Merill Fernando  

@[email protected]
1.7K Followers
773 Following
1.5K Posts
Product Manager @microsoft | entra.news CxP #identity #entra #graphpowershell
Dad • Dev • He/Him • 🇦🇺 • 🇱🇰 • Wurundjeri Country • Toots are my own. @merill on Twitter
Websitehttps://merill.net/about/
Twitterhttps://twitter.com/merill
LinkedInhttps://www.linkedin.com/in/merill
GitHubhttps://github.com/merill
ProfileHe/Him
Newsletterhttps://entra.news
Merill Fernando  12h ago

Entra Hardening Tip #4 - Block legacy authentication

Problem:
Legacy auth (SMTP/IMAP/ROPC) doesn’t support MFA, making it a prime target for password attacks and an easy entry point for attackers using stolen creds.
1/4

Show threadMerill Fernando  1d ago

The report also referse to the emergence of EvilTokens, a phishing-as-a-service (PhaaS) toolkit identified as a key driver of large-scale device code abuse.

For more info see https://lnkd.in/g66x8sAD

Don't wait till one of your users are phished to roll out this CA policy.
5/5

Show threadMerill Fernando  1d ago
→ Include: All users + All resources
→ Target: User Action = Register or join devices
→ Conditions: Authentication Flows 👉 Device code flow
→ Access control: Block access
🔹 Exclude the specific apps that have a legitimate reason to use 'Device code flow'.
3/5
Merill Fernando  1d ago

Entra Hardening Tip #3: Block device code authentication flow

Device code flow allows users to sign into headless devices like Teams meeting rooms and CI/CD pipelines.

The problem:
1/5

Show threadMerill Fernando  2d ago

The fix:

Create a CA policy

→ Include: All users
→ Target: User Action = Register or join devices
→ Grant access: Require authentication strength - MFA

Microsoft reported seeing these types of attacks in 2022

https://www.microsoft.com/en-us/security/blog/2022/01/26/evolved-phishing-device-registration-trick-adds-to-phishers-toolbox-for-victims-without-mfa/#:~:text=One%20account%20belonging%20to%20an,to%20discover%20freshly%20registered%20devices.
3/6

Merill Fernando  2d ago

Entra Hardening Tip #2: Require MFA for device join & device registration using 'User Action'

If you don’t enforce a Conditional Access policy for “Register or join devices”, you’re leaving a gap.

Attackers can take advantage of this and register new devices without MFA.
1/6

Merill Fernando  3d ago

👋 Folks, I'm starting a new series of Entra Hardening tips from today.

Here's how it will work. One new tip every weekday (I take a break on weekends).

Tip #1: Privileged accounts in Entra ID should be cloud native identities
1/7

Merill Fernando  4d ago

Sneak peek at something new I'm building...

I'm so excited, I can't wait to share with everyone. You are all going to ❤️ it.

Who wants to take a guess what it is?

For the handful of folks who I've told, your excluded from answering 😂

Merill Fernando  5d ago

Just dropped a new Entra Chat episode with Sean Metcalf and honestly my brain is full 🤯

Sean has been doing Microsoft identity security since Azure AD was barely a thing and he still sees the same misconfigs in enterprise environments every. single. day.

🎙️ Watch → https://entra.news/p/stop-leaving-the-door-open-the-entra

Merill Fernando  Apr 11

Most IT admins treat Conditional Access like Whac-A-Mole. 🔨

In this episode of Entra.Chat, Per Torben breaks down why the standard docs aren't enough and how to build a scalable security framework that actually works.

Don't get locked out. Get secure. 🔒

🎧 https://entra.news/p/how-to-design-bullet-proof-conditional