Security on JanBakker.tech

How to add granular amr claims to your SAML apps in Entra ID

Fri, 24 Jul 2026 08:18:03 +0000

In my last post, I covered how Entra ID now automatically sends the amr and acr claims for Salesforce, so its phishing-resistant MFA check finally has something to check. That part is automatic, no config needed.

Every other SAML app doesn’t get that automatically. Per Microsoft’s own optional claims reference, the app administrator still has to add the optional amr claim, with the include_granular_amr additional property, before authnmethodsreferences shows up in the assertion at all.

Lock or sign-out when Yubikey is removed from the device

Tue, 21 Jul 2026 13:53:20 +0000

I didn’t know there was already a solution for this, and maybe you are looking for it too. I learned about this from the Blue Security Podcast.

Meet: YubiKey Locker | Yubico

With YubiKey Locker, implement a protocol-agnostic security key removal policy that seamlessly integrates across various operating systems. This is important in meeting existing smart card customer security requirements (e.g. policies for smart card removal behavior), but also enables the forward-looking customer to bridge to modern protocols like FIDO2 passkeys, while staying compliant with their existing security policies. Moreover, the capability developed by Sciber enhances overall security posture for all organizations by locking the workstation or logging off the user when a YubiKey is not present, so it’s a great capability not only for those sunsetting legacy methods or form factors.

Writing Maester tests using AI - From idea to Pull Request

Tue, 21 Jul 2026 09:37:48 +0000

I love Maester. No doubt about that. I’ve made several contributions to this open-source project before, but it took me a lot of effort to learn how the underlying structure worked as a non-developer, and this challenge can be hard for a lot of Entra or Microsoft 365 admins out there.

Admin control for SSO prompts in Windows; finally, an off switch!

Thu, 16 Jul 2026 07:15:29 +0000

If you’ve been paying attention to the EEA sign-in changes over the past while, you’ll know Microsoft started prompting users before reusing their Windows credentials to sign in to other Microsoft apps and services. Good for user choice, less great if you’re an admin who just spent years getting SSO working and now watches it ask permission every time.

Passkeys by default and retirement of Microsoft-provided SMS and voice authentication - A guide to stay calm

Tue, 14 Jul 2026 16:01:19 +0000

I don’t have all the answers, but I promise to keep this post updated with all the details I find.

Microsoft dropped a bomb by announcing it will stop funding phone-based MFA, such as SMS and voice, and that passkeys will become the new standard.

Why Windows is the hardest passkey surface in 2026 and what Entra admins should expect

Mon, 06 Jul 2026 07:47:51 +0000

Written by: Corbado

If you have rolled out passkeys to a mixed device fleet, you might have probably noticed the following pattern. Some users log in smoothly and barely create a ticket (e.g. iPhone users), while others, like Windows users, do. Behind runs the same identity provider, same policy, same relying party but the user experience with passkeys can be very different depending on the user’s setup.

Entra ID SAML authnmethodsreferences (AMR) now supports phishing-resistant MFA

Fri, 26 Jun 2026 14:12:37 +0000

If you’ve been following the Salesforce phishing-resistant MFA (PRMFA) requirement story, you know the clock has been ticking. Salesforce has been pushing organizations to enforce phishing-resistant MFA for Salesforce administrators. The tricky part? Until now, Microsoft Entra ID has not always sent enough information in the SAML assertion for Salesforce to verify how the user authenticated, only that they authenticated.

Use Device Code Flow to register a passkey in Microsoft Authenticator App

Wed, 13 May 2026 15:43:32 +0000

The other day, I was doing some research in my lab, and had to register a new passkey a couple of times. At some point, I stumbled upon the device code flow in the Microsoft Authenticator app. I was aware of this flow, but I suddenly realized how easy it is to create a new passkey on a rogue/remote device, using social engineering. One more reason to block it!

Configurable token lifetimes in Entra ID

Mon, 04 May 2026 14:01:00 +0000

Today, a quick post about setting up token lifetime policies in Entra ID. In some use cases, organizations require a short access token for highly privileged apps or resources. That said, this is probably NOT needed for the typical apps we all use day-to-day.

Your service principals probably don't need secrets

Mon, 20 Apr 2026 11:59:25 +0000

Application policies in Entra have been around for a while now to manage the use of secrets, but I don’t see many folks using them. It’s probably because secrets are still widely used, and an unlimited lifetime for secrets results in less yelling from developers. Everyone’s happy.

