This week: the ConnectWise Cloud Backup breach and what it teaches us about app permissions, a big wave of posts on agent identity blueprints, cleaning up risky apps and secrets, and plenty on passkeys and Conditional Access.

🎙️ This week on Entra.Chat: Jeff Sakowicz from the Microsoft Entra application platform team shares the order that actually works for cleaning up risky apps, secrets and consent. Watch the episode the learn more.

🚨 The ConnectWise (SkyKick) breach. On 15 October an attacker used one stolen credential for the ConnectWise Cloud Backup app to sign in to 173+ Microsoft 365 tenants. There was no phishing, no password and no MFA prompt, because the app already had admin consent to read mail, files and the directory in every tenant. I made a short video that explains how Entra app permissions made this possible, why Conditional Access didn’t apply, and what to check in your tenant today. If you use the app, start by finding it by its app ID (506e08f9-6e9a-4da4-942b-a099a03644ae) in Enterprise apps and disabling it. Don’t delete it.

Sponsored by:

EasyEntra: Empower First-Level Support to Work Efficiently

Managing standard first-level user support in a hybrid environment is overly complex. To handle even basic tasks, your team needs expertise across multiple platforms like ADUC, Exchange on-premises Admin Center, M365 Admin Center, Entra Admin Center, EXO Admin Center, EXO PowerShell, and Entra Connect PowerShell.

EasyEntra eliminates this complexity and allows first-level support to work without headaches:

✅ Intuitive - The interface mimics the familiar AD Users & Computers layout.
✅ Consolidated - Manage all user settings from a single-pane-of-glass.
✅ Responsive - Preloads all properties for lightning-fast navigation of settings.
✅ Reduces junior IT training - Onboard junior IT staff in minutes.
✅ Protects senior IT staff - Prevent first-level support tickets from escalating.

Download Free Trial! →

⚡️ Microsoft

🏆 General Availability

• What’s new in Microsoft Entra: October 2026 • Yina Arenas

🔥 Public Preview

📖 Read

• The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime • Microsoft Threat Intelligence

🗣️ Message Center

• MC1437671 - Microsoft Entra: Passwordless password change in My Sign-Ins

• MC1450134 - Microsoft Entra: Windows Hello for Business and macOS Platform SSO as standalone MFA factors

📺 Watch

• 📺 Zero Trust: From Strategy to Reality • Mark Simos

From the community…

Sponsored by:

App Sprawl is Outpacing Governance

New apps keep coming in. Can your governance processes keep up? Between SaaS growth, shadow IT, AI-powered citizen development, and a constant stream of new app requests, maintaining control of your Entra ID environment is getting harder. And governance challenges extend beyond onboarding:
🔑 Excessive permissions and unclear ownership
📦 Insecure tenant defaults
🗑️ Orphaned apps and lingering access
🔃 Inconsistent offboarding and lifecycle governance

You can’t govern what you can’t see. ENow’s AppGov Score benchmarks your Entra ID application governance posture, uncovering risks and gaps so you know what to prioritize first. Get your free App Governance Benchmark Report & Score, plus a 7-day upgrade to explore the tool in your own tenant.

Benchmark Your App Governance →

☀️ Learn

👩‍✈️ AI & Copilot

• Prevent users from creating new agent identity blueprints • Jan Bakker

• Microsoft Entra expands who can create agent blueprints • Daniel Bradley

• How to Restrict Users from Creating Agent Identity Blueprints in Microsoft Entra • Ali Tajran

• Entra – Restrict users to create agent identity blueprint • Benoit HAMET

• Microsoft Entra Updates Agent Blueprint Creation and Consent Requirements • Shanchana

• Microsoft Entra Lets Users Create Agent Blueprints by Default • Rudy Mens

🧰 Workload ID

• How to Set a Custom Token Lifetime for One App in Entra ID • MEZBA UDDIN

⛑️ ID Protection

• M365Permissions v2.2.0 released! • Jos Lieben

👮‍♂️ ID Governance

• How to speed up PIM activations in Microsoft Entra ID • Daniel Bradley

• PIM custom extensions, what the docs didn’t say when I tested this • Joël Prins

• Attackers Follow the Path You Designed – Why Identity Architecture Matters More Than Ever? • Shehan Perera

• Best Practices for Group Management in Microsoft 365 • Office 365 Reports

• Attackers Follow the Path You Designed – Why Identity Architecture Matters More Than Ever • Chris Bradshaw

🌐 Private Access & Internet Access (GSA)

• Understanding Traffic Forwarding and Advanced Diagnostics • Andy Kemp

• Deploying the Global Secure Access Client with Intune • Andy Kemp

📦 Apps

• App Registrations and Enterprise Apps: What the Entra Object Model Actually Looks Like • Jonathan Hope

• Microsoft Plans to Allow Users to Create Agent Blueprints • Tony Redmond

• Containment in Microsoft 365 - the token problem • Rory Wagner

• Entra ID Backup & Recovery in GA • Julian Rasmussen

🫆 Authentication

• Phishing-Resistant by Default: Microsoft’s Passkey Shift • Nathan McNulty

• Passkeys Are Not a Trap • Scott Helme

• 📺 The 4 Entra Passkey Types: Which One Do You Need? • Azure Brother

👥 User & Group Management

• Entra User Source of Authority – The Future is Now! • Anthony J. Fontanez

🤖 DevOps & PowerShell

• 📺 MSGraphProxy: We Have Microsoft Graph at Home - Morten Mynster • PowerShell Conference Europe

🚦 Conditional Access

• Microsoft Entra ID Introduces Individual Security Defaults Protections (Preview) • Blesslin Rinu

• Manage individual Security Defaults protections in Microsoft Entra • Daniel Bradley

🥷 Conditional Access

• Restrict Access to Microsoft Entra Admin Center: The Toggle That Locks Nothing • Mark Oldham

🏙️ External ID - Guests & Multi-Tenant Organizations

• Microsoft Entra’s New Sponsored Guests Experience Puts Governance in the Hands of Business Owners • Colby Pryor and Colby Pryor

• B2B Guest Blocked by Country? Check Global Secure Access Source IP Restoration • Samuel Eng and Samuel Eng

♻️ Sync

• Cloud Sync provisioning agent fails to start with a gMSA • Jan Bakker

🔥 Maester

👨🏽‍💻 Merill’s corner

• Want to get featured on Entra.News? → Submit your content 😎

• Want us to say nice things about your company? Sponsor entra.news 🤩

• Love the newsletter? Tell us 💚❤️💜

🪃 Acknowledgement of Country

Entra.News is created on Wurundjeri land and acknowledges the traditional owners of country throughout Australia, recognising their continuing connection to land, water and community. We pay our respect to them and their cultures and to elders both past and present.

Prevention starts with policy

The best medicine is prevention. Before you clean anything up, go through the policy controls you already have and set them to block insecure configuration that doesn’t fit your organization’s risk tolerance. This is a balance, not a switch. “If you want the most secure system in the world, unplug the server, bury it underground. Your job is done.” Lock things down too hard and developers and end users will find other ways to get work done, especially now that they have agents to help them. Shadow IT is almost always less secure than what you stopped. So whenever a control blocks self-service, make sure people know what to do next and how to get unblocked quickly.

Treat high-value apps as production infrastructure

Microsoft runs customer-facing apps in tenants separate from its corporate tenant. Tenant-level isolation is a useful form of segmentation, and some large organizations do the same for their production assets. But a second tenant brings its own operational overhead, and a tenant that falls into chaos can leave you worse off than before.

Whatever you decide, treat your multitenant apps and high-value line-of-business apps as production infrastructure, the same way you would protect a database or a high-value Azure subscription. A good middle ground is to keep a close eye on the owners and sponsors of your high-value apps and agent identities. They are the people who can change those identities’ authentication configuration, so their accounts need good hygiene.

The easier win is test, demo and staging. If they still live in your productivity or production tenant, move them out. Midnight Blizzard showed how small dominoes lead to big consequences: Microsoft’s own write-up describes a password spray against a legacy, non-production test tenant account, followed by a legacy test OAuth application that had elevated access to the corporate environment.

Sponsored by

Many of the app and consent problems in this episode are exactly what Maester checks for: it runs security tests against your Microsoft Entra and Microsoft 365 configuration and tells you what passed and what failed.

Maester Cloud turns those results into a workflow your team can run every day:

• Assign an owner to each finding and link it to a ticket, instead of tracking remediation in a spreadsheet.

• See what got fixed since the last run, and record accepted risks.

• Catch drift with daily history and alerts when a setting changes.

• Every tenant in one place, without switching sign-ins.

Try the live demo of Maester.Cloud

Subscribe with your favorite podcast player or watch on YouTube

Map your surface area, then think in three dimensions

Before buying a new inventory tool, use the one you already have. If your organization already tracks production assets or other identities, bring your non-human identities into that system instead of running a parallel process. Then answer three questions: how many of these do I have, what categories of identity are in the portfolio, and what are the big categories of risk?

Jeff looks at risk in three dimensions:

• Active threats. Priority zero. Hand them to the SOC immediately.

• Posture. Surface area from misconfiguration, or configuration that was state of the art five years ago, such as the implicit flow for a single-page app. Weak credentials, insecure redirect URIs, unused identities and legacy protocols all live here.

• Blast radius. How much privilege each identity has, whether it’s used or not.

Most organizations end up with a huge list of high-privilege apps and posture issues. You will never get every risk to zero at that scale, so the job is to prioritise by risk and by return on effort.

Burn down secrets: stop the bleeding first

Say you’ve read the Solorigate reports and want to get client secrets off your non-human identities. Step one is to stop the bleeding: create an app management policy that blocks new password credentials from being added. App management policies can take an enforcement date, so only apps created after that date are affected and your hundreds of existing apps keep working while you fix them. There is no equivalent for user authentication methods.

Before you switch it on, find out how disruptive it will be. One new app a month that uses a password credential is easy to absorb. A hundred a day could grind the organization to a halt. Have the guidance and the exception process ready, and move the enforcement date if you need to.

Once the problem has stopped growing, turn to the debt. Split it into categories and start with the two ends of the spectrum:

• The most privileged. Apps with existing passwords that have app-only access to read all mailboxes or read and write all user profiles go to the top of the list. Move them to a stronger credential and check whether they need that access at all.

• The wholly unused. More on this below.

The end goal is system-managed credentials, using a managed identity or workload identity federation with a federated identity credential (FIC). You can argue a certificate’s private key is harder to leak than a secret, but as Jeff says, “a bad copy-paste is a bad copy-paste.” System-managed credentials also remove a big source of toil for developers, which helps when you need people to move.

Why mail is the flag

Mail permissions can look less frightening than broad directory permissions, but for many attacks mail is the goal. “Mail’s often the flag that the attacker’s trying to capture.” Other access is often just a way to move laterally or elevate privilege. Mail, Teams chats and files can be the end goal, and that is what most historical consent phishing attacks went after. A mailbox is also a good lateral movement tool: it can hold credentials and bank details, and it gives an attacker what they need to craft a convincing social engineering attack against everyone the victim emails or chats with every day.

Lost secrets make this worse. A secret that is valid for years, used by apps nobody can name, gives an attacker a way in without adding a new credential, so there’s no new event for you to trace.

Unused identities: the highest return on effort

A wholly unused identity is the highest-ROI bucket. “If you get rid of an unused identity, you might be knocking an item off of seven lists.” In one move you can remove a weak password, an insecure redirect URI, overprivileged access and some legacy protocol usage. Do your due diligence first, because some apps only run once a year at tax season. But removing something that is truly unused doesn’t disrupt anyone, and it can be done as a central action by a single team without engaging every app owner. That high-leverage central action is what Microsoft leaned into for its Secure Future Initiative work.

Then look at low-usage identities. They hide in plain sight: an identity with an automated runner that wakes up every day to run a test suite won’t show up as unused, and may not be privileged enough to make your red list. Look closely and you find the same two token requests every day for months, with no person or agent relying on them. Microsoft Entra recommendations already flag unused applications and unused credentials.

Consent phishing and your consent policy

A small set of controls drastically reduces the chance of a compromise through consent phishing, and the first is a consent policy. Microsoft has revised the defaults several times over the last few years and they are now in a good state, but check yours and tune it for your organization.

Older tenants deserve a second look in both directions. Many organizations turned user consent fully off around 2019, when consent phishing surged and the setting was just on or off. The modern consent policy framework now offers far more granular options, so you can enable the self-service your business needs without opening a hole. Note that changing your consent settings only affects future consent; existing grants stay in place.

The protections you don’t see

Publisher verification is more than a blue checkmark. Microsoft uses it as a signal in several places. By default, multitenant apps registered after November 8, 2020 that don’t have a verified publisher can’t get user consent from other tenants unless they only ask for basic sign-in and profile permissions.

Risk-based step-up consent is another. It’s on by default in every tenant, and when a user consent request looks risky it requires an admin instead, even when the user would normally be allowed to consent. Microsoft built it this way because once a user takes the lure and lands on a consent screen, “the click-through rate on the actual consent prompt was very, very high.” The best defence is to stop them getting there. Microsoft also detects and takes down campaigns that use malicious apps.

Before you grant consent: a checklist

Step-up consent sends more requests to admins, and admins are confused by consent screens too. A short list of scary permissions can look safer than a long list of granular ones. Jeff’s checklist:

1. Sanity check. What is this, why am I being asked, and does it make sense for the business? Many attacks are illogical when you stop to think: you weren’t actually trying to redeem an Uber gift card.

2. Check the publisher. From outside the organization, does it have a verified publisher? From inside, who built it, and do you trust them to maintain a well-secured identity?

3. Read the permissions, not the length. Directory.ReadWrite.All can cover what 15 or 20 granular permissions do. A longer list isn’t necessarily worse.

4. Weigh business value against risk. Access the app doesn’t need, or access whose value doesn’t justify the risk, adds surface area and blast radius. That is the harder conversation, and the important one.

Three places to start

Find out which capabilities your licences give you, because some useful tools are in Microsoft Defender and not every organization has them. Then start on the policy side: stop the problem from getting bigger, turn on right away anything that won’t disrupt existing productivity, and put the disruptive controls in your plan. In parallel, use Microsoft Entra recommendations, Defender, ID Protection and ID Governance to work through the existing debt, starting with the highest-risk and highest-ROI items you can fix with a small set of central actions.

If you want SKU-light places to start, Jeff names three: consent policies, app management policies and Microsoft Entra recommendations (some recommendations have licence requirements).

The same lessons apply to agents

Agent identities follow the same pattern. Microsoft built protections into the core Agent ID model to reduce or remove some of these risks, but some development-friendly options are fine in development and risky in production. Privilege reduction and the rest of this playbook apply to agents just as they do to service principals, so get ahead of your agent portfolio now and manage your whole non-human identity fleet together.

About Jeff Sakowicz

Jeff Sakowicz is a Principal PM Manager on Microsoft Entra, where he leads part of the application platform team: the control plane for non-human identities, including the core data model, APIs and experiences for apps, service principals and Microsoft Entra Agent ID, and how they are configured securely.

In 14 years at Microsoft he has helped build much of the identity platform admins use every day. He started in identity support, moved into program management on the core directory team (including a stint as PM for DirSync), worked on Azure AD Graph and Microsoft Graph, and then spent most of his career leading product work on the application and service principal model and the OAuth permissions and consent model, including publisher verification and risk-based step-up consent.

LinkedIn - https://www.linkedin.com/in/jeffsakowicz/

Related Links

Jeff’s recommended reading (mentioned at 46:03):

• Protect against consent phishing - https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/protect-against-consent-phishing

• Configure how users consent to applications - https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/configure-user-consent?pivots=portal

• Configure app management policies (restrictions on how applications can be configured) - https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/configure-app-management-policies?tabs=portal

• Security best practices for application properties - https://learn.microsoft.com/en-us/entra/identity-platform/security-best-practices-for-app-registration

• What are Microsoft Entra recommendations? - https://learn.microsoft.com/en-us/entra/identity/monitoring-health/overview-recommendations

• Overview of Microsoft Defender for Cloud Apps (mentioned at 47:19) - https://learn.microsoft.com/en-us/defender-cloud-apps/what-is-defender-for-cloud-apps

• Non-human identities in Microsoft Defender (Preview; excludes managed identities and Microsoft first-party apps) - https://learn.microsoft.com/en-us/defender-xdr/investigate-non-human-identities

• Incident response playbooks - https://learn.microsoft.com/en-us/security/operations/incident-response-playbooks

More from the episode:

• Recommendation to remove unused applications (mentioned at 45:29) - https://learn.microsoft.com/en-us/entra/identity/monitoring-health/recommendation-remove-unused-apps

• Recommendation to remove unused credentials from applications (mentioned at 45:29) - https://learn.microsoft.com/en-us/entra/identity/monitoring-health/recommendation-remove-unused-credential-from-apps

• What are workload identities? (mentioned at 28:30) - https://learn.microsoft.com/en-us/entra/workload-id/workload-identities-overview

• Workload identity federation (mentioned at 28:30) - https://learn.microsoft.com/en-us/entra/workload-id/workload-identity-federation

• Publisher verification (mentioned at 33:58) - https://learn.microsoft.com/en-us/entra/identity-platform/publisher-verification-overview

• Configure risk-based step-up consent (mentioned at 35:36) - https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/configure-risk-based-step-up-consent

• Overview of permissions and consent in the Microsoft identity platform (mentioned at 41:34) - https://learn.microsoft.com/en-us/entra/identity-platform/permissions-consent-overview

• Configure the admin consent workflow (does not clean up existing grants) - https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/configure-admin-consent-workflow

• Review permissions granted to enterprise applications - https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/manage-application-permissions

• Get started with app governance in Defender for Cloud Apps (mentioned at 47:19) - https://learn.microsoft.com/en-us/defender-cloud-apps/app-governance-trial-user-guide

• Microsoft actions following attack by nation state actor Midnight Blizzard (mentioned at 42:59) - https://www.microsoft.com/en-us/msrc/blog/2024/01/microsoft-actions-following-attack-by-nation-state-actor-midnight-blizzard

• Midnight Blizzard: guidance for responders on nation-state attack (mentioned at 42:59) - https://www.microsoft.com/en-us/security/blog/2024/01/25/midnight-blizzard-guidance-for-responders-on-nation-state-attack/

• Secure Future Initiative: September 2024 progress update (mentioned at 26:11) - https://www.microsoft.com/en-us/security/blog/2024/09/23/securing-our-future-september-2024-progress-update-on-microsofts-secure-future-initiative-sfi/

• Best practices for Microsoft Entra Agent ID (mentioned at 49:03) - https://learn.microsoft.com/en-us/entra/agent-id/best-practices-agent-id

Related Entra.Chat Episodes

• The Ultimate Guide to App Consent in Microsoft Entra (mentioned at 29:58) - https://entra.news/p/the-ultimate-guide-to-app-consent

• Inside Microsoft’s Entra Tenant: The Internal App Governance Playbook - https://entra.news/p/inside-microsofts-entra-tenant-the

• The Hidden Risks of Non-Human Identities in Your Tenant - https://entra.news/p/the-hidden-risks-of-non-human-identities

Chapters

01:05 Intro

01:23 Meet Jeff Sakowicz

05:04 Prevention starts with policy

07:31 Should your apps get their own tenant?

