Masood Raza | IAM & Zero Trust

IAM & Zero Trust architect, 24+ yrs in enterprise IT. 8x Microsoft certified, ISC2 CC, MCT. Learn IAM by building it: free Frontline Lab guides + newsletter

[Masood Raza | IAM & Zero Trust @masoodrazaaa]

I've spent 24+ years in enterprise IT, most of it on identity: AD, Entra ID, privileged access, Zero Trust.

Now I write free, hands-on IAM labs. The Frontline Lab: build it in a free Azure tenant, document it, explain it in an interview.

Learn IAM by building it.

[Masood Raza | IAM & Zero Trust @masoodrazaaa]

The passkey trap is the one that will bite. Passkeys count for sign-in MFA, but SSPR still needs its own eligible methods.

Map who only has SMS or voice for reset, and get them an authenticator app or email method before February.

[Masood Raza | IAM & Zero Trust @masoodrazaaa]

@bastienperez_ Big quality-of-life change for labs and frontline rollouts. Until it ships, a short-lived Temporary Access Pass is still the clean bootstrap: issue TAP, register the passkey, expire the TAP.

Keep TAP issuance in a break-glass or helpdesk role, not with every admin.

[Masood Raza | IAM & Zero Trust @masoodrazaaa]

@buckleyplanet This is where Entra Agent ID's sponsor model helps. Every agent needs a business sponsor accountable for why it exists, its access reviews and when it gets retired.

When the sponsor leaves or changes role, reassign their agents the same day as their mailbox.

[Masood Raza | IAM & Zero Trust @masoodrazaaa]

@buckleyplanet Useful change. Until then, the workaround is a dedicated Teams CA policy that covers every meeting, then a separate policy for the users who join the sensitive ones.

When per-meeting CA lands, start with those high-risk meetings first rather than rewriting everything at once.

[Masood Raza | IAM & Zero Trust @masoodrazaaa]

@RidgelineCyber Useful list. One I'd add if it's not in there: device code sign-ins. Filter SigninLogs on AuthenticationProtocol for deviceCode and look at who and from where.

In most tenants that's a short list, so anything new on it deserves a look. Kits like MadApe abuse exactly that flow.

[Masood Raza | IAM & Zero Trust @masoodrazaaa]

@buckleyplanet Microsoft's advice is to block device code flow almost everywhere. A Conditional Access policy with the Authentication flows condition does it.

Check sign-in logs for device code sign-ins first, then exclude only what really needs it, like meeting room devices.

[Masood Raza | IAM & Zero Trust @masoodrazaaa]

I hold 8 Microsoft certifications and the ISC2 CC, and I teach as an MCT.

Full guide, updated for the 2026 prices: https://t.co/Nqa6dhM1ve

Then build the free lab: https://t.co/qzYMxsCH33

[Masood Raza | IAM & Zero Trust @masoodrazaaa]

The free ISC2 CC exam is gone.

If your plan to break into IAM was built on it, here's the 2026 version: what changed, what didn't, and the 90-day order I'd follow again. 🧵

[Masood Raza | IAM & Zero Trust @masoodrazaaa]

Be honest about timing. A first IAM-adjacent role in 4–8 months is realistic with a structured plan. The dedicated IAM role usually comes 12–18 months after that.

Expect 10–20 applications per interview. That's a niche specialisation, not a verdict on you.

[Masood Raza | IAM & Zero Trust @masoodrazaaa]

New to IAM and tempted to skip Active Directory because it looks old-fashioned? Don't.

In a hybrid Entra ID setup, users and groups are still mastered in AD and synced up by Entra Connect.

Learn OUs, groups, GPOs and DNS on one lab DC. Everything after gets easier.

[Masood Raza | IAM & Zero Trust @masoodrazaaa]

@bhaidar The step I'd add at validation: check the audience and issuer, then the right claim for the call type.

Delegated tokens carry scopes in scp. App-only tokens carry app roles in roles and no scp, so an API that only checks scp will reject or mishandle daemon calls.

[Masood Raza | IAM & Zero Trust @masoodrazaaa]

@DFIR_Radar If nobody in the tenant needs device code flow, block it with Conditional Access (the authentication flows condition) and exclude only the devices that do, like meeting room consoles.

Check the sign-in logs for device code sign-ins first so you know who those are.

[Masood Raza | IAM & Zero Trust @masoodrazaaa]

@directorcia One more check for the pilot: the Entra Connect AD connector account needs Reset password and Change password rights on the OUs where those users live.

If writeback fails for one department and not another, OU permissions are the first place I'd look.

[Masood Raza | IAM & Zero Trust @masoodrazaaa]

@acjuelich Good use of the extra time: list every dynamic group with a memberOf rule and what it drives (Conditional Access scope, licences, app assignments).

The groups that gate access are the ones to rebuild first, so the deadline doesn't land on a policy.

[Masood Raza | IAM & Zero Trust @masoodrazaaa]

@marvin_gerstner Thanks Marvin. That group is often the oldest exclusion in the tenant too.

One way to make the review stick: run an Entra access review on the exclusion group itself (needs P2), so its owner has to re-approve every member each quarter.

[Masood Raza | IAM & Zero Trust @masoodrazaaa]

Every Conditional Access exclusion group needs three things:

1. An owner
2. A written reason, and an end date if it's temporary
3. A scheduled review of who's in it

Break-glass accounts belong there. Last year's "temporary" migration group usually doesn't.

#MicrosoftEntra