🔒 Secure Bits 💡 𝗔𝗿𝗲 𝘆𝗼𝘂 𝗽𝗹𝗮𝗻𝗻𝗶𝗻𝗴 𝘁𝗼 𝗿𝗼𝗹𝗹 𝗼𝘂𝘁 𝗽𝗮𝘀𝘀𝗸𝗲𝘆𝘀 𝗶𝗻 𝗠𝗶𝗰𝗿𝗼𝘀𝗼𝗳𝘁 𝗘𝗻𝘁𝗿𝗮 𝗜𝗗 𝗮𝗻𝗱 𝗱𝗼𝗻𝘁 𝗸𝗻𝗼𝘄 𝘄𝗵𝗲𝗿𝗲 𝘁𝗼 𝘀𝘁𝗮𝗿𝘁? I put together a step-by-step guide that will help you configure Passkeys from the perspective of System Administrator. 𝟭. 𝗖𝗵𝗼𝗼𝘀𝗲 𝘁𝗵𝗲 𝗽𝗮𝘀𝘀𝗸𝗲𝘆 𝘁𝘆𝗽𝗲𝘀 It will guide you on passkey types, what are they good for, what are the main differences between them and how to use each type. 𝟮. 𝗘𝗻𝗮𝗯𝗹𝗲 𝘁𝗵𝗲 𝗺𝗲𝘁𝗵𝗼𝗱 𝗮𝗻𝗱 𝗰𝗿𝗲𝗮𝘁𝗲 𝘁𝗵𝗲 𝗽𝗿𝗼𝗳𝗶𝗹𝗲𝘀 ⚙️ Authentication methods > Policies > Passkey (FIDO2) It will show you how to set up Passkey profiles. Each profile has its own attestation setting, passkey types and specifies allowed passkey hardware. 𝟯. 𝗦𝗲𝘁 𝘂𝗽 𝗧𝗲𝗺𝗽𝗼𝗿𝗮𝗿𝘆 𝗔𝗰𝗰𝗲𝘀𝘀 𝗣𝗮𝘀𝘀 It shows how to configure TAP so helpdesk can use it to onboard new users or recover lost or stolen passkeys. 𝟰. 𝗖𝗿𝗲𝗮𝘁𝗲 𝗮 𝗖𝗼𝗻𝗱𝗶𝘁𝗶𝗼𝗻𝗮𝗹 𝗔𝗰𝗰𝗲𝘀𝘀 𝘁𝗵𝗮𝘁 𝗿𝗲𝗾𝘂𝗶𝗿𝗲𝘀 𝗣𝗵𝗶𝘀𝗵𝗶𝗻𝗴-𝗿𝗲𝘀𝗶𝘀𝘁𝗮𝗻𝘁 𝗠𝗙𝗔 Finally it will guide you how to create Conditional Access policy that requires authentication strength, aka how to enforce the configured Passkey profiles with 𝗣𝗵𝗶𝘀𝗵𝗶𝗻𝗴-𝗿𝗲𝘀𝗶𝘀𝘁𝗮𝗻𝘁 𝗠𝗙𝗔 Also, check the client requirements before the pilot: iOS 17 or Android 14 and newer, a current Authenticator build, and Bluetooth turned on for both devices. The guide has the exact settings, the requirements and the screenshots. Full PDF Link in the comments. 📢 Big shout out to @TechBrandon for his website Passkey Path: techbrandon.github.io/passke… Some of the practical tips are based on his work. Are you already running passkeys in Entra? Which types did you pick for the admins, and which for the standard users? 𝘈𝘶𝘵𝘩𝘰𝘳: Martin Strnad #SecureBits #EntraID #Passkeys #FIDO2 #PhishingResistantMFA #Microsoft365 #CyberSecurity

💡 𝗦𝗲𝗰𝘂𝗿𝗲 𝗕𝗶𝘁𝘀 🔒 𝗔𝗰𝘁𝗶𝘃𝗲 𝗗𝗶𝗿𝗲𝗰𝘁𝗼𝗿𝘆 𝗽𝗿𝗶𝗺𝗮𝗿𝘆𝗚𝗿𝗼𝘂𝗽𝗜𝗗: 𝗰𝗵𝗲𝗰𝗸 𝘄𝗵𝗮𝘁 𝘆𝗼𝘂𝗿 𝘁𝗼𝗼𝗹𝘀 𝗮𝗿𝗲 𝗮𝗰𝘁𝘂𝗮𝗹𝗹𝘆 𝗿𝗲𝗽𝗼𝗿𝘁𝗶𝗻𝗴 Active Directory group membership is not only defined by the member / memberOf attributes. A user can also be a member of a group through their primaryGroupID. 𝗧𝗵𝗶𝘀 𝗰𝗿𝗲𝗮𝘁𝗲𝘀 𝘀𝗼𝗺𝗲 𝗶𝗻𝘁𝗲𝗿𝗲𝘀𝘁𝗶𝗻𝗴 𝗶𝗻𝗰𝗼𝗻𝘀𝗶𝘀𝘁𝗲𝗻𝗰𝗶𝗲𝘀: 🔹 Get-ADGroupMember returns users whose primaryGroupID points to the group. 🔹 Get-ADGroup -Properties member does not. 🔹 Get-ADUser -Properties memberOf does not show the primary group either. 🔹 net group does include these users. It gets even more interesting with nested groups: recursive queries can miss users whose membership exists through primaryGroupID. This matters especially for monitoring privileged groups. If your scripts or security tools look only at the group object’s member attribute, you may not be seeing the complete membership. ⚠️ There is also a technique where an attacker can deny read access to primaryGroupID on an unprotected user object, making the relationship even harder to discover through common AD and PowerShell tooling. 𝗣𝗿𝗮𝗰𝘁𝗶𝗰𝗮𝗹 𝗰𝗵𝗲𝗰𝗸: Get-ADUser -Property primaryGroup,primaryGroupID -Filter {-not(primaryGroupID -like "513")} | Select-Object Name,primaryGroupID,primaryGroup For normal user accounts, 513 represents Domain Users. Non-standard values are therefore worth reviewing rather than assuming your normal group-membership enumeration has caught everything. ➡️ 𝗧𝗵𝗲 𝗯𝗶𝗴𝗴𝗲𝗿 𝘁𝗮𝗸𝗲𝗮𝘄𝗮𝘆: test how your monitoring actually enumerates AD group membership. Different methods can return different answers. Author: @TechBrandon (🔗Full article is in the comments) #ActiveDirectory #WindowsSecurity #CyberSecurity #IdentitySecurity #BlueTeam