11:50 Where do you even start?

16:05 Burn down secrets: stop the bleeding

19:47 Why mailboxes are the prize

23:18 Unused identities: the highest ROI

26:33 What actually gets orgs moving

29:16 Consent phishing and your consent policy

33:23 The protections you don’t see

38:13 Before you grant consent: a checklist

43:00 Midnight Blizzard and forgotten tenants

44:08 Low-usage identities in plain sight

45:28 Three places to start

49:03 Agents are next

Podcast Apps

Entra.Chat - https://entra.chat

Apple Podcast - https://entra.chat/apple

YouTube - https://entra.chat/youtube

Spotify - https://entra.chat/spotify

Overcast - https://entra.chat/overcast

Pocketcast - https://entra.chat/pocketcast

Others - https://entra.chat/rss

Merill’s socials

YouTube - youtube.com/@merillx

LinkedIn - linkedin.com/in/merill

Twitter - twitter.com/merill

TikTok - tiktok.com/@merillf

Bluesky - bsky.app/profile/merill.net

Mastodon - infosec.exchange/@merill

Threads - threads.net/@merillf

GitHub - github.com/merill

A stolen refresh token is one of the most useful things an attacker can walk away with. In this week’s Entra Chat episode we dig into what Global Secure Access adds on top of Entra ID to shut that down, from Universal CAE to securing agents.

Some highlights from this week’s issue

👉 The Microsoft Digital Defense Report 2026 is out, plus a community breakdown of the key takeaways
👉 Message Center: passkey support for B2B users, and a reminder to replace memberOf dynamic group rule
👉 Darren Robinson’s two-part series on MCP skills as IAM guardrails for agentic identity lifecycle
👉 A deep dive into a device code phishing campaign
👉 Maester 2.3 is here. Moar products, moar tests! New coverage for GitHub, Azure DevOps, Agent ID, Intune, GSA and macOS
👉 Configuring emergency accounts, accepted risks, custom domains and more lands in Maester Cloud!

Enjoy!

Enjoy!

Sponsored by:

EasyEntra: Empower First-Level Support to Work Efficiently

Managing standard first-level user support in a hybrid environment is overly complex. To handle even basic tasks, your team needs expertise across multiple platforms like ADUC, Exchange on-premises Admin Center, M365 Admin Center, Entra Admin Center, EXO Admin Center, EXO PowerShell, and Entra Connect PowerShell.

EasyEntra eliminates this complexity and allows first-level support to work without headaches:

✅ Intuitive - The interface mimics the familiar AD Users & Computers layout.
✅ Consolidated - Manage all user settings from a single-pane-of-glass.
✅ Responsive - Preloads all properties for lightning-fast navigation of settings.
✅ Reduces junior IT training - Onboard junior IT staff in minutes.
✅ Protects senior IT staff - Prevent first-level support tickets from escalating.

Download Free Trial! →

⚡️ Microsoft

📖 Read

• Microsoft Digital Defense Report 2026

• Pre-authenticated (tempauth) URLs are retiring: move to Microsoft Entra ID tokens before April 1, 2027 • SharePoint Team

• Post-quantum authentication: Why organizations should start testing certificate ecosystems now • Microsoft Security Research

📺 Watch

• 📺 Microsoft Entra Tenant Governance in action: best practices and real-world scenarios • Ben Athawes, Jeff Staiman and Nik Charlebois

🗣️ Message Center

• MC1459133 - Microsoft Entra ID: Passkey support for B2B users

• MC1437671 - Microsoft Entra: Passwordless password change in My Sign-Ins

• MC1450133 - Microsoft Entra: Users can register a passkey or passwordless sign-in as their first multifactor authentication method

• MC1486284 - Microsoft Purview | Data Loss Prevention: Administrative Units support for DLP policies for Microsoft Copilot

• MC1488834 - Microsoft Entra ID: Final reminder to replace MemberOf rule operator configurations by November 3, 2026

From the community…

🚀 Most popular posts from last week

• 🥇 Microsoft Enforces Conditional Access on Outlook Attachments with a Dedicated Entra Application • Karthi

• 🥈 Dynamic PIM role activation picker • Aaron Guilmette

• 🥉 Known EWS Apps that need Allow-Listing or a Migration – with AppIDs • Rudy Mens

Sponsored by:

Get your Entra ID Applications Ready for 2027

Get your Entra ID Applications Ready for 2027
📆If your organization’s 2027 plans include new agents, apps, and SaaS integrations, your Entra tenant will also see more identities, permissions, credentials, and access to govern.

ENow’s Entra ID App Governance Playbook covers the five governance gaps that increase your attack surface and potential blast radius, from over-permissioned applications to expired client secrets that disrupt business operations and productivity. We’ll show you what to triage first, starting with tenant-wide defaults. Follow the playbook over the next 3 months, and you’ll start 2027 with stronger governance and security postures and a foundation for ongoing Entra ID application lifecycle governance.

📖 Inside: Microsoft’s client secret guidance, practical recommendations, and an FAQ you can share with your team.

Download the Free Playbook →

☀️ Learn

👩‍✈️ AI & Copilot

• Agent ID Effective Access: From Inventory to Permission Intelligence • David Alonso Dominguez

🧰 Workload ID

• Securing SharePoint access with Managed Identities and Sites.Selected permission • Damien Van Robaeys

⛑️ ID Protection

• 📺 Your Entra Risk Policies Retired. Here’s What Replaces Them • Jonathan Edwards

👮‍♂️ ID Governance

• My scripts grew up: introducing SiSGovernance • Sandra Saluti

• Users can now manage their sponsored Entra ID guest accounts in My Account (Preview) • Tobias Asböck

• AI MCP Skills as IAM Policy: Guardrails for Agentic Identity Lifecycle Orchestration (Part 1) • Darren Robinson

• AI MCP Skills as IAM Policy: Guardrails for Agentic Identity Lifecycle Orchestration (Part 2) • Darren Robinson

• Zero-trust Microsoft Entra ID • Keith Doolan

🌐 Private Access & Internet Access (GSA)

• Microsoft Entra Global Secure Access: Prompt Injection Protection for Generative AI • Oliver Mueller

• Multiple Traffic Forwarding Profiles for Private Access • Alexander Appelby

🫆 Authentication

• What’s the hardest part of a passwordless rollout? • Michael Duddington

• The authentication debate has a blind spot • Joël Prins

• Key takeaways from the Microsoft Digital Defense Report 2026 • Niklas Tinner

• MFA Passed. The Attacker Still Got In. • Carlos Perez

🤖 DevOps & PowerShell

• Microsoft Graph PowerShell SDK V2.41 Finally Fixes Assembly Clash • Tony Redmond

🚦 Conditional Access

• Zero Trust - Conditional Access Architecture • Guillaume Bossiroy

• 📺 Microsoft Entra Conditional Access Made Easy Complete Beginner Guide 2026 • Andy Malone

🖥️ Devices

• Citrix DaaS – Entra ID SSO in Co-existence with FAS • Julian Jakob

• How to Disable SMTP AUTH in Exchange Online • Ali Tajran

• Inside Intune: Faster compliance updates for Windows devices • Rudy Ooms

🥷 Security

• Borrowing Windows Hello keys for authentication and persistence • Dirk-jan Mollema

• Anatomy of a device code phishing campaign • Nicola Suter

📒 Tenant Configuration

• Five boundaries before an IAM pipeline runs • Felix Elliott

🛍️ External ID - Customers

• Build your own Tenant Portal (with AI, in an afternoon) • Mateusz Jendza

🔥 Maester

• Maester 3.0: a new test engine, and a heads-up for preview users • Merill Fernando

👨🏽‍💻 Merill’s corner

What’s new in Maester Cloud this week

Control which Maester tests run in each tenant, review new tests before they run, record accepted risks properly, and save the views you use every day.

Learn more

• Want to get featured on Entra.News? → Submit your content 😎

• Want us to say nice things about your company? Sponsor entra.news 🤩

• Love the newsletter? Tell us 💚❤️💜

🪃 Acknowledgement of Country

Entra.News is created on Wurundjeri land and acknowledges the traditional owners of country throughout Australia, recognising their continuing connection to land, water and community. We pay our respect to them and their cultures and to elders both past and present.

Compliant network is part of Global Secure Access, and, like source IP restoration, it comes with Entra ID P1. Put the GSA client on your devices, add one Conditional Access policy that blocks access from anywhere outside the All Compliant Network locations named location, and a stolen refresh token or PRT cookie no longer works from the attacker’s own machine. As Alex puts it, the token itself does not become bound, but your use of it is gated by being on your organization’s compliant network.

Merill is joined by two former colleagues who are Microsoft Entra PMs: Alexander (Alex) Pavlovsky from the Global Secure Access feature team, and Marilee Turscak, who works on helping customers adopt AI safely. They explain why Microsoft built networking into identity, walk through the compliant network policy and a BYOD sign-in with no client installed, and demo a network policy that stops an agent from deleting a file its user is allowed to delete.

Why a stolen token stops working

For phishing itself, Alex is clear that the main line of defence is still stronger credentials that do not involve passwords. Compliant network helps with what comes after: the newer attack patterns where refresh tokens are stolen and replayed.

If your tenant-wide policy says you can only authenticate from a compliant network, you can also only replay refresh tokens from a compliant network. PRTs become unusable unless they are used from a device that has GSA, which means your organization’s device. Alex says the same applies to ROADtools-style attacks with PRT cookies: none of that works with compliant network in place. The signal is also tenant-specific. A GSA device in tenant B satisfies compliant network in tenant B and nowhere else.

In the demo, Alex builds the policy in a few clicks: all users, all resources (so the primary refresh token, Entra ID itself and Microsoft Graph are covered), any network except compliant network locations, then block. Start it in report-only mode, watch who is not coming through compliant network, pilot with a smaller group and expand. You do not need the advanced GSA licences for this, but you do need the GSA client on your devices or a remote network sending the traffic.

And exclude your break glass accounts. Alex has taken many panicked customer calls from admins who forgot, and Marilee locked herself out of a test tenant this way recently.

One engine for identity and network

When Merill joined Microsoft, he couldn’t see why networking belonged to the identity team. Alex explains the reasoning. When identity picks up a signal that a user, session or token is at risk, the network has to hear about it quickly, and passing those signals between separate systems through traditional APIs is too slow at this scale. So Microsoft made the identity engine and the network engine one engine.

That design shows up in source IP restoration. Behind a typical proxy or security service edge, every user looks like they signed in from the provider’s shared IP range. GSA sends the user’s original source IP to Entra securely, so sign-in logs are accurate, Conditional Access can evaluate the user’s own IP, and Identity Protection’s location and impossible travel detections work again. It is also why compliant network works at all: the GSA edge shares a security engine with Entra ID, so it can tell Entra that this is a legitimate GSA device from a specific tenant, and Entra can trust that signal.

The network can tell agents from users

“Agents are super deterministic. They are very resourceful. They do not give up.” Alex also argues that saying no to agents means falling behind your competitors, so the question becomes how to protect their use.

GSA can detect when network access comes from an agent, and its policy rules can match on the HTTP method, the destination and whether a user or an agent is acting. Marilee’s baseline recommendation is to block sensitive actions by agents. In her demo, the Zava helper agent tries to remove a document from Dropbox and gets an “agent is not authorized” error, because a policy called “block agents from destructive actions” blocks the DELETE method for agents only. The user checkbox is left clear, so the person can still delete the file themselves. The logs show the same attribution, which Alex says is valuable even before you apply any policy.

Alex also describes Copilot Studio agents running through GSA with no client anywhere. A Copilot Studio admin checks one box to enable the GSA integration, and with Internet Access and a policy in place, that agent traffic flows through GSA and your policies apply.

BYOD without the client

Marilee shows a user on a personal device with no GSA client. When she signs in, she is prompted to switch to her work browser profile, and from then on Explicit Forward Proxy sends that profile’s traffic through GSA. When she tries to open Facebook, she is blocked inside the work profile and nowhere else on her device. Alex sees the managed Edge profile becoming a sandbox with secure network access and Purview DLP, which could reduce the need for remote browser isolation. The full client still gets the most features, including agent detection, and remote networks are a third way to send traffic through GSA.

Universal CAE now acts on device state

Continuous access evaluation used to depend on applications that understood it, which mostly meant SharePoint, Teams and Exchange. Send an app’s traffic through GSA and it becomes CAE-aware too, including private apps. If an admin is on an SSH session over GSA and Entra flags their identity, Alex says the session is dead within about two to five minutes, even if their token is good for another 90 minutes.

The week before recording, Microsoft added device state support. If Intune or a third-party MDM marks a device non-compliant in Entra ID, GSA asks the user to bring it back into compliance or lose network connectivity. User risk changes and device deletion or disablement also trigger it now. If you already run GSA, you get this without changing anything, which is Merill’s favourite kind of feature.

About Alexander Pavlovsky

Alexander Pavlovsky is a Product Manager on the Microsoft Entra Global Secure Access feature team. He has been at Microsoft for 22 years. He started in Microsoft Consulting, installing domain controllers and Exchange servers for customers from CDs, then moved to the identity product team as a customer-facing PM in the Entra GTP (Get To Production) team, later CXE (Customer Experience), helping organizations adopt Azure AD.

LinkedIn - https://linkedin.com/in/alexpav

About Marilee Turscak

Marilee Turscak is a Product Manager on the Microsoft Security team focusing on Microsoft Entra. For the past two years she has focused on getting customers deployed across the Microsoft Entra Suite, and she now works on helping customers adopt AI safely and securely.

LinkedIn - https://linkedin.com/in/marilee-turscak

Related Links

• What is Global Secure Access? - overview and the licensing table for each feature (mentioned at 10:08) - https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access

• Source IP restoration (mentioned at 15:07) - https://learn.microsoft.com/en-us/entra/global-secure-access/how-to-source-ip-restoration

• Universal Conditional Access (mentioned at 15:26) - https://learn.microsoft.com/en-us/entra/global-secure-access/concept-universal-conditional-access

• Universal Tenant Restrictions (mentioned at 15:26) - https://learn.microsoft.com/en-us/entra/global-secure-access/how-to-universal-tenant-restrictions

• Compliant network check with Conditional Access (mentioned at 18:24) - https://learn.microsoft.com/en-us/entra/global-secure-access/how-to-compliant-network

• ROADtools - the Azure AD and Entra ID exploration framework behind many PRT cookie attacks (mentioned at 21:19) - https://github.com/dirkjanm/ROADtools

• BYOD with Global Secure Access (mentioned at 23:30) - https://learn.microsoft.com/en-us/entra/global-secure-access/concept-bring-your-own-device

• Explicit Forward Proxy overview (mentioned at 24:31) - https://learn.microsoft.com/en-us/entra/global-secure-access/concept-explicit-forward-proxy

• Configure Explicit Forward Proxy for Microsoft Edge with Intune (mentioned at 25:06) - https://learn.microsoft.com/en-us/entra/global-secure-access/how-to-configure-explicit-forward-proxy-intune-policy

• WebMCP (mentioned at 27:05) - https://github.com/webmachinelearning/webmcp

• Remote network connectivity (mentioned at 27:54) - https://learn.microsoft.com/en-us/entra/global-secure-access/concept-remote-network-connectivity

• Web filtering, including rules that match on user or agent and HTTP method (mentioned at 29:43) - https://learn.microsoft.com/en-us/entra/global-secure-access/concept-web-filtering

• AI agent discovery (mentioned at 29:43) - https://learn.microsoft.com/en-us/entra/global-secure-access/concept-ai-agent-discovery

• Secure Web and AI Gateway for Copilot Studio agents (mentioned at 34:13) - https://learn.microsoft.com/en-us/entra/global-secure-access/concept-secure-web-ai-gateway-agents

• Set up Global Secure Access for Copilot Studio agents (mentioned at 34:13) - https://learn.microsoft.com/en-us/entra/global-secure-access/how-to-secure-web-ai-gateway-agents

• Tutorial: require a compliant network for Microsoft traffic (mentioned at 39:22) - https://learn.microsoft.com/en-us/entra/global-secure-access/tutorial-microsoft-traffic-compliant-network

• Manage emergency access (break glass) accounts (mentioned at 41:01) - https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/security-emergency-access

• Conditional Access report-only mode (mentioned at 42:52) - https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-report-only

• Universal Continuous Access Evaluation (mentioned at 45:12) - https://learn.microsoft.com/en-us/entra/global-secure-access/concept-universal-continuous-access-evaluation

• Continuous access evaluation in Microsoft Entra ID (mentioned at 45:12) - https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-continuous-access-evaluation

Related Entra.Chat Episodes

• Identity-Centric Network Security: Entra Global Secure Access Architecture & Benefits - https://entra.news/p/identity-centric-network-security

• Global Secure Access Explained: Real-World Rollouts, Mistakes, and Best Practices - https://entra.news/p/global-secure-access-explained-real

• The Ultimate Microsoft Entra Global Secure Access Migration Guide - https://entra.news/p/the-ultimate-microsoft-entra-global

Chapters

00:00 Cold open
01:14 Intro
01:32 Meet Alex and Marilee
05:18 Why networking became part of identity
10:08 How Global Secure Access works
15:07 Source IP restoration
18:24 Compliant network comes with Entra ID P1
19:51 Compliant network vs stolen tokens
21:47 How compliant network actually works
23:30 BYOD without the client
29:43 Telling agents apart from users
31:02 Baseline: block risky agent actions
34:13 Copilot Studio agents through GSA
37:20 Identity and network teams must converge
39:22 Demo: require a compliant network
43:45 What happens to a stolen token
45:12 Universal continuous access evaluation
49:35 Wrap-up

Podcast Apps

Entra.Chat - https://entra.chat

Apple Podcast - https://entra.chat/apple

YouTube - https://entra.chat/youtube

Spotify - https://entra.chat/spotify

Overcast - https://entra.chat/overcast

Pocketcast - https://entra.chat/pocketcast

Others - https://entra.chat/rss

Merill’s socials

YouTube - youtube.com/@merillx

LinkedIn - linkedin.com/in/merill

Twitter - twitter.com/merill

TikTok - tiktok.com/@merillf

Bluesky - bsky.app/profile/merill.net

Mastodon - infosec.exchange/@merill

Threads - threads.net/@merillf

GitHub - github.com/merill

Quick question. Do you know how many secrets your AI coding agent created last month?

That’s what this week’s Entra Chat episode with Arturo Lucatero is about.

Plus the new Microsoft Digital Defense Report, self-hosted Maester Cloud, and I’ll be at Workplace Ninja in Melbourne this month.

Let's dive in.

