Build is just around the corner, and I’m excited to see all the new goodies that are going to drop. Microsoft and NVIDIA have also been teasing something, probably a new Arm-based PC. Will it live up to the hype? Let’s find out…

I’ve also heard that we’ll get some new Entra bits at Build 🤞. I’m looking forward to bringing it all to you in next week’s issue.

Don’t forget to listen to or watch this week’s Entra.Chat episode. This week, we looked at what it takes to roll out passkeys to millions of users in a B2C consumer scenario, and the lessons we can apply to our own workforce passkey deployments.

Enjoy!

Sponsored by:

Stop App Credential Expirations Before Outages

Prevent outages caused by expired or expiring certificates and secrets across your Microsoft Entra ID applications. ENow Credential Monitor helps IT teams identify risky credentials before they break integrations, flood the help desk, or trigger late-night troubleshooting.

• Alert on expired and expiring secrets and certificates

• Reduce app outages and user disruption

• Avoid ticket spikes and 2 a.m. firefighting

• Keep critical business apps running smoothly

Get Your Score + 7-Day Trial

⚡️ Microsoft

🔥 Public Preview

• Transforming our approach to sensitivity labels at Microsoft with Microsoft Entra • Stephanie Parry

• Find shadow tenants and reduce risk fast with Microsoft Entra Tenant Governance • Cindy Crane

📺 Watch

• 📺 Microsoft Entra Tenant Governance | Find Configuration Drift • Jeff Staiman

• 📺 Securing macOS devices with Conditional Access • Kenneth van Surksum

🗣️ Message Center

• MC1325414 - Microsoft Entra ID SSPR will require registered authentication methods starting September 7, 2026

• MC1326253 - Conditional Access policies now apply to Windows Hello for Business and macOS Platform SSO registration

From the community…

🚀 Most popular posts from last week

• 🥇How to Block Access for High-Risk AI Agents • Ali Tajran

• 🥈🛠️ SAML & OIDC testing for Microsoft Entra ID • Gabe Corsini

• 🥉Building Custom Sign-In Portals with Custom Branding Themes in Entra • Colby Prior

☀️ Learn

💳 Verified ID

• Microsoft Entra ID Account Recovery: Claims Matching API First Impressions • Samuel Eng

🧰 Workload ID

• Direct Managed Identity or Federated Managed Identity? • Daniel Bradley

🌐 Private Access & Internet Access (GSA)

• 🎙️ Ctrl+Alt+Azure | 344 - Insights on using applied AI with Rick Van Rousselt • Jussi Roine and Rick Van Rousselt

• Why Most Joiner, Mover, Leaver (JML) Processes in Microsoft 365 Are Still Broken • Shaun Hardneck

📦 Apps

• 📺 How to trigger an authenticated Power Automate flow from a SharePoint document library • Ejaz Hussain

🫆 Authentication

• Authentication Methods • Jonathan Hope

• Can’t Register MFA? Conditional Access Is Blocking It (53 chars) • Rudy Mens

• Fix Register MFA but none have been enabled for your Account • Rudy Mens

• 📺 Kali365 Nightmare? Don’t Worry Passkeys Have you Covered • Andy Malone

🤖 DevOps & PowerShell

• Send Welcome Email to New Users & Part 2 • Tony Redmond

• Setup Azure DevOps Workload Identity Federation using Terraform • Brian Veldman

• Entra Change Tracker • Eric Woodruff

🚦 Conditional Access

• Zero Trust - Network and Location Context & Devices as Trust Signals • Guillaume Bossiroy

• 📺 Entra ID Security Defaults: What They Are & When to Turn Them Off • Jonathan Edwards

• 📺 From Static to Risk-Driven: Entra ID P2 Conditional Access Blueprint (2026) • Azure Brother

🏙️ External ID - Guests & Multi-Tenant Organizations

• Container label support and Guest access controls for Entra ID Security Groups (part 1) + (part 2) • Vasil Michev

🥷 Security

• CIS Microsoft 365 Foundations Benchmarks v7.0.0 • Havard Overas

• Emergency Access Application • Josimar Hedler

• 🛠️ Rethink Secure Score: risk-based scoring across Defender XDR, Entra, AD, Azure, ExposureGraph, and Shodan • Morten Knudsen

• 📺 BlueHat 2026: Pulling strings: From user to global admin via appIdUris • Microsoft Security Response Center (MSRC)

♻️ Sync

• Time to move to Entra Cloud Sync • Michael Niehaus

📒 Tenant Configuration

• Microsoft Certification Practice

• 🛠️ Entra ID Tenant Lookup • Julian Rasmussen

👨🏽‍💻 Merill’s corner

• Want to get featured on Entra.News? → Submit your content 😎

• Want us to say nice things about your company? Sponsor entra.news 🤩

• Love the newsletter? Tell us 💚❤️💜

🪃 Acknowledgement of Country

Entra.News is created on Wurundjeri land and acknowledges the traditional owners of country throughout Australia, recognising their continuing connection to land, water and community. We pay our respect to them and their cultures and to elders both past and present.

Turn them on.
Users register them.
Passwords go away.
Everyone is more secure.

But in the real world, passkey rollouts are not just an authentication setting. They are a product rollout, a user experience change, a support change, and an operational change all at once.

In this episode, I spoke with Vincent Delitz from Corbado, who has worked on large-scale passkey deployments in customer identity scenarios, including public-sector and consumer environments with millions of users. While the examples come from the CIAM world, many of the lessons apply directly to workforce identity and Microsoft Entra deployments as well.

Sponsored by:

Cloud RADIUS built for Entra + Intune environments

EZRADIUS was designed and built by ex-Microsoft engineers with deep Entra and Intune experience. It integrates seamlessly into the Microsoft ecosystem, making it easy to migrate from your on-prem NPS server to a modern, zero-trust network with full support for cloud-first and hybrid environments.

• Deploy in minutes: no on-prem servers, no Windows updates

• Certificate-based auth: EAP-TLS support for Microsoft Cloud PKI or any CA

• Intune compliance checks for zero-trust Wi-Fi and VPN access

• Built for teams of 10 to 10,000: no minimums, no enterprise gatekeeping

• Pay only for users that connect with usage-based pricing

Start your 30-day trial (no credit card required) or book a demo to see how “EZ” it is.

Try it Out

Here are five practical lessons from the conversation.

1. Know why you are rolling out passkeys

Before you start the rollout, be clear on the reason.

Most organisations adopt passkeys for one or more of these reasons:

Security
Passkeys are phishing-resistant and remove many of the risks that come with passwords, SMS OTP, and other phishable methods.

User experience
Signing in with Face ID, Touch ID, Windows Hello, or a security key can be faster and easier than typing passwords and completing MFA prompts.

Cost reduction
In customer identity scenarios, passkeys can reduce SMS OTP costs. In workforce scenarios, they can reduce password reset and sign-in related help desk calls.

The key lesson is this: your rollout strategy should match your goal.

If your goal is security, you need to think about when and how to retire phishable methods.
If your goal is adoption, you need to make passkeys the easiest path.
If your goal is cost reduction, you need to measure whether users are actually moving away from the older methods.

Simply enabling passkeys is not the same as achieving the outcome.

2. Use a staged rollout, not a big bang

One of the biggest mistakes is assuming you can turn on passkeys and immediately remove passwords.

That sounds clean from a security perspective, but in reality it can create confusion, support tickets, and failed sign-ins.

A better model is a staged rollout:

Stage 1: Offer passkeys as an option

Start by making passkeys available. Let users register and begin using them without taking away existing methods immediately.

Stage 2: Nudge adoption

Do not leave passkeys buried as “just another sign-in method.” Make them visible. Make them the preferred option where possible. Help users understand why they should use them.

Stage 3: Gradually retire phishable methods

Once you can see that a user or group has been successfully using passkeys for a period of time, then you can start reducing reliance on passwords, SMS, or other weaker methods.

Stage 4: Fix recovery

This is the part many teams forget.

Once passkeys become the primary sign-in method, account recovery becomes the new weak point. If recovery still relies on phishable methods or manual help desk processes, attackers will target that path instead.

A passkey rollout is not complete until recovery is also secure.

3. Passkeys move complexity from the backend to the user’s device

With passwords, SMS OTP, or push notifications, a lot of the complexity sits in the backend.

With passkeys, much more happens on the client side.

That means success depends on things like:

The user’s device.
The browser version.
The operating system.
The credential manager.
Whether Bluetooth is enabled.
Whether the passkey is synced.
Whether the user is on a managed device or BYOD.
Whether a password manager has changed the sign-in experience.

This is a big mindset shift.

For example, cross-device passkey sign-in often relies on Bluetooth proximity checks. That is great when it works. But what happens if Bluetooth is disabled on a kiosk, blocked by policy, or unavailable on a shared device?

That is the sort of issue you want to find before go-live, not after a three-month project.

The practical takeaway: test the real environments your users will sign in from. Not just your own managed test devices.

4. Your backend logs may not tell the full story

This was one of the most important lessons from the episode.

Passkey success rates can look great in backend logs, but still miss a large part of the user experience.

Why?

Because many failures happen before the backend sees anything useful.

A user may not have the passkey on the current device.
The credential manager may not appear.
The browser may have a bug.
The user may cancel the Face ID or Touch ID prompt.
The passkey may have been deleted locally.
The device may try to use the wrong credential manager.
The user may think registration worked, even though the backend blocked it.

From the backend, you might only see the successful challenges. That can make your success rate look much better than the lived experience.

This is why observability matters.

For customer identity platforms, you may be able to add frontend telemetry and track where users get stuck. In workforce scenarios, you may not be able to instrument the Entra sign-in page directly, but you can still look for signals elsewhere:

Which users are passkey-capable?
Which devices and browsers are being used?
Which users registered passkeys but are not using them?
Which support tickets map to specific OS, browser, or credential manager combinations?
Which groups are still falling back to passwords or SMS?

The lesson: do not rely on a single “success rate” number. It may hide the real rollout problems.

5. Support multiple passkeys and explain the mental model

A common mistake is limiting users to one passkey.

That may sound tidy, but it does not match how people actually work.

A user may have a Windows laptop, a Mac, an iPhone, an Android phone, a password manager, and a physical security key. Some passkeys sync. Some do not. Some are device-bound. Some are stored in iCloud Keychain, Google Password Manager, Bitwarden, 1Password, Windows Hello, or on a physical key.

If users can only register one passkey, they may be locked out when they move to another device.

A better approach is to allow multiple passkeys and make it clear what each one is for.

For example:

One passkey in iCloud Keychain.
One in Google Password Manager.
One in an enterprise password manager.
One physical security key.
One backup key for critical accounts.

This also means communication matters.

Users do not always understand terms like “FIDO2,” “WebAuthn,” “AAGUID,” “attestation,” or even “passkey.” They understand things like:

Sign in with your face.
Sign in with your fingerprint.
Use your security key.
Use the passkey saved on this device.

The more technical your language, the more likely users are to get confused.

This applies internally as well. Even project teams need a shared vocabulary. Are you talking about synced passkeys? Device-bound passkeys? Security keys? Windows Hello for Business? Platform credentials? Roaming authenticators?

If the project team is confused, the users definitely will be.

Bonus lesson: Attestation matters, but not for every user

We also discussed attestation, which is one of those topics that can get confusing quickly.

In simple terms, attestation lets an authenticator prove what type of device or security key it is. This is useful when you want to control exactly which authenticators are allowed.

For example, for privileged admins, you may want to require specific physical security keys issued by the organisation. In that case, attestation can help you enforce that only approved keys are used.

But synced passkeys are different.

If a passkey is stored in iCloud Keychain, Google Password Manager, Bitwarden, or another synced credential manager, it can move across devices. That breaks the model where you can prove it belongs to one specific physical authenticator.

So the practical model may be:

Use stricter device-bound passkeys and attestation for privileged users.
Allow synced passkeys for broader user populations where usability and adoption matter more.
Be clear about the trade-off.

Synced passkeys may not give you the same level of device control as a hardware key, but they are still a huge improvement over passwords and many phishable MFA methods.

Final thoughts

The big takeaway from this episode is that passkey success is not just about enabling the feature.

You need to plan for adoption, device readiness, recovery, support, telemetry, and user education.

Passkeys can absolutely improve security and user experience, but only if the rollout is treated as a real change program.

The teams that succeed will be the ones that ask the hard questions early:

Why are we rolling this out?
Which users are ready?
Which devices are not?
What will break on day two?
How will users recover access?
How will we know whether adoption is actually happening?

Passkeys are the future of authentication, but the rollout still needs careful planning.

