A couple of years back, I was really struggling to get Evilginx up and running. The main reason was that I had forgotten how to do it by the time I needed an instance for a demo, so it took me hours to spin it up. Then, I decided to take notes, and I made this post. To this day, this is my go-to manual for getting Evilginx up and running from scratch. It contains all the steps, such as…
One of the longest-running previews in Entra ID is the support for hardware (OATH) tokens. Hardware tokens can create OTP tokens that can be used to satisfy MFA requirements in Entra ID. That said, I also must point out that this method is not phishing-resistant. (T)OTP tokens can easily be stolen using AiTM attacks. But that’s for another time. This post will focus on the management of the hardware keys itself. According to the documentation, this feature has received several…
Microsoft recently announced their new FIDO2 provisioning APIs within Microsoft Entra ID. While users can register their FIDO2 keys fairly easily with a Temporary Access Pass, the new API allows admins to register keys on behalf of a user. This can be extremely handy in onboarding scenarios or in case a new key needs to be shipped to a vendor or contract worker. The Microsoft APIs support every vendor of FIDO2 (passkeys), but Yubico has made some extra effort to…
In case you didn’t get the latest memo, Microsoft is tightening the security around the Azure and Microsoft 365 admin portals by enforcing multifactor authentication for all interactive sign-ins. In this post, I will try to answer all the questions about this change, as there seem to be a lot of questions on social media lately. If you still have questions after reading this post (which I’m sure you have), please reach out so I can add your Q&A to…
Conditional Access include and exclude groups cannot be messed with. As we have seen in a previous blog post, this will impact your security posture. But what if you need to create a legitimate escape for operational purposes? Take this use case, for example: You’ve enforced phishing-resistant MFA for your admin accounts on all apps (you are a rockstar!). Still, some applications do not support MSAL/WAM, or you have legacy scripts that use Internet Explorer 11 for authentication, so your…
Bypassing Conditional Access is easy. That’s because most Conditional Access policies rely on Entra ID Security Groups. Since Entra ID is very “flat” by default, every admin with group management permissions can add or remove members to ANY group. That’s why we want to handle our include and exclude groups carefully. This idea does not stand alone and is also mentioned in this marvelous article by Thomas Naunheim. If you’re new to Restricted Management Administrative Units, I suggest reading this…
It’s here! A long-awaited feature in Microsoft 365 is finally there. Now, in public preview, organizations can add another phishing-resistant credential to their arsenal: device-bound passkeys. DISCLAIMER: This feature is currently in public preview. Everything you read in this blog post is subject to change and may be outdated soon. Always check the current documentation on Microsoft Learn to keep track of changes. Images in this post might be slightly different in reality. What is a device-bound passkey? First, let’s…
Entra ID protection is an excellent feature amongst the other services in the Entra Premium P2 license SKU. Microsoft Entra ID Protection detects identity-based risks so that admins can mitigate those risks. Users can also self-mitigate risk. To evaluate and asses this feature, you could, of course, simulate a bunch of risky events, as described here. Using a TOR browser and the developer tools in the browser, you can quickly bump up your sign-in risk to trigger the policies in…
When moving away from traditional and weak authentication methods like passwords to stronger ones like Authenticator App and passkeys, it’s essential to keep informed when some of these methods change. Organizations moving to modern authentication are facing new challenges around onboarding and recovery of authentication methods, as attackers can also use this to settle in someone’s account by simply adding an extra authentication method. Entra ID will log this event, but no out-of-the-box feature informs the user. This step-by-step tutorial…
Today, a quick tip for all Entra admins out there. Conditional Access policies can be subject to change. When a policy is changed, its not very easy to see what changed. From the audit logs, this is how it looks: Let’s face it; that’s not very convenient to read. Well, here’s the good part: Microsoft released a new feature that can “visualize” changes to Conditional Access straight from the audit logs. This will show the changes side by side. You…