
Daddy, nurd, VR lover, dune obsessed, battletech pilot... 3 crazy warhammer 40k'er sons who love their tech, an amazing wife and now a #miee
England, United Kingdom
Joined February 2019
- Tweets1.7K
- Following133
- Followers91
- Likes1.2K
ABaldock retweeted
โ ๏ธ ๐๐ฒ๐ณ๐ฒ๐ป๐ฑ๐ฒ๐ฟ๐: ๐๐ฎ๐๐ฐ๐ต ๐ณ๐ผ๐ฟ ๐๐ผ๐ฐ๐๐ฆ๐ถ๐ด๐ป-๐๐ต๐ฒ๐บ๐ฒ๐ฑ ๐ ๐๐๐๐๐๐.๐๐๐ ๐ฑ๐ผ๐บ๐ฎ๐ถ๐ป๐
โ
A quick hunt in Microsoft Defender XDR Threat Intelligence Explorer surfaced ๐ฎ๐ฏ๐ฌ ๐ฑ๐ผ๐บ๐ฎ๐ถ๐ป ๐ถ๐ป๐ฑ๐ถ๐ฐ๐ฎ๐๐ผ๐ฟ๐ ๐ถ๐ป ๐ข๐ฐ๐๐ผ๐ฏ๐ฒ๐ฟ ๐ฎ๐ฌ๐ฎ๐ฒ matching the DocuSign theme on ๐ ๐๐๐๐๐๐.๐๐๐
โ
Worth checking your environment for:
๐ง URLs observed in email
๐ Outbound network connections
๐ DNS/proxy activity
๐ป Endpoint telemetry
โ
๐๐๐ป๐๐ถ๐ป๐ด ๐ถ๐ฑ๐ฒ๐ฎ: look for unexpected ๐๐๐๐๐๐๐๐-*.๐ ๐๐๐๐๐๐.๐๐๐ activity and investigate any hits.
โ
Small IOC patterns can sometimes reveal a much larger campaign footprint.๐ซก
โ
#ThreatHunting #DefenderXDR
Not more bloody change, can't they just remove copilot bloat first, fix windows 11, solve the other 10000+ issues first oh and make in simpler for some items to be actioned in a gui. Not everyone loves powerhell, sorry grump old computer user who lived before mouses...
Important: Get ready to migrate to Microsoft Entra Cloud Sync!
As organizations look to strengthen identity security and advance their Zero Trust strategies, many are looking for simpler, more reliable ways to manage hybrid identity.
To support these needs, Microsoft is beginning the transition from Microsoft Entra Connect Sync to the cloudโnative Microsoft Entra Cloud Sync - helping reduce onโpremises complexity while improving security, reliability, and dayโtoโday manageability.
This shift is a key step toward a cloud-managed identity future that will provide a more secure, resilient, and easier-to-operate synchronization experience. As part of ongoing modernization efforts, Microsoft's strategy remains to deliver stronger security, improved reliability, and simpler identity operations.
๐๐ก๐๐ญ'๐ฌ ๐ง๐๐ฑ๐ญ:
Beginning in Julyโฏ2026, Microsoft will begin notifying customers about their individual transition timelines. The transition will be rolled out in phases, and Microsoft will reach out directly to each organization when their assigned transition window begins. This phased approach ensures that Microsoft can provide tailored guidance and support to all its customers.
- Initial phases: In the first waves, Microsoft will focus on tenants for whom Entra Cloud Sync already meets all their identity synchronization needs. If your organization relies on advanced features or has a large directory, you will not be among the initial targeted groups. Microsoft will prioritize early transitions for customers with straightforward configurations that are fully supported by Entra Cloud Sync's current capabilities.
- Subsequent phases: As Entra Cloud Sync's capabilities expand, Microsoft will progressively notify the later groups and ensure they can transition successfully once equivalent support is available in Entra Cloud Sync
๐๐ก๐๐ญ'๐ฌ ๐๐ก๐๐ง๐ ๐ข๐ง๐ :
Once your organization is notified of its assigned transition window, you will receive detailed guidance and resources to help you begin the move to Entra Cloud Sync. During this period:
- You will have to review your current configuration, assess readiness, and familiarize yourself with Cloud Sync's capabilities.
- You will gain access to the transition tool and step-by-step documentation to support a smooth transition.