Sponsored by:

ICYMI - From App Sprawl to Control in Entra ID

As app registrations, service principals, SaaS apps, and third-party integrations accumulate, your workload identity attack surface grows, and visibility gets clouded:

✅ Who owns each application?
✅ What can it access?
✅ Should it still be in your tenant?

Learn practical steps to build stronger workload identity and application governance across the full lifecycle, from onboarding and ownership through permissions, credentials, ongoing review, and offboarding. Get real-world tips and grounded guidance from Entra experts: Merill Fernando, Nicolas Blank, and Alistair Pugin.
Workload identity governance shouldn’t mean more portal hopping, manual reviews, and one-by-one cleanup for already-stretched Entra admins. Get a clear picture of your app estate & what deserves your attention first.

Watch on Demand →

⚡️ Microsoft

🔥 Public Preview

• Sign in to Microsoft apps with passkeys from external identity providers • Justin Ploegert

📖 Read

• Insights from the 2026 Microsoft Digital Defense Report • Terrell Cox

• Star Blizzard refines phishing and malware delivery with the RedFlick technique • Microsoft Threat Intelligence

• Phishing Abuses RMM Tools for Persistent Access • Microsoft Security Research

📆 Upcoming Events

• ​​Secure what’s next: Your guide to Microsoft Security at Microsoft Ignite 2026 • Lindsay Myers

From the community…

🚀 Most popular posts from last week

• 🥇 Where to store your Microsoft 365 passkey? • Jan Bakker

• 🥈 Synced Passkeys Appearing in Entra? Was SMS the reason? • Shane Mallia

• 🥉 Governing Exchange Distribution Lists with Entra ID (The No-Secrets Way) • Sandra Saluti

☀️ Learn

👩‍✈️ AI & Copilot

• AI Agents Are Joining Your Microsoft 365 Tenant. Is Your Security Model Ready? • Shaun Hardneck

🧰 Workload ID

• Service Principals Are Identities Too • Shaun Hardneck

👮‍♂️ ID Governance

• Escalating Privileges as a Catalog Owner: How Microsoft Entra Identity Governance’s API Permission Management Could Be Abused • Thomas Naunheim

• Dynamic PIM role activation picker • Aaron Guilmette

🌐 Private Access & Internet Access (GSA)

• Microsoft Global Secure Access (GSA) Traffic Forwarding Profiles v2 • Richard M. Hicks

• Global Secure Access – Multiple Traffic Forwarding profiles for Private Access is finally here! • Michael Morten Sonne

• Entra ID – Use Microsoft managed PKI for TLS inspection with GSA • Benoit HAMET

• How to control AI with GSA • Niklas Tinner

Sponsored by:

Maester Cloud is now available to self-host!

Maester Cloud is the portal companion to Maester. It runs in your own Azure subscription, and a guided setup gets you started.

• Scheduled runs, plus drift tracking for every test

• Email reports and alerts, with no Mail.Send permission granted in Entra

• Your data stays in your Azure subscription, in the region you pick

It’s $99/month or $1,188/year, and also available on Azure Marketplace.

👉 Get started

📦 Apps

• Known EWS Apps that need Allow-Listing or a Migration – with AppIDs • Rudy Mens

• 📺 From App Registrations to Managed Identity: Identity Patterns for Secure Automation • Microsoft Community Learning

🫆 Authentication

• Microsoft Entra Passkey Registration with WebAuthn: Handling Authenticator and App Protection Conditional Access Challenges • Sreejith Reghunathan Pillai

👥 User & Group Management

• How Purview extends administrative units to support SharePoint Online sites • Vasil Michev

• Entra/Office 365 - Group based license assignments failing • Benoit HAMET

🚦 Conditional Access

• Microsoft Enforces Conditional Access on Outlook Attachments with a Dedicated Entra Application • Karthi

🖥️ Devices

• Modernizing Shared Devices: Inside Microsoft’s New Passwordless Teams Resource Accounts • Colby Pryor

• Android & macOS support for in-session passwordless authentication (Preview) • Flavio Meyer

♻️ Sync

• Entra SCIM MCP v0.3.0 updates for changes to the Entra SCIM API • Darren Robinson

📒 Tenant Configuration

• How to disable SMTP Authentication in Microsoft365 • Liam Robinson

🔥 Maester

👨🏽‍💻 Merill’s corner

• Want to get featured on Entra.News? → Submit your content 😎

• Want us to say nice things about your company? Sponsor entra.news 🤩

• Love the newsletter? Tell us 💚❤️💜

🪃 Acknowledgement of Country

Entra.News is created on Wurundjeri land and acknowledges the traditional owners of country throughout Australia, recognising their continuing connection to land, water and community. We pay our respect to them and their cultures and to elders both past and present.

That would undo a lot of hard work. Under Microsoft’s Secure Future Initiative, Microsoft spent years removing secrets from its own estate and helping customers do the same with managed identities and workload identity federation. The agent era is the window to make secretless the default before the habit sets in.

Arturo is a Principal Product Manager on Microsoft Entra Agent ID, and he helped launch Managed Service Identity, the feature we now call Managed Identities for Azure resources. In this episode he and Merill trace the whole path: why secrets break, how managed identity takes them away inside Azure, how workload identity federation extends that to AWS, GCP, Azure Arc and now AI vendors like Anthropic, and what that means for agents.

Secrets work until they don’t

A service principal with a client secret works. It works right up to the moment it gets leaked, expires in the middle of an important job, or turns out to have no clear owner, no rotation plan and no one who knows where it is stored. Managed identity moves that whole burden to the platform. The secret still exists, but the developer never sees it. The admin’s job shrinks to control-plane questions: which resource, which identity, and what it can access. Arturo also hints at what comes next: binding managed identity tokens to the resource so a leaked token is useless anywhere else.

Beyond Azure

Not every workload or data source lives in Azure. Workload identity federation lets a workload present a token from an identity provider you already trust, such as AWS, Google Cloud, GitHub or Kubernetes, and exchange it for an Entra token with no secret involved. Azure Arc brings managed identity to servers outside Azure, including the one under your desk, which raised a hard design question for the team: what happens to the secret when the machine is in someone’s basement?

Coding agents default to secrets

Coding agents learned from years of examples full of client secrets and Key Vault plumbing, so that is what they produce. Merill has to push his own agents back towards workload identity federation every time. Arturo hit the same problem from the inside: when he asked a coding agent to build with Agent ID, it created a plain service principal and named it “blueprint”. The fix was rewriting documentation and shipping agent skills that teach coding agents the right pattern.

Why agent identities still allow client secrets

Merill asks the obvious question. If secrets are this bad, why can an agent identity have one? Arturo’s answer is compatibility. Agent identities already authenticate through a federated identity credential flow under the hood, but many places that call agents cannot obtain an OIDC token yet. Without secrets or certificates as a fallback, people would simply keep using app registrations.

Open standards are the way out

Agents now cross identity providers and clouds every day. Entra is leaning on open standards so they can do that without secrets or interrupting users: SPIFFE identities that can be exchanged for Entra tokens, and ID-JAG, which lets admins pre-consent so an agent can reach a service like GitHub or Slack without prompting the user.

Is Each App in Entra ID Still Worth Governing?

App registrations and enterprise applications accumulate. Owners change. Projects and pilots end. Credentials linger. And stale or unused apps and their permissions can continue adding risk and governance overhead long after their purpose is gone.

ENow App Governance Accelerator helps you understand and act on:

• What is in your Entra ID application estate

• Who owns business and technical decisions and management?

• Which apps, permissions, and credentials need attention?

• What can be safely cleaned up to reduce your attack surface on a continuous basis as your tenant grows and changes?

Get the visibility and automated workflows you need to investigate application lifecycles at scale, clear out stale apps, and stop wasting time governing applications that shouldn’t still be there in the first place.

See it in Action

Subscribe with your favorite podcast player or watch on YouTube

About Arturo Lucatero

Arturo Lucatero is a Principal Product Manager at Microsoft working on Microsoft Entra Agent ID, where he focuses on giving agents a strong, governable identity and on the developer experience for building with it, including skills that teach coding agents to use Agent ID correctly. He joined Microsoft’s identity team after a re-org moved him there from Power BI, worked on Connect Health, and then helped Stuart Kwan launch Managed Service Identity, now managed identities for Azure resources. Most of his career has been spent modernising non-human identities, from managed identity and Azure Arc to workload identity federation.

LinkedIn - https://www.linkedin.com/in/arturo-lucatero/

Related Links

• Microsoft Entra Agent ID skill for coding agents, in GitHub Copilot for Azure (mentioned at 32:52) - https://github.com/microsoft/GitHub-Copilot-for-Azure/blob/main/plugins/azure-skills/skills/entra-agent-id/SKILL.md

• AI-guided setup for Microsoft Entra Agent ID, using the skill with GitHub Copilot (mentioned at 32:52) - https://learn.microsoft.com/en-us/entra/agent-id/agent-id-ai-guided-setup

• Ben Reader: Access Azure Key Vault from a local Kubernetes cluster with Azure Arc workload identity (mentioned at 22:32) - https://powers-hell.com/2026/08/26/access-azure-key-vault-from-a-local-kubernetes-cluster-with-azure-arc-workload-identity

• Ben Reader: Run a PowerShell workload on a local Kubernetes cluster that talks to Microsoft Graph (mentioned at 22:32) - https://powers-hell.com/2026/09/08/run-a-powershell-workload-on-a-local-kubernetes-cluster-that-talks-to-microsoft-graph

• Managed identities for Azure resources, formerly Managed Service Identity (mentioned at 04:50) - https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/overview

• Workload identity federation (mentioned at 15:18) - https://learn.microsoft.com/en-us/entra/workload-id/workload-identity-federation

• Workload Identity Federation for the Claude API (mentioned at 16:27) - https://platform.claude.com/docs/en/manage-claude/workload-identity-federation

• Agent identity blueprints in Microsoft Entra Agent ID (mentioned at 20:35) - https://learn.microsoft.com/en-us/entra/agent-id/agent-blueprint

• Access Azure resources with managed identity on Azure Arc-enabled servers (mentioned at 23:09) - https://learn.microsoft.com/en-us/azure/azure-arc/servers/managed-identity-authentication

• SPIFFE and SPIRE (mentioned at 27:41) - https://spiffe.io/

• Federate a SPIFFE/SPIRE workload identity with Microsoft Entra ID (mentioned at 29:25) - https://learn.microsoft.com/en-us/entra/workload-id/workload-identity-federation-spiffe-spire

• Pieter Kasselman: SPIFFE at the BotAuth BoF, IETF 123 (mentioned at 29:53) - https://datatracker.ietf.org/meeting/123/materials/slides-123-webbotauth-spiffe-at-the-botauth-bof-pieter-kasselman-00

• Identity Assertion JWT Authorization Grant (ID-JAG), IETF draft (mentioned at 30:21) - https://datatracker.ietf.org/doc/draft-ietf-oauth-identity-assertion-authz-grant/

• Microsoft Secure Future Initiative (mentioned at 06:30) - https://www.microsoft.com/en-us/trust-center/security/secure-future-initiative

Related Entra.Chat Episodes

• One Compromised Agent ID Blueprint Can Cross Tenant Boundaries - https://entra.news/p/one-compromised-agent-id-blueprint

• From Windows Core to Leading Agent ID: Vince Smith’s Microsoft Story - https://entra.news/p/from-windows-core-to-leading-agent

• Attackers Are Targeting the AI Ecosystem You Cannot See - https://entra.news/p/attackers-are-targeting-the-ai-ecosystem

Chapters

00:00 Intro
01:19 Arturo’s path from Intel to identity
04:50 Launching Managed Service Identity
07:06 Why MSI became managed identities
09:41 How managed identity removes the secret
14:31 Beyond Azure: workload identity federation
17:08 Coding agents and the new secret sprawl
20:01 When a coding agent fakes an Agent ID blueprint
22:32 Managed identity anywhere with Azure Arc
24:42 Why agent identities still allow client secrets
27:41 Open standards: SPIFFE and ID-JAG
31:48 What developers should do today

Podcast Apps

Entra.Chat - https://entra.chat

Apple Podcast - https://entra.chat/apple

YouTube - https://entra.chat/youtube

Spotify - https://entra.chat/spotify

Overcast - https://entra.chat/overcast

Pocketcast - https://entra.chat/pocketcast

Others - https://entra.chat/rss

Merill’s socials

YouTube - youtube.com/@merillx

LinkedIn - linkedin.com/in/merill

Twitter - twitter.com/merill

TikTok - tiktok.com/@merillf

Bluesky - bsky.app/profile/merill.net

Mastodon - infosec.exchange/@merill

Threads - threads.net/@merillf

GitHub - github.com/merill

🚨 17 trillion records. That's how many Microsoft records one researcher says they could have accessed. It's a good reminder that apps and service principals are identities too, and they're often the least-watched ones in the tenant. Microsoft's own write-up on Storm-3168 abusing compromised service principals makes the same point. I shared a few practical steps for locking down the apps in your tenant in this LinkedIn post. Worth a read before your next app review.

Enjoy!

Sponsored by:

EasyEntra: Empower First-Level Support to Work Efficiently

Managing standard first-level user support in a hybrid environment is overly complex. To handle even basic tasks, your team needs expertise across multiple platforms like ADUC, Exchange on-premises Admin Center, M365 Admin Center, Entra Admin Center, EXO Admin Center, EXO PowerShell, and Entra Connect PowerShell.

EasyEntra eliminates this complexity and allows first-level support to work without headaches:

✅ Intuitive - The interface mimics the familiar AD Users & Computers layout.
✅ Consolidated - Manage all user settings from a single-pane-of-glass.
✅ Responsive - Preloads all properties for lightning-fast navigation of settings.
✅ Reduces junior IT training - Onboard junior IT staff in minutes.
✅ Protects senior IT staff - Prevent first-level support tickets from escalating.

Download Free Trial!

⚡️ Microsoft

🔥 Public Preview

• What’s new in Microsoft Security: September 2026​​ • Alym Rayani

📖 Read

• Unmasking EvilTokens: Getting to the root of device code phishing • Microsoft Threat Intelligence and Microsoft Security Research

• Storm-3168: Agentic-driven cloud attacks using compromised service principals • Microsoft Security Research

🗣️ Message Center

• MC1478465 - Security Copilot is now included as part of your Microsoft 365 E5/E7 plan

📆 Upcoming Events

• Prepare your tenant estate for AI: Join our upcoming webinars • Hien Nguyen

  • Microsoft Entra Tenant Governance in action: Best practices and real-world scenarios - October 6, 2026 ⏰ 9:00 AM–10:00 AM Pacific Time

From the community…

🚀 Most popular posts from last week

• 🥇 Microsoft delays Entra SMS and voice retirement dates • Daniel Bradley

• 🥈 Building a Modern Conditional Access Strategy: The Identity Firewall Your Organization Actually Needs • Colby Pryor

• 🥉 Finally a smooth(er) passkey onboarding experience in Microsoft 365! • Jan Bakker

Sponsored by

Maester tells you what’s failing today. Maester Cloud tells you what changed. Every Maester run lands in one portal, so new failures, fixes, and drift across every tenant surface on their own, with no more diffing old HTML reports.

• Drift alerts emailed from your own Microsoft 365 mailbox

• 5+ years of run history as audit evidence, for unlimited tenants and users

$99/month, self-hosted in your own Azure subscription with guided setup in minutes. Cancel any time. Every subscription funds the free, open-source Maester core.

Start Maester Cloud for $99/month

☀️ Learn

👩‍✈️ AI & Copilot

• Security Copilot is now included as part of Microsoft 365 E5/E7 • Daniel Bradley

• 📺 Agent ID: Why AI Agents Need Their Own Identity • Rio Hindle

👮‍♂️ ID Governance

• Governing Exchange Distribution Lists with Entra ID (The No-Secrets Way) • Sandra Saluti

🌐 Private Access & Internet Access (GSA)

• 📺 Global Secure Access Failure States, Maester 2.2 Active Directory Checks, and OpenAI Misalignment • Cloudy with a Chance of Insights, The MSFT Podcast

🫆 Authentication

• Synced Passkeys Appearing in Entra? Was SMS the reason? • Shane Mallia

• (Mis)understanding Software OATH token in Entra • Dániel Kovács

• Where to store your Microsoft 365 passkey? • Jan Bakker

• Entra ID telephony providers for SMS and voice MFA: first look • Jan Bakker

• Passkeys on the laptop are easy. The phone? Not so much! • Per-Torben Sorensen

• How to Run a Passkey Registration Campaign in Entra ID • Kavya

• SMS and Voice Retirement, Part 1 • Jonathan Hope

• SMS and Voice Retirement, Part 2 • Jonathan Hope

• 📺 How to Fix Entra Passkey Registration on BYOD [Walkthrough] • Ru Campbell

• 📺 How to Opt Out of the Entra ID Passkey Registration Campaign with Microsoft Graph • Steven Weiner

👥 User & Group Management

• What is dynamicMembershipPriority for Entra Groups? • Daniel Bradley

• Permission update for the AI Administrator role in Entra ID • Tobias Asböck

• Security operator permission change • Jay Kerai

🤖 DevOps & PowerShell

• Graph API adds (limited) support for onPremisesExtensionAttributes for group objects • Vasil Michev

• How to Use Separate Apps to Control Access to the Microsoft Graph PowerShell SDK • Tony Redmond

🚦 Conditional Access

• Context-based Redirections (Preview): Smarter Security for Every Remote Session • Flavio Meyer

• Microsoft Entra Token Protection for Browsers: Same Key, Wrong Car • Dustin Gullett

• Entra Protected Actions | Putting Guardrails Around Your Most Critical Admin Tasks • Michael Vink

• Conditional Access Emergency Bypass: When an Exclusion Needs to Work Now • Marco Wohler

🥷 Security

• How I Could’ve Accessed 17 Trillion Microsoft Records • Faav

♻️ Sync

• Entra ID – New version of Entra ID Connect (2.6.91.0) is available with migration workflow to Entra ID Cloud Sync • Benoit HAMET

• 📺 Time to Switch? Migrate from Entra Connect to Cloud Sync FULL DEMO! • Andy Malone

📒 Tenant Configuration

• New Entra event hints at account takeover controls • Daniel Bradley

• Granular Delegated Administrative Privileges (GDAP) – where is it not supported/working correctly? • Michael Morten Sonne

• How Easy is It to Restore Microsoft 365 Tenants After a Catastrophic Attack • Tony Redmond

⚒️ Toolkit

• Where to store your Microsoft 365 passkey? • Jan Bakker

🔥 Maester

• Beyond Baselines: Building Custom Identity Security Testing with Maester and PowerShell • Sam Erde, Merill Fernando

👨🏽‍💻 Merill’s corner

• Want to get featured on Entra.News? → Submit your content 😎

• Want us to say nice things about your company? Sponsor entra.news 🤩

• Love the newsletter? Tell us 💚❤️💜

🪃 Acknowledgement of Country

Entra.News is created on Wurundjeri land and acknowledges the traditional owners of country throughout Australia, recognising their continuing connection to land, water and community. We pay our respect to them and their cultures and to elders both past and present.

