#azuread — Public Fediverse posts

What are your biggest Entra (AzureAD) Conditional Access questions or pain points? I'm working on a giant Conditional Access post for the #TrustedSec blog -- would welcome your inputs!
#Microsoft #Entra #AzureAD #Azure #ConditionalAccess #conditionalaccesspolicies

I'd like to point out this really interesting article on the topic: 𝐓𝐨𝐤𝐞𝐧 𝐓𝐡𝐞𝐟𝐭 𝐓𝐚𝐥𝐤.

Key points and topics covered:

- Primary Refresh Tokens (PRT) on all operating system platforms have been hardened against theft from day one. The level of protection depends on operated system capabilities, with Windows offering the strongest protection.

- First line of defense against token theft is protecting your devices by deploying endpoint protections, device management, MFA (and moving towards phishing-resistant credentials), and antimalware

You can reduce token theft by carefully orchestrating Entra ID security products:

▶Addressing token theft of sign-in session artifacts: Conditional Access: Token protection policy offers cryptographic protection against replay of stolen tokens.

▶Addressing token theft of app session artifacts: block usage of stolen access tokens and workload cookies outside of your corporate network by using Conditional Access.

▶Detecting token theft: enable risk detections with Microsoft Entra ID Protection to elevate user risk when token theft is suspected.

https://techcommunity.microsoft.com/t5/microsoft-entra-blog/addressing-data-exfiltration-token-theft-talk/ba-p/3915337

#microsoft #microsoftsecurity #entraid #azuread #azure #idp #token #tokentheft #cloudsecurity #identity #prt #cookies #identityprotection #mfa #cae #conditionalaccess #refreshtoken #token

#AzureAD #MFA is having a bad day right now, I can't sign-in into #Microsoft #EntraID with my admin accounts.

And since I messed up the #ConditionalAccessPolicy exclusions my #BreakGlass account is useless too.

𝗠𝗶𝗰𝗿𝗼𝘀𝗼𝗳𝘁 𝗘𝗻𝘁𝗿𝗮 𝗣𝗿𝗶𝘃𝗮𝘁𝗲 𝗔𝗰𝗰𝗲𝘀𝘀: 𝗔𝗻 𝗜𝗱𝗲𝗻𝘁𝗶𝘁𝘆-𝗖𝗲𝗻𝘁𝗿𝗶𝗰 𝗭𝗲𝗿𝗼 𝗧𝗿𝘂𝘀𝘁 𝗡𝗲𝘁𝘄𝗼𝗿𝗸 𝗔𝗰𝗰𝗲𝘀𝘀 𝗦𝗼𝗹𝘂𝘁𝗶𝗼𝗻

Private Access in Microsoft's SSE solution offers secure, controlled access to private resources using Zero Trust principles, expanded from the existing Entra ID Application Proxy. It supports a range of protocols, authentication methods, and anomaly detection, all benefiting from Microsoft's extensive global network.

Find out more info:

https://techcommunity.microsoft.com/t5/microsoft-entra-azure-ad-blog/microsoft-entra-private-access-an-identity-centric-zero-trust/ba-p/3905451

Here's a summarized breakdown of the provided information:

1️⃣Private Access in Microsoft's SSE Solution:

✔️Built on Zero Trust principles.

✔️Verifies every user and enforces least privilege.

✔️Grants access only to needed private applications and resources.

2️⃣Expansion of Entra ID Application Proxy:

✔️Private Access extends capabilities of Entra ID Application Proxy in Microsoft Entra.

✔️Evolves into a comprehensive Zero Trust Network Access (ZTNA) solution.

✔️Shares connectors but offers expanded functionalities.

3️⃣Access to Any Private Resource:

✔️Simplifies and secures access to private resources on any port and protocol.

✔️Policies enable secure, segmented, and granular access to corporate network apps.

✔️Covers on-premises, cloud-based applications, and more.

4️⃣Granular Access Controls and Anomaly Detection:

✔️Conditional Access policies offer per-app, least privilege controls.

✔️Contextual information about users, devices, and locations enhances policies.

✔️Anomalies or changes trigger session termination or stronger authentication.

5️⃣Secure Access Across Ports and Protocols:

✔️Private Access enables secure entry to applications, regardless of location.

✔️Works with various protocols, including RDP, SSH, SMB, FTP, TCP, and UDP.

6️⃣Diverse Authentication Methods:

✔️Supports single sign-on (SSO) via SAML, http headers, or legacy Kerberos.

✔️No need for application modifications.

7️⃣Microsoft's Global Network Advantage:

✔️Private Access utilizes Microsoft's vast global network for delivery.

✔️Enhanced security and faster access compared to traditional VPNs.

✔️Optimized connection for hybrid and remote work scenarios.

#microsoft #entra #sse #ZTNA #ZeroTrustNetworkAccess #ZeroTrust #sso #saml #mfa #conditionalaccess #azuread #securityserviceedge #vpn #azure #cloud #cloudsecurity

#Token #revocation and #expiration in #AzureAD is important in terms of responding to #security #incidents affecting Azure AD. How and when do tokens expire or what are the revocation options?

#Access tokens typically have an expiration time of 60 minutes. And there is no way to manually invalidate an access token except by manually deleting the token in the cache on the device.

#Refresh tokens typically have a default expiration of 90 days. However, refresh tokens can be invalidated by an admin from the Azure portal or using PowerShell or the Graph API.

A Primary Refresh Token (#PRT) is invalidated when the Azure AD account is disabled or deleted, the user password is changed or reset, or the device where the PRT was issued is disabled or deleted.

A rich #training #offer at BSides Milano we have top-notch trainings, in some case for the first time in #Italy! All #in-person! The #event will be held from 4 to 8 July 2023. From 4 to 7 we will be focus on #learnitall on the 8 we will deep dive in our #amazing #conference. Ticket will be available from tonight for the trainings. We have an early bird rate until 30th April.
Are you ready? We are!! join our group SecurityBsidesItalia #linkedin or on #discord https://lnkd.in/dBu7wkJG for detailed info! #cyber #threatintelligence #threatintel #cloud #redteaming #redteam #blueteam #threathunting #exploitation #secureboot #TTE #multicloud #hybridcloud #voip #Linux #Windows #LTE #baseband #deception #detection #evasion #edr #BSML23 #AWS #Azure #AzureAD #GCP #devops #cicd #RTOS #FalseFlag #HoneyNet #IDAPro #Python #reverseengineering #Ghidra #network #MITRE #TTPs #persistence #commandandcontrol #lateralmovement #osint #obfuscation #malware #malwareanalysis .
Reserve your your spot!! https://lnkd.in/dZf-yyPv

#Password #expiration for accounts no longer makes sense and is not recommended if multi-factor authentication (#MFA) is used. For this reason, it is recommended to disable password expiration in the #Microsoft365 environment as well.

But what if the company has synchronized identities in the Password Hash Sync (#PHS) scenario? In that case, the #AzureAD password expiration policy is not applied to the synchronized accounts. And such accounts passwords are always set to never expire. It is assumed that in such a case the policy in Active Directory handles this.

But what if the user never authenticates to the local AD? The computer has Azure AD Join and the user is only using cloud services. The password for his AD account has expired, but he doesn't even know about it, and Azure AD still authenticates the user because passwords for synchronized accounts never expire.

In this case, you need to configure the Azure AD Connect server to apply the Azure AD password expiration policy also to synchronized accounts. This can be done using PowerShell on the Azure AD Connect server: Set-MsolDirSyncFeature -Feature EnforceCloudPasswordPolicyForPasswordSyncedUsers