- You will move and test your synchronization environment in Entra Cloud Sync before any permanent changes are made.
Once your transition to Entra Cloud Sync is successfully completed:
- Entra Cloud Sync will be the primary mechanism for identity synchronization capabilities between Active Directory and Entra ID, replacing the identity sync functionality in Entra Connect tool.
๐๐ก๐๐ญ'๐ฌ ๐ง๐จ๐ญ ๐๐ก๐๐ง๐ ๐ข๐ง๐ :
Once you migrate to Cloud Sync, your hybrid authentication features that enable onโpremises credentials to be used for accessing cloud resources will continue to be available after migration on the Connect Sync config wizard.
#Microsoft365 #EntraID
ABaldock retweeted
I had the attackerโs IP. I had the logs. But I was powerless to stop them. ๐คฏ
This is the "Identity Trap" @LouisMastelinck (Microsoft MVP) revealed on the latest Entra Chat.
Most of us think weโre safe because we have Guest Access policies and MFA turned on. But Louis shared a nightmare scenario: Email OTP.
Because it doesn't always create a full user object, your incident response tools are effectively toothless.
โ You canโt revoke the session.
โ You canโt "Block User."
โ You're just a spectator to your own breach.
Louis joined me for a masterclass in Entra ID reality. We didn't just talk features; we talked war stories.
Whatโs inside this episode:
๐ฅ The "Kill SMS" Blueprint: A script-free method to move thousands of users to the Authenticator app overnight.
๐ฉ The "Bad Reputation" Flag: A secret new Entra log feature that tells you exactly which phone numbers are "dirty."
๐ก๏ธ The Passkey Reality Check
๐ซ SharePoint vs. Entra: Why the "Entra B2B Integration"...
Stop checking boxes and start building real identity security. Louis brings the energy, the technical depth, and the "war stories" to show you how.
Watch the full deep-dive on the Entra.Chat podcast today!
ABaldock retweeted
A simple, lightweight PowerShell script to remove pre-installed apps, disable telemetry.
ABaldock retweeted
๐ก My Cybersecurity Home Lab Mini SOC Environment
Over the past few months, I built a fully virtualized home lab designed to mimic a real SOC environment combining offensive testing, defensive monitoring, and layered security.
ABaldock retweeted
Minecraftโs #HourOfAI activity is here!
Unlock AI education for learners of all ages alongside @PlayCraftLearn & @CSforAll.
Learn more: msft.it/6013t3q0J
#MicrosoftElevate #HoAI #MinecraftEdu
ABaldock retweeted
Copilot Teach is now free for teachers using Microsoft 365!
โข Develop lesson plans
โข Produce flashcards and study aids
โข Generate rubrics
Get started with this guide:
clouddesignbox.co.uk/microsoโฆ
#MicrosoftEducation #AIEducation #EdTech #TeachingTools
ABaldock retweeted
Fun fact - every org that uses Intune is licensed for ConfigMgr which means licensed for CMTrace/OneTrace
Ideally, they would make OneTrace freely available, but for now, go download the ConfigMgr installer and get your log reader ๐
Reference: learn.microsoft.com/en-us/inโฆ
CMTrace.exe requires a SCCM license, so if you`re unlicensed you should use LogExpert instead to analyze @MSIntune logs. Heck, you can even use the free version of @MasterPackager to create a MSI.
github.com/LogExperts/LogExpโฆ
ABaldock retweeted
When staff feel โalways on,โ wellbeing and retention take a hit.
1๏ธโฃ Set quiet hours
2๏ธโฃ Schedule focus time
3๏ธโฃ Schedule messages/emails
4๏ธโฃ Use Cloud Design Box โ fewer platforms, clearer communication
5๏ธโฃ Promote balance โ remind staff to switch off
#SchoolLeadership #Wellbeing
ABaldock retweeted
Learn about this week's big AI announcements at "What's New in Microsoft EDU" - October 2025 webinar ๐
Agenda:
โ
AI features coming for ALL M365 Educators & Students
โ
Learning Zone
โ
M365 LTI integration for LMSes
โ
Q&A
๐
Wed Oct 22nd, 8am PST
๐
Wed Oct 22nd, 4pm PST
ABaldock retweeted
Love this!
This week @MicrosoftEDU launched the new AI-powered "Teach" module in the Microsoft 365 Copilot app and Teams EDU.
