Posts on JanBakker.tech

Where to store your Microsoft 365 passkey?

Fri, 25 Sep 2026 16:00:51 +0000

Microsoft 365 (Entra ID) has supported passkeys for a long time now. From auto-registered passkeys like Windows Hello to synced passkeys.

I’ve created this tool to quickly see the current capabilities, to use for conversations with colleagues or customers. I try to keep the page current as features will be added or change. I will also expand the subpages with relevant context, risk considerations, dependencies, limitations, user experience, and caveats.

Entra ID telephony providers for SMS and voice MFA: first look

Fri, 25 Sep 2026 06:58:46 +0000

What was announced#

Microsoft has published the first documentation for Choose Your Own Telephony Provider in Entra ID, together with an FAQ that might answer some of your questions. It is the answer to one question many of us have been asking: what happens to users who really need SMS or voice MFA once Microsoft stops delivering those messages itself?

Finally a smooth(er) passkey onboarding experience in Microsoft 365!

Mon, 14 Sep 2026 15:35:23 +0000

Microsoft is doing a lot to enhance the onboarding of passkeys. The three major changes behind this are:

MC1450133 - Microsoft Entra: Users can register a passkey or passwordless sign-in as their first multifactor authentication method

MC1440968 - Microsoft Entra ID: Optimizations for passkey registration experience

How to create a Microsoft 365 device-bound passkey on macOS

Sat, 22 Aug 2026 06:36:58 +0000

I did a discovery today, and I want to share it, because I did not know this was an option. Up until now, I always thought that device-bound passkeys where limited to Windows Hello for Business, FIDO2 security keys, and the Microsoft Authenticator App.

How to add granular amr claims to your SAML apps in Entra ID

Fri, 24 Jul 2026 08:18:03 +0000

In my last post, I covered how Entra ID now automatically sends the amr and acr claims for Salesforce, so its phishing-resistant MFA check finally has something to check. That part is automatic, no config needed.

Every other SAML app doesn’t get that automatically. Per Microsoft’s own optional claims reference, the app administrator still has to add the optional amr claim, with the include_granular_amr additional property, before authnmethodsreferences shows up in the assertion at all.

Lock or sign-out when Yubikey is removed from the device

Tue, 21 Jul 2026 13:53:20 +0000

I didn’t know there was already a solution for this, and maybe you are looking for it too. I learned about this from the Blue Security Podcast.

Meet: YubiKey Locker | Yubico

With YubiKey Locker, implement a protocol-agnostic security key removal policy that seamlessly integrates across various operating systems. This is important in meeting existing smart card customer security requirements (e.g. policies for smart card removal behavior), but also enables the forward-looking customer to bridge to modern protocols like FIDO2 passkeys, while staying compliant with their existing security policies. Moreover, the capability developed by Sciber enhances overall security posture for all organizations by locking the workstation or logging off the user when a YubiKey is not present, so it’s a great capability not only for those sunsetting legacy methods or form factors.

Writing Maester tests using AI - From idea to Pull Request

Tue, 21 Jul 2026 09:37:48 +0000

I love Maester. No doubt about that. I’ve made several contributions to this open-source project before, but it took me a lot of effort to learn how the underlying structure worked as a non-developer, and this challenge can be hard for a lot of Entra or Microsoft 365 admins out there.

Admin control for SSO prompts in Windows; finally, an off switch!

Thu, 16 Jul 2026 07:15:29 +0000

If you’ve been paying attention to the EEA sign-in changes over the past while, you’ll know Microsoft started prompting users before reusing their Windows credentials to sign in to other Microsoft apps and services. Good for user choice, less great if you’re an admin who just spent years getting SSO working and now watches it ask permission every time.

Passkeys by default and retirement of Microsoft-provided SMS and voice authentication - A guide to stay calm

Tue, 14 Jul 2026 16:01:19 +0000

I don’t have all the answers, but I promise to keep this post updated with all the details I find.

Microsoft dropped a bomb by announcing it will stop funding phone-based MFA, such as SMS and voice, and that passkeys will become the new standard.