Passkeys, passkeys, passkeys. The message center is full of them again this week. We’ve rounded them up below, plus posts from the community breaking down what each one actually means for your tenant.

And don’t miss this week’s episode. Sam Erde and Michael Soule joined me to talk Active Directory security testing in Maester 2.2.

Enjoy!

Sponsored by:

Announcing AI Red Team Tactics for M365, Copilot & Enterprise AI (AltSec CAIRTP)

Altered Security’s CAIRTP is a beginner friendly course designed for information security professionals looking to attack and secure AI across Microsoft 365 and Azure environments.

Course Highlights:

• Attack & defend Copilot & Agent Identities

• Abuse Agent Attack Surfaces in the Microsoft AI ecosystem

• Practice advanced attacks beyond prompt injection

• Abuse AI Identities & evade AI guardrails

• Perform hands-on attacks in real-world scenarios

Participants who complete the course and pass the exam can earn the Altered Security Certified AI Red Team Professional (AltSec CAIRTP) certification.

Key Dates & Information:
Live Bootcamp Starts: November 20, 2026 (4-Week Duration)

On-Demand Course: Planned for mid-December 2026

Learn more

⚡️ Microsoft

🔥 Public Preview

• Migrate to Microsoft Entra Cloud Sync with the migration tool

• Public preview of self-service onboarding for new Microsoft Entra App Gallery applications • Hilda Kinyunyu

• Simplify Employee Identity Lifecycle with HiBob and Microsoft Entra • Udi Milo

📖 Read

• From guidance to action: Security fundamentals that materially reduce risk • Ron Pessner

• Replace VPN access with identity-driven security • Sule Tatar

🗣️ Message Center

• MC1426371 - Microsoft Entra: Passkeys by default and retirement of Microsoft-provided SMS and voice authentication

• MC1450133 - Microsoft Entra: Users can register a passkey or passwordless sign-in as their first multifactor authentication method

• MC1459133 - Microsoft Entra ID: Passkey support for B2B users

• MC1474104 - Microsoft Entra ID: Follow-up on SMS first-factor sign-in retirement and upcoming changes

Sponsored by:

Turn Entra ID App Risk Counts into a Fix List

The free AppGov Score tells you how many risky applications are in your Entra ID tenant (among 24 other risk checks). But a number alone does not tell you which apps or configurations need attention.

With a 7-day AppGov Accelerator trial from ENow, you can see the named applications behind those risk counts, the permissions they hold, and the governance context you need to prioritize remediation. You’ll also gain access to:

• Daily tenant scans to track progress and changes 📈

• Expanded visibility and dashboard access ➕

• Alerts for client secrets and certificate expirations ⚠️

Start your trial by obtaining your AppGov Score and scheduling a quick activation call. Request your Score today!

Access your Trial

From the community…

🚀 Most popular posts from last week

• 🥇 New feature in PIM - fire custom extensions on role activation • Stian A. Strysse

• 🥈 Entra ID Continuous Access Evaluation and Microsoft 365 • Tony Redmond

• 🥉 Microsoft Entra expands passkey registration campaigns • Daniel Bradley

☀️ Learn

👩‍✈️ AI & Copilot

• Entra Auth Tracer + WebMCP – Letting an AI Agent Debug Your Authenticaiton Traffic • Darren Robinson

• 📺 New Agent 365 controls for Microsoft admins • Microsoft Mechanics

🧰 Workload ID

• Reading Microsoft Entra ID Groups Across Tenants with a Managed Identity as a Federated Credential • Constantin Hager

🌐 Private Access & Internet Access (GSA)

• Entra Internet Access • Michael Frank

• Locking down PAWs internet access when GSA drops • Christian Friedel-Jain

📦 Apps

• Active Directory Security Testing in Maester 2.2 • Merill Fernando

🫆 Authentication

• Microsoft delays Entra SMS and voice retirement dates • Daniel Bradley

• Finally a smooth(er) passkey onboarding experience in Microsoft 365! • Jan Bakker

• 📺 Already Have WHfB? Why Entra Wants a Passkey Anyway! • Azure Brother

👥 User & Group Management

• Microsoft adds basic permissions for groups in Graph • Daniel Bradley

🤖 DevOps & PowerShell

• Microsoft Starts Twelve-Month Retirement of Windows PowerShell Support for Graph SDK • Tony Redmond

🚦 Conditional Access

• Building a Modern Conditional Access Strategy: The Identity Firewall Your Organization Actually Needs • Colby Pryor

🖥️ Devices

• 📺 Hybrid Explained: Your Domain PCs Can Run Intune • Jonathan Edwards

🥷 Security

• Cached Token Theft: Extracting Azure and Microsoft Graph Refresh Tokens from the macOS Keychain via PowerShell • Thomas Naunheim

• Continuous Access Evaluation: Is it really tho? | CirriusTech • Graham Gold

• 📺 This Simple Entra ID Change Can Reduce Your Attack Surface • Rio Hindle

♻️ Sync

• Microsoft Entra Connect Sync – Passwordless Authentication is now GA, plus the new Entra Connect Migration Tool is here! (v2.6.91.0) • Michael Morten Sonne

• 📺 Hybrid Identity Deep Dive: Microsoft Entra Cloud Sync Writeback to Active Directory • Colby Pryor

👨🏽‍💻 Merill’s corner

• Want to get featured on Entra.News? → Submit your content 😎

• Want us to say nice things about your company? Sponsor entra.news 🤩

• Love the newsletter? Tell us 💚❤️💜

🪃 Acknowledgement of Country

Entra.News is created on Wurundjeri land and acknowledges the traditional owners of country throughout Australia, recognising their continuing connection to land, water and community. We pay our respect to them and their cultures and to elders both past and present.

Maester, the open-source PowerShell testing framework, added Active Directory coverage: 269 opt-in checks across 19 areas, from users, groups, computers and service principal names through GPO state, DACLs, DNS, trusts, replication and schema. They run against your domain, not your tenant, and they are off unless you explicitly connect to Active Directory.

Mike Soule, who wrote and validated that test suite, and Sam Erde, Microsoft MVP and author of DLLPickle, join Merill at HIP Conf in Nashville to go through what the tests cover, how to run them safely, and where the project is heading.

Sponsored by:

Is Each App in Entra ID Still Worth Governing?

App registrations and enterprise applications accumulate. Owners change. Projects and pilots end. Credentials linger. And stale or unused apps and their permissions can continue adding risk and governance overhead long after their purpose is gone.

ENow App Governance Accelerator helps you understand what’s in your Entra ID application estate, who owns it, which apps, permissions, and credentials need attention, and what can safely be cleaned up to reduce your attack surface on a continuous basis as your tenant grows and changes.

Get the visibility and automated workflows you need to investigate application lifecycles at scale, clear out stale apps, and stop wasting time governing applications that shouldn’t still be there in the first place.

See ENow AppGov in Action

Operational health is not the same as a security finding

The design decision that makes these tests usable is the split between operational patterns and security controls. Six groups nested in a row is not a vulnerability. Nesting is an intentional, functional capability. It is also nearly impossible to reason about when you are trying to work out where a permission actually comes from, and that is how incidents happen.

So not every test is pass/fail. Some exist to be investigated and monitored, and Maester’s tagging lets you baseline them and watch whether an anti-pattern is spreading or receding over time. The underlying guidance is a blend: years of health checks across dozens of forests, community research from teams like Semperis and SpecterOps, and Microsoft’s own documentation — which, for a product people keep declaring dead, is currently some of the best documentation and logging Microsoft ships. The new NTLM auditing in Windows Server is the example: the who, the why and the where of every NTLM authentication, instead of replaying events and correlating them yourself.

Maester is not trying to replace the likes of PingCastle, Purple Knight or Locksmith. Those tools offer real value, and the conversation now is about bringing those perspectives into one central platform.

The permissions you actually need

Everything the AD tests do is read-only. A plain domain user gets a surprising amount, because a directory is built to be readable — you will simply get a subset of the tests. The full set needs tier-zero read access, because some tests reach objects in the configuration container. In a tiered environment, that means running as a tier-zero admin from a privileged admin workstation.

Interactively, there is nothing to set up beyond line of sight to a domain controller, the ActiveDirectory module and PowerShell. The AD tests are excluded by default and have to be requested by tag. For automation, run a local runner, or give a container runtime a path back to a domain controller. Today the tests run as the logged-in user’s domain credentials; alternate credentials and group managed service accounts are on the road map.

Tiering, ESAE and the enterprise access model

There are no explicit tiering tests yet, but they are coming now that Microsoft has published implementation guidance. The history is worth knowing. ESAE — the Enhanced Security Admin Environment, the red forest — solved a real problem: inside Active Directory, a domain admin is trusted implicitly, so the source of authority needs to sit somewhere that is not self-referential. A separate management forest achieves that, at a cost in operational complexity that most organisations could not sustain. Microsoft has since moved to the enterprise access model, and in practice most teams landed in the middle: tiering based on access control, with tier zero for core identity infrastructure, tier one for servers, databases and applications, and tier two for workstations and the workforce.

The advice is not all-or-nothing. Any amount of effort you put into tiering is a good investment. Where Maester helps is codifying Microsoft’s recommended implementation as tests you can actually check yourself against, including the DACL and inheritance anti-patterns that accumulate through ordinary operations.

What is coming next

The dependency on the ActiveDirectory PowerShell module is on its way out. Almost all of this work is LDAP-level, so a .NET-based approach covers the vast majority of tests with no module dependency — which opens up Linux, macOS and non-domain-joined machines. Multi-domain aggregation is in progress; today a run covers a single domain at a time. And Maester 3 is being planned around a new engine for the built-in tests, with multi-threading and parallel execution, licensing handled centrally instead of inside every test, and Pester retained for backward compatibility and custom tests.

Subscribe with your favorite podcast player or watch on YouTube

About Michael Soule

Mike Soule is a Maester co-maintainer and National Director of Enterprise Architecture at Sentinel Technologies, where he works with enterprise customers on identity, cloud and security. He wrote and validated the Active Directory test suite that shipped in Maester 2.2 — 269 opt-in checks across 19 areas — and has been the project’s leading test contributor since the night after Maester’s launch talk at the PowerShell Conference, when he turned up the next morning with roughly thirty CISA tests already written.

LinkedIn - https://www.linkedin.com/in/mikesoule/

GitHub - https://github.com/soulemike

About Sam Erde

Sam Erde is a Maester co-maintainer and a Microsoft MVP, working at Patriot Consulting. He has spent more than twenty years in PowerShell, Active Directory, Group Policy, Exchange and Microsoft 365, contributes to open-source defensive tooling including Locksmith, and wrote DLLPickle, the module that gets you out of assembly version conflicts when several Microsoft modules are loaded in one session.

LinkedIn - https://www.linkedin.com/in/samerde/

GitHub - https://github.com/SamErde

Related Links

• Maester - open-source PowerShell test automation for Microsoft 365, Entra and now Active Directory (mentioned at 00:21) - https://maester.dev

• Introducing Maester 2.2 - the release that added 269 opt-in Active Directory checks across 19 areas (mentioned at 04:50) - https://maester.dev/blog/maester-2-2/

• Active Directory security testing in Maester - what the tests cover and how to run them (mentioned at 04:50) - https://maester.dev/blog/active-directory-security-testing/

• Maester on GitHub - source, tests and contribution guide (mentioned at 03:44) - https://github.com/maester365/maester

• Locksmith - Jake Hildreth’s AD CS assessment and remediation tool (mentioned at 05:11) - https://github.com/jakehildreth/Locksmith

• NTLM auditing enhancements in Windows 11 24H2 and Windows Server 2025 (mentioned at 09:53) - https://support.microsoft.com/en-us/topic/overview-of-ntlm-auditing-enhancements-in-windows-11-version-24h2-and-windows-server-2025-b7ead732-6fc5-46a3-a943-27a4571d9e7b

• AD DS tier model for privileged access security (mentioned at 24:47) - https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/tier-model

• Securing privileged access - the enterprise access model that replaced ESAE (mentioned at 25:23) - https://learn.microsoft.com/en-us/security/privileged-access-workstations/privileged-access-access-model

• DLLPickle - Sam Erde’s module for PowerShell assembly version conflicts (mentioned at 16:16) - https://github.com/SamErde/DLLPickle

• HIP Conference - Hybrid Identity Protection, Nashville, where this episode was recorded (mentioned at 01:18) - https://www.hipconf.com/

• PowerShell DSC (mentioned at 31:34) - https://learn.microsoft.com/en-us/powershell/dsc/overview

Chapters

00:00 Intro

00:40 Is Active Directory dead?

01:41 How Maester started and Mike’s overnight tests

04:50 Active Directory tests in Maester 2.x

05:03 How Maester compares to PingCastle and Locksmith

07:03 Operational health checks vs security findings

08:43 Where the AD guidance comes from

11:12 Running the tests and the permissions you need

13:53 Dropping the ActiveDirectory PowerShell module

15:18 One report for AD and cloud plus a Maester 3 teaser

17:20 Performance and memory in very large forests

20:23 Never run it on a domain controller

23:03 Multi-domain and multi-forest scans

24:14 Testing AD tiering and the enterprise access model

28:02 Beyond AD: DNS and Windows Server roles

28:50 Validating GPOs and desktop builds with Maester

31:25 Maester vs DSC and config-as-code

35:49 AD is not dead

Podcast Apps

Entra.Chat - https://entra.chat

Apple Podcast - https://entra.chat/apple

YouTube - https://entra.chat/youtube

Spotify - https://entra.chat/spotify

Overcast - https://entra.chat/overcast

Pocketcast - https://entra.chat/pocketcast

Others - https://entra.chat/rss

Merill’s socials

YouTube - youtube.com/@merillx

LinkedIn - linkedin.com/in/merill

Twitter - twitter.com/merill

TikTok - tiktok.com/@merillf

Bluesky - bsky.app/profile/merill.net

Mastodon - infosec.exchange/@merill

Threads - threads.net/@merillf

GitHub - github.com/merill

Apologies for the slightly late newsletter this week. I had way too much fun at the HIP Conference in Nashville, managed to pick up a bug on the way home, and I’m only just recovering from all the excitement 😀

Don’t forget to check out this weeks podcast with none other than the ‘Yoda of Microsoft Entra’ Tarek Dawoud, sharing some deep insights into AD and Entra.

Enjoy!

Sponsored by:

EasyEntra: Empower First-Level Support to Work Efficiently

Managing standard first-level user support in a hybrid environment is overly complex. To handle even basic tasks, your team needs expertise across multiple platforms like ADUC, Exchange on-premises Admin Center, M365 Admin Center, Entra Admin Center, EXO Admin Center, EXO PowerShell, and Entra Connect PowerShell.

EasyEntra eliminates this complexity and allows first-level support to work without headaches:

✅ Intuitive - The interface mimics the familiar AD Users & Computers layout.

✅ Consolidated - Manage all user settings from a single-pane-of-glass.

✅ Responsive - Preloads all properties for lightning-fast navigation of settings.

✅ Reduces junior IT training - Onboard junior IT staff in minutes.

✅ Protects senior IT staff - Prevent first-level support tickets from escalating.

Download Free Trial!

⚡️ Microsoft

📖 Read

• Passkey-themed social engineering leads to identity and cloud compromise • Microsoft Security Research

• Protecting organizations from AI-assisted executive impersonation and invoice fraud • Microsoft Security Research

🗣️ Message Center

• MC1469555 - Microsoft Entra: Optimized passkey registration campaign experience

• MC1470871 - Microsoft Graph: User.ReadBasic.All will no longer allow reading user app role assignments and license details

• MC1181769 - Microsoft Purview: Integration with Entra GSA Internet Access to enable sensitive file filtering at the network layer

Sponsored by:

Retiring MIM? Modernise identity sync with DirSync

Microsoft Identity Manager (MIM) is approaching end of life in 2029, leaving many organisations searching for a modern, supported approach to directory synchronisation even in complex and disconnected environments. If you’re still relying on MIM, now is the time to start planning your transition.

PowerSyncPro DirSync is a low-maintenance alternative designed for modern identity environments. Synchronise users, groups, contacts, passwords, and SID history across Active Directory, Microsoft Entra ID and Google Workspace, supporting coexistence, mergers, acquisitions, and large-scale transformation projects.

With advanced matching, attribute rewriting, What-If reporting and near real-time synchronisation, DirSync helps reduce operational overhead while giving IT teams greater control and visibility.

Learn more about PowerSyncPro DirSync or read our blog.
See how PowerSyncPro DirSync can help you move beyond MIM.

Book a Demo

From the community…

🚀 Most popular posts from last week

• 🥇 Passkey as first MFA method: What could go wrong? • Per-Torben Sorensen

• 🥈 How to Block Personal Windows Devices in Microsoft Intune • Mark Oldham

• 🥉 The magic of Agent Identities in Microsoft Entra • Gabe Corsini

☀️ Learn

👩‍✈️ AI & Copilot

• AI Agents as Non-Human Identities: Why Autonomy Changes the Governance Problem • Sameer Bhanushali

• Blueprint Inheritance Abuse in Entra Agent ID • Elli Shlomo

🧰 Workload ID

• Entra ID Continuous Access Evaluation and Microsoft 365 • Tony Redmond

• Run a PowerShell Workload on a Local Kubernetes Cluster That Talks to Microsoft Graph • Ben Reader

👮‍♂️ ID Governance

• The Lazy Way to Bulk Access Packages • Sandra Saluti

• New feature in PIM - fire custom extensions on role activation • Stian A. Strysse

📦 Apps

• Managing Permissions for Cloud-only Identities on Azure Files SMB • Brian Veldman

🫆 Authentication

• Switching password managers is easy and safe on Android • Jean-Pierre Pralle

• Microsoft Entra expands passkey registration campaigns • Daniel Bradley

• Attackers Use Passkey Phishing to Hijack Microsoft Cloud Accounts and Exfiltrate Data • The Hacker News

• 📺 How to Map Out the Entra Passkey Registration Campaign [Demo] • Ru Campbell

👥 User & Group Management

• Accessing Content of Microsoft 365 Group Mailboxes Through Microsoft Graph • Martin Heusser

🤖 DevOps & PowerShell

• Microsoft closes a data access gap for Graph API permission • Daniel Bradley

• Why Entra Administrators Cannot Disable Their Own Accounts • Tony Redmond

🚦 Conditional Access

• Microsoft Entra Conditional Access GPS Location: Why Authenticator Asks to Enable Location • Sreejith Reghunathan Pillai

🥷 Security

• 🛠️ Audit Entra ID for privilege escalation paths through application permissions, role assignments, and app ownership • Nicolas Blank

• Microsoft Security Architect: Active Directory Is 10x Harder to Defend Than Entra • Merill Fernando

• Are Your Microsoft Entra Extensions Actually Being Used? • Sebastian Flaeng Markdanner

📒 Tenant Configuration

• 📺 Episode 436: Finding the Entra Tenants You Didn’t Know You Had • Microsoft Cloud IT Pro Podcast

🔥 Maester

• You ran Maester 200 times. Now what? • Mateusz Jendza

Sam Erde and I had the opportunity to present on Maester with a deep dive into creating custom tests with Maester. We’ll include the link to the recording once it is published.

