Enrique Róo Moares

Cloud Solution Architect | Microsoft 365 | Intune | Azure AD | Modern Workplace | Tweets are my own

[@rnabmitra @rnabmitra]

This is a handy reference when you work on #Kusto #KQL
https://t.co/RhNqfNHWOj

[@rnabmitra @rnabmitra]

#Windows365 brings Context based redirections. Now you can block redirections of Drive/Clipboard/Peripherals from personal devices.
https://t.co/sYjWoiob6y

[@rnabmitra @rnabmitra]

#Windows365 #Build #Announcements
https://t.co/aktNZyKg5f
#Dev Images
#W365Flex
#W365ForAgents

[APNIC @apnic]

“RADIUS is the protocol that will never die” - Alan DeKok

So given that RADIUS is staying, what do we need to do to make it secure for the next 30 years?
https://t.co/eX572AtSPL

[@rnabmitra @rnabmitra]

The blog’s out here to configure #PSSO during #ADE for #macOS with #MSIntune

https://t.co/CYY6v68EJw

[Tom Hickling @tomhickling]

#Autopilot Device Preparation Policies are now generally available with #Windows365. Ensure your applications are installed and scripts are run before the #CloudPC is considered "provisioned":

https://t.co/AHFmAiOpIj

[@rnabmitra @rnabmitra]

Start your free 50-hour trial of #Windows365 for #Agents and begin building agents in #Microsoft #Copilot #Studio
https://t.co/7D4Tabn8Zo

[Micke Karlsson @Micke_K_72]

3.10.3 Released. Added Win32 app Install/Uninstall script support and Windows Quality Update Policies. Fixed category import, JSON property order for Git tracking + multiple documentation fixes. See https://t.co/fFctA4XZkj for more info

[UpdateDavid_MSFT @UpdatedavidM]

What’s new in Microsoft Intune – April https://t.co/SIMFcJyygN

I'm proud to announce that New Windows Application Inventory in Intune Released today!

1/2

[@rnabmitra @rnabmitra]

#windows365 Frontline is now #w365 Flex
Learn more here: https://t.co/q7kDujEhpO

[Sascha Stumpler 💻 @SasStu]

Tired of forced reboots interrupting your users?

I built a solution using Intune's Win32 app framework to trigger graceful, user-aware restarts on demand - toast notification, snooze, grace period and all.

https://t.co/UawJfztp14

#Intune #MicrosoftIntune #PowerShell

[@rnabmitra @rnabmitra]

Take a look at the investments we’re making in #MSIntune to help important changes move faster and more predictable
https://t.co/oAjdNZGF9u

[@rnabmitra @rnabmitra]

#W365Agents Today, we’re bringing Windows 365 for Agents to public preview
https://t.co/Ivwq0T83z5

[Horizon Secured @horizon_secured]

🔒 Secure Bits 💡
𝗬𝗼𝘂𝗿 𝘁𝗲𝗻𝗮𝗻𝘁 𝗵𝗮𝘀 𝗖𝗔 𝗺𝗶𝘀𝗰𝗼𝗻𝗳𝗶𝗴𝘂𝗿𝗮𝘁𝗶𝗼𝗻. 𝗘𝘃𝗲𝗿𝘆 𝗮𝗱𝗺𝗶𝗻 𝗶𝘀 𝗹𝗼𝗰𝗸𝗲𝗱 𝗼𝘂𝘁. 𝗗𝗼 𝘆𝗼𝘂 𝗵𝗮𝘃𝗲 𝗮 𝘄𝗮𝘆 𝗯𝗮𝗰𝗸 𝗶𝗻?

Most organizations don’t — or think they do, until they discover their break-glass accounts are untested, unmonitored, or built on outdated guidance. You don’t want to find that out the hard way, and you definitely don’t want to go through Microsoft’s Tenant Recovery process.

🤔 𝗪𝗵𝘆 𝗰𝗮𝗿𝗲?
A lockout from a bad CA policy, a compromised admin, or a personnel emergency means opening a support ticket with Microsoft and waiting. In urgent situations, you don’t have 14 days for that process.