KB - employeeLeaveDateTime show empty (null)

Mon, 06 Jul 2026 09:41:25 +0000

This is a knowledge base item. I hope it will help you someday.

The issue#

When syncing the employeeLeaveDateTime attribute to Entra ID, the value shows null.

In this example, I use Graph Explorer to check the value.

Why Windows is the hardest passkey surface in 2026 and what Entra admins should expect

Mon, 06 Jul 2026 07:47:51 +0000

Written by: Corbado

If you have rolled out passkeys to a mixed device fleet, you might have probably noticed the following pattern. Some users log in smoothly and barely create a ticket (e.g. iPhone users), while others, like Windows users, do. Behind runs the same identity provider, same policy, same relying party but the user experience with passkeys can be very different depending on the user’s setup.

Entra ID SAML authnmethodsreferences (AMR) now supports phishing-resistant MFA

Fri, 26 Jun 2026 14:12:37 +0000

If you’ve been following the Salesforce phishing-resistant MFA (PRMFA) requirement story, you know the clock has been ticking. Salesforce has been pushing organizations to enforce phishing-resistant MFA for Salesforce administrators. The tricky part? Until now, Microsoft Entra ID has not always sent enough information in the SAML assertion for Salesforce to verify how the user authenticated, only that they authenticated.

Domainless SAML federation in Microsoft Entra External ID

Tue, 19 May 2026 06:42:09 +0000

If you’ve ever set up direct federation with a SAML Identity Provider in Microsoft Entra External ID, you’ll know the pain. You configure everything correctly, invite a guest user, and then they hit a cryptic error at sign-in:

AADSTS5000819: SAML Assertion is invalid. Email address claim is missing or does not match domain from an external realm.

Use Device Code Flow to register a passkey in Microsoft Authenticator App

Wed, 13 May 2026 15:43:32 +0000

The other day, I was doing some research in my lab, and had to register a new passkey a couple of times. At some point, I stumbled upon the device code flow in the Microsoft Authenticator app. I was aware of this flow, but I suddenly realized how easy it is to create a new passkey on a rogue/remote device, using social engineering. One more reason to block it!

Entra ID Governance - View approver information for pending requests

Mon, 04 May 2026 14:26:11 +0000

A new feature in Entra ID Governance was introduced and enabled by default.

When users request an access package and approval is needed, they can now see the name and email of the approver.

Configurable token lifetimes in Entra ID

Mon, 04 May 2026 14:01:00 +0000

Today, a quick post about setting up token lifetime policies in Entra ID. In some use cases, organizations require a short access token for highly privileged apps or resources. That said, this is probably NOT needed for the typical apps we all use day-to-day.

Your service principals probably don't need secrets

Mon, 20 Apr 2026 11:59:25 +0000

Application policies in Entra have been around for a while now to manage the use of secrets, but I don’t see many folks using them. It’s probably because secrets are still widely used, and an unlimited lifetime for secrets results in less yelling from developers. Everyone’s happy.

Yet, attackers love secrets and use them all the time. In obvious places, like app registrations, but also on service principals, where you don’t expect them. You cannot see or add them in the UX, but they can be added via the Graph API.

Block or limit multi-tenant and consumer applications in Entra ID

Wed, 15 Apr 2026 10:02:16 +0000

Two new policies have been added to the recently introduced Application Policies in Entra ID!

Admins can now restrict or block multi-tenant applications, and applications that support consumer sign-in (personal Microsoft accounts)

KB - Entra Private Access Session persistence

Wed, 08 Apr 2026 13:21:31 +0000

This is a knowledge base item. I hope it will help you someday.

**Update:**This setting can also be set from the Entra admin center now.

It can be set under the Network access properties of the Enterprise Application.

Conditional Access Optimization Agent knowledge base

Sun, 15 Mar 2026 06:57:10 +0000

Y’all know this song by the Beatles, right?

What would you think if I sang out of tune?
Would you stand up and walk out on me?
Lend me your ears, and I’ll sing you a song
And I’ll try not to sing out of key

Oh, I get by with a little help from my friends
Mmm, I get high with a little help from my friends
Ooh, I’m gonna try with a little help from my friends

How to get better with Graph API - Part one

Fri, 06 Mar 2026 19:28:30 +0000

As you might know, Graph API is an important part of Microsoft 365. Everything (or most) of the things you see in the Entra admin center or Microsoft Admin portal is pulled from the Graph API. Every button you click pulls data from or pushes data to the Graph API.

