#MicrosoftMVP | Cyber Security Architect 🛡️| #MicrosoftEntra 🔑 + #Azure ☁️ | #Schaengel
Koblenz
Joined June 2009
- Tweets1.9K
- Following472
- Followers7.2K
- Likes2.7K
Thomas Naunheim retweeted
Last week we shipped Maester 2.3. Here's the walk-through.
The big one: The new Affected objects blade. Every user, group and app behind your failed checks, in one view.
@Thomas_Live built it and explains why, plus a quick tour of the rest, in 6 min.
GA of service-to-service token binding is announced in Entra’s October “What’s new”. Initial release: #ManagedIdentities on #Azure Trusted Launch or Confidential VMs/VMSS, for KeyVault. Can’t wait for more supported scenarios for NHIs in #MicrosoftEntra:
techcommunity.microsoft.com/…
I joined Dinant Paardenkooper on "AzSecurity - Learn by doing" to share the story behind #EntraOps including live demos: Classification Model, Classification Explorer & reporting integrations for a practical Enterprise Access Model in #MicrosoftEntra.
🎥 youtube.com/watch?v=KUyrlFt0…
🤔 Why should the AI Administrator role in #MicrosoftEntra be considered Control Plane (Tier 0)? At first glance, it might seem particularly privileged just to manage #AgentIdentities. But there's an aspect that often gets overlooked. (1/7) 👇
🛡️ The EntraOps Classification Explorer makes this classification visible and documented. We've also covered the AI Administrator role, its permissions, and associated risks in our new Attack & Defense Playbook chapter on Microsoft Entra Agent Identity. (6/7)
📚 Further reading (7/7):
🔹 Attack & Defense Playbook:
entrasecurity.com/AgentIdent…
🔹 Microsoft Learn:
learn.microsoft.com/en-us/en…
🔹 Live Response Abuse: cloud-architekt.net/abuse-de…
🔹 EntraOps Explorer:
entraops.com/explorer
🤖 New chapter: #AgentIdentities in the Attack & Defense Playbook for #MicrosoftEntra is live!
🔗 github.com/Cloud-Architekt/A…
Together with @samilamppu, @RobbeVdDaele, and @DerkvanDerWoude, I’ve been researching #AgentID foundations, attack scenarios, detections, and mitigations.
We’ve also started publishing the Attack & Defense Playbook as a dedicated website.
You can now explore it at:
entrasecurity.com/
#MDDR 2026 is out – a must-read for everyone in #MicrosoftSecurity. Password spray still leads by volume, but post-authentication attacks keep gaining ground: token theft shows up as a distinct post-compromise tactic. Check out the full report:
aka.ms/MDDR2026
🤖 🔑 New chapter of the #MicrosoftEntra Attack & Defense Playbook coming soon!
6+ months of research with @samilamppu, @RobbeVdDaele and @DerkVanDerWoude on #AgentIdentities:
🥷 Potential attack scenarios
🔎 Detection & reporting
🛡️ Mitigation & delegation
Early next week 👀
While researching #MicrosoftEntra Identity Governance, I found a permission-expansion path via Catalog Owners and API permissions. Reported to MSRC and fixed. My write-up covers the scenario, why and how you should monitor your catalogs with #EntraOps:
cloud-architekt.net/elm-esca…
@ericonidentity, @vanhybrid, @rucam365 and I discuss cloud identity attacks with @sapirxfed. If you want to learn more about techniques from device code flow to on-prem-to-cloud risks in #MicrosoftEntra, this #IdentityRoundtable episode is for you!
youtube.com/watch?v=0MvTYcrZ…
Also available on the following Podcast platforms:
🎧 Spotify: open.spotify.com/show/3X95cN…
🍏 Apple Podcasts: podcasts.apple.com/us/podcas…
Thomas Naunheim retweeted
🎤 Speaker Spotlight: @Thomas_Live
Wer steuert eure Entra-Tenants – inkl. Shadow IT? Bei der CDC-Germany zeigt Thomas Tenant Governance von Discovery bis delegierter Administration.
📅 30. Sept. · 15:20 · Hanau
🎟️ cdc-germany.de
#CDCGermany #MicrosoftEntra #Security
🤖 Made with AI
#Azure and #MicrosoftGraph #PowerShell tokens can be persisted in the #macOS Keychain and exfiltrated by other scripts. In my blog, I unpack research about:
🎯 Same-user-context risk
🛡️ Process-scoped mitigations & detections
🛠️ A defensive audit script
🔗 cloud-architekt.net/macos-ca…