🧠 𝗪𝗵𝗮𝘁 𝘄𝗲 𝘀𝗲𝗲 𝗶𝗻 𝘁𝗵𝗲 𝗳𝗶𝗲𝗹𝗱
•𝗕𝗿𝗲𝗮𝗸-𝗴𝗹𝗮𝘀𝘀 𝗮𝗰𝗰𝗼𝘂𝗻𝘁𝘀 𝗮𝗿𝗲 𝗺𝗶𝘀𝘀𝗶𝗻𝗴 — Two geographically separated accounts is the baseline.
•𝗚𝗲𝗻𝗲𝗿𝗶𝗰 𝗻𝗮𝗺𝗲𝘀 — admin@…, info@… are not break-glass accounts.
•𝗙𝘂𝗹𝗹 𝗖𝗔 𝗲𝘅𝗰𝗹𝘂𝘀𝗶𝗼𝗻 𝗶𝘀 𝗱𝗲𝗮𝗱 — MFA is now enforced by Microsoft regardless.
•𝗪𝗲𝗮𝗸 𝗮𝘂𝘁𝗵 𝗺𝗲𝘁𝗵𝗼𝗱𝘀 — Phone or certificate-based auth will fail exactly when you need it.
•𝗨𝗻𝗽𝗿𝗼𝘁𝗲𝗰𝘁𝗲𝗱 𝗮𝗰𝗰𝗼𝘂𝗻𝘁𝘀 — Any admin can edit or delete them.
•𝗡𝗼 𝗺𝗼𝗻𝗶𝘁𝗼𝗿𝗶𝗻𝗴 — If someone touches these accounts, you should know immediately.

🛠️ 𝗖𝗿𝗲𝗮𝘁𝗲 𝘁𝘄𝗼 𝗮𝗰𝗰𝗼𝘂𝗻𝘁𝘀
Use descriptive names on onmicrosoft[.]com with a random string — e.g. [email protected]. Assign 𝗚𝗹𝗼𝗯𝗮𝗹 𝗔𝗱𝗺𝗶𝗻𝗶𝘀𝘁𝗿𝗮𝘁𝗼𝗿 as a direct, permanent, active role. No eligibility.

🛠️ 𝗟𝗼𝗰𝗸 𝘁𝗵𝗲𝗺 𝗱𝗼𝘄𝗻
Place both accounts and their group inside an 𝗥𝗠𝗔𝗨 (requires Entra P1). Manage access via a custom PIM role — max 1-hour activation, approval required, auth context enforced (requires Entra P2).

🛠️ 𝗖𝗼𝗻𝗳𝗶𝗴𝘂𝗿𝗲 𝗮𝘂𝘁𝗵𝗲𝗻𝘁𝗶𝗰𝗮𝘁𝗶𝗼𝗻
Scope a passkey profile to the break-glass group with specific AAGUIDs for your hardware keys (YubiKey, Token2). Enforce via a custom authentication strength in a dedicated CA policy. Exclude the group from all other CA policies — run a What If to verify only your two break-glass policies apply.

🛠️ 𝗦𝗲𝘁 𝘂𝗽 𝗮𝗹𝗲𝗿𝘁𝗶𝗻𝗴
Stream AuditLogs and SignInLogs to a Log Analytics Workspace (requires Azure subscription). KQL alert rule on the break-glass Object IDs — any event fires immediately.

🛡️ 𝗦𝘁𝗼𝗿𝗲, 𝘁𝗲𝘀𝘁, 𝗱𝗼𝗰𝘂𝗺𝗲𝗻𝘁
Each passkey + PIN in a separate physical location. Define who can trigger the procedure and under what circumstances. Test end-to-end at minimum every 180 days — Microsoft recommends 90. Pick your cadence, but validate.

💬 When was the last time you tested these accounts?

𝘈𝘶𝘁𝘩𝘰𝘳: Martin Strnad

PS: We will soon 𝗽𝘂𝗯𝗹𝗶𝘀𝗵 𝗳𝘂𝗹𝗹 𝗴𝘂𝗶𝗱𝗲 on this topic!

#EntraID #IdentitySecurity #ConditionalAccess #SecureBits #HorizonSecured

[Jörgen Nilsson @ccmexec]

Enterprise state roaming is moving to Windows Backup for Organizations!
This is great news!
https://t.co/gXhVWWNYF3
#MSintune #Windows11

[Intune Support Team @IntuneSuppTeam]

📱 Migrating frontline devices? Start by understanding what you actually have.

Our latest @MSIntune blog with Intune MVP @SMG_0927 shows how to identify gaps, eliminate unknowns, and build a reliable foundation for your migration.

➡️ Learn more: https://t.co/YBieNjEXMS

#MSIntune #AlwaysIntune

[Sascha Stumpler 💻 @SasStu]

Auditing FIDO2 authentication for Windows Sign-in https://t.co/L0IULKXpDn

[Per Larsen #MSFT #MSIntune #MSSecurity @PerLarsen1975]

Windows 365 + Intune Advanced Endpoint Management Capabilities: Better Together #MSintune #Windows365
https://t.co/KSgTpz5GRL

[Richard Hicks @richardhicks]

How to migrate from classic #VPN to zero-trust network access (#ztna) with #Microsoft #Entra Private Access. #mobility #security #identity #DirectAccess #aovpn https://t.co/RmSkmprsqu

[Microsoft Intune @MSIntune]

Windows 365 and Microsoft Intune Suite are stronger together.

Learn how Windows 365 fits cleanly into existing Intune workflows—supporting Zero Trust, modern management, and scalable operations, without added complexity: https://t.co/nTveM4o7m6