Father Engineer Learner Lurker | Microsoft MVP | AD, Entra & enterprise security specialist. Senior Security Consultant @trustedsec. Fellow Human Being.
Joined August 2011
- Tweets3K
- Following431
- Followers1.3K
- Likes7.7K
Pinned Tweet
I'm shaving my head again this year. Please consider donating to this great cause. Help me raise money for #childhoodcancer research with @StBaldricks. stbaldricks.org/participants…
This is the developer side of the Application. If you're the customer, you need a relationship with your vendors. Check for overly permitted apps and SPs in privileged roles. I'll be working on a write-up soon. In the meantime, Jeremy links Merills video which covers it briefly.
Re: the ConnectWise incident. App Instance Lock is the default in Entra ID as of June 2026. It's a good idea to go back now make sure it is enabled for multi-tenant apps: learn.microsoft.com/en-us/en…
Nice and quick explanation of the overlying issue with application credentials
I made a short video that explains Entra app permissions and the part they played in the ConnectWise incident: how one app credential reached 173+ Microsoft 365 tenants with no password or MFA, and what to check today.
youtube.com/watch?v=Q36aL_HI…
Tech Brandon retweeted
Did you know that if you have Entra ID P1 there is a new way to block your stolen refresh token from being replayed by the attacker?
Find out 🧵👇
1/7
Tech Brandon retweeted
🔒 Secure Bits 💡
𝗔𝗿𝗲 𝘆𝗼𝘂 𝗽𝗹𝗮𝗻𝗻𝗶𝗻𝗴 𝘁𝗼 𝗿𝗼𝗹𝗹 𝗼𝘂𝘁 𝗽𝗮𝘀𝘀𝗸𝗲𝘆𝘀 𝗶𝗻 𝗠𝗶𝗰𝗿𝗼𝘀𝗼𝗳𝘁 𝗘𝗻𝘁𝗿𝗮 𝗜𝗗 𝗮𝗻𝗱 𝗱𝗼𝗻𝘁 𝗸𝗻𝗼𝘄 𝘄𝗵𝗲𝗿𝗲 𝘁𝗼 𝘀𝘁𝗮𝗿𝘁?
I put together a step-by-step guide that will help you configure Passkeys from the perspective of System Administrator.
𝟭. 𝗖𝗵𝗼𝗼𝘀𝗲 𝘁𝗵𝗲 𝗽𝗮𝘀𝘀𝗸𝗲𝘆 𝘁𝘆𝗽𝗲𝘀
It will guide you on passkey types, what are they good for, what are the main differences between them and how to use each type.
𝟮. 𝗘𝗻𝗮𝗯𝗹𝗲 𝘁𝗵𝗲 𝗺𝗲𝘁𝗵𝗼𝗱 𝗮𝗻𝗱 𝗰𝗿𝗲𝗮𝘁𝗲 𝘁𝗵𝗲 𝗽𝗿𝗼𝗳𝗶𝗹𝗲𝘀
⚙️ Authentication methods > Policies > Passkey (FIDO2)
It will show you how to set up Passkey profiles. Each profile has its own attestation setting, passkey types and specifies allowed passkey hardware.
𝟯. 𝗦𝗲𝘁 𝘂𝗽 𝗧𝗲𝗺𝗽𝗼𝗿𝗮𝗿𝘆 𝗔𝗰𝗰𝗲𝘀𝘀 𝗣𝗮𝘀𝘀
It shows how to configure TAP so helpdesk can use it to onboard new users or recover lost or stolen passkeys.
𝟰. 𝗖𝗿𝗲𝗮𝘁𝗲 𝗮 𝗖𝗼𝗻𝗱𝗶𝘁𝗶𝗼𝗻𝗮𝗹 𝗔𝗰𝗰𝗲𝘀𝘀 𝘁𝗵𝗮𝘁 𝗿𝗲𝗾𝘂𝗶𝗿𝗲𝘀 𝗣𝗵𝗶𝘀𝗵𝗶𝗻𝗴-𝗿𝗲𝘀𝗶𝘀𝘁𝗮𝗻𝘁 𝗠𝗙𝗔
Finally it will guide you how to create Conditional Access policy that requires authentication strength, aka how to enforce the configured Passkey profiles with 𝗣𝗵𝗶𝘀𝗵𝗶𝗻𝗴-𝗿𝗲𝘀𝗶𝘀𝘁𝗮𝗻𝘁 𝗠𝗙𝗔
Also, check the client requirements before the pilot: iOS 17 or Android 14 and newer, a current Authenticator build, and Bluetooth turned on for both devices.
The guide has the exact settings, the requirements and the screenshots. Full PDF Link in the comments.
📢 Big shout out to @TechBrandon for his website Passkey Path:
techbrandon.github.io/passke…
Some of the practical tips are based on his work.
