already listed, like Anthropic. For any of these sub processors, your data is authorised to be stored and processed outside of Azure anyway :)

[Daniel Bradley @DanielatOCN]

https://t.co/tSEtzsCS23 tracks which Graph API permissions can be used for each built-in Microsoft Admin role. And it also keeps track of changes, allowing you to compare the difference when roles are updated! 🚀

A challenge for those writing Microsoft Graph PowerShell scripts is knowing which Graph API permissions work for which Role. This is because there is no mapping between between the two, as they work on independent authorisation planes. I asked Microsoft about this challenge last year and it wasn't something they planned to solve... Yes, some Graph API endpoints provide a "least privileged role" in the documentation, but it doesn't solve the problem, which is why I built this utility.

#Microsoft #Entra #Roles

[Daniel Bradley @DanielatOCN]

@DrAzureAD @WEareTROOPERS Yes!! Would like to see this

[Daniel Bradley @DanielatOCN]

@NathanMcNulty @NerdShinobi We UK folk just say it how it is written, En-Tra, surely that makes more sense ;)

[Daniel Bradley @DanielatOCN]

@merddyn For Entra, it has never ever been that way, how long ago did you last check ;)

[Daniel Bradley @DanielatOCN]

The Microsoft Licensing FAQs finally clarify a long-standing point of frustration for Entra ID. I have broken this down here https://t.co/smodwJLoQQ

The "One Person, One License" philosophy for Microsoft Entra was only ever shared through blog posts and social media, meaning people often doubted whether it breached the current licensing terms or not. Now, the Microsoft Licensing FAQs clarify these points.

𝐏𝐒𝐀: 𝐒𝐭𝐨𝐩 𝐥𝐢𝐜𝐞𝐧𝐬𝐢𝐧𝐠 𝐬𝐞𝐜𝐨𝐧𝐝𝐚𝐫𝐲 𝐚𝐜𝐜𝐨𝐮𝐧𝐭𝐬 (𝐥𝐢𝐤𝐞 𝐀𝐝𝐦𝐢𝐧 𝐚𝐜𝐜𝐨𝐮𝐧𝐭𝐬) 𝐰𝐡𝐞𝐫𝐞 𝐢𝐭 𝐢𝐬𝐧'𝐭 𝐫𝐞𝐪𝐮𝐢𝐫𝐞𝐝.

#Entra #Microsoft

[Daniel Bradley @DanielatOCN]

@merill Yes please

[Daniel Bradley @DanielatOCN]

@Nigel_Farage Is social media safety not part of the current IT syllabus for secondary schools... surely that would make more sense? Social media was way worse 20 years ago during the times of Bebo and Tumblr. Nothing like preparing adolescents for adulthood like treating them like a child.

[Daniel Bradley @DanielatOCN]

@darkstarnj74 You should do, did you read my article?

[Daniel Bradley @DanielatOCN]

Baseline Scope enforcement in Conditional Access is rolling out today, but Microsoft have hidden the setting for it > https://t.co/3k5omkG8af

Currently, if a Conditional Access policy includes an exclusion, and your application only requests a specific set of baseline directory scopes (like https://t.co/f44DVMcoIo), then that authentication request could bypass the Conditional Access policy.

Rolling out from today, this behaviour is changing, and all authentication requests will be subject to Conditional Access policy enforcement.

For 99.9% of organisations, there will be no impact on you, but for a small subset that have built their own applications, you should verify any impact following the steps I have outlined in my article!

#Microsoft #Entra

[Daniel Bradley @DanielatOCN]

@acjuelich I believe it will be enforced, this is for you to make exceptions

[Daniel Bradley @DanielatOCN]

@mjovanovictech @KarenPayneMVP Was hoping for a reset!

[Daniel Bradley @DanielatOCN]

Check it out 🩵 You can now validate PIM requests automatically (like verifying a Ticket ID) using Custom Extensions! Read here > https://t.co/u1PIEnveME

This could be such a game changer, both for security, validation and accountability for accessing Roles, Groups and Azure Resource.

Once configured properly, you go from an organisation that only reacts to critical privileged access events, to an organisation that implements zero trust programmatically to a critical part of the user elevation process.

While it would require some development, I'm sure it will not be long for ISV's to integrate API's and approval logic to integrate natively into PIM!

#Microsoft #Entra #PIM

[Daniel Bradley @DanielatOCN]

@crismsantos @nick_cloudops Well that’s quite small, but if you need an ISO, just download one online?