Yet, attackers love secrets and use them all the time. In obvious places, like app registrations, but also on service principals, where you don’t expect them. You cannot see or add them in the UX, but they can be added via the Graph API.

Block or limit multi-tenant and consumer applications in Entra ID

Wed, 15 Apr 2026 10:02:16 +0000

Two new policies have been added to the recently introduced Application Policies in Entra ID!

Admins can now restrict or block multi-tenant applications, and applications that support consumer sign-in (personal Microsoft accounts)

Conditional Access Optimization Agent knowledge base

Sun, 15 Mar 2026 06:57:10 +0000

Y’all know this song by the Beatles, right?

What would you think if I sang out of tune?
Would you stand up and walk out on me?
Lend me your ears, and I’ll sing you a song
And I’ll try not to sing out of key

Oh, I get by with a little help from my friends
Mmm, I get high with a little help from my friends
Ooh, I’m gonna try with a little help from my friends

How to find unattested device-bound passkeys in Entra ID

Mon, 09 Feb 2026 08:47:15 +0000

Attestation is an important topic in the context of device-bound passkeys. Seeing the creative work from Nathan, Fabian, and Jos coming together, you might want to keep an eye on non-attested, device-bound passkeys in Entra ID.

The hidden risk of using aka.ms shortURLs for Microsoft portals

Fri, 06 Feb 2026 13:17:52 +0000

We all love them: Microsoft’s short URLs at aka.ms. The aka.ms domain is owned by Microsoft and is used to shorten URLs for many purposes. I even got one myself that points to my MVP profile. They are usually pointing to documentation, which is fine, but they are also used for Entra or Microsoft 365-integrated portals. Just to name a few examples:

Jan's resource catalog to learn all about agents (from an Entra ID perspective)

Fri, 30 Jan 2026 07:35:22 +0000

I’ve been digging into agents lately, especially the identity and security aspects. As this whole concept is quite new to all of us, it’s always hard to know where to start. Who got this thing figured out already? Who to follow? Who to ask questions?

Least privilege for Temporary Access Pass creation

Sun, 25 Jan 2026 14:15:32 +0000

Today, giving out Temporary Access Passes for Microsoft 365 is a very common task. And attackers love them as well, since they bypass some security policies, including MFA. With Zero Trust in mind, we should always strive to use ‘just-in-time’ and ‘just-enough’ permissions. So whether you do this task manually or have it fully automated, both scenarios need to follow least privilege.

Access Azure Virtual Desktop and Windows 365 Cloud PC from non-managed devices

Mon, 12 Jan 2026 13:10:56 +0000

Many organizations use Azure Virtual Desktop or Windows 365 Cloud PC. But how do we secure access to those resources? A very common use case is to connect from a non-managed device (BYOD). Then, from there, a user would have access to other resources, such as applications, email, and documents. The virtual workspace is managed, well-secured, and controlled by the organization, with end-users’ (BYO) devices used as stepping stones.

How to enable passkeys for guest users in Entra ID

Fri, 19 Dec 2025 14:12:23 +0000

Passkeys like FIDO security keys, synced passkeys, and passkeys in Microsoft Authenticator are secure and convenient authentication methods for your end users. They are phishing-resistant, passwordless, and enable fast sign-in to Microsoft 365 or other Entra ID-integrated apps.

The issue#

Unfortunately, guest users who access your (resource) tenant with MFA enforced are unable to register a passkey, despite having it enabled or registered in their home tenant. This is also stated on Microsoft Learn.

Store your Microsoft 365 passkeys in 1Password

Mon, 24 Nov 2025 20:04:37 +0000

Syncable passkeys in Microsoft 365 and Entra ID are here, so we are no longer limited to the Authenticator app and FIDO2 keys for storing passkeys. Passkeys can now be synced up “into the cloud”, so we can enjoy them on all our devices without the hassle of recovering each time we get a new phone or lose our YubiKey.

KB - Enable Single Sign On for Windows 365 Cloud PC

Tue, 28 Oct 2025 20:00:18 +0000

This short tutorial explains how to enable Single Sign-On for Windows 365 Cloud PC using the Graph Explorer.

On Microsoft Learn, we can already find instructions for using PowerShell, but I’m a big fan of using the Graph API and Graph Explorer.