About Vincent Delitz

Vincent Delitz is the Co-founder and Managing Director at Corbado, the passkey intelligence platform designed specifically for enterprise CIAM teams. Based in Munich, Vincent is a software engineer turned founder who has been deeply focused on the technology since the term “passkeys” first emerged in 2022.

Through Corbado, he helps large-scale B2C enterprises understand why passkey adoption might be flat, identify what’s breaking logins, and successfully scale passkeys alongside their existing IDPs (including Entra, Okta, Auth0, Ping, ForgeRock, or in-house solutions). Corbado is trusted by major organizations like VicRoads (supporting 5 million users), as well as leaders in financial services and e-commerce. As a speaker, Vincent frequently shares his expertise on passkey adoption and the often-overlooked “Day 2” passkey problems that don’t appear in standard vendor documentation.

LinkedIn - https://www.linkedin.com/in/vincent-delitz/

🔗 Related Links

• How to enable passkeys (FIDO2) in Microsoft Entra ID - https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-authentication-passkeys-fido2

• Enterprise Passkey Deployment Challenges - https://www.corbado.com/blog/enterprise-passkey-deployment-challenges

• Corbado - https://www.corbado.com/

📗 Chapters

04:10 The Consumer vs. Workforce Scale

07:49 Uncovering the True Motivations for Passkeys

11:06 The Four Stages of Going Passwordless

12:51 Day 2 Problems and Implementation Hurdles

17:02 Real-World Device and Network Limitations

22:53 Why Passkey Success Rates Are Misleading

27:20 Best Practices for Large-Scale Deployments

32:16 Demystifying Passkey Attestation and AGUIDs

38:48 Handling Support Tickets and Adoption Strategies

Podcast Apps

🎙️ Entra.Chat - https://entra.chat

🎧 Apple Podcast → https://entra.chat/apple

📺 YouTube → https://entra.chat/youtube

📺 Spotify → https://entra.chat/spotify

🎧 Overcast → https://entra.chat/overcast

🎧 Pocketcast → https://entra.chat/pocketcast

🎧 Others → https://entra.chat/rss

Merill’s socials

📺 YouTube → youtube.com/@merillx

👔 LinkedIn → linkedin.com/in/merill

🐤 Twitter → twitter.com/merill

🕺 TikTok → tiktok.com/@merillf

🦋 Bluesky → bsky.app/profile/merill.net

🐘 Mastodon → infosec.exchange/@merill

🧵 Threads → threads.net/@merillf

🤖 GitHub → github.com/merill

The long-awaited Platform SSO during Automated Device Enrollment (ADE) for macOS is officially generally available! You can now complete device registration right inside the macOS Setup Assistant before a user ever hits the desktop. In other massive news, Microsoft Entra was named a Leader in the Forrester Wave™: Workforce Identity Security Platforms (Q2 2026) securing the highest scores across both the Current Offering and Strategy categories.

Also in this issue: tune into the latest Entra.Chat episode with Jeff Staiman to learn how Microsoft’s own battle with Midnight Blizzard shaped the new Tenant Governance control plane. And if you’re a GSA customer, don’t miss the newly published GSA Ops Guide.

Enjoy!

Sponsored by:

PST Export in One Line of PowerShell (FREE)

Exporting an Exchange Online mailbox to PST traditionally means wrestling with eDiscovery exports, installing Outlook, or paying for third-party tools - hours of work for what should take one command.

EasyEntra’s Invoke-EEMailboxToPst handles the entire export in a single line:

🚀 Export any mailbox to PST with one CmdLet
🚀 Real-time progress reporting and minimal memory burn
🚀 Native PST writer - no Outlook/MAPI tie-in
🚀 Delegate exports to first-line support - zero tribal knowledge
🚀 PowerShell module is free – no license required

Available via EasyEntra GUI and PowerShell (no license required). Download EasyEntra to get started.

“Your product is such a time saver - I love it.”
IT Infrastructure Specialist, MEC Aerial Work Platforms, United States

Free PST Export

⚡️ Microsoft

🏆 General Availability

• Platform SSO during automated device enrollment is now generally available for macOS • Justin Ploegert

📖 Read

• Microsoft recognized as a Leader in The Forrester Wave™ for Workforce Identity Security Platforms • Nadim Abdo

• How Storm-2949 turned a compromised identity into a cloud-wide breach • Microsoft Defender Security Research Team

Sponsored by:

Book a demo

From the community…

👩‍✈️ AI & Copilot

• Step-by-Step guide to Microsoft Entra Agent ID • Dishan M. Francis

• Natural Language Queries Against Entra ID • Klaus Bierschenk

• How to Block Access for High-Risk AI Agents • Ali Tajran

💳 Verified ID

• Announcement: Terraform Provider for Entra Verified ID • Mateusz Jendza

👮‍♂️ ID Governance

• Microsoft Entra PIM Secure Admin Access • Mark Oldham

• Password Delivery Is the Last Manual Step in Onboarding • Sandra Saluti

• 🛠️ Introducing the New PIMActivation Portal: Managed, Self-Hosted, and Mobile Ready • Sebastian Flaeng Markdanner

🫆 Authentication

• Identity Is Everything. • Jon Hope

• 🛠️ SAML & OIDC testing for Microsoft Entra ID • Gabe Corsini

👥 User & Group Management

• Microsoft Purview Workload Content roles in Entra & new PIM alerts • Ewelina Paczkowska

🖥️ Devices

• Platform SSO during automated device enrollment is now generally available for macOS • Justin Ploegert

🥷 Security

• 🛠️ Release Monkey365 v0.98 · silverhack/monkey365 • Juan Garrido

• Different Ways to Restrict User Access to Entra Portal • Adi

📒 Tenant Configuration

• Building Custom Sign-In Portals with Custom Branding Themes in Entra • Colby Prior

• 📺 Entra ID Has Been Unprotected for 16 Years! • Azure Academy

🛍️ External ID - Customers

• Domainless SAML federation in Microsoft Entra External ID • Jan Bakker

• Enabling user attributes, e.g. “email” in the JWT in Entra External ID (EEID) • Rory Braybrook

• Using the High Scale Compatibility (HSC) mode in Entra External ID (EEID) for enabling Azure AD B2C… • Rory Braybrook

👨🏽‍💻 Merill’s corner

• Want to get featured on Entra.News? → Submit your content 😎

• Want us to say nice things about your company? Sponsor entra.news 🤩

• Love the newsletter? Tell us 💚❤️💜

🪃 Acknowledgement of Country

Entra.News is created on Wurundjeri land and acknowledges the traditional owners of country throughout Australia, recognising their continuing connection to land, water and community. We pay our respect to them and their cultures and to elders both past and present.

What Can Your AI Applications Access?

Organizations are investing heavily in AI-powered applications and agents, but many are discovering they lack the operational visibility and governance discipline needed to scale AI confidently and securely.

With continuous visibility into Entra ID applications, permissions, OAuth access, secrets, certificates, and application ownership, ENow App Governance Accelerator can:

• Reduce uncertainty around what SaaS apps can access

• Accelerate application reviews and approval processes

• Strengthen operational trust across security and leadership teams

• Prevent unmanaged application growth from becoming operational risk

• Enable lean IT teams to support AI expansion at scale

• Demonstrate governance maturity required for enterprise AI adoption

Request a Demo + Free Trial

While most admins focus on securing their primary production environment, many organizations are sitting on hundreds of “test” or “shadow” tenants that were created by users with a simple Azure subscription. These unmanaged environments often lack proper security bars and can become entry points for sophisticated attackers.

The Wake-Up Call: Midnight Blizzard

The urgency for these new features was fueled by the 2024 Midnight Blizzard attack. In that instance, attackers compromised a legacy test tenant and used its old access rights to move laterally into Microsoft’s core environment. This highlighted a critical gap: securing one tenant isn’t enough if you don’t even know how many other tenants are connected to your organization.

Three Things You’ll Learn in This Episode:

1. Automatic Discovery of the “Unknown”: Jeff explains how the Related Tenants feature uses signals like B2B sign-in logs, multi-tenant app consents, and billing relationships to automatically find every tenant connected to your corporate identity.

2. Configuration Drift Monitoring: You can now define a “Golden Configuration” for your tenants. The service monitors over 200 resource types across Entra, Intune, Teams, and Exchange every six hours, alerting you the moment a security setting is weakened.

3. The “Three-Step” Handshake: To prevent accidental or malicious takeovers, Microsoft has implemented a rigorous trust process. If two tenants don’t share a billing relationship, the governed tenant must explicitly invite the governing tenant before any control can be established.

A New Approach to Licensing

Something many admins will find surprising is the licensing model. Unlike many Entra features that require a license for every user, Tenant Governance is licensed based on the number of admins interacting with the features. This makes it far more accessible for organizations trying to secure a massive multi-tenant estate without a massive budget.

Why you should listen: Jeff dives deep into how Microsoft managed its own 7 million internal tenants and shares the roadmap for future discovery signals, including using Global Secure Access network telemetry to find tenants being accessed from corporate devices.

Whether you are managing a merger or just trying to clean up years of “test” environments, this episode provides the blueprint for moving from manual, one-tenant-at-a-time management to a deterministic, automated security posture.

Subscribe with your favorite podcast player or watch on YouTube 👇

About Jeff Staiman

Jeff Stammen is the PM Area Lead for Tenant Governance within the Identity and Access Management (IAM) team at Microsoft. A true company veteran of 31 years, Jeff originally joined Microsoft managing engineering compensation and famously architected Microsoft's core engineering leveling framework (Levels 59–61) directly from requirements delivered by Steve Ballmer. Today, he leads engineering and product efforts to secure multi-tenant cloud ecosystems at massive scale.

LinkedIn - https://www.linkedin.com/in/jeffstaiman/

🔗 Related Links

• Microsoft Entra Tenant Governance - https://learn.microsoft.com/en-us/entra/id-governance/tenant-governance/overview

📗 Chapters

00:00 Intro

00:18 Introducing Jeff Stammen

00:41 Jeff’s 31-Year Journey at Microsoft

01:25 The Midnight Blizzard Hack That Started It All

05:07 Tenant Governance: What It Is and Why It Exists

07:12 Where Should Admins Start?

09:57 Configuration Snapshots and Baselines

13:02 The M365 DSC Connection

15:18 What Resources Should You Monitor?

17:07 How Drift Detection Works

19:49 Multi-Tenant Monitoring Strategy

20:02 Related Tenants: Discovering Your Unknown Exposure

20:39 Licensing: Basic vs Premium Explained

22:48 Quotas and Resource Limits

24:27 Governance Relationships and Cross-Tenant Role Assignments

28:26 Two-Step vs Three-Step Governance Flow

31:15 Discovery Signals and Blind Spots

35:17 Tenant Restrictions: A Related Feature Worth Knowing

36:40 Secure Tenant Creation

38:10 Governance Policy Templates

40:01 Licensing Across Multiple Tenants

43:43 Final Recommendations: Where to Start Today

47:54 Wrap Up

Podcast Apps

🎙️ Entra.Chat - https://entra.chat

🎧 Apple Podcast → https://entra.chat/apple

📺 YouTube → https://entra.chat/youtube

📺 Spotify → https://entra.chat/spotify

🎧 Overcast → https://entra.chat/overcast

🎧 Pocketcast → https://entra.chat/pocketcast

🎧 Others → https://entra.chat/rss

Merill’s socials

📺 YouTube → youtube.com/@merillx

👔 LinkedIn → linkedin.com/in/merill

🐤 Twitter → twitter.com/merill

🕺 TikTok → tiktok.com/@merillf

🦋 Bluesky → bsky.app/profile/merill.net

🐘 Mastodon → infosec.exchange/@merill

🧵 Threads → threads.net/@merillf

🤖 GitHub → github.com/merill

A quick note from Merill: Earlier this week, I shared that I’m leaving Microsoft to start out on my own. The flood of responses has been completely overwhelming. Thank you all so much for the incredible support.

I won’t lie, taking a leap like this is terrifying, and I’ve definitely had moments of second-guessing my sanity! But seeing your kind words reminds me why I need to follow my heart.

Though my day job is changing, my loyalty isn’t: I will always be the #1 Entra fan.

Merill

Sponsored by:

PST Export in One Line of PowerShell (FREE)

Exporting an Exchange Online mailbox to PST traditionally means wrestling with eDiscovery exports, installing Outlook, or paying for third-party tools - hours of work for what should take one command.

EasyEntra’s Invoke-EEMailboxToPst handles the entire export in a single line:

🚀 Export any mailbox to PST with one CmdLet
🚀 Real-time progress reporting and minimal memory burn
🚀 Native PST writer - no Outlook/MAPI tie-in
🚀 Delegate exports to first-line support - zero tribal knowledge
🚀 PowerShell module is free – no license required

Available via EasyEntra GUI and PowerShell (no license required). Download EasyEntra to get started.

