Entra.News #47: This week in Microsoft Entra

Learn about GA of multiple passwordless account support on Android, updates to sign-in logs and GA of the guest sponsor field.

Jun 02, 2024

👋 Hi, Merill here with this week’s round up of the latest news on Microsoft Entra from around the globe 🌍.

The Entra related news that makes me the happy is that Android users can finally add multiple passwordless PSI (phone sign-in) accounts to Authenticator 🥳.

Enjoy!

⚡️ Microsoft

🏆 General Availability

🔥 Public Preview

📖 Read

Tutorial: Customized reports in Azure Data Explorer (ADX) using data from Microsoft Entra ID • Microsoft Learn
Hunting for MFA manipulations in Entra ID tenants using KQL • Thabet Awad
Demystifying Microsoft Entra ID, Tenants and Azure Subscriptions • Ricardo Macedo Martins
Addressing common Entra Id protection deployment and maintenance issues • Chad Cox
May 2024: A look at the latest Microsoft Entra key feature releases, announcements, and updates • Samiksha Gupta
Securing access to any resource, anywhere • Joseph Dadzie
6 insights from Microsoft’s 2024 state of multicloud risk report to evolve your security strategy • Andrew Conway

🗣️ Message Center

From the community…

☀️ Learn

🛍️ External ID - Customers

Using native authentication in Entra External ID to sign in a user with email and OTP • Rory Braybrook

👮‍♂️ ID Governance

Monitor Lifecycle Workflows status in Entra ID Governance • Christian Frohn
Privileged Access Management in Microsoft 365 • Admin Droid
Harnessing Terraform for Entra ID Identity Governance: A Leap into IaC 🚀🔐 • Manish Periwal

🌐 Private Access & Internet Access (SSE)

Goodbye, VPN: Part 1 - This is private • Steve Weiner
Secure Azure File Shares Access With Microsoft Entra Private Access • Charbel Nemnom

🔑 Authentication

Implement a Microsoft Entra ID External Authentication Method using ASP.NET Core And OpenIddict • Damien Bowden
Why No Windows Support for Microsoft Authenticator • Brian Baldock
UPDATED information about passkeys in Entra ID • Per-Torben Sørensen
Microsoft enforces tenant-level MFA in July! What should I know? • Tommi Hovi

👥 Group Management

Entra ID Dynamic Groups – Direct reports of a manager • Jan Bakker

🤖 DevOps & PowerShell

How to Manage Microsoft Entra sign-in logs with PowerShell • Daniel Bradley

🚦 Conditional Access

Maximizing Security: Entra ID Sign-in Frequency Demystified • Simon Skotheimsvik
Using Conditional Access Policies to Block Tor Exit Nodes in Entra ID • John Fitzpatrick

📈 Reporting and Insights

Export M365 Group-Based License Assignment Report Using PowerShell • Office 365 Reports

🥷 Security

Evading Token Protection For EntraID/M365 (2024 Edition) • Edwin David (rootsecdev)
“Trust” in a world of Zero Trust • Matthew Levy
How adversaries use Entra ID service principals in business email compromise schemes • Justin Schoenfeld

⚒️ Toolkit

Streamlining Microsoft Azure Security Posture Checks with the Microsoft Azure CIS Checker Script • Shaun H
FIDO2/passkeys MFA Server for Microsoft External Authentication Method • Damien Bowden

🎙️ Podcasts

Passkeys in Microsoft Entra: Benefits, Implementation Tips & More | Security Swarm Podcast (35 min) • Jan Bakker, Andy Syrewicze

📺 Watch

Mac Platform SSO: Office, Edge, and Windows 365 Cloud PC (10 min) • Steve Weiner
How to make OneDrive prompt for MFA after Autopilot (14 min) • Steve Weiner
Discover What's New in Microsoft Entra: The Ultimate Guide (12 min) • Peter Rising
Microsoft Conditional Access - 7 New Features Admins MUST Know! (18 min) • Andy Malone
The strongest form of MFA? | Why your MFA may need an upgrade (49 min) • Nick Ross

🔥 Maester

OH CLIP: Quick Demo of Maester (6 min) • ViaMonstra Online Academy
Maester Github Actions integration (7 min) • Jan Bakker
Maester Azure DevOps integration (15 min) • Jan Bakker

👨🏽‍💻 Merill’s corner

Did you know that we started adding CISA tests to Maester.dev? Set up the monitoring with GitHub Actions, Azure DevOps or Azure Automation and get alerted whenever you tenant drifts away from the recommended config.

There's a healthy discussion over on Twitter about using groups vs explicit users as break glass in CA policies. For me the group vs user is just a small part of a bigger conversation. Here are more things you need to consider (read to the end, I have an answer). 👉 Someone forgets to exclude the BG user/group from a CA policy 👉 Someone is doing a clean-up and accidentally deletes the BG user/group 👉 Someone removes the GA role from the BG user/group 👉 Someone removes the auth method of the BG account 👉 Your BG uses FIDO2 and someone sets up an auth method policy that blocks the FIDO2 AAGUID (ps. this happened to me) 👉 The BG account gets disabled If there is anything else you've come across? Comment below? ✅️ My answer? Set up Maester.dev to monitor your tenant for these critical config items. Even if something gets changed years later it will get picked up. Fabian Bader wrote a bunch of tests for CA including one to check for BG exclusion on each policy. The best part is you can write your own tenant specific test and have them monitored daily and alert you. It costs $0 and less than half an hour to set up the automation. Maester, let's you define your security policy as code. The key configuration for your tenant can be codified and written as tests and checked into version history. This is better than documentation that no one reads or maintains after it is originally written. Even if the entire Identity team wins the lottery or (more likely) move onto different roles, the same tests can be running years later and will help junior team members that eventually take over from you. Dev teams have been doing this forever. It's time we in cybersecurity bring some rigour to the way we manage our tenants. After all, identity is the new control plane.

🪃 Acknowledgement of Country

Entra.News is created on Wurundjeri land and acknowledges the traditional owners of country throughout Australia, recognising their continuing connection to land, water and community. I pay my respect to them and their cultures and to elders both past and present.

Entra.News - Your weekly dose of Microsoft Entra

Discussion about this post