Are you already running passkeys in Entra? Which types did you pick for the admins, and which for the standard users?
𝘈𝘶𝘵𝘩𝘰𝘳: Martin Strnad
#SecureBits #EntraID #Passkeys #FIDO2 #PhishingResistantMFA #Microsoft365 #CyberSecurity
Tech Brandon retweeted
Mosey on up and join @SoberInCyber at the Deadwood Soda Saloon tonight from 6-9:00 PM during the Sponsor Stampede at @BHinfoSecurity @WWHackinFest!
🥤 Handcrafted sodas & a sparkling good time await ya.
soberincyber.org/events-1/so…
#WWHFDeadwood2026
ALT Sober in Cyber “Deadwood Soda Saloon” event graphic with a Western theme and Wild West Hackin’ Fest logo. Text reads: “Wednesday • October 7 • 6–9:00 PM,” “Located in the back of Miss Kitty’s Mercantile,” and “649 Main Street, Deadwood, SD.” Center photo shows people seated at the Deadwood Soda Saloon bar on novelty stools shaped like the backs of horses.
I blogged again! That's like 3 blogs in 3 weeks ... And I'm working on another one for October.
Logging isn't a switch to flip; it's something to tune and maintain. In our new blog, @TechBrandon outlines a four-step #ActiveDirectory logging framework covering log sizing, audit policies, detection goals, and gap analysis. Read it now! hubs.la/Q04zj5P50
Accidentally happened upon this banger. In a world full of AI music, they choose to troll us old school.
👏 @Wendys 👏
“Songs to Listen to in a Wendy’s Parking Lot” is available everywhere you stream music. wendys.lnk.to/SongsToListenT…
Tech Brandon retweeted
💡 𝗦𝗲𝗰𝘂𝗿𝗲 𝗕𝗶𝘁𝘀 🔒
𝗔𝗰𝘁𝗶𝘃𝗲 𝗗𝗶𝗿𝗲𝗰𝘁𝗼𝗿𝘆 𝗽𝗿𝗶𝗺𝗮𝗿𝘆𝗚𝗿𝗼𝘂𝗽𝗜𝗗: 𝗰𝗵𝗲𝗰𝗸 𝘄𝗵𝗮𝘁 𝘆𝗼𝘂𝗿 𝘁𝗼𝗼𝗹𝘀 𝗮𝗿𝗲 𝗮𝗰𝘁𝘂𝗮𝗹𝗹𝘆 𝗿𝗲𝗽𝗼𝗿𝘁𝗶𝗻𝗴
Active Directory group membership is not only defined by the member / memberOf attributes. A user can also be a member of a group through their primaryGroupID.
𝗧𝗵𝗶𝘀 𝗰𝗿𝗲𝗮𝘁𝗲𝘀 𝘀𝗼𝗺𝗲 𝗶𝗻𝘁𝗲𝗿𝗲𝘀𝘁𝗶𝗻𝗴 𝗶𝗻𝗰𝗼𝗻𝘀𝗶𝘀𝘁𝗲𝗻𝗰𝗶𝗲𝘀:
🔹 Get-ADGroupMember returns users whose primaryGroupID points to the group.
🔹 Get-ADGroup -Properties member does not.
🔹 Get-ADUser -Properties memberOf does not show the primary group either.
🔹 net group does include these users.
It gets even more interesting with nested groups: recursive queries can miss users whose membership exists through primaryGroupID.
This matters especially for monitoring privileged groups. If your scripts or security tools look only at the group object’s member attribute, you may not be seeing the complete membership.
⚠️ There is also a technique where an attacker can deny read access to primaryGroupID on an unprotected user object, making the relationship even harder to discover through common AD and PowerShell tooling.
𝗣𝗿𝗮𝗰𝘁𝗶𝗰𝗮𝗹 𝗰𝗵𝗲𝗰𝗸:
Get-ADUser -Property primaryGroup,primaryGroupID -Filter {-not(primaryGroupID -like "513")} |
Select-Object Name,primaryGroupID,primaryGroup
For normal user accounts, 513 represents Domain Users. Non-standard values are therefore worth reviewing rather than assuming your normal group-membership enumeration has caught everything.
➡️ 𝗧𝗵𝗲 𝗯𝗶𝗴𝗴𝗲𝗿 𝘁𝗮𝗸𝗲𝗮𝘄𝗮𝘆: test how your monitoring actually enumerates AD group membership. Different methods can return different answers.
Author: @TechBrandon (🔗Full article is in the comments)
#ActiveDirectory #WindowsSecurity #CyberSecurity #IdentitySecurity #BlueTeam
Newest blog dropped. Check it out for a quick resource on why Device Platforms should not be considered a security control for your CAPs. petri.com/bypass-entra-condi…
Wow. I'm super mixed on this. Seems that orgs with good intentions may have users pushed into unintended methods. On the other hand, I'm a huge supporter of "synced passkeys are better than no passkeys". Join me for more passkey chaos: xitter.cf/TrustedSec/status/2102…
Folks, you might have been caught out by this but it's what Microsoft said they would do, according to the docs.