“Your product is such a time saver - I love it.”
IT Infrastructure Specialist, MEC Aerial Work Platforms, United States

Free PST Export

⚡️ Microsoft

🏆 General Availability

• Secure the moments attackers target: onboarding, access requests, and account recovery • Ankur Patel

• Sponsor group type requirements for agent identities • Microsoft Entra Agent ID team

• Microsoft Identity Manager 2016 SP3 now available: Enhanced stability for hybrid identity • Ben Mann

📖 Read

• Defense at AI speed: Microsoft’s new multi-model agentic security system finds 16 new vulnerabilities • Taesoo Kim

• New Microsoft Certified: Cybersecurity Business Professional Certification • Liberty Munson

• Microsoft Entra Global Secure Access operations guide • Microsoft Learn

📺 Watch

• 📺 Azure Files Native Entra ID support with AVD FSLogix

🗣️ Message Center

• RM561035 - Microsoft Edge: Allow M365 authentication popups in work profiles

Sponsored by:

Benchmark Entra ID Application Governance

How many enterprise apps, OAuth integrations, and service principals are sitting in your Microsoft Entra ID tenant? In many Microsoft environments, application sprawl builds quietly through:

• User-consented third-party SaaS integrations

• Custom and internal applications

• Test deployments and abandoned dev projects

ENow’s free AppGov Score Assessment uses read-only access to benchmark application governance in Microsoft Entra ID and identify visibility gaps, ownership issues, excessive permissions, expired credentials, and high-privilege access risks.

Get a baseline of enterprise applications, app registrations, ownership gaps, and permission exposure measures across your environment.

Check your AppGov Score

From the community…

☀️ Learn

🧰 Workload ID

• Using configurable token lifetimes in Microsoft Entra ID, .NET and Microsoft Graph • Damien Bowden

👮‍♂️ ID Governance

• PIM Tray: Activate Microsoft Entra ID PIM Roles From the Windows Tray • Thomas Marcussen

🌐 Private Access & Internet Access (GSA)

• 📺 AI Prompt Injection Attacks Are Easy [How To Stop This] • Ru Campbell

📦 Apps

• Entra Enterprise App Recon • Derk van der Woude

• Configure excluded callers for Entra application management policies • Vasil Michev

• Member, Guest, and Wrong: Classifying Entra Users the Practical Way • Nicolas Blank

🫆 Authentication

• Use Device Code Flow to register a passkey in Microsoft Authenticator App • Jan Bakker

• Passkeys enabled ≠ phishing-resistant • Per-Torben Sorensen

• Finding Your Way on the Passkey Path • Brandon Colley

🤖 DevOps & PowerShell

• Understanding How Graph Permissions for Groups Work • Tony Redmond

🚦 Conditional Access

• Protecting Against Credential and Token Theft | 🛡️Jay Kerai • Jay Kerai

• Getting With The Times: Time-Based Conditional Access • Sebastian Flaeng Markdanner

🔐 Credential Management

• Registration Campaigns Now Include Passkeys in Microsoft Entra • Daniel Bradley

🖥️ Devices

• Creating Dynamic Device Model Groups in Entra with PowerShell • Jorge Suarez

• Restricted Management Administrative Unit for PAW Workstations • Jan Mulder

• Control SharePoint Online Site Access for Unmanaged Devices • Adi

🥷 Security

• 📺 The dark art of OIDC abuse - A case study in Entra ID - Cody Burkard - NDC Security 2026 • Cody Burkard

• 📺 Hardening Microsoft Entra, 5 Critical Tips for Admins • Andy Malone

📒 Tenant Configuration

• How Many Global Admins Should I Have in Microsoft 365? • Daniel Bradley

👨🏽‍💻 Merill’s corner

• Want to get featured on Entra.News? → Submit your content 😎

• Want us to say nice things about your company? Sponsor entra.news 🤩

🪃 Acknowledgement of Country

Entra.News is created on Wurundjeri land and acknowledges the traditional owners of country throughout Australia, recognising their continuing connection to land, water and community. We pay our respect to them and their cultures and to elders both past and present.

We talk about the massive shift toward Passkeys and registration campaigns, the impending migration from Entra Connect Sync to Cloud Sync, and the rapidly evolving world of Agent IDs and AI workloads. We also cover how Entra admins can leverage new Defender XDR features and Security Copilot agents to secure their environments.

About Fabian and Thomas

Fabian Bader is a Microsoft MVP and Cybersecurity Architect at glueckkanja, based in Hamburg, Germany. He is a well-known researcher in the Microsoft identity space, creator of the Cloud Brothers blog, and creator of the Maester and Token Tactics V2 tools. His work focuses on Microsoft Entra and the Defender suite, helping customers secure their cloud environments.

Thomas Naunheim is a Microsoft MVP and a Cybersecurity Architect at glueckkanja. He specializes in Microsoft Entra, identity and access management, and cloud security posture.

• Thomas LinkedIn - https://www.linkedin.com/in/thomasnaunheim/

• Fabian LinkedIn- https://www.linkedin.com/in/fabianbader/

🔗 Related Links

• What’s New in Microsoft Entra: May 2026 - https://techcommunity.microsoft.com/blog/microsoft-entra-blog/whats-new-in-microsoft-entra-may-2026/4517884

• Claude API Docs - https://platform.claude.com/docs/en/manage-claude/wif-providers/azure

• Microsoft Graph - https://learn.microsoft.com/en-us/graph/api/resources/agentid-platform-overview?view=graph-rest-1.0

📗 Chapters

00:00 Intro

01:18 The Year of Passkeys & Registration Campaigns

08:49 Windows Hello & Passkey Syncing

16:37 Migrating to Entra Cloud Sync

22:27 The Rise of Agent IDs & AI Workloads

28:21 Defender XDR Updates for Entra Admins

38:32 Security Copilot & Conditional Access Agent

45:48 Access Packages & New AI Admin Roles

Podcast Apps

🎙️ Entra.Chat - https://entra.chat

🎧 Apple Podcast → https://entra.chat/apple

📺 YouTube → https://entra.chat/youtube

📺 Spotify → https://entra.chat/spotify

🎧 Overcast → https://entra.chat/overcast

🎧 Pocketcast → https://entra.chat/pocketcast

🎧 Others → https://entra.chat/rss

Merill’s socials

📺 YouTube → youtube.com/@merillx

👔 LinkedIn → linkedin.com/in/merill

🐤 Twitter → twitter.com/merill

🕺 TikTok → tiktok.com/@merillf

🦋 Bluesky → bsky.app/profile/merill.net

🐘 Mastodon → infosec.exchange/@merill

🧵 Threads → threads.net/@merillf

🤖 GitHub → github.com/merill

In case you missed it, World Passkey Day was this week, and Microsoft had a few announcements to mark the occasion, including Microsoft Entra ID account recovery reaching GA and the preview of passkey-preferred authentication.

This week, I also had a fascinating conversation with Erin Grenlee about a really cool Entra Agent ID tutorial she built. It’s a guided walkthrough covering Agent ID, permissions, and the key concepts you need to understand. You can also use it to visualize all the agent blueprints you have in your tenant.

Watch the full walkthrough below.

Enjoy!

Sponsored by:

User Lifecycle: Onboard and Offboard With a Single CmdLet

Fact: Managing hybrid users across AD, Entra ID, and Exchange Online is a breeding ground for missed steps and security gaps - from day one to last day.

EasyEntra’s PowerShell-enabled workflows handle the entire lifecycle:

🚀 Onboard a fully provisioned user in 30 seconds - UI or two-parameter CmdLet.
🚀 Templates defined from existing users in seconds.
🚀 Offboard completely in 10 seconds - UI or single CmdLet.
🚀 Offboarding settings configured once, applied consistently every time.
🚀 Delegate life-cycle management to first-line support - no senior PowerShell skills or tribal knowledge required.

Start your 30-day trial or book a demo - setup takes under a minute - free for tenants with fewer than 25 licensed users.

“It feels almost like a revolution.”
Head of IT, Arjeplog Municipality, Sweden

Wait… One CmdLet?

⚡️ Microsoft

🏆 General Availability

• What’s New in Microsoft Entra: May 2026 • Martin Coetzer

  • Network content filtering by file type in Global Secure Access

  • Prompt injection protection

  • Global Secure Access client on iOS and iPadOS

  • Configure Global Secure Access with Cloud Firewall and remote networks for internet access

  • External user access in the Global Secure Access Windows client

  • Secure branch office Microsoft Entra Internet Access with Global Secure Access remote network connectivity

  • View approver details for access package requests in the My Access portal

  • Enforce Conditional Access policies on Privileged Identity Management role activation

  • Reduce risk with Microsoft Identity Manager 2016 Service Pack 3

  • Issuer Hints streamline certificate selection in certificate-based authentication

  • Certificate-based authentication on iOS

  • Certificate-based authentication elevated in system-preferred MFA list on iOS

  • Certificate Authority scoping for certificate-based authentication

  • Configurable token lifetimes in Microsoft Entra ID

  • Social identity provider support for native authentication in Microsoft Entra External ID

  • Prefetch Workday termination data to customize account disable logic

  • Track and optimize Microsoft Entra license usage in the Microsoft Entra admin center

📖 Read

• Passkeys aren’t the finish line: Eliminating fallbacks and fixing recovery • Ankur Patel

• World Passkey Day: Advancing passwordless authentication • Vasu Jakkal, Nadim Abdo

• Breaking the code: Multi-stage ‘code of conduct’ phishing campaign leads to AiTM token compromise • Microsoft Defender Security Research Team

📺 Watch

• Simplifying Entra ID authentication with AI • Kyle Marsh, Jean‑Marc Prieur

• Keynote - Securing AI: Building Trust in the Era of AI • Vasu Jakkal

• Agent 365 - Security & Compliance Controls • Shilpa Ranganathan

🗣️ Message Center

• MC1303719 - Microsoft Entra: Upcoming changes to federatedTokenValidationPolicy default settings

• MC1243549 - Retirement of SharePoint One-Time Passcode (SPO OTP) and transition to Microsoft Entra B2B

• MC1300981 - Power Apps - Dataverse Agent users with Microsoft Entra Agent ID

• MC1300584 - Microsoft Entra: App Instance Lock enabled by default for new applications

• RM502875 - Microsoft Copilot (Microsoft 365): Microsoft Graph APIs for App & Agent Inventory and Details

• RM561652 - Microsoft Edge: Passkey Sync for Enterprise Users

📆 Upcoming Events

• Build a secure identity foundation: 5 webinars to strengthen access management with Microsoft Entra • Melanie Maynes

Sponsored by:

Book a demo

☀️ Learn

👩‍✈️ AI & Copilot

• Step-by-Step guide to Microsoft Entra Agent ID • Dishan M. Francis

• AI governance overview: stop panicking and fix the basics • Ewelina Paczkowska

• Primer: bulk actions with the Agent 365 API • Vasil Michev

• Shadow AI in Microsoft 365 Admin Center • Shanchana

🧰 Workload ID

• Managed Identity Support for Azure Bastion - Azure Network Security in the Field • Andrew Mathu and Aaron Tsang

👮‍♂️ ID Governance

• Entra ID Governance - View approver information for pending requests • Jan Bakker

🌐 Private Access & Internet Access (GSA)

• Microsoft Entra Global Secure Access Troubleshooting Guide • Oliver Mueller

📦 Apps

• App Instance Lock enabled by default for new applications • Daniel Bradley

• Entra App Instance Lock Enabled by Default in June • Rudy Mens

• 🛠️ JeffBley/SamlCertRotation: An automation tool to rotate and set as active Saml certificates in Entra ID • Jeff Bley

🫆 Authentication

• Android Finally Supports FIDO2 PIN-protected Credentials Over NFC ; Only Six Years Late • Dr. Emin Huseynov

• Passkey Path - A Choose Your Own Adventure Guide • Brandon Colley

👥 User & Group Management

• Take control over AD-managed groups • Jeffrey Tigchelaar

• How to Manage Default User Permissions in Microsoft 365 • Dhinesh

🚦 Conditional Access

• Conditional Access: The Safety Net • Jon Hope

• Microsoft Entra ID Continuous access evaluation and how it works! • Tom Wechsler

• Conditional Access Policy Maximum Limit Explained • Ali Tajran

• 📺 Secure Android BYOD: Intune App Protection + Conditional Access Guide • Alexandru Malos

• 📺 3 Conditional Access Policies Every Microsoft 365 Tenant Needs Day One • Jonathan Edwards

🖥️ Devices

• Windows Hello Not Working? Recover Entra Joined Device Sign-in Without Knowing the Password • Sreejith Reghunathan Pillai

📈 Reporting and Insights

• Custom Security Attributes Report • Roy Klooster

• Update the Microsoft 365 User Profile Card with Awards • Tony Redmond

🥷 Security

• Configurable token lifetimes in Entra ID • Jan Bakker

• AADGraphActivityLogs: How to Detect Legacy Azure AD Graph Attacks • Invictus-IR

♻️ Sync

• Entra ID – Prepare to migrate from Entra Connect Sync to Entra Cloud Sync • Benoit HAMET

🛍️ External ID - Customers

• Connecting Entra External ID (EEID) to Entra ID as an external provider via OIDC, using private_key_jwt, not client_secret • Rory Braybrook

• On Entra External ID (EEID) custom extensions and event listeners • Rory Braybrook

👨🏽‍💻 Merill’s corner

• Want to get featured on Entra.News? → Submit your content 😎

• Want us to say nice things about your company? Sponsor entra.news 🤩

• Love the newsletter? Tell us 💚❤️💜

🪃 Acknowledgement of Country

Entra.News is created on Wurundjeri land and acknowledges the traditional owners of country throughout Australia, recognising their continuing connection to land, water and community. We pay our respect to them and their cultures and to elders both past and present.