Dynamic Conditional Access policies using custom security attributes

Sun, 26 Oct 2025 15:17:48 +0000

Conditional Access policies can become very complex and quickly grow out of control. Custom requirements, exceptions, and edge cases often cause policy drift. In this blog post, I want to introduce a dynamic way to manage custom requirements for applications and resources that provides a flexible way to set access requirements without creating a Conditional Access policy per application or resource.

A public bug report for Entra ID application policies

Mon, 20 Oct 2025 17:18:23 +0000

I’ve spent the last couple of nights trying out this new feature in Entra ID: application policies. I’ve already written two ( 1, 2) blog posts about it, but just when I thought I was done, here’s another finding that really blows my mind. Hear me out.

A closer look at Entra Application policies to govern secrets and certificates

Sat, 18 Oct 2025 08:12:33 +0000

My latest post on this topic introduced the new admin interface on Application Policies in Entra ID. Although the APIs had been around for a while, I personally didn’t see them being implemented at all. I believe the reason for that is the complexity of the API, in combination with the topic itself. Making sense of enterprise apps and app registrations is a complicated topic on its own. Add authentication and authorization into the mix, and you’ve got yourself a hot potato that nobody dares to keep in their hands for long.

Trigger Logic App on group membership changes in Entra ID

Sat, 11 Oct 2025 10:14:26 +0000

A couple of years ago, I stumbled upon a neat Logic App / Power Automate connector that can respond to changes in group membership. Act on group membership changes in Azure Active Directory - JanBakker.tech

Today, I’d like to give it some more love, since this is a very powerful, but underrated and probably also unknown piece of magic that will help you in a lot of automation scenarios. Especially when you are responsible for IAM Governance and lifecycle, but probably for a ton of other use cases.

No, your NHIs can't use passwords either!

Mon, 22 Sep 2025 20:40:48 +0000

For human identities, going passwordless is becoming pretty standard these days. It looks like passkeys are getting some good traction, and more and more organisations are moving towards passwordless solutions for their workforce.

But with the rise of NHI (non-human identities), it’s time to fight the battle of passwords in this corner of the field. If we look at Entra ID, a lot of applications and service principals are still relying on passwords, while other alternatives are left aside.

You shall not pass(key)! (updated)

Tue, 09 Sep 2025 12:19:56 +0000

In a previous blog post, I briefly touched on all the current caveats involved with passkeys in Entra ID. One of the most raised questions is around the onboarding and recovery of passkeys. So, in this blog post, we will dive deeper into the chicken-egg situation where you want to enforce passkeys for all resources, but none of your users have one registered. Here is where the “fun” begins.

Security Info Registration. Entra ID's rabbit hole.

Fri, 29 Aug 2025 14:01:26 +0000

This blog post needs a brief introduction. Bear with me.

Five years ago, I spent a significant amount of time creating a blog post about the Combined Registration Wizard in Entra ID. It took many hours to capture the screenshots, as every change in the settings took 20 minutes to take effect. However, I’m glad I took that effort, because it has helped me to this very day.

KB - We detected that this particular key type has been blocked by your organization

Fri, 04 Jul 2025 13:12:13 +0000

This is a knowledge base item. Hope it will help you someday.

Issue#

When you register a new passkey to Entra ID or Microsoft 365, an error is thrown:

Poor man’s IGA: Generate Temporary Access Pass for joiners

Tue, 10 Jun 2025 18:31:40 +0000

This post is part of the “Poor Man’s IGA” series. The idea is simple: we pick one feature from the Entra ID Governance stack, and think of an alternative, cheap(er) way to get it done. Why?

Every organization deserves proper IAM tools.
Entra ID Governance is excellent, but too expensive for most organisations.
Get the most out of your existing license and built-in features.

Most of all, making solutions as outlined in the post is like playing with LEGO. You will have different building blocks that can also be (re)used in other processes. Working with Logic Apps, managed identities, and Graph API will give you great flexibility to create your own creative solutions.

Poor man's IGA: Revoke all refresh tokens for user

Wed, 04 Jun 2025 15:46:43 +0000

This post is part of the “Poor Man’s IGA” series. The idea is simple: we pick one feature from the Entra ID Governance stack, and think of an alternative, cheap(er) way to get it done. Why?

Every organization deserves proper IAM tools.
Entra ID Governance is excellent, but too expensive for most organisations.
Get the most out of your existing license and built-in features.