I'm evaluating AI SOC and MDR platforms that can automatically disable an on-premises Active Directory account when it detects that the account may be compromised. Many products appear…
Microsoft's reporting on device-code phishing highlights an awkward security tradeoff: device-code authentication is legitimate, but attackers can abuse it by persuading users to authorize a session on another…
We've seen device-code phishing attacks where an attacker uses an OAuth token to register a rogue device in Entra ID and obtain a Primary Refresh Token (PRT). Because…
We've been investigating device-code phishing attacks where an attacker authenticates through a device-code flow, obtains OAuth tokens, and then registers or joins a rogue device to Entra. The…
Our company recently started pushing passkey enrollment, and the messaging has created a lot of confusion. We initially understood that employees using the Microsoft Authenticator app could bypass…
I'm planning a Zero Trust security architecture for a relatively simple Microsoft 365 environment. We have a small number of internal users on managed devices, plus guest users…
I'm reviewing activity from an IT administrator account and need to determine whether it reflects legitimate administration or internal reconnaissance. The account generated numerous LDAP queries against domain…
I recently reviewed some old side projects and found more machine credentials than expected: CI access tokens for projects I abandoned years ago, deploy tokens for hosts I…
We use Azure Virtual Desktop with Conditional Access policies that block sign-ins from locations outside our approved office or home-country locations. We also have a travel-exemption policy that…
Microsoft is phasing out SMS and voice-based MFA in favor of passkeys and other phishing-resistant authentication methods. All of my users currently use Microsoft Authenticator push notifications with…
Data security has changed significantly as organizations move more systems and information into the cloud. If you were designing a cloud-first security program today, would you begin with…
I've spent the last few years rolling out the usual security basics across our organization: MFA everywhere, password managers, secure email gateways, regular phishing training, and the other…
Most of our core business applications are being migrated to SaaS, which would leave on-premises Active Directory and other Windows- and security-related infrastructure as the main services still…
An account already has Microsoft Authenticator and another authenticator app configured as its default sign-in methods. SMS and voice-call MFA are being phased out, but a phone number…