#WorkloadID - Twitter Hashtag

about 1 year ago

Learn how to implement #ConditionalAccess for #WorkloadID and automate Incident Response: 🔗 https://t.co/phoT3Y6aop Apply restriction of credentials by App Management Policies in #MicrosoftEntra and #Azure Policies for MSIs: 🔗 https://t.co/NyEyJCVBKO 🔗 https://t.co/hDeHkA25lW

Thomas_Live's tweet photo. Learn how to implement #ConditionalAccess for #WorkloadID and automate Incident Response:
🔗 https://t.co/phoT3Y6aop

Apply restriction of credentials by App Management Policies in #MicrosoftEntra and #Azure Policies for MSIs:
🔗 https://t.co/NyEyJCVBKO
🔗 https://t.co/hDeHkA25lW https://t.co/tUiy5rdjxW

1

4

0

5

344

Thomas Naunheim @Thomas_Live

over 1 year ago

I've published a #KQL function ("WorkloadIdentityInfoXDR") for #MicrosoftDefender to enhance details of #MicrosoftEntra #WorkloadID from various sources, incl. the new table "OAuthAppInfo" but also IdentityInfo table and #ExposureManagement. (1/2) 🔗 https://t.co/1L9ZnwCVBB

Thomas_Live's tweet photo. I've published a #KQL function ("WorkloadIdentityInfoXDR") for #MicrosoftDefender to enhance details of #MicrosoftEntra #WorkloadID from various sources, incl. the new table "OAuthAppInfo" but also IdentityInfo table and #ExposureManagement. (1/2)
🔗 https://t.co/1L9ZnwCVBB https://t.co/UOw7soeGfQ

2

58

12

45

4K

Thomas Naunheim @Thomas_Live

about 2 years ago

[New blog post] Identify and prevent abuse of 🤖 #ManagedIdentities by #FederatedCredentials from ⚡ unauthorized entities. This will include how to detect and avoid #WorkloadID compromise in #Azure by using #AzADSPI, #MicrosoftSentinel and #AzurePolicy. https://t.co/SDi4N95l37

1

56

28

48

10K

Thomas Naunheim @Thomas_Live

over 2 years ago

In the previous month, I’ve written a blog post series about #MicrosoftEntra #WorkloadId: https://t.co/WOYkUKGsNz In this thread, I like to give you a summary about a few key aspects about managing non-human identities in #EntraID which has been also described in the articles.

Thomas_Live's tweet photo. In the previous month, I’ve written a blog post series about #MicrosoftEntra #WorkloadId: https://t.co/WOYkUKGsNz
In this thread, I like to give you a summary about a few key aspects about managing non-human identities in #EntraID which has been also described in the articles. https://t.co/CWduMsFWLH

3

68

20

44

6K

Thomas Naunheim @Thomas_Live

over 2 years ago

Ingestion of results from #EntraID Recommendations to Microsoft Sentinel is a great use case. It can be used for entity enrichment or workbooks. For example, I've integrated them to my #EntraOps #WorkloadID Workbook to show privilege classification of stale apps and credentials.

Thomas_Live's tweet photo. Ingestion of results from #EntraID Recommendations to Microsoft Sentinel is a great use case. It can be used for entity enrichment or workbooks. For example, I've integrated them to my #EntraOps #WorkloadID Workbook to show privilege classification of stale apps and credentials. https://t.co/plew73gmRE

1

2

0

2

463

Thomas Naunheim @Thomas_Live

over 2 years ago

[New blog post] #MicrosoftEntra #WorkloadID - Incident Response with #MicrosoftSentinel Playbooks and #ConditionalAccess 🤖 🛡 In this part of the blog post series, I will cover the implementation of incident response to the enriched threat detections. https://t.co/z1r22VmvcY

0

35

8

26

3K

Thomas Naunheim @Thomas_Live

almost 3 years ago

[New blog post] #MicrosoftEntra #WorkloadID - Advanced Detections and Enrichment in #MicrosoftSentinel: Implementing #AzADSPI and #WatchList solution to enrich incidents (e.g., with privileged classification based on Tiering Model) and enhanced detections. https://t.co/Z280O0GWmS

1

29

10

15

4K

Thomas Naunheim @Thomas_Live

almost 3 years ago

[New blog post] #MicrosoftEntra #WorkloadID - Threat Detection with #MicrosoftDefenderXDR and #MicrosoftSentinel: Overview of integrated threat intelligence, detection and UEBA capabilities across the various products to monitor non-human identities. https://t.co/vnBkkqc5UY

Thomas_Live's tweet photo. [New blog post] #MicrosoftEntra #WorkloadID - Threat Detection with #MicrosoftDefenderXDR and #MicrosoftSentinel: Overview of integrated threat intelligence, detection and UEBA capabilities across the various products to monitor non-human identities. https://t.co/vnBkkqc5UY https://t.co/CSctWr8T0R

0

45

13

30

7K

Thomas Naunheim @Thomas_Live

about 3 years ago

Working on the last finishing touches for the second part of my blog post series about #Entra #WorkloadId which will be published early next week. Stay tuned!