Cybersecurity Architect | Securing Microsoft Cloud (Identity, Endpoint & Data)
Joined August 2024
- Tweets354
- Following283
- Followers59
- Likes875
shellgio_ retweeted
New Microsoft Entra ID role:
Entra SOC Identity Responder
◽ Enable/Disable users
◽ Revoke active sessions
◽ Reset password
Great effort to make response actions more granular.
shellgio_ retweeted
An HONOR to be heading to @wpninjasus where I'll be running a live demo-heavy session of tips and tricks on how to secure the **** out of a tenant in <1 hour. We'll start with the defaults then I'll talk folks through what actually works, what sounds good but doesn't really help, and how to avoid breaking everything as we lock it all down.
Let me know if I'll see you there!
shellgio_ retweeted
the irony of being a woman earning a CCNA that leads to a job + financial freedom… in part due to educational material from a man who believes you should be confined to the home, barefoot & pregnant in the kitchen
shellgio_ retweeted
Check it out, Microsoft have just given Security Administrators more permissions in Entra > ourcloudnetwork.com/microsof…
Now the Security Administrator can:
• Enable a user account
• Disable a user account
• Invalidate refresh tokens on a user account
• Update the password on a user account
This comes after Microsoft recently split these actions from the User Administrator role by creating the Entra SOC Identity Responder role!
All happening silently I might add!!
#Entra #News #Microsoft
shellgio_ retweeted
If you want to go deeper than the docs on the new Defender Controlled Configuration feature, check out Thomas' article here :)
Still some nuances that remain to be seen, but docs and code point out this may eventually extend to areas like device control, EDR, and firewall 😎
vertho.tech/2026/08/13/defed…
here you go Champ ;)
shellgio_ retweeted
Have you seen this warning yet? I feel Microsoft are preparing to enforce license compliance in Entra > ourcloudnetwork.com/are-micr…
New licensing usage reporting and active warning messages make me feel like Microsoft are on the verge of something bigger...
Right now, it's clear some organisations are abusing the mechanics behind Microsoft Entra, I see it all the time. That one "test" premium license that never gets removed normally gets benefited from by the whole organisation, then what incentive does a business have to buy the correct amount...
But, let's not be mistaken. Microsoft can already see your utilisation from their own telemetry system. A small amount of overage is expected, considering guest users and the "one person, one license" philosophy. But with high overage, you may be asking for trouble.
Do you expect Microsoft are planning something bigger here?
#Microsoft #Entra #News
shellgio_ retweeted
Folks, Maester 2.2 is here!!
It was just a couple of months ago when we launched Maester 2.0 and the amazing Maester community has been SUPER busy.
The biggest news is support for Active Directory is now in preview thanks to Mike Soule and we have some really cool plans for Active Directory with @PrzemyslawKlys and his awesome TestimoX AD suite. Stay tuned on this.
We've added tests for so many new products (and sorry you need to sign in more times because not every Microsoft product uses Graph anymore 🤷♀️).
That includes Copilot config, Dataverse, SharePoint, Github (as more folks move agentic devlops to GitHub this is going to be super important), new Intune and Entra ID checks and so much more.
Here are the highlights
🔥 269 Active Directory checks across identity, policy, infrastructure, DNS, trusts, replication, and access control
🔥 5 Microsoft Purview checks to get your data security foundations ready for Copilot and AI
🔥 12 new SharePoint Online checks across the CIS and CISA baselines, now cross-platform with PnP.PowerShell
🔥 5 CIS GitHub organization controls and first-class GitHub connectivity
🔥 9 Global Secure Access checks for Private Access, forwarding profiles, Compliant Network, and Internet Access
🔥 4 Intune endpoint security checks for LAPS, attack surface reduction, App Control for Business, and Managed Installer
🔥 New Entra ID checks covering agent risk, directory sync safeguards, Conditional Access gaps, legacy MSOnline, and privileged first-party apps
🔥 A sharper report with markdown summaries, per-test durations, and critical findings sorted first
🔥 Contributor credits across maester.dev, so the people writing these tests get the recognition they deserve
Huge thanks to our contributors Artem Borodai, @BrianReidC7, @cbrhh, Christopher Edwards, @fabian_bader, Henrik Piecha, @janbakker_, Jean-Philippe George, Jon Gross, Jonathan Hope, Loïc Michel, Massimo Mazzariol, Matthias F., Mike Soule, Morten Mynster Kristensen, Ofir Gavish, @SamErde, Simon Albers, Stephan van Rooij, @thomas_live, Thomas Schmidt, Travis McDade, Truls Dahlsveen
(PS Please let me know if I've missed anyone)
Plus a huge personal thank you from me to all the maester.cloud founding sponsors maester.cloud/founders who have helped me go full time on Maester. This release wouldn't have been possible without you.
Learn all about this release at maester.dev/blog/maester-2-2
shellgio_ retweeted
One tiny change to my VS @code configuration has made life a lot easier for me. Markdown documents now open in preview by default, instead of in the editor. Editing them is still as simple as a double-click! Anyone with me?