What admins can learn from the new Entra ID Groups Insights blade

Wed, 18 Feb 2026 14:54:06 +0000

Microsoft released a new overview in Entra ID: Entra ID Groups Insights.

Currently in preview, it has some limitations, but what caught my attention is the new Graph API endpoint that this report is using: beta/reports/identityAnalytics/groups

How to find unattested device-bound passkeys in Entra ID

Mon, 09 Feb 2026 08:47:15 +0000

Attestation is an important topic in the context of device-bound passkeys. Seeing the creative work from Nathan, Fabian, and Jos coming together, you might want to keep an eye on non-attested, device-bound passkeys in Entra ID.

The hidden risk of using aka.ms shortURLs for Microsoft portals

Fri, 06 Feb 2026 13:17:52 +0000

We all love them: Microsoft’s short URLs at aka.ms. The aka.ms domain is owned by Microsoft and is used to shorten URLs for many purposes. I even got one myself that points to my MVP profile. They are usually pointing to documentation, which is fine, but they are also used for Entra or Microsoft 365-integrated portals. Just to name a few examples:

Jan's resource catalog to learn all about agents (from an Entra ID perspective)

Fri, 30 Jan 2026 07:35:22 +0000

I’ve been digging into agents lately, especially the identity and security aspects. As this whole concept is quite new to all of us, it’s always hard to know where to start. Who got this thing figured out already? Who to follow? Who to ask questions?

Least privilege for Temporary Access Pass creation

Sun, 25 Jan 2026 14:15:32 +0000

Today, giving out Temporary Access Passes for Microsoft 365 is a very common task. And attackers love them as well, since they bypass some security policies, including MFA. With Zero Trust in mind, we should always strive to use ‘just-in-time’ and ‘just-enough’ permissions. So whether you do this task manually or have it fully automated, both scenarios need to follow least privilege.

Access Azure Virtual Desktop and Windows 365 Cloud PC from non-managed devices

Mon, 12 Jan 2026 13:10:56 +0000

Many organizations use Azure Virtual Desktop or Windows 365 Cloud PC. But how do we secure access to those resources? A very common use case is to connect from a non-managed device (BYOD). Then, from there, a user would have access to other resources, such as applications, email, and documents. The virtual workspace is managed, well-secured, and controlled by the organization, with end-users’ (BYO) devices used as stepping stones.

Useful search filters in Entra ID you might not know (yet)

Thu, 08 Jan 2026 20:05:18 +0000

I learn new stuff every day. And so do you by reading this post.

The other day, I was scrolling through the Entra admin center and discovered some useful search filters in the Users section that I had not seen before. That could just be my ignorance, but since I did not know about them, I figured more folks should be enlightened. Hence, this short, informative post. I was surprised that such a handy filter was available by the click of a button. No fancy PowerShell scripts or MCP servers, just plain UI stuff today!

How to enable passkeys for guest users in Entra ID

Fri, 19 Dec 2025 14:12:23 +0000

Passkeys like FIDO security keys, synced passkeys, and passkeys in Microsoft Authenticator are secure and convenient authentication methods for your end users. They are phishing-resistant, passwordless, and enable fast sign-in to Microsoft 365 or other Entra ID-integrated apps.

The issue#

Unfortunately, guest users who access your (resource) tenant with MFA enforced are unable to register a passkey, despite having it enabled or registered in their home tenant. This is also stated on Microsoft Learn.

Store your Microsoft 365 passkeys in 1Password

Mon, 24 Nov 2025 20:04:37 +0000

Syncable passkeys in Microsoft 365 and Entra ID are here, so we are no longer limited to the Authenticator app and FIDO2 keys for storing passkeys. Passkeys can now be synced up “into the cloud”, so we can enjoy them on all our devices without the hassle of recovering each time we get a new phone or lose our YubiKey.