If you’ve been waiting for the dust to settle on Microsoft Entra Agent ID before diving in, the wait is over. Agent ID hit General Availability on May 1st, and in this episode of Entra Chat, Erin Greenlee, a PM in the the Entra AuthN team joins to break down one of the trickiest parts of the new model: how permissions actually work.

The three-tier model you need to understand

The biggest mental shift with Agent ID is moving from the familiar single app registration model to a three-tier hierarchy. Here’s the short version:

• Agent Blueprint → the template for your agent. Think of it as a souped-up app registration that lives in one tenant and defines how the agent behaves. Every agent needs one, even if you’re only ever creating a single instance.

• Blueprint Principle → the identity that represents the blueprint inside each tenant it’s deployed to. This is the middle tier, and it has a superpower: permissions granted here cascade down to all current and future agent identity instances automatically.

• Agent Identity → the actual running instance of the agent. This is what authenticates, what shows up in your tenant logs, and what can hold its own individual permissions on top of whatever it inherits.

Required Resource Access is a hint, not a grant

One thing that trips people up early: adding permissions to the blueprint’s Required Resource Access (RRA) doesn’t actually grant anything. It’s a signal to admins adopting your agent. A polite list of “here’s what this agent will need to function.” The real grant happens later, either upfront during adoption or dynamically as the agent needs it. Expect agents to lean more on dynamic consent than traditional apps have, since agents evolve and request new permissions as tasks change.

Inheritance only works if you set it up

Permissions granted on the Blueprint Principle will only cascade down to agent identities if the resource app (e.g. Microsoft Graph) is explicitly marked as an inheritable resource on the blueprint. It’s an easy thing to miss, and if you skip it, your Blueprint Principle grants won’t flow through to your instances.

A free tool to visualise all of this

Erin built an interactive web app — using GitHub Copilot, no less — that makes all of the above click visually. It has a no-sign-in tutorial that walks you through the object relationships, a permission matrix view, and even generates the PowerShell or Graph API scripts to apply your configuration in real life. No changes are made to your tenant unless you explicitly ask it to. The source code is being open-sourced too, so you can fork and customise it if you want.

Watch the full episode to see Erin walk through the tool live, including how permission inheritance works in practice and a real-world debugging scenario that inspired the whole thing.

About Erin Greenlee

Erin is a member of the Entra AuthN team working on AI and Agent ID at Microsoft. She previously joined Entra Chat to discuss app permissions and consent, and she loves building tools that make complex identity concepts easier to understand.

LinkedIn - https://www.linkedin.com/in/eringreenlee/

Sponsored by:

Find App Access Gaps Before They Break Workflows

In Microsoft Entra ID, small visibility gaps lead to outages and delays. Expired secrets break integrations, while unclear ownership and excessive permissions slow access decisions. Teams still struggle to answer:

• Which apps access Microsoft 365 data?

• Is that access still justified?

• Who owns it?

AppGov Score helps you quickly identify these gaps. ENow App Governance Accelerator then exposes app-specific credential risks, permission issues, and ownership gaps before they disrupt operations.

Start with your AppGov Score, then upgrade to a 7-day free trial to take action.

Request your Score

🔗 Related Links

• https://aka.ms/erins-agent-helper

📗 Chapters

01:11 Agent ID General Availability

04:14 The Agent ID Visualizer Tool

05:35 Defining the Agent Blueprint

08:06 Understanding the Blueprint Principle

10:57 Agent Identity Instances Explained

13:37 Required Resource Access (RRA)

24:07 Inheritable Permissions and Cascading

30:18 Applying Changes with Scripts

Podcast Apps

🎙️ Entra.Chat - https://entra.chat

🎧 Apple Podcast → https://entra.chat/apple

📺 YouTube → https://entra.chat/youtube

📺 Spotify → https://entra.chat/spotify

🎧 Overcast → https://entra.chat/overcast

🎧 Pocketcast → https://entra.chat/pocketcast

🎧 Others → https://entra.chat/rss

Merill’s socials

📺 YouTube → youtube.com/@merillx

👔 LinkedIn → linkedin.com/in/merill

🐤 Twitter → twitter.com/merill

🕺 TikTok → tiktok.com/@merillf

🦋 Bluesky → bsky.app/profile/merill.net

🐘 Mastodon → infosec.exchange/@merill

🧵 Threads → threads.net/@merillf

🤖 GitHub → github.com/merill

It’s been an eventful week, with Agent ID and Agent 365 going GA, bringing lots of new capabilities for Entra administrators, including enhancements to Identity Governance, Internet and Private Access, Agent Registry, now in the Microsoft 365 admin center, and more.

We also released Maester 2.1, and I had fellow core maintainer Sam Erde on the Entra Chat podcast to talk about all the new Maester tests and features.

Enjoy!

Sponsored by:

How Well Do You Know Your Entra Apps?

Microsoft Entra ID environments often contain hundreds, sometimes thousands, of enterprise applications, service principals, and delegated permissions. The challenge is not just managing them, it’s knowing which apps have access to your Microsoft 365 data, whether permissions are excessive, and where governance gaps may exist.

AppGov Score gives you a fast, data-driven assessment of your Entra application governance and security posture. In minutes, you can:

• identify risky app permissions

• uncover overlooked applications

• benchmark your tenant against proven governance best practices.

See where your application governance stands. Try AppGov Score for free today.

Scan your environment

⚡️ Microsoft

🏆 General Availability

• Microsoft Agent 365, now generally available, expands capabilities and integrations • Nirav Shah, Rob Lefferts, Jason Roszak

• What’s New in Agent 365: May 2026 • Alex Pozin, Samer Baroudi

• Microsoft 365 E7 and Agent 365 are now generally available • Caroline Stanford

• What is Microsoft Entra Agent ID? • Microsoft Learn

• Protect agent identities with Microsoft Entra • Microsoft Learn

• Authorization in Microsoft Entra Agent ID • Microsoft Learn

• Manage agent registry in Microsoft 365 admin center • Microsoft Learn

• Governing Agent Identities • Microsoft Learn

• Conditional Access for agent identities • Microsoft Learn

• Learn about Secure Web And AI Gateway for Microsoft Copilot Studio agents • Microsoft Learn

• What is the Microsoft agent identity platform • Microsoft Learn

• General Availability: Refresh Token (RT) Transfer to Apple Watch in Microsoft Entra External ID Native Authentication • Sasha Mars

🔥 Public Preview

• Lock down AI, web, and private apps: what’s new in Internet Access and Private Access • Sinead O’Donovan

• You can’t govern what you can’t see: Closing the identity visibility gap for apps • Joseph Dadzie

• Assign Azure Role-based access control (RBAC) Roles - Entitlement management (Preview) • Microsoft Learn

• ID Protection for agents (Preview)

📖 Read

• 8 best practices for CISOs conducting risk reviews • Rico Mariani

• Email threat landscape: Q1 2026 trends and insights • Microsoft Threat Intelligence, Microsoft Defender Security Research Team

🗣️ Message Center

• MC1297981 - Agent Registry API transition to Agent 365

• MC1173195 - Microsoft 365 Copilot: Graph APIs for agent and app management

• MC1296475 - New dedicated License Requests page in Microsoft 365 Admin Center

• RM557187 - Microsoft Edge: Cross Tenant Support using Intune MAM

From the community…

🚀 Most popular posts from last week

• 🥇Your service principals probably don’t need secrets • Jan Bakker

• 🥈Don’t Burn the Steak: Entra Passkeys, Shared PCs, and Phishing-Resistant Access • Dustin Gullett

• 🥉Conditional Access Foundations: The Bottom of the Stack (And Why It Matters Most) • Jon Hope

☀️ Learn

⛑️ ID Protection

• Things to configure in Entra Identity Protection • Chad Cox

🌐 Private Access & Internet Access (GSA)

• SASE 101: How to get started with secure access in a cloud-first world • Sule Tatar

• What’s New in Entra Global Secure Access Client v2.28.96 • Richard M. Hicks

📦 Apps

• Why you should stop using third-party apps with poor authentication • Daniel Bradley

👥 User & Group Management

• Understanding Your Group Estate: Microsoft Entra Group Source of Authority • Driek Desmet

🤖 DevOps & PowerShell

• 🛠️ I.D.E.A #003 – One script to register them all! • Per-Torben Sørensen

🚦 Conditional Access

• Conditional Access Policy – Named Locations • Keith Doolan

🖥️ Devices

• Connect to Microsoft Entra joined device with SSO • Michael Frank

• Introducing cross-tenant support for MAM on Windows devices • Peter van der Woude

🏙️ External ID - Guests & Multi-Tenant Organizations

• Guest Device Join Type • Jóhannes’

• How To Secure Guest User Access & SPO OTP Retirement • Michael Vink

🥷 Security

• Auditing Application Permissions in Microsoft Entra ID: Hidden Risks, Pitfalls, and Quarkslab’s QAZPT Tool • Sébastien Rolland

• Identity & Access Management (IAM) Controls – The Stryker Incident • Keith Doolan

• Key Microsoft 365 Security Settings to Disable for Better Protection • AIMA

• Update to Microsoft SigninLogs • Andrea Fisher

📒 Tenant Configuration

• The Missing Link: Entra Backup and Recovery • Shehan Perera

• 📺 Native Backup for Microsoft Entra is Here (And It Changes the Recovery Game (15 min) • T-Minus365

🛍️ External ID - Customers

• Configuring banned passwords in Entra External ID (EEID) • Rory Braybrook

• Connecting Entra External ID (EEID) to Entra ID as an external provider via OIDC, not via a Guest Invitation • Rory Braybrook

• On Entra External ID (EEID) custom extensions and event listeners — Introduction • Rory Braybrook

⚒️ Toolkit

• mjendza/workshop-entra-as-code-interactive - Entra as Code Workshop

  Manage your Entra ID tenant using Infrastructure as Code • Mateusz Jendza

🔥 Maester

• What’s new in Maester 2.1.0 • Maester Team

• Maester ❤️ Multi-Tenant Reports — Microsoft Security Test Automation Framework • Brian Veldman

👨🏽‍💻 Merill’s corner

• 📺 Merill’s Game-Changing Browser Extension Just Dropped! (9 min) • Peter Rising

• Want to get featured on Entra.News? → Submit your content 😎

• Want us to say nice things about your company? Sponsor entra.news 🤩

• Love the newsletter? Tell us 💚❤️💜

🪃 Acknowledgement of Country

Entra.News is created on Wurundjeri land and acknowledges the traditional owners of country throughout Australia, recognising their continuing connection to land, water and community. We pay our respect to them and their cultures and to elders both past and present.

Since the December release, the community has shipped 540 new commits, grown the test suite from 128 to 168 tests, and added coverage across entirely new product areas.

Here’s a taste of what’s covered:

🤖 Securing Your AI Agents (Copilot Studio) With Microsoft’s Agent 365 going GA and organisations rapidly deploying Copilot Studio agents, Maester now includes tests based directly on Microsoft’s own recommendations for securing agents. Think orphaned agents with no owner, missing authentication on MCP connections, dormant agents, risky HTTP configurations, and agents shared too broadly. If you’re deploying agents in your tenant, these tests should be running.

🔧 AI That Writes Its Own Security Tests One of the most exciting developments in this release isn’t a test, it’s a custom AI skill that writes Maester tests for you. Sam built a GitHub Copilot agent skill that understands Maester’s structure, coding conventions, and contributor guide. You describe a security check in plain English, and within minutes you get a properly structured test, helpers, and documentation. No VS Code required! You can do it straight from GitHub’s Agents tab or even the mobile app. The barrier to contributing to Maester just got a lot lower.

