Florian Adolf ⚡

#Microsoft #Azure Identity Security and Threat Protection 🐱‍💻🦾👨‍💻all Tweets are my own

[Florian Adolf ⚡ @fload_sec]

Finally! Thanks to everyone in the community. #az500 #azuread #security #microsoft
View my verified achievement from @microsoft. https://t.co/lXoC6KtOy6

[Merill Fernando @merill]

⚡ Check out this new Microsoft Entra blog post 👇

MFA enforcement for Microsoft Entra admin center sign-in coming soon

https://t.co/O6hY0MCRkJ

[Merill Fernando @merill]

I'm excited to share the Entra Story tomorrow @ the Cloud Identity Summit with Tarek Dawoud.

Here's a sneak peek 👇

[Merill Fernando @merill]

Getting ready to share The Entra Story at the Cloud Identity Summit

[Matt Zorich @reprise_99]

If you were (or are) a CISO, what are your 5 non-negotiables? For me:

1. If it's vulnerable, it's being patched
2. Connecting to a VPN? You are coming from a device I trust.
3. MFA everywhere.
4. Any security tools are fully deployed and actively monitored
5. I get all the logs

[IAM!ERICA @EricaZelic]

MS Cloud MFA/2FA bypasses:

AiTM
Illicet Consent
PRT theft
Browser Cookies Theft
PRT/Cookie Proxy
Device Code
Conditional Access Gaps

Which ones did I miss?

[Florian Adolf ⚡ @fload_sec]

@rucam365 Me explaining lifetime and refresh cascade for every token.

[David O'Brien (he/him) @david_obrien]

Microsoft just released their updated Microsoft Cybersecurity Reference Architectures (MCRA). A slide deck full of high-level guidance on securing one's organisation. Very handy for orgs starting out or already on the way.

https://t.co/XaxoxTDZoH

[Ru Campbell @rucam365]

When you ask Microsoft consultants how putting all your trust in Entra is zero trust.

[Accidental CISO @AccidentalCISO]

Oh, what the hell. Risk accepted. Congratulations! 🎉

[SwiftOnSecurity @SwiftOnSecurity]

Holy shit Microsoft figured out how their signing key was leaked
https://t.co/bJuY0tDFzn

[Jan Bakker @janbakker_]

MFA fatigue is real. Check this thread....

Most folks think Azure MFA is easy. They just flip the switch. But there are so many settings out there that can impact user experiences.

Here are some quick tips that might ease the pain a bit:

1. Do not user per-user MFA. Go with Conditional Access
2. Only configure sign-in frequency for persona's that need it, not for all users.
3. Make use of WhfB, or FIDO2 if possible. It will take care of the MFA claim in PRT. No prompts for your users.
4. Use the Authenticator App instead of SMS. It's way more user-friendly
5. Less risk and/or managed device eq longer session. More risk and/or unmanaged device eq shorter session.

[Tobias Zuegel | mrentraid.bsky.social @MrAzureAD]

There are two options to enforce compliant devices via #AzureAD Conditional Access:
A) Grant Require compliant device
vs
B) Block with device exclusion rule "(device.deviceOwnership -eq "Company" -and device.isCompliant -eq True)"

What do you use and why?

[Florian Adolf ⚡ @fload_sec]

View my verified achievement from @microsoft. https://t.co/TsYY3DL9RI

[Tarek Dawoud @cybertarek]

The second best thing about going Passwordless is the improved security. The best thing is the great end to end user experience:
https://t.co/83oa6qXTQ5

[Thomas Naunheim @Thomas_Live]

New chapter of #AzureAD Attack & Defense ☁️🔐 playbook has been published by @samilamppu and me: „Abuse of #AzureADConnect Sync Service Account for suspicious activities“.
#MicrosoftSentinel detections and mitigations for #HybridIdentity are also included.
https://t.co/Jvl9iNIMcO

[Florian Adolf ⚡ @fload_sec]

@MrAzureAD Congrats! And welcome back :)

[Christopher Brumm @cbrhh]

by @backbone2k

[Gavin Ashton @gvnshtn]

Basics

[Florian Adolf ⚡ @fload_sec]

@AntonioMaio2 @DebugPrivilege @AntonioMaio2 apart from getting stolen, wouldn’t be device compliance a proper alternative to offer to these never-reg people?