👨🏽‍💻 Merill’s corner

• Want to get featured on Entra.News? → Submit your content 😎

• Want us to say nice things about your company? Sponsor entra.news 🤩

• Love the newsletter? Tell us 💚❤️💜

🪃 Acknowledgement of Country

Entra.News is created on Wurundjeri land and acknowledges the traditional owners of country throughout Australia, recognising their continuing connection to land, water and community. We pay our respect to them and their cultures and to elders both past and present.

Tarek Dawoud, Lead Architect on the Technical Excellence Team in Microsoft Security, walks Merill through those slides and then draws the conclusion for identity teams in his own words: “Active Directory is like 10x harder to defend than Entra.” If you do not already have a plan to move off AD, he says, sit down and write one.

He also says how Microsoft handles this itself. Most of Microsoft’s own servers run in the cloud, its front ends run with no domain at all, and on-prem AD survives mainly as a dial-tone service: the thing they need to bring Azure up from scratch, and not much else.

Tarek is back on Entra.Chat, and he was privy to a small part of Project Glasswing, where Microsoft got early access to Anthropic’s Mythos-class models to find vulnerabilities in its own products before attackers could. The red-team community was cynical at the time; what Microsoft saw internally was, in his words, “very concerning. Those things were damn good.” From there he builds Weston’s argument: the whole security industry rests on an assumption of scarcity. Vulnerabilities are rare, exploits are expensive, and attackers have recognisable tactics, techniques and procedures. Patch-and-pray works when bugs arrive slowly. TTP-based detection works when a human crew reuses its playbook. When a risk is small, driving it smaller is worth the money; as Tarek puts it, “if something has a 95% possibility of happening, pushing it down to 80% doesn’t change anymore.” The Hugging Face intrusion (an OpenAI agent, and not a deliberate attack, as Merill is quick to note) showed what happens when the old assumptions fail: the agent landed on one server and looped, try an exploit, fail, write a new tool, try again, with no attempt to hide and no signature to match. Hugging Face survived by repeatedly tearing down and rebuilding core infrastructure. Tarek’s question for listeners: “Does your AD team have that skill?” Tearing down and rebuilding domain controllers, he notes, is not a thirty-minute operation.

Merill raises the two objections he hears most. First: you are just trusting Microsoft, and Entra ID has bugs too. Tarek’s answer is about who is on the hook. Microsoft owns and patches the Entra infrastructure; the service deploys roughly every 10 business days and can push a critical hotfix worldwide within a day or two, across a fleet that was already more than 100,000 compute nodes five years ago. You still have to handle Entra bugs, but the work looks like a Conditional Access policy to block a risky flow such as device code flow, not patching every server yourself. One customer he worked with had about 12 people in IAM for more than 200,000 employees; Entra has over 2,000. Second: this is licensing revenue and cloud stickiness dressed up as security. Tarek does not pretend to know the CAL math. “Assuming good intentions,” he says, the case is defensibility: the ports, the legacy protocols, the sheer number of things to watch, and the amount of legacy that is indefensible. That is where the “10x” line comes from: an architect’s rough comparison, not a measurement.

The back half is the path, using the Road to the cloud model at aka.ms/ad2entra. Map yourself to one of five states first: cloud attached, hybrid, cloud-first, AD minimized, cloud only. Then the moves that matter most. Decide, as a business, to stop buying apps that only run on-prem and make OAuth or SAML support a checkbox in the security review, because you will never turn off AD while a single LDAP app remains. Move devices to cloud management and out of hybrid join. Do not extend your domain into the cloud to manage servers; every cloud can patch and maintain a server without one, Microsoft’s own front ends run with no domain, and a domain you rely on becomes an attack vector for every server that trusts it. At the AD-minimized stage, HR provisions to Entra first (cloud HR, or API-driven inbound provisioning if your HR system is on-prem or file-based) and only the subset of users who need a stubborn legacy app is brought down to AD. The order of operations is apps first, then users and groups, with the Zero Trust Workshop identity pillar as the tracker for every box.

Tarek is honest about what is not solved. Intune does not manage servers today (Azure Arc is one approach), and some on-prem cases, such as retail stores that need local servers to keep point of sale running when the internet drops, still need a domain controller. The identity data warehouse, the layer that normalises HR data before it reaches the directory, is something SailPoint does well and Entra “doesn’t quite do yet,” so expect that MIM, SailPoint or Saviynt-style layer to persist. And the last two Exchange servers: object-level Source of Authority transfer exists now, but the attribute-level transfer that would let you switch just the mail properties to cloud management is still in progress. Tarek has met maybe five customers at stage 5. He still closes with hope. If the last thing standing before your domain controller is those two Exchange servers, you have succeeded, and “as someone who owns identity infrastructure, you do have a path out. There are people who have no path out.”

What you will learn

• Why the scarcity assumption behind patching and TTP-based detection is breaking, and what the numbers on Weston’s slides (80 to 1,142 patches, 27-second breakout, exploits seven days before the patch) mean for anyone who owns servers.

• What the Hugging Face intrusion showed about how an AI agent actually attacks, and the one question to ask your AD team.

• How Tarek answers “Entra ID has bugs too” and “this is just licensing,” and what your residual burden looks like on an IDaaS.

• The five states of the Road to the cloud model, and why mapping where you are comes before any migration work.

• Why you do not need a domain to manage servers in the cloud, and where a domain controller is still legitimately needed.

• What changes at the AD-minimized state: HR to Entra first, API-driven provisioning for non-cloud HR, and why an identity data warehouse still exists.

• What actually keeps the last two Exchange servers alive, and how object-level versus attribute-level Source of Authority changes that.

• Which legacy protocols are the real blockers (NTLM and LDAP) and the options on the table: App Proxy, Entra Domain Services, Universal Print.

• How to use the Zero Trust Workshop identity pillar to track every step and stop the on-prem estate from growing.

Subscribe with your favorite podcast player or watch on YouTube 👇

About Tarek Dawoud

Tarek Dawoud is Lead Architect on the Technical Excellence Team in Microsoft Security, part of the Microsoft Security Customer Value Program. A Microsoft veteran of more than 18 years, he previously led the architecture team in Microsoft’s customer engineering (CXE) organization for Microsoft Entra, and has worked with Microsoft’s largets enterprise customers on identity for years. He is a returning Entra.Chat guest; his earlier episode, From Active Directory to AI Agents: The 25-Year Saga of Microsoft’s Identity, is at https://entra.news/p/from-active-directory-to-ai-agents.

LinkedIn - https://www.linkedin.com/in/tarekdawoud/

Related Links

• David Weston’s Black Hat USA 2026 keynote, The End of Rare: Defending When Offense Is Cheap (mentioned at 05:42; Tarek suggests skipping the first 14 minutes to get to the talk) -

• Hugging Face: Anatomy of a Frontier Lab Agent Intrusion, a technical timeline of the July 2026 incident (mentioned at 13:51) - https://huggingface.co/blog/agent-intrusion-technical-timeline

• OpenAI: The Hugging Face incident and the road ahead (companion post to the Hugging Face timeline) - https://openai.com/index/hugging-face-incident-and-the-road-ahead/

• Road to the cloud: moving identity and access management from Active Directory to Microsoft Entra, aka.ms/ad2entra (mentioned at 26:14) - https://learn.microsoft.com/entra/architecture/road-to-the-cloud-introduction

• Cloud-based management of Exchange attributes for Remote Mailboxes in hybrid environments (mentioned at 51:08) - https://learn.microsoft.com/en-us/exchange/hybrid-deployment/enable-exchange-attributes-cloud-management

• Decommission the last Exchange Server after transferring SOA to cloud (mentioned at 51:08) - https://learn.microsoft.com/en-us/exchange/hybrid-deployment/decommission-last-exchange-server

• Microsoft Zero Trust Workshop video playlist, including the identity walkthrough (mentioned at 57:51) - https://www.youtube.com/playlist?list=PL3ZTgFEc7LyuZlK_W0nUN_VV6hscz-rQP

• Zero Trust Workshop guided videos (mentioned at 57:51) - https://microsoft.github.io/zerotrustassessment/docs/videos

• Zero Trust Workshop, identity pillar (mentioned at 52:21) - https://zerotrust.microsoft.com

• Matt Zorich’s post on how hard it is to recover a compromised on-prem environment (mentioned at 21:02) -

• Project Glasswing: securing critical software for the AI era (mentioned at 02:10) - https://www.anthropic.com/glasswing

• User Source of Authority (SOA) overview - https://learn.microsoft.com/en-us/entra/identity/hybrid/user-source-of-authority-overview

• Group Source of Authority (SOA) overview - https://learn.microsoft.com/en-us/entra/identity/hybrid/concept-source-of-authority-overview

• API-driven inbound provisioning concepts - https://learn.microsoft.com/en-us/entra/identity/app-provisioning/inbound-provisioning-api-concepts

• Overview of Microsoft Entra Domain Services - https://learn.microsoft.com/en-us/entra/identity/domain-services/overview

• What are cloud-native Windows endpoints - https://learn.microsoft.com/en-us/intune/solutions/cloud-native-endpoints/overview

• Windows Hello for Business cloud Kerberos trust deployment guide - https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/deploy/hybrid-cloud-kerberos-trust

Related Entra.Chat Episodes

• How General Motors Moved 200,000 People to Passkeys - https://entra.news/p/how-general-motors-moved-200000-people

• They migrated 40,000 devices to Entra Join in 9 months - https://entra.news/p/they-migrated-40000-devices-to-entra

• Decommissioning On-Prem AD: Lessons Learned from We Are Era’s Successful Migration - https://entra.news/p/decommissioning-on-prem-ad-lessons

Chapters

00:00 Intro

01:30 Mythos and Glasswing

05:42 Weston’s Black Hat keynote: the end of scarcity

11:29 Pyramid of Pain and the Hugging Face intrusion

17:02 27-second breakouts and exploits before the patch

19:41 The pitch: get off AD

23:10 But Entra ID has bugs too

26:10 aka.ms/ad2entra and the licensing objection

31:38 Where to start: cloud attached to cloud first

34:47 What about servers? You don’t need a domain

41:20 AD minimized: cloud HR and the identity warehouse

47:23 Stage 5 and the last Exchange server

52:07 The Zero Trust Workshop identity pillar

57:54 Closing with hope

Podcast Apps

Entra.Chat - https://entra.chat

Apple Podcast - https://entra.chat/apple

YouTube - https://entra.chat/youtube

Spotify - https://entra.chat/spotify

Overcast - https://entra.chat/overcast

Pocketcast - https://entra.chat/pocketcast

Others - https://entra.chat/rss

Merill’s socials

YouTube - youtube.com/@merillx

LinkedIn - linkedin.com/in/merill

Twitter - twitter.com/merill

TikTok - tiktok.com/@merillf

Bluesky - bsky.app/profile/merill.net

Mastodon - infosec.exchange/@merill

Threads - threads.net/@merillf

GitHub - github.com/merill

There’s a LOT happening with Entra this week, with passkeys being the biggest topic now that we’re past 1 September. We also have more clarity from Microsoft, with new updates to the docs on Microsoft Learn walking through the changes and what to expect.

Plus, our Entra MVPs do some deep dives and provide practical guidance on these changes and what to do.

If you are looking for inspiration for your passkey rollout, check out this week’s timely Entra Chat podcast episode with Andrew Cameron, Distinguished Identity Engineer at General Motors, who graciously shared their learnings as they roll out passkeys to nearly 200,000 GM staff.

BTW, I’ll be at the Hybrid Identity Protection conference in Nashville this week, and I’m looking forward to catching up with many folks from the Entra community, hanging out, and talking about Entra, AI and Maester. Hopefully, I’ll record a few podcasts too.

Merill

Sponsored by:

Is Each App in Entra ID Still Worth Governing?

App registrations and enterprise applications accumulate. Owners change. Projects and pilots end. Credentials linger. And stale or unused apps and their permissions can continue adding risk and governance overhead long after their purpose is gone.

ENow App Governance Accelerator helps you understand what’s in your Entra ID application estate, who owns it, which apps, permissions, and credentials need attention, and what can safely be cleaned up to reduce your attack surface on a continuous basis as your tenant grows and changes.

Get visibility and automated workflows to investigate application lifecycles at scale, reduce stale apps, and spend less time governing applications that no longer need to be there.

See AppGov in Action

⚡️ Microsoft

🏆 General Availability

• What’s new in Microsoft Entra: September 2026 • Yina Arenas

  • Microsoft Entra Tenant Governance

  • Improve access governance with User-centric Access Reviews (UAR)

  • Create workflows by cloning an existing workflow in Lifecycle Workflows

  • Microsoft Entra Resource Accounts for Teams Devices

🏁 Public Preview

• What’s new in Microsoft Entra: September 2026 • Yina Arenas

  • Synchronize sAMAccountName with Microsoft Entra Domain Services

  • Manage identity lifecycle from the cloud with Microsoft Entra Cloud Sync

  • Microsoft Entra Global Secure Access MCP Firewall

• Change announcements

  • Enhancements to Security Administrator role

  • Replace MemberOf-Based Configurations by November 3, 2026

  • Permission scope update for User.ReadBasic.All

🗣️ Message Center

• MC1440968 - Microsoft Entra ID: Optimizations for passkey registration experience

• MC1423108 - Microsoft Entra: Improved restore experience for Authenticator passkeys on iOS

• RM567885 - Microsoft 365: Entra ID Backup & Recovery

• MC1438571 - Default visibility of additional profile card properties in Microsoft 365 profile cards

• RM568784 - Microsoft Defender for Identity: Unified identity timeline on the Identity page

• RM569446 - Microsoft Entra: Enhanced Security Accounts Manager (sAM) Account Name support for Microsoft Entra Domain Services

• MC1465773 - Microsoft Viva Engage: Microsoft Entra permissions required for community and membership administration

📕 Microsoft Learn Docs

• Run a registration campaign to set up a passkey or Microsoft Authenticator - Updated

  Major doc update on 5 Sep: The documentation now describes Microsoft managed, Enabled, and Disabled campaign states, method-specific eligibility and prompting conditions, and prerequisites for Authenticator and passkey campaigns. The updated experience is rolling out through the end of September 2026, so tenant behavior may vary during rollout.

• Enable Microsoft Entra passkey on Windows

📆 Upcoming Events

• 📺 Live AMA: Secure multi-tenant environments with Microsoft Entra Tenant Governance • Microsoft Community Learning

From the community…

🚀 Most popular posts from last week

• 🥇 Microsoft accidentally created a new “All Company” group in Entra ID • Tobias Asböck

• 🥈 Agent 365 settings explained • Derk van der Woude

• 🥉 Entra ID P2 for SMBs: Is it Worth It and Which License to choose? • Gannon Novak

Sponsored by:

Maester Cloud turns every Maester and Microsoft Zero Trust Assessment run into a durable evidence trail. See new failures, fixes, accepted risks, and posture changes across every tenant - without digging through old HTML reports.

• Keep 5+ years of tenant history in your chosen Azure region

• Compare runs, spot drift, and get change alerts

Self-hosted private preview now available at $99/month! Helps fund open-source Maester development, shape the roadmap.

Install Maester Cloud today!

☀️ Learn

👩‍✈️ AI & Copilot

• The magic of Agent Identities in Microsoft Entra • Gabe Corsini

🎁 Apps

• Introducing Entra Extensions Manager: A Better Way to Manage Custom Extensions • Sebastian Flaeng Markdanner

🧰 Workload ID

• Revoking Access Tokens for Risky Service Principals • Tony Redmond

• Running a Regular Check for New Graph Permissions • Tony Redmond

• NHI? Never Heard of Him — The Service Principal Sitting in Your Tenant • Jonathan Hope

👮‍♂️ ID Governance

• Securing Microsoft Entra Guest Access: Lifecycle Management with Access Packages and Access Reviews • Oliver Mueller

• Your governance model is probably built around the wrong thing • Sandra Saluti

• When a Manager Isn’t an Attribute • Sandra Saluti

🌐 Private Access & Internet Access (GSA)

• Entra Private Network Connector Session Persistence • Richard M. Hicks

• Entra Global Secure Access (GSA) Client Intune Deployment PowerShell Script • Richard M. Hicks

🫆 Authentication

• Passkey as first MFA method: What could go wrong? • Per-Torben Sorensen

• How General Motors Moved 200,000 People to Passkeys • Merill Fernando

• 📺 Your SSPR Is About To Stop Working • Jonathan Edwards

👥 User & Group Management

• Need More User Attributes in Entra ID? Here Are Your Options • Klaus Bierschenk

🚦 Conditional Access

• Missing Service Principals in Entra ID: Why Conditional Access, App Protection and Global Secure Access will fail + more fun • Michael Morten Sonne

🖥️ Devices

• How to Block Personal Windows Devices in Microsoft Intune • Mark Oldham

• 📺 Group Policy Vs Microsoft Intune - Is It Time to Let Go? • Andy Malone

• 📺 How Attackers Abuse Device Code Flow [How to Stop it] • Ru Campbell

🏙️ External ID - Guests & Multi-Tenant Organizations

• How to Resolve External User ID by Email Address and Vice Versa • Martin Heusser

• Cross-Tenant Policies To Replace Free/Busy Organization Relationships • Brian Reid

🥷 Security

• 📺 The Cruellest Phishing Email I’ve Ever Seen! • Andy Malone

♻️ Sync

• How to sync user accounts from Entra ID to Active Directory • Daniel Bradley

📒 Tenant Configuration

• Teams Clamps Down on MOERA-Only Tenants • Tony Redmond

• Microsoft Graph hints at external tenant reporting • Daniel Bradley

• Restricting the new Copilot desktop app with Entra ID Tenant Restrictions • Tobias Asböck

🛍️ External ID - Customers

• How to run a .http file • Rory Braybrook

• Making Email Optional in Microsoft Entra External ID: Why This Matters for Modern CIAM • Colby Pryor

• Using the .NET .http file to test native auth with SSPR in Entra External ID (EEID) • Rory Braybrook

• Using the .NET .http file to test native auth with email/OTP in Entra External ID (EEID) • Rory Braybrook

🔥 Maester

👨🏽‍💻 Merill’s corner

Join Mike Soule and me in January 2027 at Workplace Ninjas US for a session on Mastering Maester. 👇

• Want to get featured on Entra.News? → Submit your content 😎

• Want us to say nice things about your company? Sponsor entra.news 🤩

• Love the newsletter? Tell us 💚❤️💜

🪃 Acknowledgement of Country

Entra.News is created on Wurundjeri land and acknowledges the traditional owners of country throughout Australia, recognising their continuing connection to land, water and community. We pay our respect to them and their cultures and to elders both past and present.