🛡️ Defender for Endpoint Coverage Maester now includes 24 community-contributed MDE tests covering antivirus configuration, endpoint policy posture, cloud protection, behaviour monitoring, and PUA protection. Getting these tests into shape required the new AI skill to refactor months of pending work and it delivered.

🔑 Azure DevOps Security (37+ New Tests) With AI-generated code accelerating supply chain risks, securing your DevOps pipeline has never been more critical. Maester 2.1 ships with 37+ new Azure DevOps tests, checking OAuth config, PAT token policies, external guest access, collection admin hygiene, and more.

🔗 Linked Identity Checks for Privileged Accounts A new test surfaces a common blind spot: privileged admin accounts that remain active after their linked standard user account is disabled. If someone leaves your organisation and their cloud admin account stays enabled, Maester will now catch it.

📋 CIS Benchmark Refresh & Conditional Access Improvements Community contributor Morten has refreshed the CIS benchmark tests to reflect the latest changes, plus improved the logic behind several conditional access policy checks — including automated tracking of Entra ID roles used in XSPM and commercial access quality checks.

There’s a lot more covered in the full episode, including multi-tenant reporting updates, the new dev container for contributors, a surprisingly entertaining story about two AI models dissing each other’s code reviews, and a teaser for what’s coming in the next release.

👉 Listen to the full episode for the deep dives, the war stories behind getting community PRs across the line, and Merill and Sam’s take on where AI fits into the future of security testing.

About Sam Erde

Sam is an Architect at Patriot Consulting who focuses on performing security assessments, securing and deploying Microsoft 365, and writing PowerShell. He has been a critical pillar for the Maester community over the last year, helping heavily refactor the codebase and streamlining community contributions.

LinkedIn - https://www.linkedin.com/in/samerde/

Sponsored by:

Would you bet your reputation on your current Microsoft 365 security posture?

Sure, you’ve checked Purview. Maybe tightened Conditional Access. We all do that.

But it’s usually the quiet stuff that bites... permissions that expanded, policies that drifted, exceptions nobody revisited.

You could assume it’s fine.

Or you could run the Microsoft 365 Security Posture Check.

It’s free.

It runs locally.

And no, it doesn’t send your tenant data back to us.

We’ll even help you set it up.

Get yours here

🔗 Related Links

• What’s new in Maester 2.1.0 - https://maester.dev/blog/whats-new-since-maester-2-0

📗 Chapters

00:00 Intro

05:49 Securing Copilot Studio & AI Agents

08:53 The Challenge with Defender for Endpoint Tests

013:39 Using AI to Automate Writing Security Tests

22:30 Dev Containers for Easy Contributions

24:58 New Azure DevOps Security Checks

31:02 Multi-Tenant Reporting & Xbox’s Secret

37:00 Active Directory Tests & The Future of Hybrid

43:00 The Long-Term Vision for Maester

54:48 CIS Benchmarks & Linked Identity Tests

Podcast Apps

🎙️ Entra.Chat - https://entra.chat

🎧 Apple Podcast → https://entra.chat/apple

📺 YouTube → https://entra.chat/youtube

📺 Spotify → https://entra.chat/spotify

🎧 Overcast → https://entra.chat/overcast

🎧 Pocketcast → https://entra.chat/pocketcast

🎧 Others → https://entra.chat/rss

Merill’s socials

📺 YouTube → youtube.com/@merillx

👔 LinkedIn → linkedin.com/in/merill

🐤 Twitter → twitter.com/merill

🕺 TikTok → tiktok.com/@merillf

🦋 Bluesky → bsky.app/profile/merill.net

🐘 Mastodon → infosec.exchange/@merill

🧵 Threads → threads.net/@merillf

🤖 GitHub → github.com/merill

There’s a little bit of everything this week from GSA to Account Recovery and everything in between.

Don’t forget to check out this week’s Entra Chat with Sandra Saluti who shared quite a few ID Governance gems and best practices and some lively discussions on LinkedIn and X on the topic.

Enjoy!

Sponsored by:

User Lifecycle: Onboard and Offboard With a Single CmdLet

Fact: Managing hybrid users across AD, Entra ID, and Exchange Online is a breeding ground for missed steps and security gaps - from day one to last day.

EasyEntra’s PowerShell-enabled workflows handle the entire lifecycle:

🚀 Onboard a fully provisioned user in 30 seconds - UI or two-parameter CmdLet.
🚀 Templates defined from existing users in seconds.
🚀 Offboard completely in 10 seconds - UI or single CmdLet.
🚀 Offboarding settings configured once, applied consistently every time.
🚀 Delegate life-cycle management to first-line support - no senior PowerShell skills or tribal knowledge required.

Start your 30-day trial or book a demo - setup takes under a minute - free for tenants with fewer than 25 licensed users.

“It feels almost like a revolution.”
Head of IT, Arjeplog Municipality, Sweden

Wait… One CmdLet?

⚡️ Microsoft

🏆 General Availability

• Now generally available: License usage insights in Microsoft Entra • Joseph Dadzie

• Tenant Configuration Management APIs are now generally available • Aditya Mukund

• General Availability: Single Sign-On (SSO) from Native Apps to Embedded Web Views in Microsoft Entra External ID Native Authentication • Sasha Mars

📖 Read

• Get ahead of agent sprawl: manage and govern AI agents at scale • Ngozi Nwoko

• Microsoft’s perspective on agentic identity standards • Pamela Dingle

• AI-powered defense for an AI-accelerated threat landscape • Ales Holecek

🗣️ Message Center

• MC1279092 - Microsoft Entra: Passkeys in registration campaigns update (updated 23 April)

• MC1198077 - Microsoft Entra: Cross-tenant security group synchronization

• MC1287372 - Microsoft Entra ID Governance Account Discovery

From the community…

🚀 Most popular posts from last week

• 🥇Any user can disable passkeys in Windows. Completely. No admin rights needed. • Dr. Emin Huseynov

• 🥈Who Created That Service Principal? Tracing It Back with Microsoft Graph • Shannon Kuehn

• 🥉Prevent disabling passkeys on Windows • Dániel Kovács

Sponsored by:

Book a demo

☀️ Learn

👩‍✈️ AI & Copilot

• Getting Started with Security Copilot (42 min) • Microsoft Security Community

• Entra Agent ID → Federated Identity Credentials (FIC) deep-dive • Derk van der Woude

• Microsoft Entra Agent ID: How Identity Works for AI Agents • Carlos Suarez

🧰 Workload ID

• Secure, Keyless Application Access with Managed Identities - Now GA in Azure Files SMB • Priyanka-Gangal

• Your service principals probably don’t need secrets • Jan Bakker

👮‍♂️ ID Governance

• Account Discovery in Microsoft Entra ID Governance • Blesslin Rinu

• Admin Account Lifecycle Management – Part 3: Offboarding admin accounts • Christian Frohn

🌐 Private Access & Internet Access (GSA)

• Token Replay Protection and the Compliant Network Check • Chris Brumm

📦 Apps

• Microsoft Entra ID: Understanding OAuth App Consent and Permissions • Thalpius

🫆 Authentication

• Conditional Access Foundations: The Bottom of the Stack (And Why It Matters Most) • Jon Hope

• Don’t Burn the Steak: Entra Passkeys, Shared PCs, and Phishing-Resistant Access • Dustin Gullett

• Enterprise Passkey Deployment Challenges & Solutions • Vincent Delitz

• Microsoft Entra Passkeys Synced vs Device-Bound • Mark O

• Passkeys in Windows Hello, Security AND Convenience! • Per-Torben Sørensen

• Troubleshooting Common Microsoft Authenticator Issues • Kanaga

• 🎙️ Ep. 1 - Passkeys, Pitfalls & Tenants Gone Wild: Your Entratainment Begins! • Eric Woodruff, Thomas Naunheim, Ru Campbell, Nathan McNulty, Michael Van Horenbeeck

👥 User & Group Management

• New AI Reader Role Added to Microsoft Entra • Daniel Bradley

🤖 DevOps & PowerShell

• Awards, certifications and working with the /profile Graph API endpoint • Vasil Michev

• The Microsoft Graph PowerShell SDK and the additionalProperties Property • Tony Redmond

• 📺 Application Insights - Securing with Entra ID (34 min) • Alexander Schmidt

🚦 Conditional Access

• 📺 Your Conditional Access is Outdated. Here is the 2026 Blueprint (9 min) • Azure Brother

🔐 Credential Management

• Entra ID Account Recovery End To End (or How To Prove Who You Really Are When Recovering Your Identity in Microsoft 365) • Brian Reid

🖥️ Devices

• Device-Preferred Credential in Entra ID • Andrea Fisher

📈 Reporting and Insights

• 🛠️ EntraReporter: Getting a complete picture of Entra ID role assignments • Kåre Overgård

🥷 Security

• Agent ID Administrator scope overreach: Service Principal takeover in Entra ID - Silverfort • Noa Ariel

• CVE-2026-35431 - Security Update Guide - Microsoft - Microsoft Entra ID Entitlement Management Spoofing Vulnerability • MSRC

♻️ Sync

• Getting started with Entra Connect Cloud Sync alert rules! • Pim Jacobs

• 📺 The Hidden Identity Tool That Microsoft Doesn’t want you to Know About! (17 min) • Andy Malone

📒 Tenant Configuration

• Entra and Microsoft 365 Could Improve License Reporting • Tony Redmond

• Microsoft 365 License Management with Entra ID Governance (No Code Approach) • Sandra Saluti

• Microsoft 365 Quarterly Uptime Number Sinks to New Low • Tony Redmond

• Reporting an Entra ID browser error that requires troubleshooting • Rory Braybrook

• 📺 3 Reasons to Use Entra ID P2 (10 min) • Jonathan Edwards

🛍️ External ID - Customers

• Entra External ID Native Auth: Two Years Later & MFA via Conditional Access. Part 2 • Mateusz Jendza

• Remove sign-up from Entra External ID user flows • Damien Bowden

👨🏽‍💻 Merill’s corner

• Want to get featured on Entra.News? → Submit your content 😎

• Want us to say nice things about your company? Sponsor entra.news 🤩

• Love the newsletter? Tell us 💚❤️💜

🪃 Acknowledgement of Country

Entra.News is created on Wurundjeri land and acknowledges the traditional owners of country throughout Australia, recognising their continuing connection to land, water and community. We pay our respect to them and their cultures and to elders both past and present.

In this episode, you will learn:

• The Golden Rule of Automation: Why you must stop using “presentation data” (like UPNs or Email addresses) as your anchor. We explain why the Object ID is the only immutable truth for your automation.

• The “Marriage Bug”: A cautionary tale of how a simple name change can break hybrid joins and lead to accidental laptop wipes and how to prevent it.

• The “Unsexy” Side of Governance: Why the most important part of your job isn’t writing PowerShell, but interviewing HR and stakeholders to map out process flow diagrams before you ever touch the portal.

• Closing the “Rehire Gap”: How to solve the common crisis where contractors lose access for 48 hours during a renewal because of lifecycle synchronization delays.

• Directory Extensions vs. Exchange Attributes: Technical advice on where to store your identity metadata for the most reliable governance.

Sponsored by:

Entra ID Gaps That Cause Outages

In Microsoft Entra ID, outages often start small: an expired client secret, a lapsed certificate, or a suddenly failing integration. Traditional controls don’t track credential expiry or enforce application ownership, so issues appear only after something breaks.

Teams are left asking:

• Which applications can access Microsoft 365 data?

• Is that access still appropriate?

• Who owns the app?

Unclear answers stall reviews, weaken accountability, and slow delivery.

ENow App Governance Accelerator closes these gaps by highlighting expiring credentials, surfacing permission risks, and identifying ownership gaps before they disrupt operations. New Standard Tier pricing makes it accessible for organizations under 10,000 users, typically $3,500–$9,500 annually.

Explore Entra ID Gaps

About Sandra Saluti

Sandra Saluti is a consultant at Epical working with Microsoft Entra ID and identity governance. She helps organisations design secure and practical identity solutions with a focus on governance, access management, and Zero Trust.