Since Sept 1, tenants with an attestation-enforced or AAGUID-restricted passkey policy are suddenly seeing users register synced and browser passkeys. Admins are asking "why isn't Microsoft respecting my FIDO2 policy?"
Here's what's going on.
The "Passkeys by default" retirement page on Learn (published July 14) says this in its Important box:
"Users enabled for SMS or Voice ... will be auto-enabled for passkeys in AMP. These in scope users will be put into a passkey profile allowing ALL types of passkeys. Your Registration Campaign settings will be set to Microsoft Managed state targeting passkeys."
Two important notes:
1. Passkey profiles are a union. If a user is in more than one profile, a passkey only has to satisfy ONE of them. So your attestation-enforced profile is still there. Microsoft just added a second, unrestricted profile next to it for every SMS/voice user, and that one wins for registration.
2. Your registration campaign state doesn't protect you. Disabled, Enabled, doesn't matter. The doc says it gets set to Microsoft Managed regardless, which is why some of you saw your campaign config wiped with Microsoft in the audit log. Even with the campaign off, the new profile lets users self-register a non-attested passkey from My Security Info.
The ONLY way to avoid this was the opt-out flag on the authentication methods policy:
PATCH graph.microsoft.com/beta/pol…
{ "optOutSettings": { "passkeyDynamicMigration": true } }
Or moving users out of SMS and voice before Sept 1.
Where Microsoft dropped the ball: the Message Center post (MC1426371) only says "passkeys will be automatically enabled for users currently enabled for SMS or voice." It never mentions a new unrestricted profile or that your attestation/AAGUID restrictions would be bypassed. And MC1469555 says the campaign "does not override configured passkey policies", which is technically true and practically misleading. The passkey profile part is only on Learn.
So: not a bug, but a really important detail buried in one paragraph on a docs page.
What to do now:
- Look at your passkey profiles for a Microsoft-created one with both passkey types and no restrictions, and check who's targeted.
- Set the opt-out flag if you need attestation to hold, then clean up that profile. Note the doc says the flag stops working Feb 1, 2027.
- If you already had the flag set and it still changed, that IS a bug. Open a case.
Docs: learn.microsoft.com/entra/id…
Flying home from a successful client engagement. Excited to see my family and slightly less excited to meet my brand new Mac Studio.
I wanted to get out a quick blog this afternoon, not because of urgency, but because this is a 3+yr old problem that I keep seeing. I should have named it F*ck Teams. techbrandon.github.io/entra/…
Anything you want to know or think should specifically be covered? Looking forward to sharing some real world advice on how to make Passkeys possible.
Passkeys are changing the game—and the timeline for adoption got expedited. Join @paulsems, @TechBrandon, and Jason Crawford on Wed, October 7 for "AMA: Passkeys and Preventing Credential Theft" and get answers to your #passkey questions. Register now! hubs.la/Q04y2N1w0
I'll be speaking at 2026 CornCon Cybersecurity Conference on Oct 01 - 03, 2026. I would love to see you there!
Register here: whova.com/portal/registratio…
#CornCon
Not much has changed with passkeys but despite your current role, it's time to get familiar with Entra's implementation
UPDATE 📣 Organizations used to ask themselves "if" they'd adopt passkeys; #Microsoft decided the "when" for us, as of Sept 1, 2026. Our updated blog by @TechBrandon covers how Entra is implementing passkeys and what every role needs to know. Read it now! hubs.la/Q04xyjR40
Agents in AD are going to be indistinguishable from user based service accounts, or even user accounts themselves. But TBH, Entra is also already behind a similar curve. Governance is only covering who colors inside the lines. And if anyone likes coloring outside the lines its AI
Do you know the BIGGEST fear for a Microsoft VP?
Its not whether they will make more money.
It's whether the org they are leading is working on a Zune while the rest of the world is building the iPhone.
Every feature PM is asked 'are you building where the puck is going to be in five years?'
Work on the wrong thing, your org might still make money but you and your leadership team are shown the door (ask Steve Ballmer).
Side note: I see all these posts on X whenever I talk about AD vs Entra.
'Oh it's all for the money' - You have no idea the thin ice you are on. Guess what Microsoft needs to do to make more money on prem? Hello Windows Server CALs 💰
Coming back to our main thread.
Here are some of the moonshot features the Entra ID team started working on more than half a decade ago.
- Decentralised ID (now Verified ID)
- Entra Global Secure Access
- Passwordless and Passkeys
Today, most teams are working on Agents and Agent Identities.
Do you think they are adding support for Agent ID to Active Directory?
Please...
I wrote a little about this here. Would love your take. petri.com/the-agents-entra-c…
