Dynamic Conditional Access policies using custom security attributes
Conditional Access policies can become very complex and quickly grow out of control. Custom requirements, exceptions, and edge cases often cause policy drift.…
Category
Security
A public bug report for Entra ID application policies
I've spent the last couple of nights trying out this new feature in Entra ID: application policies. I've already written two (1,2) blog posts about it, but…
A closer look at Entra Application policies to govern secrets and certificates
My latest post on this topic introduced the new admin interface on Application Policies in Entra ID. Although the APIs had been around for a while, I…
Trigger Logic App on group membership changes in Entra ID
A couple of years ago, I stumbled upon a neat Logic App / Power Automate connector that can respond to changes in group membership. Act on group membership…
No, your NHIs can't use passwords either!
For human identities, going passwordless is becoming pretty standard these days. It looks like passkeys are getting some good traction, and more and more…
You shall not pass(key)! (updated)
In a previous blog post, I briefly touched on all the current caveats involved with passkeys in Entra ID. One of the most raised questions is around the…
Security Info Registration. Entra ID's rabbit hole.
This blog post needs a brief introduction. Bear with me.
KB - We detected that this particular key type has been blocked by your organization
This is a knowledge base item. Hope it will help you someday.
Poor man’s IGA: Generate Temporary Access Pass for joiners
Today, we look at a joiner scenario, where you want to trigger a time-based workflow to send a Temporary Access Pass 7 days before the employee's start date.
Poor man's IGA: Revoke all refresh tokens for user
Today, we look at Microsoft Entra ID Lifecycle Workflows. Microsoft has recently introduced a new task that revokes a user's refresh token. Consider scenarios…
Unlocking the Power of employeeHireDate in Entra ID Dynamic Groups
Disclaimer: The main structure of this blog post is created by Claude 3.7 Sonnet. Together with Lokka, I figured out all the supported operators by testing all…
Register Yubikeys on behalf of your users with YubiEnroll
In an earlier post, I showed several ways to (bulk) provision Yubikeys (or keys from other vendors) in Microsoft Entra using the provisioning APIs. In this…