LinkedIn - https://www.linkedin.com/in/sandra-saluti-6866a686/

🔗 Related Links

• Sandra’s Blog - https://agderinthe.cloud/author/sandra/

📗 Chapters

00:00 Welcome to Entra Chat

03:18 Explaining Identity Governance

08:51 Handling Late Hires and Rehires

11:25 Using Directory Extensions Effectively

18:50 Stop Targeting UPNs for Automation

25:18 Managing Chaos with Guest Access Reviews

30:56 Deciding Who Approves App Access

33:51 Replacing Nested Groups with Access Packages

39:29 Closing Thoughts and Community

Podcast Apps

🎙️ Entra.Chat - https://entra.chat

🎧 Apple Podcast → https://entra.chat/apple

📺 YouTube → https://entra.chat/youtube

📺 Spotify → https://entra.chat/spotify

🎧 Overcast → https://entra.chat/overcast

🎧 Pocketcast → https://entra.chat/pocketcast

🎧 Others → https://entra.chat/rss

Merill’s socials

📺 YouTube → youtube.com/@merillx

👔 LinkedIn → linkedin.com/in/merill

🐤 Twitter → twitter.com/merill

🕺 TikTok → tiktok.com/@merillf

🦋 Bluesky → bsky.app/profile/merill.net

🐘 Mastodon → infosec.exchange/@merill

🧵 Threads → threads.net/@merillf

🤖 GitHub → github.com/merill

There are some important updates in this week’s Message Center posts, so be sure to check them out and prepare for the changes.

Don’t forget to queue up this week’s Entra Chat featuring the legendary Sean Metcalf, and hear his top tips for hardening Entra ID in 2026.

Enjoy!

Sponsored by:

Uncover Risky Entra ID Apps Faster

Most Microsoft 365 tenants accumulate hundreds of enterprise applications, with OAuth permissions granted over time and ownership left undefined. Security teams often lack visibility into which apps access mailboxes, files, or user data, and which introduce risk.

Native tools provide pieces of this data, but not a unified view. That gap makes consistent application governance hard to maintain.

AppGov Score assesses your Entra ID application landscape. Identify high-risk permissions, detect unused or overprivileged apps, and surface ownership gaps so you can prioritize remediation based on real exposure.

Attending the Microsoft 365 Community Conference in Orlando? Visit ENow at booth #617 to see how teams are strengthening application governance while enabling their users.

Get Your App Risk Score

⚡️ Microsoft

🔥 Public Preview

• Authorize SFTP access to blobs using Microsoft Entra ID (preview) - Azure Storage • Microsoft Learn

📖 Read

• What’s new in Microsoft Entra – March 2026 • Shobhit Sahay

🗣️ Message Center

• MC1282568 - General Availability: Microsoft Entra passkeys on Windows

• MC1225192 - Microsoft Entra ID Governance: Azure subscription required to continue using guest governance features

• MC1221452 - (Updated 15 Apr) Microsoft Entra ID: General Availability of passkey profiles and migration for existing Passkeys (FIDO2) tenants

• MC1279092 - Microsoft Entra: Passkeys in registration campaigns update

• MC1255405 - Microsoft Edge for Business: Cross-tenant support using Intune Mobile Application Management (MAM)

• MC1223829 - Upcoming Conditional Access change: Improved enforcement for policies with resource exclusions - The new Baseline scope configuration is now available to preview the enforcement behavior before it is enabled by default.

From the community…

🚀 Most popular posts from last week

• 🥇Microsoft Security Copilot for M365 E5/E7 recommendations from the field • Derk van der Woude

• 🥈Common Entra ID Security Assessment Findings – Part 3: Weak Privileged Identity Management Configuration – Compass Security Blog • Christian Feuchter

• 🥉How to Track Changes in Microsoft 365 Groups • Tony Redmond

Sponsored by:

Would you bet your reputation on your current Microsoft 365 security posture?

Sure, you’ve checked Purview. Maybe tightened Conditional Access. We all do that.

But it’s usually the quiet stuff that bites... permissions that expanded, policies that drifted, exceptions nobody revisited.

You could assume it’s fine.

Or you could run the Microsoft 365 Security Posture Check.

It’s free.

It runs locally.

And no, it doesn’t send your tenant data back to us.

We’ll even help you set it up.

Get yours here

☀️ Learn

👩‍✈️ AI & Copilot

• A Deep-Dive into Entra Agent ID Authentication • Derk van der Woude

🧰 Workload ID

• Block or limit multi-tenant and consumer applications in Entra ID • Jan Bakker

• Who Created That Service Principal? Tracing It Back with Microsoft Graph • Shannon Kuehn

👮‍♂️ ID Governance

• Beyond Basic SCIM: Custom Role and Warehouse Mapping with Microsoft Entra ID and Snowflake • Parshu Anantharam

• Making Lifecycle Workflows State-Aware with State Groups • Patrik Jonsson

🌐 Private Access & Internet Access (GSA)

• Why you should enable the Microsoft Traffic Forwarding Profile • Chris Brumm

📦 Apps

• Block Multi-Tenant and Consumer Applications in Microsoft Entra • Shanchana

• Getting the Group Claims when authenticating with Microsoft Graph • Brian Veldman

• 📺 Entra ID Integrated SFTP (16 min) • John Savill

• 📺 Device Authentication Flows in Microsoft Entra (12 min) • Colby Pryor

🫆 Authentication

• Any user can disable passkeys in Windows. Completely. No admin rights needed. • Dr. Emin Huseynov

• Prevent disabling passkeys on Windows • Dániel Kovács

• Microsoft Entra Passkeys: Registration Campaign Delays Explained • Daniel Bradley

• Synchronizing Forced Password Changes from AD to Entra ID for AVD and Cloud PC Access – All about Endpoint Management • Eswar Koneti

• 📺 Are passkeys as secure as you think? (43 min) • Fabian Bader

• 📺 How to Handle Upcoming Entra Passkey Changes [Defaults Fail] (17 min) • Ru Campbell

• 📺 Not Another Tech Podcast - Synced Passkeys (38 min) • Andy Kemp, Nate Hutchinson

👥 User & Group Management

• Customize Microsoft 365 Profile Cards with Division, Role & Employee Type using Entra ID • Sreejith Reghunathan Pillai

• Entra ID – You can now synchronize groups with cross-tenant capability • Benoit Hamet

• 🛠️ I built a free Microsoft Entra ID tool that finds roles Microsoft hasn’t documented yet • Antonio Russo

🤖 DevOps & PowerShell

• Writing PowerShell for the Eventually Consistent Entra ID Database • Tony Redmond

• Complete Microsoft 365 PowerShell Environment Setup • Tiago S. Carvalho

🚦 Conditional Access

• Common Entra ID Security Assessment Findings – Part 4: Weak Conditional Access Policies • Christian Feuchter

• Conditional Access, or how to stop playing security Whac-A-Mole • Åsne Holtklimpen

• Your Conditional Access Device Filters Are a Paper Wall • Rawson Wade

🏙️ External ID - Guests & Multi-Tenant Organizations

• Manage external users in your Microsoft 365 tenant • Erik Lindeboom

📒 Tenant Configuration

• 📺 Microsoft FINALLY Adds Entra Backup… But Wait (8 min) • Jonathan Edwards

• 🛠️ TrustM365 - Baseline, Detect, Restore for M365 • Anthony Porter

🔥 Maester

👨🏽‍💻 Merill’s corner

• Want to get featured on Entra.News? → Submit your content 😎

• Want us to say nice things about your company? Sponsor entra.news 🤩

• Love the newsletter? Tell us 💚❤️💜

🪃 Acknowledgement of Country

Entra.News is created on Wurundjeri land and acknowledges the traditional owners of country throughout Australia, recognising their continuing connection to land, water and community. We pay our respect to them and their cultures and to elders both past and present.

About Sean Metcalf

Sean Metcalf is the Identity Security Architect at TrustedSec and a renowned expert in Microsoft identity security. He holds the rare Certified Master in Active Directory certification and has spoken at major security conferences including Black Hat, DEF CON, and BlueHat on how to defend cloud and hybrid environments.

LinkedIn - https://www.linkedin.com/in/seanmmetcalf/

🔗 Related Links

• Securing Entra ID Administration: Tier 0 - https://trustedsec.com/blog/securing-entra-id-administration-tier-0

• Managing Privileged Roles in Microsoft Entra ID: A Pragmatic Approach - https://trustedsec.com/blog/managing-privileged-roles-in-microsoft-entra-id-a-pragmatic-approach

• Improve Entra ID Security More Quickly - https://adsecurity.org/?p=4825

• Microsoft Graph Skill - https://graph.pm

📗 Chapters

00:04:05 AI and the Evolution of Attacks

00:06:42 The Importance of Hardening Fundamentals

00:12:03 Securing Entra ID Quickly

00:16:24 Protecting Tokens with VBS and TPM

00:19:58 Restricting Consent and Guest Users

00:23:40 Managing Rogue Tenants

00:27:36 Cloud Admin Workstation Strategies

00:34:14 Delegated Admin Privileges

00:44:32 The Danger of Application Permissions

00:57:06 Artemis Mission Trivia

Podcast Apps

🎙️ Entra.Chat - https://entra.chat

🎧 Apple Podcast → https://entra.chat/apple

📺 YouTube → https://entra.chat/youtube

📺 Spotify → https://entra.chat/spotify

🎧 Overcast → https://entra.chat/overcast

🎧 Pocketcast → https://entra.chat/pocketcast

🎧 Others → https://entra.chat/rss

Merill’s socials

📺 YouTube → youtube.com/@merillx

👔 LinkedIn → linkedin.com/in/merill

🐤 Twitter → twitter.com/merill

🕺 TikTok → tiktok.com/@merillf

🦋 Bluesky → bsky.app/profile/merill.net

🐘 Mastodon → infosec.exchange/@merill

🧵 Threads → threads.net/@merillf

🤖 GitHub → github.com/merill

There’s quite a bit from the community this week, including a mix of agents, some solid deep dives into Conditional Access gaps and identity attack paths, and a few practical security findings from the field.

From Microsoft: the planned rollout for passkeys in Microsoft registration campaigns (MC1253746) has been paused for now. Read the post below for more info.

Also, this week’s Entra Chat podcast is with Per-Torben Sørensen. We go deep on designing Conditional Access policies. You’ll likely come away with at least one new idea to apply. Worth adding to your podcast queue.

Enjoy!

Sponsored by:

User Lifecycle: Onboard and Offboard With a Single CmdLet

Fact: Managing hybrid users across AD, Entra ID, and Exchange Online is a breeding ground for missed steps and security gaps - from day one to last day.

EasyEntra’s PowerShell-enabled workflows handle the entire lifecycle:

🚀 Onboard a fully provisioned user in 30 seconds - UI or two-parameter CmdLet.
🚀 Templates defined from existing users in seconds.
🚀 Offboard completely in 10 seconds - UI or single CmdLet.
🚀 Offboarding settings configured once, applied consistently every time.
🚀 Delegate life-cycle management to first-line support - no senior PowerShell skills or tribal knowledge required.

Start your 30-day trial or book a demo - setup takes under a minute - free for tenants with fewer than 25 licensed users.

“It feels almost like a revolution.”
Head of IT, Arjeplog Municipality, Sweden

Wait… One CmdLet?

⚡️ Microsoft

🏆 General Availability

• Protect enterprise generative AI applications with prompt injection protection

📖 Read

• Plan for change – Agent Registry consolidation into Microsoft Agent 365

• As AI adoption scales, is your access strategy still viable? • Kaitlin Murphy

• Inside an AI‑enabled device code phishing campaign • Microsoft Defender Security Research Team

🗣️ Message Center

• MC1253746 - Microsoft Entra: Passkeys in Microsoft registration campaigns - Updated April 9, 2026: After further review, we have decided not to move forward with this change at this time. We will communicate via a new Message center post when we are ready to proceed. We apologize for any inconvenience this may cause and appreciate your understanding.

