Entra Connect v2.6.79.0 was just released and contains undisclosed security fixes and @Microsoft recommends to update fast. On the bright side, it will finally support FIDO2 based authentication!
Folks, I just released Lokka 2.0 today!
The world's first Microsoft Graph MCP server is now a full blown MCP App.
First up multi-tenant support. You can now sign into more than one tenant.
What does it mean?
1/16
1/ We are sharing additional details regarding our investigation into unauthorized access to GitHub's internal repositories.
Yesterday we detected and contained a compromise of an employee device involving a poisoned VS Code extension. We removed the malicious extension version, isolated the endpoint, and began incident response immediately.
Entra App Proxy continues to be one of the biggest hidden gems of Entra P1
For over a decade, we've been able to stop exposing risky apps to the Internet by routing through agents with outbound connections to Azure
I don't care what vendor you use, just get it off the Internet
@techspence@laplanted24@magicswordio@ThreatLocker Without changing a single thing, you can create an alert and automate remediation if you wanted
They publish queries that pull the latest domain names lists and hunt for you ;)
https://t.co/NB6MEzPV0p
❗️🚨 Microsoft Edge keeps every saved password in process memory as cleartext from the moment it launches. Microsoft's responsed when reported: "by design."
All of them. Including credentials for sites you won't open this session.
Researcher @L1v1ng0ffTh3L4N tested every major Chromium browser. Edge is the only one that behaves this way.
Chrome decrypts credentials on demand, and App-Bound Encryption locks the keys to an authenticated Chrome process so other processes can't reuse them.
In Chrome, plaintext surfaces only during autofill or when a password is viewed, making memory scraping far less useful.
What makes this extra weird is that Edge still demands re-authentication before revealing those passwords in its Password Manager UI, while the same browser process already holds every one of them in plaintext.
In shared environments, this turns into a credential harvest. On a terminal server, an attacker with admin rights can read the memory of every logged-on user process. In the published PoC video, a compromised admin account lifts stored credentials from two other logged-on (and even disconnected) users with Edge running.
Microsoft's official response when notified: "by design."
The finding was disclosed April 29 at BigBiteOfTech by PaloAltoNtwks Norway, alongside a small educational tool that lets anyone verify the cleartext storage for themselves.
Stop using UPNs for Entra ID automation. It’s a ticking time bomb. 💣
If a user changes their name (marriage/rebrand), your logic breaks.
The result? Wiped laptops, broken groups, and "forever access."
Here is how to build a stable identity lifecycle. 🧵
1/5
@DanielatOCN@PyroTek3 Ah right, I only ever user the service to translate a domain name to tenant id without authenticating so didn’t think about the additional use cases 😅
@SwiftOnSecurity For that countermeasure to be somewhat effective we also need universal CAE for to make sure access tokens can be revoked too… although I didn’t read up on the details in this case, perhaps CAE was in fact in play :)