ALT Square VS Code-themed infographic titled “Open Markdown in Preview by Default.” Two configuration methods are shown side by side. Option 1 uses the Settings UI: press Ctrl plus comma or Cmd plus comma, search for “Editor Associations,” find “Workbench: Editor Associations,” select “Add Item,” then enter `*.md` as the key and `vscode.markdown.preview.editor` as the value. Option 2 edits `settings.json`: open the Command Palette with Ctrl or Cmd plus Shift plus P, select “Preferences: Open User Settings (JSON),” and add a `workbench.editorAssociations` entry mapping `*.md` to `vscode.markdown.preview.editor`. Below the options, a simplified VS Code window shows Markdown source for a README on the left and its rendered preview on the right. Footer text reads, “This one small change made working with project documentation much easier for me.”
shellgio_ retweeted
Join us for the next M365SCUG: 29 July | 18:00 - 20:00 UTC+1
1: Me! - Conditional Access Unscripted: 10 Years of Lessons Learned
2: @UgurKocDe - Automating Intune with Graph, Agents, and Reality
REGISTER: meetup.com/m365sandcug
Hosted by myself, @WillTheFrenchie, and @WelkasWorld
shellgio_ retweeted
So uhh, I might be doing a free @AlteredSecurity Hacker Summer webinar next week that covers this exact scenario 🫠
On the offensive side, some evilginx mods to automate passkey registration and AI use 😈
On the defensive side, all of the mitigations 😇
alteredsecurity.com/from-ini…
google.com/amp/s/www.bleepin…
Like device code phishing but stronger.
TBH I'm surprised, I didn't think attackers will actually phish users to register passkeys
shellgio_ retweeted
📢 𝗗𝗲𝗳𝗲𝗻𝗱𝗲𝗿𝘀, 𝘁𝗮𝗸𝗲 𝗻𝗼𝘁𝗲!
A significant change is coming for Microsoft Defender for Cloud Apps.
Starting 𝗝𝗮𝗻𝘂𝗮𝗿𝘆 𝟲, 𝟮𝟬𝟮𝟳, File Policies will no longer be managed in Defender for Cloud Apps and will be available exclusively through Microsoft Purview.
Now is the right time to review your current policies, understand the impact, and start planning your migration strategy to avoid surprises down the road.
📖 Check out the migration guidance and prepare your transition:
learn.microsoft.com/en-us/de…
#MicrosoftSecurity #MicrosoftDefender #DefenderForCloudApps #MicrosoftPurview #DataSecurity #CloudSecurity #CyberSecurity #SecOps #Compliance #SecurityOperations
shellgio_ retweeted
Why did I leave Microsoft?
To work full time on 🔥 Maester.
Over 40,000+ tenants today rely on Maester to monitor their tenants daily.
I wanted to make sure that the tests they are running continue to be relevant and evolve as Microsoft 365 and the security landscape evolves.
So today I'm announcing the launch of Maester.Cloud
Maester Cloud is the portal companion to Maester that lets you track your results over time. It is multi tenant, runs in your cloud (or ours) and more → check out the site for all the features.
More importantly Maester Cloud is a way for me to fund the continued development of the open source Maester core and the tests in Maester.
That is our mission. In fact I worked with the core team @fabian_bader , @Thomas_Live , @MySnozzberries and @SamErde to create the Maester Manifesto (maester.cloud/manifesto). It is our promise to the community.
If you value Maester and would like to support and ensure that Maester continues to grow and be healthy, I would be beyond thrilled if your organisation can sponsor this effort.
I would also appreciate it very much if you can share this post with your network to spread awareness.
Thanks!
ALT Screenshot of Maester Cloud
shellgio_ retweeted
Video and slides of my webinar on Evading Microsoft Defender for Identity are published. One of my favorite topics. Hope to keep coming back to MDI evasion.
Video - youtube.com/watch?v=Ygrvs8B_…
Slides - 16cdd728-52b5-4665-b161-3011…
#HackerSummer #RedTeam #Evasion
shellgio_ retweeted
I have 6 kids and an amazingly supportive wife. I’ve been working from home since 2020.
There’s 0% chance I could be as happy or productive working in an office.
To each their own 🙏
Why Remote Work is White Collar Fraud.
"I have a three-year-old and a five-year-old. The idea that I could do any work at my house is like a total fantasy.
The kids come home at 3pm, your work day needs to keep going. I'm highly against it." @typesfast
shellgio_ retweeted
New video: quick run through of 5 post-access Microsoft 365 abuse mechanisms (app creds, Graph permanent delete, Intune device wipes/scripts, MDE LR)
WATCH: youtube.com/watch?v=Y_DazkEv…
Lot of defensive controls I didn’t fit in e.g. workload identities or most RBAC things... more on those soon.
shellgio_ retweeted
Tienes razón, esto es lo que nos estamos perdiendo con el home office
Se romantizó tanto el trabajo remoto que mucha gente no se da cuenta que trabajar desde tu casa todos los días te aísla y te deprime.
Muchos te venden que trabajar desde el sillón es el éxito pero estamos creando una generación con ansiedad social que no puede sostener una charla de 5 minutos cara a cara.
Hay que salir más o está bien el homeoffice fulltime?
shellgio_ retweeted
Erin Brockovich has launched a website and has begun tracking all data centers in America and logging resident complaints
In just 1 week it’s already logged 1,690 resident complaints
For this who don’t remember
Erin Brockovich was the paralegal responsible for winning out a case against PG&E, Hinckley in California, because their wastewater runoff was seeping into rural areas and creating a lot of health issues for, for the surrounding neighborhoods
That case brought in a $333 million settlement that went to the families affected by the situation because a lot of them either had staggering medical bills due to their tap water was no longer safe
So why is this important, well residents all over America are reporting their tap water and river water is being heavily polluted by data centers
Her map of data centers is new, she just launched it
The website features an interactive US map showing operational, under-construction, and proposed AI data centers, overlaid with community-reported complaints
Residents can submit reports with details, photos, and locations. Within days of launch, it received a surge of submissions over 1,600 in the first week, and reports of 1,800+ from 47 states shortly after
Common Resident Complaints Being Logged
- Water usage
- Raising utility bills for residents
- Noise pollution: Constant 24/7 humming from fans, generators, and cooling systems disrupting sleep, daily life, and wildlife.
- E-waste from frequent hardware upgrades, pollution including PFAS concerns