From the community…

🚀 Most popular posts from last week

• 🥇Hidden Gem in Microsoft Entra Conditional Access: Authentication context • Henrik Piecha

• 🥈Conditional Access Policies are the Best Way to Block Weekend Access to Microsoft 365 • Tony Redmond

• 🥉Managing Shared Mailbox Access with Entra ID Governance • Christian Frohn

Sponsored by:

Book a demo

☀️ Learn

👩‍✈️ AI & Copilot

• Microsoft Entra Agent ID Blueprints and Microsoft Foundry: A Security Guide • Jonas Bøgvad

• Microsoft Security Copilot for M365 E5/E7 recommendations from the field • Derk van der Woude

• Using the Microsoft 365 Connector for Claude • Tony Redmond

• 📺 Introduction to Agent 365 SDK - Microsoft Community Learning (9 min) • MK Bajwa

💳 Verified ID

• Cross-Device Identity Verification via Entra Verified ID in a Multi-Agent System • Mateusz Jendza

• Entra Verified ID Upgrade signing key to become FIPS compliant • Andres Bohren

⛑️ ID Protection

• Common Entra ID Security Assessment Findings – Part 3: Weak Privileged Identity Management Configuration – Compass Security Blog • Christian Feuchter

• Continuing the Sentinel & MCP Series: Hunting Identity Risk and Password Sprays • David Alonso Dominguez

🌐 Private Access & Internet Access (GSA)

• KB – Entra Private Access Session persistence • Jan Bakker

• 📺 Network-layer data protection with Microsoft Entra GSA and Purview DLP (18 min) • Dominik Hoefling, Heike Ritter

📦 Apps

• How to Assign Application Admin to Specific Enterprise Apps • Daniel Bradley

• Leverage User and Group Assignments to Limit User Access to Apps • Tony Redmond

• 🎙️ Entra app sprawl - HIP Podcast • Sander Berkouwer, Sean Deuby, Raymond Comvalius

🫆 Authentication

• Device-preferred Credential Logic in System-preferred MFA • Shanchana

• System & Device-preferred Authentication • Michael Frank

• 📺 Your MFA Is Already Broken - Microsoft Just Didn’t Tell You (2 min) • Azure Academy

👥 User & Group Management

• How to Track Changes in Microsoft 365 Groups • Tony Redmond

• Manage Microsoft 365 Groups Using a PowerShell Script • Blesslin Rinu

🚦 Conditional Access

• Break-Glass Accounts Done Right: Securing Emergency Access in Microsoft Entra • Sebastian Flæng Markdanner

• Conditional Access: Location, Location, Location - and the Gaps We Create • Jon Hope

• Demonstrating CA Policy Gaps using AADInternals • Anton Willoughby

🏙️ External ID - Guests & Multi-Tenant Organizations

• 📺 Automate Entra ID Guest Audits (Azure Automation + Graph API) (8 min) • Azure Brother

🥷 Security

• MyStaff - hidden admin portal ?? • Jay Kerai

• IAM the Captain Now – Hijacking Azure Identity Access • Justin Mahon

• 🛠️ GoXDR - KQL Query Library • Göksel Atakan

♻️ Sync

• Entra Connect Sync 2.6.3 released • Andres Bohren

📒 Tenant Configuration

• Microsoft Finally Built Native Backup into Entra ID • Moe Kinani

• 📺 Entra Backup and Recovery in Preview: Don’t Miss This (4 min) • Peter Rising

• 📺 Entra ID Backup. What you Need to Know! (12 min) • Andy Malone

• 📺 Entra ID Tenant Governance is Here! (11 min) • Colby Pryor

• 📺 How to Audit Microsoft Entra with CIS Benchmark v6.0.1 (58 min) • Mario Bien-Aime

🛍️ External ID - Customers

• On Entra External ID (EEID) federation with Entra ID • Rory Braybrook

🔥 Maester

👨🏽‍💻 Merill’s corner

In Melbourne this week? I’ll be presenting a short session on MCP auth at the Identity Management Day Summit.

Come say hi! Register here.

• Want to get featured on Entra.News? → Submit your content 😎

• Want us to say nice things about your company? Sponsor entra.news 🤩

• Love the newsletter? Tell us 💚❤️💜

🪃 Acknowledgement of Country

Entra.News is created on Wurundjeri land and acknowledges the traditional owners of country throughout Australia, recognising their continuing connection to land, water and community. We pay our respect to them and their cultures and to elders both past and present.

In this episode of Entra Chat, Microsoft MVP Per Torben walks through the conditional access mistakes he sees even large enterprises making, and the practical framework he actually uses with customers.

You’ll learn how to set up emergency access accounts the right way, why your CA policies should be built more like a firewall than a checklist, and the one naming convention that makes managing dozens of policies actually manageable.

🎧 Hit play, your tenant will thank you.

Sponsored by:

Entra ID Gaps That Cause Outages

In Microsoft Entra ID, outages often start small: an expired client secret, a lapsed certificate, or a suddenly failing integration. Traditional controls don’t track credential expiry or enforce application ownership, so issues appear only after something breaks.

Teams are left asking:

• Which applications can access Microsoft 365 data?

• Is that access still appropriate?

• Who owns the app?

Unclear answers stall reviews, weaken accountability, and slow delivery.

ENow App Governance Accelerator closes these gaps by highlighting expiring credentials, surfacing permission risks, and identifying ownership gaps before they disrupt operations. New Standard Tier pricing makes it accessible for organizations under 10,000 users, typically $3,500–$9,500 annually.

Explore Entra ID Gaps

About Per Torben

Per Torben is a Senior Architect at Crayon and a Microsoft MVP for Identity and Access. Based in Norway, he frequently writes highly-read posts featured on Entra.News and runs the collaborative tech blog “Agder in the Cloud”.

LinkedIn - https://www.linkedin.com/in/pertorbensorensen/

🔗 Related Links

• Agder in the Cloud - https://agderinthe.cloud

• I.D.E.A. for creating/configuring break-glass accounts

  • GitHub - https://github.com/Per-Torben/I.D.E.A.

  • Blog - https://agderinthe.cloud/2026/01/06/introducing-i-d-e-a-and-i-d-e-a-001/

• Protected actions: https://agderinthe.cloud/2025/02/12/protected-actions-adding-extra-guards-to-your-entra-id-gate/

• Conditional Access hardeing (series): https://agderinthe.cloud/2024/12/05/how-to-fix-the-fundamental-flaw-in-conditional-access-part-1-introduction-and-coverage-gaps
  CA geo filter (series): https://agderinthe.cloud/2025/11/06/diving-into-geo-filter-with-entra-conditional-access-part-1

• Entra Backup - https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/backup-restore

📗 Chapters

06:22 The importance of Break Glass accounts

09:02 Securing emergency access with FIDO2 and RMAUs

18:10 Configuring Conditional Access: The “Block by Default” strategy

27:26 Managing scope and preventing accidental lockouts

29:31 Persona-based naming conventions for CA policies

35:38 Grouping settings and avoiding bloated policies

41:54 Handling exceptions and travel access with Access Packages

44:55 The flaw in Protected Actions for Conditional Access

53:38 Using the new Entra Backup feature for quick restores

Podcast Apps

🎙️ Entra.Chat - https://entra.chat

🎧 Apple Podcast → https://entra.chat/apple

📺 YouTube → https://entra.chat/youtube

📺 Spotify → https://entra.chat/spotify

🎧 Overcast → https://entra.chat/overcast

🎧 Pocketcast → https://entra.chat/pocketcast

🎧 Others → https://entra.chat/rss

Merill’s socials

📺 YouTube → youtube.com/@merillx

👔 LinkedIn → linkedin.com/in/merill

🐤 Twitter → twitter.com/merill

🕺 TikTok → tiktok.com/@merillf

🦋 Bluesky → bsky.app/profile/merill.net

🐘 Mastodon → infosec.exchange/@merill

🧵 Threads → threads.net/@merillf

🤖 GitHub → github.com/merill

Well folks, there’s a lot happening in the Entra world, we have over seven features becoming GA, a bunch of new public preview features, and an upcoming change to enforce CA policies during WHfB registration. Check them all out below.

BTW, I caught up with some Microsoft Entra MVPs to get their take on the big updates—queue it up on Spotify, Apple Podcasts, or watch on YouTube 👇

Enjoy!

Sponsored by:

Announcing the Month of Azure Red Teaming 2026

Altered Security Month of Azure Red Teaming is an initiative to raise awareness and spark discussion around one of the most critical and in-demand skillsets: Azure Red Teaming. Throughout the month we want to keep the community engaged to help infosec professionals and students understand, practice and analyze attack vectors in Azure.

What to expect during the month:

- Four Free Azure Red Team Webinars with hands-on labs (April 10th, 17th, 24th and 30th).

- Flat 20% OFF on the accoladed Azure Red Team certifications: CARTP and CARTE.

- Free labs on Altered Security’s Red Labs Platform

Get ready for a month full of free labs, webinars, blog posts, giveaways and discounts!

Know More

⚡️ Microsoft

🏆 General Availability

• Microsoft Entra expands SCIM support with new SCIM 2.0 APIs for identity lifecycle operations • Joseph Dadzie

• Microsoft Single Sign-On for Linux support for authenticating with Phish-Resistant MFA credentials

• New M365 group creation experience in My Groups

• Microsoft Entra Connect Health now enforces TLS 1.2

• General Availability: Social Identity Providers for Native Authentication via Browser‑Delegated Flows (web-view) in Microsoft Entra External ID • Sasha Mars

• Just‑in‑Time Password Migration in Microsoft Entra External ID

• Enabling Email and SMS OTP MFA in Entra External ID Native Authentication

🔥 Public Preview

• Phased Rollout with the Conditional Access Agent

• Passkey Adoption Campaigns with the Conditional Access Optimization Agent

• Microsoft Entra hybrid join using Microsoft Entra Kerberos

📖 Read

• Troubleshoot the Global Secure Access mobile client with Health check utility • Microsoft Learn

📺 Watch

• Developer Tools for Agent ID: SDKs, CLIs & Samples (37 min) • Kyle Marsh

• Self‑Service Account Recovery with Microsoft Entra (2 min) • Microsoft Security

🗣️ Message Center

• MC1260708 - Microsoft Entra ID: Improved readability for Authentication Methods Policy Update audit logs

From the community…

🚀 Most popular posts from last week

• 🥇Don’t let Entra ID Protection miss your next breach! • Nicola Suter

• 🥈Conditional Access: CA Analyzer Product Updates • Jon Hope

• 🥉How to Automate Inactive Guest User Removal in Microsoft 365 Using Power Automate • Dhinesh

Sponsored by:

Uncover Entra App Risk in Minutes

Most Entra ID tenants contain hundreds of applications with unclear ownership, excessive OAuth permissions, and long-lived secrets. These gaps are difficult to identify using native tools alone, especially at scale.

ENow’s AppGov Score provides a read-only assessment of your Entra environment using 24 Microsoft-aligned checks. It surfaces risky consent grants, privileged service principals, expired credentials, and ownerless apps, then translates findings into a clear, defensible risk score.

Instead of manual reviews or scripting, administrators gain immediate visibility into application sprawl and permission exposure, making it easier to prioritize remediation and improve governance across Microsoft 365.

Get Your App Risk Score

☀️ Learn

👩‍✈️ AI & Copilot

• Your Copilot Studio agent is acting as someone, do you know who? • Derk van der Woude

• 🎙️ Governing the Ungoverned: Agent 365 and Entra Agent ID • Jussi Roine & Tobias Zimmergren

🧰 Workload ID

• 🔐 SPIFFE & SPIRE: The Workload Identity Standard Quietly Powering Zero Trust • Sameer Bhanushali

👮‍♂️ ID Governance

• How to Extend Entra Provisioning to Apps Without SCIM or API • Nick Hunt

• Managing Shared Mailbox Access with Entra ID Governance • Christian Frohn

• 📺 Access Reviews Reimagined: What’s New in Microsoft Entra (6 min) • Peter Rising

🌐 Private Access & Internet Access (GSA)

• 🛠️ GSA Private Access Sizing Planner • Thomas Detzner

📦 Apps

• A Token of Appreciation - JWTs & Microsoft Authentication for Security Research • Tom Rolvers

🫆 Authentication

• Seamless Access: Using QR Code Sign‑In on Android Enterprise Shared Devices with Microsoft Entra • Nicky De Westelinck

👥 User & Group Management

• How to Configure Cross-Tenant Group Synchronization in Microsoft Entra ID • Karthi

• Ownerless Group Policy finally supported by the Graph API • Vasil Michev

🚦 Conditional Access

• Conditional Access Policies are the Best Way to Block Weekend Access to Microsoft 365 • Tony Redmond

• Hidden Gem in Microsoft Entra Conditional Access: Authentication context • Henrik Piecha

🖥️ Devices

• Microsoft Entra Hybrid Join Using Entra Kerberos – Step-by-Step Guide Without Sync Dependency • Sreejith Reghunathan Pillai

🏙️ External ID - Guests & Multi-Tenant Organizations

• 📺 Entra ID - Guest User Governance – Licensing Made Easy (2 min) • Julian Rasmussen MVP

📈 Reporting and Insights

• How to Report Entra ID Group Insights • Tony Redmond

🥷 Security

• Abusing Overly Permissive Roles in Azure File Sync • Christian Bortone

• Common Entra ID Security Assessment Findings – Part 2: Privileged Unprotected Groups • Christian Feuchter

• 🛠️ GoXDR - KQL Query Library • Göksel Atakan

♻️ Sync

• Hard Match & Sync Hijacking! The Part Everyone Skips Over • Moe Kinani

📒 Tenant Configuration

• Entra ID Backup and Recovery • Julian Rasmussen

• Introduction to Microsoft Tenant Governance part 1: basics and establishing relationships • Vasil Michev

• Introduction to Microsoft Tenant Governance part 2: tenant discovery and creation • Vasil Michev

• Microsoft Entra Backup and Recovery: Prerequisites, Backup, and Restore in Detail • Oliver Müller

• Tenant governance • Michael Frank

• 📺 Entra ID Free vs Premium in 2026 - Is Premium Worth It? (22 min) • Andy Malone

🔥 Maester

• Azure DevOps tests for Maester • Sebastian Claesson

• Want to get featured on Entra.News? → Submit your content 😎

• Want us to say nice things about your company? Sponsor entra.news 🤩

• Love the newsletter? Tell us 💚❤️💜

🪃 Acknowledgement of Country

Entra.News is created on Wurundjeri land and acknowledges the traditional owners of country throughout Australia, recognising their continuing connection to land, water and community. We pay our respect to them and their cultures and to elders both past and present.

