🔒 Blocking Device Code Flow in M365, full mini-toolkit now on GitHub:

1️⃣ Audit script => verify zero legitimate usage before blocking (all 4 Entra sign-in log types)
2️⃣ CA policy JSON => ready to import, just replace your break-glass group ID

🔗 https://github.com/Bluewal/m365-intune-scripts/tree/main/entra/device-code-flow

#infosec #Microsoft365 #EntraID #ConditionalAccess #BlueTeam #PowerShell

🚨 EvilTokens / AiTM attacks are actively abusing Device Code Flow to bypass MFA in M365 tenants.

Before blocking it via Conditional Access — verify it's actually unused in your environment.

Script queries all 4 Entra sign-in log types via Microsoft Graph:
✅ No results → safe to block immediately
⚠️ Results found → review before deploying

🔗 https://github.com/Bluewal/m365-intune-scripts/blob/main/entra/device-code-flow/Invoke-DeviceCodeFlowAudit.ps1

#infosec #Microsoft365 #EntraID #ConditionalAccess #BlueTeam #PowerShell

Identity attacks rise; use conditional access, behavioral analytics. Infosec K2K boosts security with adaptive controls, real-time detection.

#CyberSecurity #IdentitySecurity #ConditionalAccess #BehavioralAnalytics #ZeroTrust #IAM #CyberResilience #InfosecK2K

🚨 Entra ID External MFA (old name was External Authentication Methods) is now Generally Available.

Custom Controls is being deprecated on 30 Sept 2026.

Here's how to check your usage.

https://thedxt.ca/2026/03/microsoft-entra-id-external-mfa/

#Entra #MFA #M365 #Microsoft #Microsoft365 #ConditionalAccess

𝐇𝐨𝐰 𝐂𝐨𝐧𝐝𝐢𝐭𝐢𝐨𝐧𝐚𝐥 𝐀𝐜𝐜𝐞𝐬𝐬 𝐏𝐨𝐥𝐢𝐜𝐢𝐞𝐬 𝐀𝐫𝐞 𝐄𝐯𝐚𝐥𝐮𝐚𝐭𝐞𝐝 𝐢𝐧 𝐌𝐢𝐜𝐫𝐨𝐬𝐨𝐟𝐭 𝐄𝐧𝐭𝐫𝐚 𝐈𝐃

Understanding how Conditional Access policies are evaluated in Microsoft Entra ID is absolutely essential if you are involved in their creation or management.

I often encounter fundamental misunderstandings regarding how the evaluation of Conditional Access policies takes place. Many administrators are accustomed to systems like firewalls, where there is an order or priority for evaluating created rules. However, it does not work this way with Conditional Access policies in Microsoft Entra ID. Applying the same principle to Conditional Access policies will very likely lead to significant security risks.

Read my blog post bellow 👇 👇
https://www.cswrld.com/2026/02/how-conditional-access-policies-are-evaluated-in-microsoft-entra-id/

#cswrld #entraid #securitytips #conditionalaccess

Microsoft is rolling out two Entra ID changes this spring that take effect automatically.

Passkey profiles move to GA in March. Tenants that do not opt in will be auto-migrated starting in April (through late May for Worldwide, late June for GCC/GCC High/DoD). If attestation is disabled, synced passkeys become allowed by default, meaning credentials can sync via iCloud Keychain and Google Password Manager without an explicit decision to allow synced passkeys.

Conditional Access is closing an enforcement gap starting March 27. Policies targeting "All resources" with resource exclusions will now enforce on sign-ins where apps request only OIDC or limited directory scopes. These flows were previously not being evaluated..

I published a breakdown covering:

• Auto-migration logic and default configuration behavior
• PowerShell scripts to audit your tenant
• A three-profile passkey architecture for role-based separation
• How to identify affected Conditional Access policies
• Key gotchas (silent campaign shifts, retroactive AAGUID removal, destructive preview opt-out)

The post includes links to MC1221452, the Microsoft Tech Community announcement, and the relevant Microsoft Learn documentation.

https://nineliveszerotrust.com/blog/entra-march-2026-passkeys-ca/

#EntraID #Identity #ZeroTrust #Passkeys #ConditionalAccess #CloudSecurity #MFA

RE: https://infosec.exchange/@franklesniak/115572191076370399

#ActiveDirectory #EntraID #IdentityManagement #AccessManagement #IdentitySecurity #ZeroTrust #GroupPolicy #ConditionalAccess #PrivilegedIdentity #PrivilegedIdentityManagement #PrivilegedAccessManagement #MicrosoftSecurity #PingCastle #PurpleKnight #Maester #DigitalIdentity

@_dirkjan and my joint talk at #TROOPERS25 is now available on YouTube.

"Finding Entra ID CA Bypasses - the structured way" @WEareTROOPERS

https://youtu.be/yYQBeDFEkps

#Entra #ConditionalAccess

𝗛𝗼𝘄 𝘁𝗼 𝗯𝗹𝗼𝗰𝗸 𝘂𝗻𝗸𝗻𝗼𝘄𝗻 𝗽𝗹𝗮𝘁𝗳𝗼𝗿𝗺𝘀 𝗶𝗻 𝗠𝗶𝗰𝗿𝗼𝘀𝗼𝗳𝘁 𝗘𝗻𝘁𝗿𝗮 𝗜𝗗

Under conditional access policies, it is possible to block individual device platforms. In general, it is a good idea to eliminate all ways that a potential threat actor could use to compromise the environment. In other words, block everything that is not needed.

This also applies to device platforms within Microsoft Entra ID. For example, if your organization only uses Windows, iOS, and Android, it's a good idea to disable all other platforms. If you also use macOS, you need to add macOS as well, of course.

What I would definitely recommend blocking is Windows Phone and other unknown platforms. Unrecognized / unknown platforms are usually spoofed User Agents, which is mainly used by threat actors.

📺 Watch my YouTube video bellow 👇 👇
https://youtu.be/vFhQgwXmqTo

#cswrld #videotutorial #entraid #conditionalaccess #platforms #blocking