In this episode, Merill sits down with the person who has already done it. Andrew Cameron is a Distinguished Engineer for Identity and Cybersecurity at General Motors, and he has spent roughly 25 years there, long enough to have started on the employee portal as a web architect in 2000, and then helped build the identity function that now carries one of the world’s largest passwordless deployments.

The single biggest lever, Andrew says, was almost embarrassingly simple. GM treated Windows Hello as an optional convenience for years, then realised that an already-managed Windows device is a passkey. About 100,000 people were enabled through Windows Hello alone - no roaming key, no phone, no authenticator juggling. Platform SSO now extends the same idea to Mac through the secure enclave.

The sequence matters as much as the tools. Admin roles came first, required to carry a device-bound passkey with Azure PIM forcing the stronger method through activation. Then Conditional Access did the rollout: a small group of eager users, audit mode, and then add apps and expand outward. Andrew’s practical tip is to target the big, heavily used apps before chasing every user - it often gets you to 80% coverage faster.

Then the conversation turns to the corners most passkey explainers skip. Manufacturing workers who cannot use a phone and do not have a keyboard. Guest accounts - suppliers, dealerships and contractors - whose source tenant must also enable passkeys before the journey can complete. Call-centre users on unmanaged devices. And VDI, where certificate auth or Azure Virtual Desktop fills the gap.

Andrew also walks through the synced-versus-device-bound decision, and lands on the unglamorous first step of the whole thing: before you retire anything, know which authentication methods are actually in use.

What caught GM’s identity team by surprise

Andrew was candid about the corners that bit them - the ones most admins only discover after the weak method is already gone:

• SMS was the onboarding bootstrap. A new starter was never expected to have a passkey, so onboarding simply defaulted to an SMS code. Remove SMS and you have also removed the way people got in on day one. GM’s fix: issue a Temporary Access Pass (TAP) for onboarding, then register a strong method immediately.

• A new phone defaulted to SMS again. The “I just got a new phone” recovery path sent a code to the number by default. That whole flow had to be redesigned too, not just the sign-in policy.

• Guests were the hard problem. Several hundred thousand suppliers, dealerships and contractors can only finish a passkey sign-in if their own source tenant has also enabled passkeys. Enforce on your side and a guest can still get blocked upstream through no fault of yours.

• Factory floors have no phones and no keyboards. Manufacturing workers could not use a phone or type a password, so GM built custom non-password methods and used hardware keys for robots and other physical assets.

• Call-centre users are not on managed devices. Tens of thousands of users were remote or unmanaged, so GM folded device posture and network location into the risk evaluation.

• VDI was a fresh corner. Certificate auth and Azure Virtual Desktop SSO replaced SMS as the way into a virtual desktop.

• Hardware-key attestation had to be unwound. GM had registered AAGUIDs for hardware keys; when synced passkeys arrived, those old attestation requirements no longer applied and had to be revisited.

GM’s secrets: don’t repeat the mistakes

• Your managed device is already a passkey. The light-bulb moment was realising Windows Hello turns an already-managed Windows device into a passkey — no phone required. It became the fast path for roughly 100,000 people, and Platform SSO does the same on Mac.

• Privileged roles first, then everyone else. Admin roles carried device-bound passkeys, with Azure PIM forcing the stronger method through activation.

• Use Conditional Access as the rollout engine. Small pilot group → audit mode → add apps → expand. No big bang.

• Target the big apps, not every user. You reach ~80% coverage faster by protecting the heavily used apps first, then adding more to the same policy.

• Know your authentication methods before you retire anything. Monitoring and visibility come first — the deprecation clock is not the plan.

Sponsored by:

Scan, Score, and Secure Your Applications in Entra

Application identities represent one of the largest attack surfaces in Entra — and often one of the least consistently governed. AppGov Score helps IT and security teams understand where that risk sits.

The 24-check assessment evaluates your Entra ID application integrations against Microsoft-recommended governance practices, analyzing:

• App registrations and enterprise apps for excessive permissions

• Expired or unmanaged secrets

• Ownerless apps

• Risky consent grants

• Privileged service principals

Results are delivered as a clear, defensible risk score with actionable findings. No scripts. No manual inventory. Just a fast, read-only scan that reveals app sprawl, identity misconfigurations and blast radius — so you can prioritize remediation and strengthen your security posture with confidence.

Scan Your Tenant - No Cost

Subscribe with your favorite podcast player or watch on YouTube 👇

About Andrew Cameron

Andrew Cameron is a Distinguished Engineer for Identity and Cybersecurity at General Motors. He joined GM in 2000 as a web architect working on the employee portal, then moved into directory services and helped stand up GM’s identity and access management team in 2004. He has spent the past quarter-century building and leading identity and security at one of the world’s largest manufacturers from early SAML and OpenID Connect standardisation and Azure AD adoption, to GM’s current passwordless rollout across roughly 200,000 people.

LinkedIn - https://www.linkedin.com/in/kandrewcameron/

Related Links

• Passkeys by default and retirement of Microsoft-provided SMS and voice authentication (mentioned at 13:23) - https://learn.microsoft.com/entra/identity/authentication/concept-sms-voice-retirement

• Passkeys (FIDO2) authentication in Microsoft Entra ID (context throughout) - https://learn.microsoft.com/entra/identity/authentication/concept-authentication-passkeys-fido2

• Synced passkeys, device-bound passkeys and passkey profiles (discussed at 33:57) - https://learn.microsoft.com/entra/identity/authentication/how-to-authentication-passkeys-fido2

• Deploy phishing-resistant passwordless authentication (context at 28:38) - https://learn.microsoft.com/entra/identity/authentication/how-to-deploy-phishing-resistant-passwordless-authentication

• Configure a Temporary Access Pass (discussed at 12:48 and 33:20) - https://learn.microsoft.com/entra/identity/authentication/howto-authentication-temporary-access-pass

• Windows Hello for Business (the fast path discussed at 09:32 and 26:24) - https://learn.microsoft.com/windows/security/identity-protection/hello-for-business/

• Configure Platform SSO for macOS devices (discussed at 27:23) - https://learn.microsoft.com/intune/device-configuration/settings-catalog/configure-platform-sso-macos

• Require device compliance with Conditional Access (unmanaged-device discussion at 41:35) - https://learn.microsoft.com/entra/identity/conditional-access/policy-all-users-device-compliance

Related Entra.Chat Episodes

• 5 Lessons from Rolling Out Passkeys to Millions of Users - https://entra.news/p/5-lessons-from-rolling-out-passkeys

• From SMS MFA to Passkeys: A Practical Microsoft Entra Migration Plan - https://entra.news/p/from-sms-mfa-to-passkeys-a-practical

• Mastering Microsoft Entra ID: Real-World Passkey Deployment Tips - https://entra.news/p/mastering-microsoft-entra-id-real

Chapters

00:00 Intro

00:27 Meet Andrew Cameron

01:34 25 years of identity at GM

07:34 200,000 people and their personas

08:24 The strategy: passkeys over weaker MFA

09:32 Windows Hello: the fast path

10:06 Factory floors and hardware keys

11:20 Sponsor: AppGov Score

13:23 The SMS and voice deprecation

14:20 The guest-account problem

20:30 Roadblocks: onboarding and new phones

23:30 Conditional Access: small groups first

25:02 VDI, certificate auth and Azure Virtual Desktop

27:23 Platform SSO on Mac

28:38 The playbook: monitor, target, measure

33:57 Synced vs device-bound passkeys

35:35 Privileged roles first and Azure PIM

38:54 Final thoughts and wrap-up

Podcast Apps

Entra.Chat - https://entra.chat

Apple Podcast - https://entra.chat/apple

YouTube - https://entra.chat/youtube

Spotify - https://entra.chat/spotify

Overcast - https://entra.chat/overcast

Pocketcast - https://entra.chat/pocketcast

Others - https://entra.chat/rss

Merill’s socials

YouTube - youtube.com/@merillx

LinkedIn - linkedin.com/in/merill

Twitter - twitter.com/merill

TikTok - tiktok.com/@merillf

Bluesky - bsky.app/profile/merill.net

Mastodon - infosec.exchange/@merill

Threads - threads.net/@merillf

GitHub - github.com/merill

There’s a bit of a cloud-to-on-prem theme this week.

Entra Cloud Sync can now provision users and groups from Entra ID back to Active Directory, which is now in preview.

There’s also a new preview for keeping a group’s OU and name when changing its Source of Authority. And if you’re working with on-prem apps, there’s a useful walkthrough on governing access to them from Entra ID.

We’ve also got Greg, Eric and Rene on the Entra Chat podcast this week talking all things Entra Groups, so make sure you check it out.

Enjoy!

Sponsored by:

Cut the PS: Mailbox Folder Permissions Made Easy

PowerShell is awesome! For automation, bulk-editing, and scheduling. For first-line ad-hoc user support, PowerShell is a resource sinkhole that slows down ticket resolution, sucks in senior IT, and eats up end-user productivity.

To do “simple” mailbox folder permission management using MS standard tooling, your helpdesk needs to juggle five separate cmdlets and hand-type access rights, exact user identities, and SharingPermissionFlags values for calendar delegates.

With EasyEntra, first-line supporters of any level can view and manage mailbox folder permissions in seconds with close to zero training.

And this is just one of many features available in the same application.

“My team and I are blown away with EasyEntra.”
Group IT Manager, RM Curtis, United Kingdom

Download EasyEntra

⚡️ Microsoft

🔥 Public Preview

• Configure Microsoft Entra ID to Active Directory provisioning (preview)

• Preserve a group’s organizational unit and name when you convert Source of Authority (preview)

• Tutorial: Govern access to an on-premises app from Microsoft Entra ID (preview)

• Entra Domain Services - Public preview of enhanced security account manager support

📖 Read

• ​​​​​​What’s new in Microsoft Security: August 2026 • Alym Rayani

🗣️ Message Center

• MC1411574 - Microsoft Entra: System-preferred authentication now applies to first-factor authentication

• MC1461704 - Microsoft Defender XDR: Unified response actions across identity accounts

• MC1461705 - Microsoft Defender XDR: Unified identity timeline on the Identity page

• MC1462460 - Microsoft Entra: Domain update for My Account and identity self-service experiences

• MC1462464 - Microsoft Defender for Cloud Apps: App Governance support for the Cloud Application Administrator role is being retired

From the community…

🚀 Most popular posts from last week

• 🥇 Microsoft Graph’s Move Toward More Granular API Permissions • AIMA

• 🥈 Microsoft says use Tenant Restrictions to block personal Copilot access. I have questions. • Adam Fowler

• 🥉 Calculating the Licensing Requirement for Entra Conditional Access Policies • Tony Redmond

What happens when the identity services behind Microsoft 365 go down?

Join us this week for a live discussion on 𝗧𝗵𝗲 𝗡𝗲𝘄 𝗥𝗲𝗮𝗹𝗶𝘁𝘆 𝗼𝗳 𝗠𝗶𝗰𝗿𝗼𝘀𝗼𝗳𝘁 𝗜𝗱𝗲𝗻𝘁𝗶𝘁𝘆 𝗥𝗲𝗰𝗼𝘃𝗲𝗿𝘆 with Merill Fernando, host of Entra.Chat, and Craig Birch of Cayosoft.

Register now

☀️ Learn

👩‍✈️ AI & Copilot

• Using the Entra ID Agentic ID sample • Rory Braybrook

• Conditional Access for Agents: Blocking Agent Identities with Risk and Custom Security Attributes • Derk van der Woude

• Agent 365 settings explained • Derk van der Woude

• 📺 Hide Your OpenAI Key Behind an agentgateway Proxy and Enforce Entra ID with ChatGTP Desktop APP • Sebastian Maniak

🧰 Workload ID

• App instance property lock gets a scoping mechanism (and some other updates) • Vasil Michev

• New Graph Permissions Pose Questions for Microsoft 365 Tenants • Tony Redmond

• Access Azure Key Vault from a Local Kubernetes Cluster with Azure Arc Workload Identity • Ben Reader

• Instant revocation of service principal bearer tokens with CAE • Simone Oor

⛑️ ID Protection

• Entra ID P2 for SMBs: Is it Worth It and Which License to choose? • Gannon Novak

• Identity Threat Protection Starts After the Login • Derek Morgan

👮‍♂️ ID Governance

• Agentifying Entra ID using SCIM • Darren Robinson

• Microsoft PIM is great - but it has some shortcomings that need fixing • Stian A. Strysse

🌐 Private Access & Internet Access (GSA)

• Entra ID – A new version of the Global Secure Access is available • Benoit HAMET

• What’s New in Entra Global Secure Access Client v2.32.294.0 • Richard M. Hicks

• Global Secure Access – Now with Windows Update support! • Michael Morten Sonne

🫆 Authentication

• Passkeys for dummies • Sapir Federovsky

• Configuring Microsoft Entra ID Authentication for Azure SQL Database using Azure Bicep • Brian Veldman

• Passkeys Explained: What They Are & Why They Win • Phil Wade

• 📺 Microsoft Is Retiring SMS & Voice MFA by 2027 - are you ready? • Rio Hindle

• 📺 SMS MFA → Passkey: What Happens on September 1? • Azure Brother

• 📺 The NEW Passwordless Onboarding Flow | TAP → Passkey → Autopilot → WHfB • Azure Brother

👥 User & Group Management

• Microsoft Entra memberOf Retirement: What Admins Must Do • Merill Fernando

• Microsoft accidentally created a new “All Company” group in Entra ID • Tobias Asböck

• 📺 Your Entra Dynamic Groups Break in November (Silently) • Jonathan Edwards

🤖 DevOps & PowerShell

• Microsoft To Enforce WAM for Delegated Interactive Graph Sessions • Tony Redmond

• New Graph API permissions point to Entra ID diagnostics • Daniel Bradley

• Microsoft just added 13 Graph authentication delete permissions • Daniel Bradley

• Interact with MSGraph API locally • Morten Mynster

🚦 Conditional Access

• 10 Conditional Access Mistakes That Are Probably In Your Tenant Right Now • Jonathan Hope

• Your Entra ID protected action has a gap • Jurre Janssens

🖥️ Devices

• Fix Autopilot Device Enrollment Error 80180003 [7 Solutions] • Prajwal Desai

🥷 Security

• Token Theft in Microsoft Entra ID (Part 1 of 4): Threat Landscape and Attack Techniques • Niklas Kerner

• PRTremote: hijacking sessions via scheduled tasks • Jake Otte

• 📺 16. Kuba Gretzky: Downgrading FIDO MFA With AI Slop • Kuba Gretzky

♻️ Sync

• Sync Entra ID users to Active Directory with Cloud Sync • Daniel Bradley

📒 Tenant Configuration

• How To Use Entra Native Backup and Recovery • Michael Vink

🔥 Maester

• Running a community security baseline in CI: adding Maester to a Terraform and Entra ID GitHub Actions pipeline • Antonio Russo

👨🏽‍💻 Merill’s corner

• Want to get featured on Entra.News? → Submit your content 😎

• Want us to say nice things about your company? Sponsor entra.news 🤩

• Love the newsletter? Tell us 💚❤️💜

🪃 Acknowledgement of Country

Entra.News is created on Wurundjeri land and acknowledges the traditional owners of country throughout Australia, recognising their continuing connection to land, water and community. We pay our respect to them and their cultures and to elders both past and present.

It was a preview feature for four years. It is in a lot of production tenants.

In this episode of Entra.Chat, Merill is joined by three guests for the first time: Gregor Reimling, Chief Azure Technologist at adesso SE and Microsoft MVP for Azure and Security; René Wasel, a Microsoft 365 specialist and Microsoft MVP; and returning guest Eric Woodruff, Chief Identity Architect at Semperis. Gregor and René co-organise the Cloud Identity Summit, which happens to fall on the same date the deprecation lands.

The conversation starts with the deadline and quickly becomes something more useful: an honest audit of what groups in Entra actually do, versus what administrators assume they do.

The memberOf operator existed because Entra does not resolve nested groups the way Active Directory does. It was a flattening trick — take the members of several groups and produce one flat group that applications, licensing and policies could read. With it going away, the panel walks through the realistic replacements: move to supported attribute-based rules where an attribute exists, stamp an attribute with PowerShell where one does not, or convert the group to assigned membership and script it. Gregor and René both raise the version of this that is easy to forget — a rule written years ago that nobody documented, using a sync rule editor nobody wants to reopen.

Then the discussion turns to the part that is not on any deprecation notice. Nested groups are supported in Conditional Access. They are not supported for group-based licensing, where only first-level members get a licence. They are not supported for Global Secure Access, where a nested group assigned to a traffic forwarding profile applies only to its direct members with no error, no warning, and nothing in the portal to tell you. Chris Brumm found that one and wrote a Maester test for it, because the only way to know is to go looking.

There is a new group property that blocks nesting in both directions, undocumented when this was recorded. Sensitivity labels have reached Entra security groups in preview, bringing a guest-access control that stops new guests but does not evict the ones already in the group. And Merill spotted something through Entra.News Daily that deserves more attention than it has had: an agent’s user account is a user identity, so existing dynamic user rules already evaluate it. If your licensing group has a broad rule and your developers start creating agent accounts, those accounts qualify. If it is a group behind a Conditional Access policy or an exclusion, that is a different conversation entirely.

Which leads to the sharpest point in the episode, and Eric makes it plainly: the security of a dynamic group is the security of the write permissions on the attributes in its rule. Some of those attributes are self-service. Some flow up from on-premises Active Directory, changed by people who are not thinking about the cloud at all. Microsoft Learn now carries an explicit warning about exactly this, and it is why groups used for privileged access cannot be dynamic.

The last third is about the Cloud Identity Summit itself. More info below.

If you have memberOf in a rule anywhere, the useful thing to do this week is find it. Everything else in this episode can wait until after November.

Featured sponsor

Cloud Identity Summit 2026 → One Day, One Topic, In the Room

Identity. Security. 2026. On Tuesday 3 November in Frankfurt, the Cloud Identity Summit gives cloud identity a conference of its own, now in its seventh year, and free to attend.

Two parallel tracks, Identity Management and Identity Security, run 50-minute sessions in English. It is deliberately vendor-neutral: Microsoft Entra, AWS, Google Cloud and whatever else you actually run. Eric Woodruff keynotes with Identity Security Kindergeburtstag fourteen years of identity being called “the new security perimeter”, and an honest look at what that has actually got us.

Why it is worth the trip:

• It is in person only. No livestream, no catch-up recordings. The organisers built it that way on purpose — “a strong focus on face-to-face conversations to support networking and exchange of experiences.” If you want the hallway conversation, you have to be in the hallway.

• Everything is identity. No filler tracks. A whole day of people who work on the same problems you do, from an international mix of industries.

• The Community Ticket is 100% free. There is an optional paid Supporter Ticket if you want to help fund the event.