Join us as we talk to three world-class MVPs about their hands-on experience with the new Entra Backup and Recovery and Tenant Governance features.

Our Microsoft MVP guests Nathan McNulty, Ru Campbell, and Thomas Naunheim break down the most exciting new features in Microsoft Entra.

In this episode, we explore:

• The “Shadow Tenant” Problem: One org found 700+ Entra tenants they didn’t know they had.

• Version Control for Admins: Why “Difference Reports” are a total game-changer for troubleshooting.

• Recovery Safeguards: How to protect your tenant from accidental deletions and “sneaky” background changes.

• Backup & Recovery: The truth about Entra Backup vs. Third-Party ISV tools.

About The Guests

Nathan, Ru, and Thomas are highly experienced MVPs specializing in identity security, governance, and Microsoft Entra.

Nathan McNulty - LinkedIn - https://www.linkedin.com/in/nathanmcnulty/

Ru Campbell - LinkedIn - https://www.linkedin.com/in/rlcam/

Thomas Naunheim LinkedIn - https://www.linkedin.com/in/thomasnaunheim/

🔗 Related Links

• Microsoft Entra Backup and Recovery Documentation - https://learn.microsoft.com/en-us/entra/backup/overview

• Microsoft Entra Tenant Governance - https://learn.microsoft.com/en-us/entra/id-governance/tenant-governance/overview

• Synced Passkeys - https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-authentication-passkeys-fido2

• Microsoft Work IQ CLI (Public Preview) - https://learn.microsoft.com/en-us/microsoft-365/copilot/extensibility/workiq-overview

• Playwright https://playwright.dev/

• Entra Auth Tracer (Chrome Extension) - https://github.com/darrenjrobinson/EntraAuthTracer

• Unified Risk Score - https://learn.microsoft.com/en-us/defender-xdr/investigate-users#risk-score-tab-preview

📗 Chapters

00:00 Intro to New Entra Features

02:04 Entra Backup and Recovery Deep Dive

10:41 Difference Reports Explained

15:54 Intro to Tenant Governance

23:34 Managing Multi-Tenant Organizations

33:31 Conditional Access Optimization Agent

36:55 The Great Passkey Debate

47:22 Retirements: SP-less Auth & ACS for SharePoint

48:46 Unified Risk Score in Defender

52:38 MVP Tips of the Week

Podcast Apps

🎙️ Entra.Chat - https://entra.chat

🎧 Apple Podcast → https://entra.chat/apple

📺 YouTube → https://entra.chat/youtube

📺 Spotify → https://entra.chat/spotify

🎧 Overcast → https://entra.chat/overcast

🎧 Pocketcast → https://entra.chat/pocketcast

🎧 Others → https://entra.chat/rss

Merill’s socials

📺 YouTube → youtube.com/@merillx

👔 LinkedIn → linkedin.com/in/merill

🐤 Twitter → twitter.com/merill

🕺 TikTok → tiktok.com/@merillf

🦋 Bluesky → bsky.app/profile/merill.net

🐘 Mastodon → infosec.exchange/@merill

🧵 Threads → threads.net/@merillf

🤖 GitHub → github.com/merill

The big news this week is the official launch of Entra Backup and Recovery and Entra Tenant Governance, along with new updates to the CA Optimization Agent.

There’s an upcoming change that may impact applications using Microsoft Graph app-only permissions. Check out the blog post “Designing for Eventual Consistency” for more details.

Don’t forget to catch up on this week’s Entra Chat podcast with Emilien Socchi, where we dig into two of his interesting projects.

Enjoy!

Sponsored by:

User Lifecycle: Onboard and Offboard With a Single CmdLet

Fact: Managing hybrid users across AD, Entra ID, and Exchange Online is a breeding ground for missed steps and security gaps - from day one to last day.

EasyEntra’s PowerShell-enabled workflows handle the entire lifecycle:

🚀 Onboard a fully provisioned user in 30 seconds - UI or two-parameter CmdLet.
🚀 Templates defined from existing users in seconds.
🚀 Offboard completely in 10 seconds - UI or single CmdLet.
🚀 Offboarding settings configured once, applied consistently every time.
🚀 Delegate life-cycle management to first-line support - no senior PowerShell skills or tribal knowledge required.

Start your 30-day trial or book a demo - setup takes under a minute - free for tenants with fewer than 25 licensed users.

“It feels almost like a revolution.”
Head of IT, Arjeplog Municipality, Sweden

Wait… One CmdLet?

⚡️ Microsoft

🏆 General Availability

• External MFA in Microsoft Entra ID is now Generally Available • Swaroop Krishnamurthy

🔥 Public Preview

• Strengthen Identity Resilience: Recover with Confidence using Microsoft Entra Backup and Recovery • Joseph Dadzie

• Microsoft Entra Tenant Governance: Secure and Manage Multi-Tenant Environments at Scale • Joseph Dadzie

• Evolving Identity Security: How the Conditional Access Optimization Agent Helps You Adapt • Swaroop Krishnamurthy

📖 Read

• Designing for Eventual Consistency for Microsoft Entra • Kyle Marsh

• Identity security is the new pressure point for modern cyberattacks • Rob Lefferts, Nadim Abdo

🗣️ Message Center

• MC1262589 - New M365 group creation and editing in My Groups

• MC1261596 - Notice: Security Copilot will be included as part of your Microsoft 365 E5 plan soon

• MC1260708 - Microsoft Entra ID: Improved readability for Authentication Methods Policy Update audit logs

• MC1248389 - Retirement of -Credential parameter when connecting to Exchange Online PowerShell

From the community…

🚀 Most popular posts from last week

• 🥇Microsoft Quietly Closes Another Loophole for Tenant Domain Enumeration • Daniel Bradley

• 🥈The Sad State of Microsoft Graph and Other APIs • Tony Redmond

• 🥉Conditional Access Optimization Agent knowledge base • Jan Bakker

☀️ Learn

👩‍✈️ AI & Copilot

• From Blueprint to Token: How Entra Agent Identity Inheritance Really Works • Derk van der Woude

• Microsoft 365 E7: The Frontier Suite and the Rise of AI Agents • Konstantin Slavin-Borovskij

• Microsoft Entra Agent ID: A Practical Guide to Blueprints and Agent Identities • Raymond Roethof

💳 Verified ID

• Build secure verification with Microsoft Entra Verified ID (14 min) • Yoel Horvitz

⛑️ ID Protection

• Don’t let Entra ID Protection miss your next breach! • Nicola Suter

• 📺 Sign-In Risk vs User Risk - Most Admins Don’t Know the Difference (14 min) • Jonathan Edwards

📦 Apps

• Common Entra ID Security Assessment Findings – Part 1: Foreign Enterprise Applications With Privileged API Permissions • Christian Feuchter

🫆 Authentication

• 🛠️ Entra Auth Tracer – A Browser Extension for Deep Inspection of Microsoft Entra Authentication Flows • Darren Robinson

• The Exchange attribute SOA switch and licencing woes • Morten Skrubbeltrang

🤖 DevOps & PowerShell

• Authentication Tokens Are Not a Data Contract - Azure DevOps Blog • Angel Wong

• Bulk Convert External Users to Internal Users Using PowerShell • Kanaga

• How to Automate Inactive Guest User Removal in Microsoft 365 Using Power Automate • Dhinesh

• Microsoft Limits App Access to Sensitive Message Properties • Tony Redmond

🚦 Conditional Access

• Block Microsoft 365 Apps using Conditional Access Policy • Prajwal Desai

• Conditional Access: CA Analyzer Product Updates • Jon Hope

🖥️ Devices

• KB5085516 OOB Update Resolves Microsoft account sign in Issues • Prajwal Desai

• 📺 Passwordless Windows for BYOD: Entra ID Passkeys Explained (9 min) • Azure Brother

🏙️ External ID - Guests & Multi-Tenant Organizations

• B2B or Not 2B? Cross-Tenant Delegated Administration with Microsoft Entra Tenant Governance • Thomas Naunheim

🥷 Security

• Microsoft Zero Trust Workshop Expands with a Dedicated AI Pillar • Praba

♻️ Sync

• Getting started with Entra Connect Cloud Sync • Pim Jacobs

📒 Tenant Configuration

• Low-Key Debut for Entra ID Backup and Recovery • Tony Redmond

• Microsoft Entra Backup and Recovery • Rudy Mens

• Microsoft Entra ID Gets Native Backup and Recovery — What You Need to Know • Jon Hope

• Tenant governance | Entra ID • Michael Frank

• 🎙️ Unified Tenant Management with Nik Charlebois-Laprade • Nik Charlebois, Richard Campbell

• 📺 Overview of Entra Backup and Recovery (11 min) • John Savill

🛍️ External ID - Customers

• Connecting Entra External ID (EEID) to Entra ID as an external provider via OIDC • Rory Braybrook

👨🏽‍💻 Merill’s corner

• Want to get featured on Entra.News? → Submit your content 😎

• Want us to say nice things about your company? Sponsor entra.news 🤩

• Love the newsletter? Tell us 💚❤️💜

🪃 Acknowledgement of Country

Entra.News is created on Wurundjeri land and acknowledges the traditional owners of country throughout Australia, recognising their continuing connection to land, water and community. We pay our respect to them and their cultures and to elders both past and present.

Two open-source tools Emilien built to find gaps in Conditional Access policies and categorize Azure/Entra roles based on attack paths.

Learn how CA Insight evaluates 250 million sign-in combinations offline in minutes instead of days, why the What If API doesn't scale, and how AZTier helps defenders and pen testers understand privilege escalation risks across Entra ID, Azure, and Microsoft Graph.

Together, these projects help security teams move from reactive log monitoring to a proactive defense strategy.

What’s Breaking and Slowing Your Entra ID Environment?

In Microsoft Entra ID, the same visibility gaps cause two problems:

• Things break

• Work slows down

Expired client secrets disrupt integrations. Certificates lapse and authentication fails. New apps appear with excessive permissions and no clear ownership. At the same time, teams struggle to answer basic questions, which applications have access to Microsoft 365 data, whether that access is still required, and who is responsible for it.

When answers are not immediate, reviews stall and projects slow down.

ENow App Governance Accelerator Credential Guard helps identify expiring credentials and expose permission and ownership gaps.

For organizations under 10,000 users, pricing ranges from $3,500 to $9,500 annually through March 31, 2026.

Find App Access Gaps

Subscribe with your favorite podcast player or watch on YouTube 👇

About Emilien Socchi

Emilien Socchi is a Cloud Security Research Engineer at Storebrand (Oslo, Norway) focusing on the proactive discovery of security issues. With an extensive background in application and cloud penetration testing, Emilien has published practical research and tooling used by defenders. He also maintains several open‑source projects, including Azure administrative tiering models and Entra ID role‑monitoring utilities.

LinkedIn - https://www.linkedin.com/in/emilien-socchi

🔗 Related Links

• CA Insight- https://github.com/emiliensocchi/entra-ca-insight

• Azure Administrative Tiering (AzTier) - https://aztier.com

• AzTier Source: https://github.com/emiliensocchi/azure-tiering

• AzTier Deployer - https://github.com/emiliensocchi/aztier-deployer

📗 Chapters

00:00 The Story Behind CA Insights

16:52 Why the ‘What If’ API Doesn’t Scale

21:09 Building an Offline Evaluation Engine

45:22 Deep Dive into AZTier: A Red Team Perspective

Podcast Apps

🎙️ Entra.Chat - https://entra.chat

🎧 Apple Podcast → https://entra.chat/apple

📺 YouTube → https://entra.chat/youtube

📺 Spotify → https://entra.chat/spotify

🎧 Overcast → https://entra.chat/overcast

🎧 Pocketcast → https://entra.chat/pocketcast

🎧 Others → https://entra.chat/rss

Merill’s socials

📺 YouTube → youtube.com/@merillx

👔 LinkedIn → linkedin.com/in/merill

🐤 Twitter → twitter.com/merill

🕺 TikTok → tiktok.com/@merillf

🦋 Bluesky → bsky.app/profile/merill.net

🐘 Mastodon → infosec.exchange/@merill

🧵 Threads → threads.net/@merillf

🤖 GitHub → github.com/merill