This is great and allows educators to create lesson plans, assessments and study aids based on your content all in one place.
#edtech #MicrosoftEDU
@mtholfsen
ABaldock retweeted
What is Maester? [1]
Maester is a PowerShell-based test automation framework that helps you stay in control of your Microsoft security configuration. Such an awesome tool - test details can be filtered by passed, failed, and skipped. Failed tests come with detailed recommendations on how to do better.
I strongly recommend running Maester periodically to secure your Microsoft 365 tenant, in addition to running PingCastle in your On-Prem AD environment.
[1] maester.dev/
ABaldock retweeted
Students can now see comprehension questions alongside the reading text.
Instead of answering at the end, they can look back at the passage as they work, making it easier to answer accurately and with confidence.ย
More info: clouddesignbox.co.uk/microsoโฆ
#ReadingSkills
ABaldock retweeted
๐ฃ My fellow #PowerShell #MVP Fabien Tschanz has released PS2EXE.Core.
Converts a PowerShell Script *.ps1 to an *.exe File. ๐
It has been released in PowerShell #Gallery. Check it out ๐ฅ
bit.ly/4fCdYni
ABaldock retweeted
NEW BLOG; How to store Defender XDR data for years in Sentinel Data Lake without expensive ingestion cost
Blog: jeffreyappel.nl/how-to-storeโฆ
#MicrosoftSecurity
ABaldock retweeted
โ๏ธ Suggest individualized practice.
โณ Set specific time goals for students.
๐ Monitor achievements, adjust strategies.
๐๏ธ Toggle between teacher and student mode.
Read more about new Reading Coach #AI features: msft.it/6016sMDhO
ABaldock retweeted
Download Microsoft Security Compliance Toolkit 1.0 microsoft.com/en-us/downloadโฆ #Security #baselines #win11 #M365apps #lgpo
ABaldock retweeted
Here's a decision tree to help developers and admins who manage Microsoft 365, Azure and Entra tenants, pick the most secure authentication method for their apps.
๐ฏ Managed Identities
The best option for app secrets is to not have any secrets in the first place. This way, you're app credentials can never be leaked.
Where possible, always choose to use managed identities in Azure and similar features in other platforms like AWS and GCP.
Did you know that with Managed Identities in Azure, no one, including the Global Administrator, can access the underlying credential?
With managed identities, identities are provided and deleted with Azure resources.
๐ฏ Workload Identity Federation
With workload identity federation, you can set up Microsoft Entra ID to trust 3rd-party identity provider tokens from services like AWS, GitHub, and Google Cloud.
For example, using this approach, an app running on AWS with an identity in Amazon Cognito can present its Cognito token to Entra ID to access Entra-protected resources like Azure OpenAI or Microsoft Graph.
๐ฏย Certificates
Not all services in Azure support Managed Identities yet, and there maybe instances where workload identity federation might not be an option.
The next best method is to use certificates for app authentication.
When using certificates, you are responsible for using short lived certificate expiry, protecting the private key from being leaked and rotating the cert when it expires (or if there is a compromise).
You also need to worry about application outage while the cert is being rotated (unless your devs add support for multiple active keys).
๐ฏ Client ID & Secret
This is by far the most used app authentication method because of its simplicity. Unfortunately, this is also the reason credentials are leaked quite easily and unintentionally.
Dangers include secrets checked into code, secrets left lying around on unencrypted text files, etc. Leaked credentials grant easy access to your data to threat actors.
Where possible, help your devs and vendors move off client secrets to using stronger authentication like managed identities and certs.
๐ฏ Learn more
โก๏ธ To learn more about avoiding common app-related security pitfalls, see this recent post by Brian Melton-Grace.
devblogs.microsoft.com/identโฆ
โก๏ธ To learn about workload identity federation, see
learn.microsoft.com/en-us/enโฆ
โก๏ธ To learn about using Entra conditional access policies for workload identities, Workload Identity Protection, and setting tenant policies to block the use of secrets, see
learn.microsoft.com/en-us/enโฆ
Note: Some of these advanced workload protection capabilities require a Workload ID Premium licence for each app. See the FAQ page linked above for details.
If you found this helpful, please like and share this post with your network! Tx.








































