Fabian Bader

Microsoft Entra Conditional Access token protection explained - Microsoft Entra ID Learn how to secure your environment with token protection in Microsoft Entra Conditional Access policies.

A rare, but highly welcome change. Microsoft changed the license requirement for Token protection from Entra ID P2 to P1.

This will protect more customers in the long run and lead to a more secure ecosystem.

learn.microsoft.com/en-us/entra/...

🚨 PSA - Zero day in SharePoint on-prem is actively exploited!

◽ Have Defender AV active
◽ Don't disable AMSI integration of SharePoint
◽ Keep an eye out for the alerts outlined in the article
◽ Look for post exploitation with the hunting query

msrc.microsoft.com/blog/2025/07...

Part 8053 of eleventy billion on our path to killing NTLM: way way way way way better auditing.

support.microsoft.com/en-us/topic/...

What r u doing while cooking?
That’s my distraction ….
#PSConfEU 2915

Azure AD Graph retirement Migrate your applications using Azure AD Graph APIs scripts to Microsoft Graph before September 2025.

The latest on the Azure AD Graph retirement mentions two temporary outage tests and more guidance.

If something stops working it might be because of those tests.

#Entra #AADGraph

techcommunity.microsoft.com/blog/microso...

One of the results of the joined research with @dirkjanm.io is entrascopes.com

Basically the yellow pages for Microsoft first party apps.

#TROOPERS25

"One thing we have learned over years is that the world moves quickly, and building is easy but supporting is hard...."

Sydney Smith 2025

#StateOfTheShell
#PSConfEU 2025

Citrix Netscaler customers - keep calm and patch CVE-2025-5777 from Tuesday.

It allows unauth memory reads, has similarities to CitrixBleed (CVE-2023-4966) as may allow session token theft.

Great company you have there. Enjoy Malmö

Rerunning my test scenarios for the #TROOPERS25 presentation...

Congratulations 🎉

A margarita pizza with mozzarella cheese

Pizza 🍕

Microsoft trying to be like @vxunderground, smh 😂

Suspicious domain m365sessionlogin[.]com was registered through Njalla on 5/18/25. Domain itself does not resolve, but subdomains login, logon, and office365 indicate hosting at 80.78.30[.]154.

The unified IdentityInfo table is the most comprehensive way to identify users and their attributes in the unified SOC experience.

You have to onboard your Sentinel workspace AND enable UEBA to take advantage of this in advanced hunting.

#xdr #sentinel

Made it on #58 of the MSRC leaderboard Q1 2025

First time I made it on the @msftsecresponse leaderboard 🍾

msrc.microsoft.com/leaderboard

Experts live NL
Workplace Ninja Norway
TROOPERS (DE)
Workplace Ninja Summit (CH)

Not yet, but if you see me at any of the conferences starting June come over and ask me about it.

a card deck from the back, fanned out, reading "Family of Client IDs" with a tree in the middle

Planning for some days off from work. What to put in the duffle back beside a good book and some sunscreen?
My new favorite card game of course.
#FOCI #FamilyOfClientID

Application Based Authentication on Microsoft Entra Connect Sync is near. With this change you will be able to use a TPM backed certificate in Entra Connect Sync for authentication.

This is a welcome change to prevent the compromise of this high privileged account.

#Entra #Certificate

Not really

I made an Azure version
microsoftedge.microsoft.com/addons/detai...

Here's (finally!) what I've found about this 😉
bsky.app/profile/cnot...

Is this in the Entra portal or in forwarded logs to Log Analytics

👀 Who is Nova?

We will find out tomorrow 😉

Here's another Maester v1.2 teaser.

We just added Severity for test results plus the ability to filter by Severity.

Great writeup

Looks like Lifecycle Workflows just added the ability to revoke session tokens 💪

Previously, we had to create our own custom extension (Logic App) to do this, so really nice to see it as a built-in task now :)

learn.microsoft.com/...

What's new in Microsoft Defender for Endpoint - Microsoft Defender for Endpoint See what features are generally available (GA) in the latest release of Microsoft Defender for Endpoint, and security features in Windows 10 and Windows Server.

Two new ASR rules are now generally available:

◽Block rebooting machine in Safe Mode
◽Block use of copied or impersonated system tools

learn.microsoft.com/en-us/defend...

Automatic attack disruption: Enhanced containment for critical assets and shadow IT | Microsoft Community Hub Staying ahead of attackers is tough, as they constantly evolve and use advanced techniques like AI to exploit vulnerabilities. Protecting high-value assets...

Microsoft XDR Automatic attack disruption just got better. It now takes into account the device role and criticality to preserve key network functionality while protecting the assets.

Plus IP address based containment of undiscovered devices! #XDR

techcommunity.microsoft.com/blog/microso...