Nathan McNultyMay 21, 2023

Pretty excited to share a new post on a lesser known Intune feature! :)

Microsoft Tunnel can do full device or per-app tunneling on iOS and Android, providing access to on-prem resources, restricted cloud resources, or ensuring access to SaaS apps come from a known, trusted set of IPs 🔥

https://blog.nathanmcnulty.com/intune-microsoft-tunnel-vpn-gateway/

#NathansBlog

Intune - Microsoft Tunnel VPN Gateway

A really neat but lesser known feature of Intune is Microsoft's Tunnel VPN solution which can do full device or per-app VPN tunneling on iOS and Android. This allows us to provide access to on-prem resources, restricted cloud resources, or ensure access to SaaS apps are coming from a known,

Nathan McNulty
Nathan McNultyApr 1, 2023

Just published my follow up post for setting up Azure AD SSO to AWS for Single-Account access, also using PIM for Groups :)

This one is really cool because of this regex used to create the SAML claim:
AWS-(?'accountid'[\d]{12})-(?'role'[\w])

Even if you don't use AWS, this technique can be applied to other apps that use Roles in SAML claims, like Splunk

https://blog.nathanmcnulty.com/aws-pim-single-account-access/

#NathansBlog

AWS - Integrating PIM with Azure AD SSO for AWS Single-Account Access

Previously I showed how we can configure SAML SSO with AWS IAM Identity Center which can make many things easier, especially for larger companies, but it may not be an ideal fit for smaller companies who have one or two accounts and want to manage groups, permissions, and governance in

Nathan McNulty
Nathan McNultyMar 31, 2023

Just published a new blog post on setting up AWS SSO with Azure AD leveraging Privileged Access Groups to provide just-in-time access and approval workflows

This concept can be used for any Azure app, so it's still an interesting read even without AWS :)

https://blog.nathanmcnulty.com/aws-pim-iam-identity-center/

#NathansBlog

AWS - Integrating PIM with Azure AD SSO for AWS IAM Identity Center

I've been working in AWS a fair bit lately (Defender for Cloud posts coming soon) and thought it would be fun to set up SSO from Azure AD. But I also wanted to see if there was a way I could integrate Privileged Identity Management into it for just in

Nathan McNulty
Nathan McNultyFeb 15, 2023

If you manage Windows Servers, I'm starting a new series on Azure Arc that you might be interested in :)

Arc is a growing platform that provides a lot of newer capabilities, like update management that replaces WSUS or SSH to on-prem Linux servers using Azure AD identities!

In this first post, I'm providing a detailed walkthrough of the onboarding process using Group Policy because I think it's one of the most common but least clear methods if you try to use the documentation :)

As always, I love feedback, so let me know if you see anything that can be improved!

https://blog.nathanmcnulty.com/azure-arc-onboarding-servers-with-group-policy/

#NathansBlog

Azure Arc - Onboarding Servers with Group Policy

As organizations migrate endpoint management to Intune, a common question I get asked is "What do I do with my servers since Intune only supports clients?" Whether you are looking to move away from Active Directory and Group Policy, Microsoft Configuration Manager, or just trying to figure all of this

Nathan McNulty
Nathan McNultyJan 23, 2023

"In the end, it cost just under $1,700 for a server that has 2x 14-core 2.4 GHz CPUs, 384 GB RAM, 8x 1.2 TB 10K RPM drives, and 3x 1TB NVMe 3500MB/S SSDs. I have been running 3 labs totaling 62 VMs, with Server 2022 + Hyper-V as the host, mostly due to integration with Azure for work related scenarios :)"

I just published a post on building my home lab in hopes that it helps others out there!

https://blog.nathanmcnulty.com/lab-server-build/

I have a couple of friends who are just getting started, and as I was gathering the information, I thought it might be helpful to put it into a blog format and share it.

Let me know if you have any questions :)

#NathansBlog

Lab - Server Build

Back in May of last year, I started building a new server and had planned to fully share the process of putting it together, setting up the OS, templates, etc. Instead, we had a baby, remodeled and sold our home, moved over 1500 miles, and had job constraints that forced

Nathan McNulty
Show threadNathan McNultyNov 15, 2022

Gah, I forgot to include the hashtags for my blog post... :(

#Intune
#AccessPackages
#NathansBlog

Nathan McNultyNov 15, 2022

Hey all, I just published an article on using Azure AD's Access Packages to enable end user device enrollment in Microsoft Intune

https://blog.nathanmcnulty.com/intune-using-access-packages-to-enable-user-device-enrollment/

If you have Azure AD P2 licensing and haven't seen Access Packages, welcome to your new obsession :)

There are a ton of other use cases for these, and I'm hoping to have some future posts to showcase great ways to use them from a security standpoint!

#Intune
#AccessPackages
#NathansBlog

Intune - Using Access Packages to Enable User Device Enrollment

Many organizations use device compliance with Conditional Access to provide protection against MFA capable phishing attacks such as Modlishka, evilginx2, or @mrd0x's browser in the browser attack. This protection works well because Conditional Access uses certificate based authentication with the device and pulls compliance data from Intune, and the attacker

Nathan McNulty
Show threadNathan McNultyNov 10, 2022

I have been wanting share my process for implementing Microsoft Defender's ASR rules for a while, and while it's not refined to where I'd like it to be, I'm going to share it and hopefully update when I can (maybe once per-rule exclusions are available).

Defender for Endpoint - Implementing ASR Rules
https://blog.nathanmcnulty.com/defender-for-endpoint-implementing-asr-rules/

#NathansBlog
#MDE
#KQL

Defender for Endpoint - Implementing ASR Rules

Phase 1: Discover and create exceptions To get started, we will create a policy to set all Attack Surface Reduction rules to Audit mode to ensure applications are not impacted. This allows us to gather telemetry data for any applications that might be affected by these rules. Data should be

Nathan McNulty