James Wallace

Not really interested in I.T

[James Wallace @surlyITguy]

Note to self.

[Nathan McNulty @NathanMcNulty]

If you have E3+, you should be looking at Global Secure Access (even if you use a 3rd party ZTNA)

My top 3 capabilities - token binding, CAE, and better user experiences

This team is moving very fast, so be sure to check out their Community Hub for more details than the docs ;)

[James Wallace @surlyITguy]

Note to self.

[Matt Zorich @reprise_99]

When we respond to large scale compromise, we regularly see the same kinds of configuration issues across Entra ID. If you want some insight to what we see in real world compromises, I put together an overview here - https://t.co/Z00BulXDFf

[James Wallace @surlyITguy]

Note to self

[Matt Zorich @reprise_99]

Over the years Microsoft DART has put together an immense amount of valuable information about preventing, detecting and responding to threats, from blogs to forensic guides. They are all now available to you in one spot via their very own Ninja Hub - https://t.co/XtIbiIXKLB

[James Wallace @surlyITguy]

Note to self.

[Matt Zorich @reprise_99]

Worth reading - a deep dive into the deception infrastructure that was previously hosted at https://t.co/Su7Qql2qKk. This provides great insights to the lifecycle of deception infrastructure - https://t.co/7A15zXLdwU

[James Wallace @surlyITguy]

Note to self.

[Nathan McNulty @NathanMcNulty]

SigninLogs
| extend AuthenticationMethod = tostring(parse_json(AuthenticationDetails)[0].authenticationMethod)
| extend AuthenticationMethodDetail = tostring(parse_json(AuthenticationDetails)[0].authenticationMethodDetail)
| extend MfaMethod = tostring(parse_json(AuthenticationDetails)[1].authenticationMethod)
| where parse_json(AuthenticationDetails)[0].succeeded == true and parse_json(AuthenticationDetails)[1].succeeded == true
| where AuthenticationMethod != "Previously satisfied"
| distinct UserPrincipalName,AuthenticationMethod,AuthenticationMethodDetail,MfaMethod

[James Wallace @surlyITguy]

Note to self.
Multicloud Connector - Integrate OTHER clouds with Azure! https://t.co/wHmEX0uiNK via @YouTube

[James Wallace @surlyITguy]

Note to self.

[Nathan McNulty @NathanMcNulty]

Excellent read, and also important to remember that "Directory Synchronization Accounts" is always excluded from MFA policies

I always recommend an additional CA policy to limit the role to only be used from IPs associated with Entra Connect servers to cover that gap ;)

[James Wallace @surlyITguy]

ING bank is now blocking Australian deposits to Kraken and freeze your account when you try.

Banks moving to cashless, banks controlling who you can transfer money to, banks holding down the little guy.

If there was any justification for decentralised banking, this is it.

[James Wallace @surlyITguy]

So I waste a total of 12 hours over two days to try and get tickets from @ticketek_au only to have my details exposed in a cyber breach.

You can't make this shit up

https://t.co/8ppcjVdjCC

[James Wallace @surlyITguy]

As an ex corporate customer of Optus business managed services I can tell you I was not surprised by this die to their incompetence. I am damn sure other have stories they can share.
https://t.co/zy23OOH8zt

[James Wallace @surlyITguy]

Rest in peace good sir.
https://t.co/ubcRxSZO5C

[James Wallace @surlyITguy]

I will buy this out of respect for the work you do in your blog.

[Matt Zorich @reprise_99]

My friends at @MicrosoftPress have given me a couple of copies of the eBook for The Definitive Guide to KQL to give away. Retweet or comment below and I will put you in the draw. To give everyone a chance, I will give it 48 hours and then draw two winners. https://t.co/ne19KZTytZ

[Matt Zorich @reprise_99]

My friends at @MicrosoftPress have given me a couple of copies of the eBook for The Definitive Guide to KQL to give away. Retweet or comment below and I will put you in the draw. To give everyone a chance, I will give it 48 hours and then draw two winners. https://t.co/ne19KZTytZ

[James Wallace @surlyITguy]

There seems to be a medical emergency at Campsie affecting my train. Funny thing is I'm not on that line.

[James Wallace @surlyITguy]

INTERESTING that the certificate is dated TODAY when services were restored.
#anz #anz_au

[James Wallace @surlyITguy]

The internet banking site says there is a certificate issue.
Did someone let it expire?

[James Wallace @surlyITguy]

The internet banking site says there is a certificate issue.
Did someone let it expire?

[ANZ Australia @ANZ_AU]

We’re investigating an issue affecting some customers accessing the ANZ App and Internet Banking. We’re working to resolve this as soon as possible and apologise for the inconvenience.

The ANZ Plus app, Phone Banking, ATMs and EFTPOS facilities continue to be available

[James Wallace @surlyITguy]

Big shout out to Kmart here is Australia.
In a period where every asshole is jacking up prices, Kmart stays true to form. Quality at low prices.

[James Wallace @surlyITguy]

Note to self.

[Nathan McNulty @NathanMcNulty]

I am so excited to see this announced!

This solution brings Conditional Access to Kerberos authentication, which means we can now put MFA and other controls in place when accessing file shares, printers, SQL, Remote Desktop, PowerShell remoting, etc

This is going to be huge :)

[James Wallace @surlyITguy]

Note to self. https://t.co/WeQJe8VTkf

[James Wallace @surlyITguy]

This was me today and yesterday at the pre sale. This is bullshit. I used one browser and then the app. SAME RESULT.
Each time in the lounge for an hour, tried 4 times then said allocation exhausted.

#ticketek_au your incompetence must be exhausting.

https://t.co/Xk5uwnaf61