• It is easy to get to. adesso SE, Prisma Frankfurt-Niederrad — around ten minutes by S-Bahn from Frankfurt Airport, ten from Frankfurt Hauptbahnhof, and a short walk from Frankfurt-Niederrad station.

• Travelling in? The Crowne Plaza Frankfurt is a ten-minute walk, €89 single with breakfast on the “Cloud Identity Summit” booking code — 50 rooms, held until 5 October.

One more thing, given what this episode is about: 3 November is also the day Microsoft retires the memberOf operator. If you are going to spend that Tuesday thinking about Entra groups anyway, spend it in a room with people solving the same problem.

Get Your Free Ticket

Subscribe with your favorite podcast player or watch on YouTube

About Gregor Reimling

Gregor is a Microsoft MVP in Azure and Security, Chief Azure Technologist at adesso SE, and a passionate advocate for the Microsoft cloud community. His expertise spans Azure architecture, Microsoft Entra, Zero Trust and hybrid cloud environments; he helps organizations successfully navigate their cloud journey. Beyond his day job, Gregor is a frequent speaker at international events, co-host of the Cloud Inspires podcast and co-founder of the Cloud Identity Summit. As a Microsoft Certified Trainer, he enjoys sharing knowledge, mentoring others, and helping IT professionals get the most out of Microsoft technologies.

LinkedIn - https://www.linkedin.com/in/gregorreimling/

About René Wasel

René is a Microsoft 365 specialist, and a Microsoft MVP for Microsoft 365. He describes his work as helping people actually use the technology they have been given, and he is active in the community as a meetup and event organiser. He co-organises the Cloud Identity Summit.

LinkedIn - https://www.linkedin.com/in/renewasel/

About Eric Woodruff

Throughout his 25-year career in the IT field, Eric has sought out and held a diverse range of roles. Currently the Chief Identity Architect for Semperis; Eric previously was a member of the Security Research and Product teams. Prior to Semperis, Eric worked as a Security and Identity Architect at Microsoft partners, spent time working at Microsoft as a Sr. Premier Field Engineer, and spent almost 15 years in the public sector, with 10 of them as a technical manager.

LinkedIn - https://www.linkedin.com/in/ericonidentity/

Related Links

• MC1448379 - Microsoft Entra ID: Replace MemberOf rules by November 3, 2026 - https://mc.merill.net/message/MC1448379

• Entra.News Daily, Merill’s daily diff of Microsoft Entra documentation changes (mentioned at 26:26) - https://daily.entra.news/changes/2026-08-14/manage-rules-for-dynamic-membership-groups-in-microsoft-entra-id-16/

• Maester, the open-source test framework used for the dynamic-group and nested-group checks discussed (mentioned at 06:09 and 30:06) - https://maester.dev/contributors/agnivesh

• Configure dynamic membership groups with the memberOf operator - the official retirement notice and migration guidance - https://learn.microsoft.com/entra/identity/users/groups-dynamic-rule-member-of

• Manage rules for dynamic membership groups - covers agent user accounts and the attribute write-permission warning - https://learn.microsoft.com/entra/identity/users/groups-dynamic-membership

• Assign users and groups to Global Secure Access traffic forwarding profiles - confirms nested groups are not supported (discussed at 15:50) - https://learn.microsoft.com/entra/global-secure-access/how-to-manage-users-groups-assignment

• Group-based licensing - confirms only first-level members receive licences - https://learn.microsoft.com/entra/fundamentals/concept-group-based-licensing

• Assign sensitivity labels to Microsoft Entra security groups (preview) (discussed at 25:09) - https://learn.microsoft.com/entra/identity/users/groups-sensitivity-labels

• Eric’s Cloud Identity Summit keynote, “Identity Security Kindergeburtstag” (mentioned at 34:12) - https://www.identitysummit.cloud/speaker

Related Entra.Chat Episodes

• Operational Groups in Entra with Nathan McNulty - https://entra.news/p/operational-groups-in-entra-with

• Mastering Microsoft Entra ID: Real-World Passkey Deployment Tips - Eric’s previous episode, referenced at 02:12 - https://entra.news/p/mastering-microsoft-entra-id-real

• From Active Directory to AI Agents: The 25-Year Saga of Microsoft’s Identity - the keynote-turned-podcast Merill promised to link (mentioned at 40:16) - https://entra.news/p/from-active-directory-to-ai-agents

Chapters

00:00 Intro

01:17 Meet Gregor, René and Eric

02:12 Passkeys: what comes after the rollout

04:17 memberOf is being retired

06:45 Workarounds: attributes, PowerShell and sync rules

10:41 Why Entra wants your groups flat

14:36 Where nested groups silently fail

17:45 The new property that blocks nesting

19:27 AD-sourced groups vs Entra-sourced groups 25:09 Sensitivity labels come to security groups

26:23 Agents are already in your dynamic groups

28:23 Why dynamic groups are not a security control

31:31 Inside the Cloud Identity Summit

35:21 Identity is not the “new” perimeter

41:44 November 3, tickets and wrap-up

Podcast Apps

Apple Podcast - https://entra.chat/apple

YouTube - https://entra.chat/youtube

Spotify - https://entra.chat/spotify

Overcast - https://entra.chat/overcast

Pocketcast - https://entra.chat/pocketcast

Others - https://entra.chat/rss

Merill’s socials

YouTube - youtube.com/@merillx

LinkedIn - linkedin.com/in/merill

Twitter - twitter.com/merill

TikTok - tiktok.com/@merillf

Bluesky - bsky.app/profile/merill.net

Mastodon - infosec.exchange/@merill

Threads - threads.net/@merillf

GitHub - github.com/merill

We are light on posts from Microsoft but there are a few interesting Message Center posts on passkeys. Microsoft finally confirming passkey support for guests, as well as WHfB and Platform SSO for macOS to be recognized as stand-alone MFA from October 2026.

We also learnt about a severe Entra ID flaw (CVSS 10.0) that allowed remote code execution. Microsoft has already fixed it and there is nothing for you to do. It was not exploited, and it was found by one of their own engineers.

Don’t forget to check out this week’s Entra.Chat podcast. The demos that Michael Grafnetter showed made me do a double take. Must watch for any Entra admin.

Enjoy!

Sponsored by:

Know Every AI Agent in Your Tenant? Neither Does

Copilot Studio mints a new Entra agent identity every time someone builds an agent. Each one is a live service principal: its own credentials, its own reach into your systems. Entra creates them fast. Nobody’s watching what happens next.

Oasis Platform is.

• Every agent discovered and owned, the full picture. No spreadsheet archaeology

• Secrets rotated automatically, without breaking production

• Stale agents recertified and retired with confidence

See it on your tenant

⚡️ Microsoft

🗣️ Message Center

• MC1459133 - Microsoft Entra ID: Passkey support for B2B users

• MC1450134 - Microsoft Entra: Windows Hello for Business and macOS Platform SSO as standalone MFA factors

• MC1303719 - Microsoft Entra: Upcoming changes to federatedTokenValidationPolicy default settings

• MC1458474 - Microsoft Entra ID: Retirement of custom CSS layout and positioning properties in company branding

From the community…

🚀 Most popular posts from last week

• 🥇 Secret’s out: How to replace client secrets with Azure managed identity • Sep Behesti

• 🥈 Microsoft is Tracking your Entra ID License Usage – Are You Compliant? • Rudy Mens

• 🥉 Entra Admin Center Flags Licensing Problems with Conditional Access • Tony Redmond

Sponsored by:

Webinar: From App Sprawl to Control in Entra ID

Wednesday, August 26 at 3 pm ET | Register

Entra ID app sprawl happens when nobody owns the process after approval. App registrations, service principals, and integrations pile up, and questions about ownership, permissions, credentials, and usage go unanswered until nobody’s confident enough to remove them.

Hosted by ENow, Microsoft MVPs Nicolas Blank and Alistair Pugin welcome guest Merill Fernando for a practical look at governing apps starting from onboarding through their full lifecycle. You’ll learn:

• What application onboarding should establish

• How to assign real ownership (technical and business)

• Where app lifecycle gaps create risk

• How to govern credentials and access over time

• Which Entra ID controls help, where gaps remain, and what to do about it

  Register Now

☀️ Learn

👩‍✈️ AI & Copilot

• Identity Risk Management Agent | Security Copilot • Michael Frank

🧰 Workload ID

• Logic Managed Identity works – Retire the workaround! • Chris Bradshaw

• Configuring Microsoft Entra ID Authentication for Azure SQL Database using Azure Bicep • Brian Veldman

👮‍♂️ ID Governance

• Entra Inbound Provisioning to Active Directory Attribute Constraint Violated • Darren Robinson

🌐 Private Access & Internet Access (GSA)

• Private DNS Hygiene in GSA — Suffixes, Segments, and the Order Things Resolve In • Christopher Brumm

• 🎙️ Renewing our understanding of Microsoft Global Secure Access | Ctrl+Alt+Azure • Jussi Roine and Tobias Zimmergren

📦 Apps

• Microsoft Graph’s Move Toward More Granular API Permissions • AIMA

• 📺 Microsoft Entra ID and SSO explained minimum required knowledge • Cobuman

🫆 Authentication

• Pass-the-Passkey: What Michael Grafnetter’s Black Hat Research Means for Entra Admins • Merill Fernando

• How to create a Microsoft 365 device-bound passkey on macOS • Jan Bakker

• 📺 How to Handle Entra Passkey & SMS Changes [5 Critical FAQs] • Ru Campbell

👥 User & Group Management

• Stop agent users joining Microsoft Entra dynamic groups • Daniel Bradley

• Microsoft Entra agent users can join your dynamic groups. Here is what to check • Merill Fernando

• Microsoft Entra memberOf Retirement: 2026 Checklist • Driek Desmet

🤖 DevOps & PowerShell

• Use of AZURE_TOKEN_CREDENTIALS in Azure.Identity • Jaliya Udagedara

• Connect to Microsoft Graph, Teams and Exchange with PowerShell Simultaneously • Martin Heusser

🚦 Conditional Access

• Calculating the Licensing Requirement for Entra Conditional Access Policies • Tony Redmond

🏙️ External ID - Guests & Multi-Tenant Organizations

• Microsoft Entra brings passkeys to B2B guest users • Daniel Bradley

🥷 Security

• Microsoft quietly expands the Entra Application Developer role • Daniel Bradley

• Microsoft adds user actions to the Security Administrator role • Daniel Bradley

• Microsoft Patches Severe Entra ID Flaw (CVSS 10.0) Allowing Remote Code Execution • The Hacker News

• 📺 Check Your Customers’ Entra ID Tenants with Maester - Constantin Hager - PSConfEU 2026 • Constantin Hager

📒 Tenant Configuration

• Microsoft says use Tenant Restrictions to block personal Copilot access. I have questions. • Adam Fowler

🛍️ External ID - Customers

• Integrating Entra External ID (EEID) with a third-party MFA provider, e.g. Authsignal • Rory Braybrook

🔥 Maester

👨🏽‍💻 Merill’s corner

• Want to get featured on Entra.News? → Submit your content 😎

• Want us to say nice things about your company? Sponsor entra.news 🤩

• Love the newsletter? Tell us 💚❤️💜

🪃 Acknowledgement of Country

Entra.News is created on Wurundjeri land and acknowledges the traditional owners of country throughout Australia, recognising their continuing connection to land, water and community. We pay our respect to them and their cultures and to elders both past and present.

In this episode of Entra.Chat, I spoke with Michael Grafnetter, Principal Security Researcher at SpecterOps and Microsoft MVP, about the Pass-the-Passkey research he presented at Black Hat USA 2026. A family of attacks against passkey implementations across Windows, Microsoft Entra ID, browsers and password managers.

Michael starts with the vulnerability chain he reported to Microsoft. Windows was writing the complete passkey assertion into the event log, and Microsoft Entra ID would accept a replay of that assertion for up to ten minutes. Any user able to read those logs including a member of Remote Desktop Users on a shared server, or unprivileged malware quietly reading event logs without tripping EDR could impersonate whoever had just signed in. If that person was a Global Administrator, so was the attacker. Windows now truncates the logged message, and Microsoft Entra ID checks authenticator signature counters to reject replays.

We also covered the attacks that do not depend on any single bug. Malware running without administrator rights can call the native Windows WebAuthn APIs directly and raise a passkey prompt flood that keeps returning until the user gives in and approves it. Synced passkeys, exported from a password manager and decrypted with a keylogged password, hand an attacker a credential with no ten-minute limit at all. And a browser-hooking technique Michael calls a passkey detour attack quietly redirects a legitimate assertion into the attacker’s own session.

The defensive thread running through all of it is the same: every one of these attacks assumes malware is already on the device. That makes device trust the key control. Privileged access workstations for administrators, Conditional Access requiring compliant devices with EDR running, and the clean source principle that says a system can only be as trustworthy as whatever it depends on.

Michael closes on an optimistic note, and it is worth repeating. Passkeys are still the future. They remain far better than passwords and phishable MFA, and every attack here costs an adversary vastly more effort than sending a phishing link. But as passkeys become the default in Microsoft Entra, the threat model deserves an honest read.

Watch the demos. This episode includes three on-screen demonstrations that are much easier to follow on video than on audio.

This episode brought to you by Workplace Ninjas US

Workplace Ninjas US isn’t just another tech conference. It’s where Microsoft experts, MVPs, engineers, and IT professionals come together to learn, network, and build lasting connections.

We are a community built on diversity, mentoring, fellowship, and creating a place where everyone belongs.

Our core DNA comes down to a few pillars:

• Over 60 sessions from the largest collection of MVPs and SMEs you will find in any event in America.

• Amazing mentoring, development, and growth through our one on one mentoring system with any speaker, our hackathon, community theatre and more.

• A diverse expo hall featuring some of the best Microsoft partners in the world that will help you drive deep efficiencies from your M365 stack.

• A place where you will learn how to think differently and collaborate better through a collection of activities and can return refreshed and invigorated to drive change in your organization.

• Don’t miss out on our early bird tickets while supplies last

Get your early bird ticket today

Subscribe with your favorite podcast player or watch on YouTube

About Michael Grafnetter

Michael Grafnetter is a Principal Security Researcher at SpecterOps and a Microsoft MVP, based in Prague. He specializes in Microsoft Entra ID and Active Directory security and PowerShell. He is the author of the DSInternals PowerShell module and the researcher who originally discovered the Shadow Credentials attack technique, now widely used by penetration testers, red teamers and attackers alike. He has presented his security research at international conferences including Black Hat Europe, Black Hat USA, SecTor, TROOPERS and BSides Lisbon.

• LinkedIn - https://www.linkedin.com/in/grafnetter/

Related Links

• Pass-the-Passkey research and tools, including Passkey Injector and the DSInternals.Passkeys module (discussed at 14:57 and 34:22) - https://github.com/SpecterOps/pass-the-passkey

• Pass-the-Passkey research paper from Black Hat USA 2026 (introduced at 07:34) - https://specterops.io/wp-content/uploads/sites/3/2026/08/Pass-the-Passkey_A4_v2.pdf

• Shadow Credentials, Michael’s earlier Active Directory research (mentioned at 01:46) - https://specterops.io/blog/2021/06/17/shadow-credentials-abusing-key-trust-account-mapping-for-account-takeover/

• DSInternals PowerShell module (mentioned at 01:34) - https://www.dsinternals.com/en/

• Passkeys (FIDO2) authentication in Microsoft Entra ID (context throughout) - https://learn.microsoft.com/entra/identity/authentication/concept-authentication-passkeys-fido2

• Synced passkeys, device-bound passkeys and passkey profiles (discussed at 23:21) - https://learn.microsoft.com/entra/identity/authentication/how-to-authentication-passkeys-fido2

• Deploy phishing-resistant passwordless authentication (context at 18:08) - https://learn.microsoft.com/entra/identity/authentication/how-to-deploy-phishing-resistant-passwordless-authentication

• Require device compliance with Conditional Access (recommended at 21:12) - https://learn.microsoft.com/entra/identity/conditional-access/policy-all-users-device-compliance

• Privileged access devices and the clean source principle (discussed at 21:55 and 35:41) - https://learn.microsoft.com/security/privileged-access-workstations/privileged-access-devices

• Unit 42, “Pass the Passkey: A Novel Attack Surface in Passwordless Authentication” — the Palo Alto research on Google Password Manager passkeys (mentioned at 26:27) - https://unit42.paloaltonetworks.com/passwordless-authentication-security-risks/

Related Entra.Chat Episodes

• From SMS MFA to Passkeys: A Practical Microsoft Entra Migration Plan - https://entra.news/p/from-sms-mfa-to-passkeys-a-practical

• 5 Lessons from Rolling Out Passkeys to Millions of Users - https://entra.news/p/5-lessons-from-rolling-out-passkeys

• Attackers Are Targeting The AI Ecosystem You Cannot See - https://entra.news/p/attackers-are-targeting-the-ai-ecosystem

Chapters

00:00 Intro

01:02 Meet Michael Grafnetter

03:09 How the Research Started

06:50 Windows Hello for Business Was the First Passkey

07:30 The Signature in Your Event Log

10:18 No, Private Keys Are Not Logged

12:25 How Entra Mitigated the Replay

13:44 Demo: Signing In With a Stolen Signature

15:22 Malware-Initiated Passkey Phishing

18:08 The Browser Is What Makes Passkeys Phishing-Resistant

20:42 What Defenders Should Actually Do

23:04 Synced Passkeys and the Export Problem

26:13 Credential Exchange and Password Manager Risk

28:19 The Passkey Detour Attack

30:43 The Authentication Broker Debate

31:57 RDP Redirection and Remote Passkey Abuse

32:59 Spotting a Suspicious Passkey Prompt

34:46 Passkeys Are Still the Future

Podcast Apps

Apple Podcast - https://entra.chat/apple

YouTube - https://entra.chat/youtube

Spotify - https://entra.chat/spotify

Overcast - https://entra.chat/overcast

Pocketcast - https://entra.chat/pocketcast

Others - https://entra.chat/rss

Merill’s socials

YouTube - youtube.com/@merillx

LinkedIn - linkedin.com/in/merill

Twitter - twitter.com/merill

TikTok - tiktok.com/@merillf

Bluesky - bsky.app/profile/merill.net

Mastodon - infosec.exchange/@merill

Threads - threads.net/@merillf

GitHub - github.com/merill

It’s a passkey week. Users can now register a passkey or passwordless sign-in as their first MFA method and SMS first-factor sign-in has been retired for Entra ID Free tenants on Aug 11. That’s a lot of change landing at once, and the community has already done the heavy lifting. Ru breaks down device-bound vs syncable passkeys, Jonathan has an opt-out guide if you need more runway, and Nathan, Jon, Kenneth and Rahul all published rollout playbooks worth bookmarking before you touch anything in prod.

Two other things to catch. Microsoft Entra Tenant Governance is now GA 🏆. And if you’re still leaning on memberOf dynamic groups, read Julian’s post (and watch Andy’s video) before you plan your fixes. 🫣

Plus I had Jai Maharaj on Entra Chat to break down the upcoming changes. We covered a lot of ground including thinking about account recovery once you’ve moved to passkeys, ID verification and more.

Enjoy!

Sponsored by:

Cut the PS: Mailbox Folder Permissions Made Easy

PowerShell is awesome! For automation, bulk-editing, and scheduling. For first-line ad-hoc user support, PowerShell is a resource sinkhole that slows down ticket resolution, sucks in senior IT, and eats up end-user productivity.

To do “simple” mailbox folder permission management using MS standard tooling, your helpdesk needs to juggle five separate cmdlets and hand-type access rights, exact user identities, and SharingPermissionFlags values for calendar delegates.

With EasyEntra, first-line supporters of any level can view and manage mailbox folder permissions in seconds with close to zero training.

And this is just one of many features available in the same application.

“My team and I are blown away with EasyEntra.”
Group IT Manager, RM Curtis, United Kingdom

Download EasyEntra

⚡️ Microsoft

🏆 General Availability

• Microsoft Entra Tenant Governance is now generally available • Cindy Crane

📖 Read

• Why Active Directory alone is no longer enough • Jorge A Lopez

• How to enforce Zero Trust across every resource • Janice Ricketts

🗣️ Message Center

• MC1450133 - Microsoft Entra: Users can register a passkey or passwordless sign-in as their first multifactor authentication method

• MC1448374 - Microsoft Entra ID: Retirement of SMS first-factor sign-in for Entra ID Free tenants

📕 Microsoft Learn Docs

• Web filtering in Global Secure Access (V2) (New)

• Migrate web content filtering policies from V1 to V2 (New)

• Tutorial: Federate a SPIFFE/SPIRE workload identity with Microsoft Entra ID (New)

• Tutorial: Federate a Google Cloud workload identity with Microsoft Entra ID (New)

Sponsored by:

Top 5 App Governance Challenges in Your Entra Tenant

Somewhere in your Entra tenant, a client secret is expiring. An over-permissioned application has access it never should have. And nobody’s reviewed which applications are in use since... honestly, who remembers?

You didn’t create this mess. Sprawl, drift, process gaps, enthusiastic users, and time did. But you are the one getting middle-of-the-night pings when an exec cannot access their business-critical app. And you might be the one getting grilled by an auditor asking why an app needs ReadWrite.All permissions.

Created for IT admins, IAM, security teams, and the people who are tasked with managing the application estate in Entra ID - the Entra ID App Governance Playbook breaks down 5 application governance gaps behind identity incidents and how to prioritize the fixes.

Get the Playbook

From the community…

🚀 Most popular posts from last week

• 🥇 Microsoft Entra Just Made Passwordless MFA Registration Easier • Daniel Bradley

• 🥈 No Guest? No Problem: Direct External Assignments in Microsoft Entra • Colby Pryor

• 🥉 Manage your AI Agents at Scale with Entra Agent ID • Brian Veldman

Yeah. ☀️ Learn

👩‍✈️ AI & Copilot

• Microsoft Graph Atlas MCP Server • Darren Robinson

🧰 Workload ID

• Secret’s out: How to replace client secrets with Azure managed identity • Sep Behesti

• Microsoft Entra: Migrating GitHub Actions Federated Credentials to Immutable Subjects • Tobias Asböck

👮‍♂️ ID Governance

• 📺 How to configure Privileged Identity Management in Entra ID • Steven Weiner

📦 Apps

• Set up OpenwebUI on Docker with Foundry and Entra ID Authentication (Caddy) • Marius Sandbu

🫆 Authentication

• From IST to SOLL: A Field Guide to Modernizing Entra ID Authentication • Kenneth van Surksum

• Afterthoughts: I said SMS and voice were being removed • Per-Torben Sorensen

• Phishing-Resistant MFA: Planning Your Passkey Rollout in Microsoft 365 • Nathan Hutchinson

• How to Move to Passkeys as the Default in Microsoft Entra • Jon Towles

• Microsoft Entra makes passwordless registration easier, but what does this mean for Zero Trust? • Rahul Jindal

• 📺 Device-Bound vs Syncable Passkeys [Admin’s Decision Guide] • Ru Campbell

• 📺 How to Delay Microsoft’s Passkey Rollout (Opt-Out Guide) • Jonathan Edwards

• 📺 Your MFA Won’t Stop This. Here’s What Will • Jonathan Edwards

👥 User & Group Management

• Farewell to memberOf Dynamic Groups • Julian Rasmussen

• Mastering Groups: The Deep Dive • Jonathan Hope

• 📺 Microsoft Is Changing Entra Dynamic Groups – Are You Ready? • Andy Malone

🤖 DevOps & PowerShell

• WAM Bam, Thank You Ma’am. What Changed in the Microsoft Graph SDK • Ben Whitmore

• Microsoft Needs To Proactively Prevent Typosquatting (how I almost got owned) | by Ethan Word | Aug, 2026 • Ethan Word

🚦 Conditional Access

• Entra Admin Center Flags Licensing Problems with Conditional Access • Tony Redmond

🖥️ Devices

• Windows Hello for Business • Keith Doolan

🥷 Security

• 📺 Nested APP Authentication - Undocumented Risk and Conditional Access Bypass • Jun-Sheng Shi and Shang-De (John) Jiang

📒 Tenant Configuration

• Microsoft is Tracking your Entra ID License Usage – Are You Compliant? • Rudy Mens

• Are Microsoft preparing license enforcement for Entra ID? • Daniel Bradley

🛍️ External ID - Customers

• How does Microsoft’s SMS retirement affect CIAM products • Rory Braybrook

• Using strong authentication and email/SMS OTP as second-factor MFA via native auth in Entra… • Rory Braybrook

🔥 Maester

👨🏽‍💻 Merill’s corner

• Microsoft Entra agent users can join your dynamic groups. Here is what to check • Merill Fernando

• Want to get featured on Entra.News? → Submit your content 😎

• Want us to say nice things about your company? Sponsor entra.news 🤩

• Love the newsletter? Tell us 💚❤️💜

🪃 Acknowledgement of Country

Entra.News is created on Wurundjeri land and acknowledges the traditional owners of country throughout Australia, recognising their continuing connection to land, water and community. We pay our respect to them and their cultures and to elders both past and present.

In this episode of Entra.Chat, Merill speaks with Jai Maharaj, Product Manager at Microsoft, about the practical journey from legacy MFA to a passwordless Microsoft Entra environment. Jai explains what is actually being retired, why organizations can still use a customer-managed telecom provider, and how passkey profiles support synced and device-bound passkeys for different user personas.

The user-experience case is compelling: Microsoft reports roughly 69 seconds for password plus traditional MFA compared with about three seconds for a synced passkey. The security case is stronger still. Passkeys resist phishing by design, but Jai stresses that deploying them does not make an organization phishing-resistant until it enforces the right authentication strength and addresses the passwords and legacy applications still in the environment.

The conversation then follows the complete identity lifecycle. How do you ensure the right person receives a passkey during onboarding? How do you verify someone requesting a sensitive role? How do you recover an account without relying on knowledge-based help-desk questions? Jai connects those scenarios to Microsoft Entra Verified ID, verifiable credentials, Face Check, identity verification partners, and self-service account recovery.

Sponsored by

Scan, Score, and Secure Your Applications in Entra

Application identities represent one of the largest attack surfaces in Entra and are often among the least consistently governed. ENow AppGov Score helps IT and identity teams understand where risk exists. Its 25-check assessment evaluates Entra ID application integrations against Microsoft-recommended governance practices, analyzing:

• App registrations and enterprise apps for excessive permissions

• Expired or unmanaged secrets and certificates

• Risky consent grants

• Privileged service principals

Results are delivered as a clear, defensible risk score with actionable findings. No scripts. No manual inventory. Just a fast, read-only scan that reveals app sprawl, identity misconfigurations, and blast radius so you can prioritize remediation and strengthen your security posture.

Scan Your Tenant – No Cost

Subscribe with your favorite podcast player or watch on YouTube 👇

About Jai Maharaj

Jai Maharaj is a Senior Product Manager at Microsoft. He works with customers and engineering teams across Microsoft Entra, with experience spanning ID Governance, Verified ID, External ID, and passkeys. He helps enterprise and public-sector organizations move from legacy authentication methods to phishing-resistant authentication.

• LinkedIn - https://www.linkedin.com/in/jai-maharaj-0938305a/

Related Links

• Microsoft-managed SMS and voice retirement timeline (discussed at 02:19 and 06:31) - https://learn.microsoft.com/entra/identity/authentication/concept-sms-voice-retirement

• Customer-managed telecom provider FAQ (mentioned at 03:41 and 07:13) - https://learn.microsoft.com/entra/identity/authentication/phone-providers-faq

• Passkey profiles, synced passkeys, and device-bound passkeys (discussed at 09:44) - https://learn.microsoft.com/entra/identity/authentication/how-to-authentication-passkeys-fido2#passkey-profiles

• Passkey concepts and Microsoft performance figures (mentioned at 14:22) - https://learn.microsoft.com/entra/identity/authentication/concept-authentication-passkeys-fido2#what-are-passkeys

• Microsoft Entra Verified ID Face Check (introduced at 31:57) - https://learn.microsoft.com/entra/verified-id/using-facecheck

• ASD/ACSC Essential Eight maturity model (mentioned at 33:41) - https://www.cyber.gov.au/business-government/asds-cyber-security-frameworks/essential-eight/essential-eight-maturity-model

• Microsoft Entra account recovery overview (discussed at 36:59) - https://learn.microsoft.com/entra/identity/authentication/concept-account-recovery-overview

• Verified ID identity verification partners (discussed at 37:12) - https://learn.microsoft.com/entra/verified-id/idv-partners

• Microsoft Entra licensing (discussed at 39:27) - https://learn.microsoft.com/entra/fundamentals/licensing

• Verified ID and Face Check pricing model (discussed at 39:27) - https://learn.microsoft.com/entra/verified-id/verified-id-pricing

• Deploy phishing-resistant passwordless authentication (mentioned at 52:34) - https://learn.microsoft.com/entra/identity/authentication/how-to-deploy-phishing-resistant-passwordless-authentication

Related Entra.Chat Episodes

• Microsoft Is Auto-Enabling Passkeys in March 2026 - https://entra.news/p/microsoft-is-auto-enabling-passkeys

• Mastering Microsoft Entra ID: Real-World Passkey Deployment Tips - https://entra.news/p/mastering-microsoft-entra-id-real

• Entra Ignite Recap: Synced Passkeys, Agent ID & The Future of Identity - https://entra.news/p/entra-ignite-recap-synced-passkeys

Chapters

00:00 Intro

02:19 Why Microsoft Is Retiring Managed SMS and Voice

03:32 What the February 2027 Deadline Means

09:27 Synced vs Device-Bound Passkeys

14:22 From 69 Seconds to Three

19:02 Making Passkeys Easier for Users

23:14 Customer Passkey Deployment Lessons

28:41 The Secure Bootstrapping Problem

31:57 Verified ID and Face Check

33:41 Essential Eight and High-Value Access

36:24 Self-Service Account Recovery

39:27 Licensing and Recovery Economics

44:45 Why Face Check Augments Passkeys

49:40 Enforce Phishing Resistance and Build a Roadmap

Podcast Apps

Apple Podcast - https://entra.chat/apple

YouTube - https://entra.chat/youtube

Spotify - https://entra.chat/spotify

Overcast - https://entra.chat/overcast

Pocketcast - https://entra.chat/pocketcast

Others - https://entra.chat/rss

Merill’s socials

YouTube - youtube.com/@merillx

LinkedIn - linkedin.com/in/merill

Twitter - twitter.com/merill

TikTok - tiktok.com/@merillf

Bluesky - bsky.app/profile/merill.net

Mastodon - infosec.exchange/@merill

Threads - threads.net/@merillf

GitHub - github.com/merill

Lots happening in Entra this week, including the retirement of the memberOf operator for dynamic groups and administrative units, new passkey updates, changes to managed policies, and more.

Also, don’t miss my latest podcast with Andres Canello, where we dive into migrating from existing VPN and SSE solutions to Microsoft Entra Global Secure Access.

Enjoy!

Sponsored by:

88% say AI has outrun their identity stack

AI agents are already making production API calls, running workflows, and touching sensitive data. Your written policies can’t regulate what a machine does at runtime or prove its actions.

FusionAuth’s 2026 State of AI and Identity Report surveyed over 300 technology leaders on the gap:

• 88% say AI adoption has outrun their identity and security readiness

• The more confident a team is in its AI posture, the more likely it’s had a confirmed incident

• Multi-tenant SaaS identity environments report far higher incident rates than isolated or self-hosted deployments

In an AI world, your deployment model is a security decision. Get the data.

Get the 2026 report

⚡️ Microsoft

🏆 General Availability

• RM558853 - Microsoft Teams: Entra passwordless resource account support for Teams Rooms on Windows and Android devices

🔥 Public Preview

• Token Protection deployment guide - Web apps (Preview) • Microsoft Learn

• Analyze provisioning logs with Microsoft MCP Server for Enterprise (Preview) • Microsoft Learn

• Advance Zero Trust for AI: New tools and guidance to secure AI agents and DevSecOps • Ron Pessner

📖 Read

• Microsoft may enable managed policies after 30 days in Report-only, shortened from 45 days, with the notification period also shortened from 28 days to two weeks

🗣️ Message Center

• MC1450134 - Microsoft Entra: Windows Hello for Business and macOS Platform SSO as standalone MFA factors

• MC1450133 - Microsoft Entra: Users can register a passkey or passwordless sign-in as their first multifactor authentication method

• MC1448379 - Microsoft Entra ID: Replace MemberOf rules by November 3, 2026

• MC1447671 - Microsoft Entra: Migrate GitHub Actions federated identity credentials to immutable subjects

• MC1325414 - Microsoft Entra ID SSPR will require registered authentication methods starting November 9, 2026

Sponsored by:

What’s been left exposed in your Microsoft 365 tenant?

The devices Defender never picked up, the dead Teams and SharePoint sites, the forgotten Entra apps, the shared mailboxes nobody owns. None of it looks urgent. All of it is exposure: standing access, unprotected devices, and data nobody is watching. Inspect 365 finds it, prioritizes what matters, and tracks each one from review to resolved.

Continuous Microsoft 365 tenant hygiene, built to find and address security risks:

• Small enough to do. Prioritized by impact, so you start with the few that matter, not the whole list.

• Documented as you go. Every decision recorded with its note.

• Provable after. What got resolved, what got accepted and why, whether you bill for the work or answer for it.

Connect a tenant in minutes and see what’s exposed in yours.

See what's in your tenant

From the community…

🚀 Most popular posts from last week

• 🥇 Conditional Access Visualizer & Deployer Tool • Joey Verlinden

• 🥈 Conditional Access Framework (2026.6.1) • Joey Verlinden

• 🥉 Why Intune Devices Became Noncompliant After the July Windows Update • Rudy Ooms

☀️ Learn

👩‍✈️ AI & Copilot

• Manage your AI Agents at Scale with Entra Agent ID • Brian Veldman

🧰 Workload ID

• Bypassing the IMDS cache • Jos Lieben

• 📺 No more passwords: The future is now! • Ben Reader

⛑️ ID Protection

• User Risk with Unified Identity Signals from Defender is here! • Michael Morten Sonne

👮‍♂️ ID Governance

• No Guest? No Problem: Direct External Assignments in Microsoft Entra • Colby Pryor

• Updated ECMA2Host Tools with Entra Application Provisioning Job Management • Darren Robinson

🌐 Private Access & Internet Access (GSA)

• New Entra ID Private Connector version • Benoit HAMET

📦 Apps

• How to prevent users from registering applications in Microsoft Entra • Daniel Bradley

🫆 Authentication

• Microsoft Entra Just Made Passwordless MFA Registration Easier • Daniel Bradley

• System-Preferred Authentication and September 1st Passkey Change • Shehan Perera

• Windows Hello for Business (WHfB) in Practice • Marco Wohler

• 📺 Microsoft Is Killing SMS MFA • Jonathan Edwards

• 📺 Why Your Passkeys Deployment Fails [5 Major Pitfalls] • Ru Campbell

👥 User & Group Management

• Access Microsoft Entra Group Insights with Group Analytics API • Blesslin Rinu

• Entra ID Enables Blocking for Nested Security Groups • Tony Redmond

• Entra ID Drops the memberOf Rule Operator for Dynamic Groups and Dynamic Admin Units • Tony Redmond

• Microsoft Entra Retires the MemberOf Rule Operator for Dynamic Membership Rules • Kanaga

• Microsoft Entra ID Is Retiring the MemberOf Rule for Dynamic Groups • Rudy Mens

• The memberOf rule operator is ending for dynamic Groups in Entra • Daniel Bradley

• Replacing MemberOf in Entra after it is deprecated • Jos Lieben

🚦 Conditional Access

• CA Baseline changes affecting Citrix Authentication • Julian Jakob

• How to Set Up Microsoft Entra Terms of Use • Mark Oldham

• 📺 MFA vs Conditional Access | They’re Not the Same Thing! • Travis Roberts

• 📺 Microsoft Entra Terms of Use Require Acceptance Before Microsoft 365 Access • Mark Oldham

🖥️ Devices

• Hide the AVD SSO Consent Prompt • Flavio Meyer

• Strengthening Endpoint Security with Device Lock Policies in Microsoft Intune • Nicky De Westelinck

• Entra Cloud Sync now allows Active Directory devices synchronization • Benoit HAMET

• 📺 Entra Join vs Hybrid Join vs Registered FINALLY Explained! • Andy Malone

🏙️ External ID - Guests & Multi-Tenant Organizations

• Securing Microsoft Entra Guest Access: Cross-tenant Access Settings and MFA Trust • Oliver Mueller

🥷 Security

• Borrowing Windows Hello keys for authentication and persistence • Dirk-jan Mollema

• Audit your entra permissions with LeastPrivilegedEntra • Morten Mynster

• Pass-the-Passkey v2.pdf • Michael Grafnetter

  

♻️ Sync

• 📺 Microsoft Entra Cloud Sync Just Got Better! New Features August 2026 • Andy Malone

📒 Tenant Configuration

• 📺 Microsoft Entra Identity Architecture – Why Identity Is Your Most Important Security Decision • Shabaz Darr

🛍️ External ID - Customers

• Using OIDC federation via native auth in Entra External ID (EEID) • Rory Braybrook

• Using social federation via native auth in Entra External ID (EEID) • Rory Braybrook

👨🏽‍💻 Merill’s corner

• Want to get featured on Entra.News? → Submit your content 😎

• Want us to say nice things about your company? Sponsor entra.news 🤩

• Love the newsletter? Tell us 💚❤️💜

🪃 Acknowledgement of Country

Entra.News is created on Wurundjeri land and acknowledges the traditional owners of country throughout Australia, recognising their continuing connection to land, water and community. We pay our respect to them and their cultures and to elders both past and present.