😭

Whelp, it seems GitHub Copilot went from one extreme to the next It was obvious and understandable something had to change as the premium request model was unsustainably generous, but the new token based model ends up being way more expensive than Codex, Claude, or openrouter.ai

No big deal, just Purview admin portal shipping telemetry to Google...

Holy crap they did it! They backported support for AppContainers from 7.7 to 7.6 🥳 For those who many not be familiar with AppContainers - it's sandboxing. We can sandbox PowerShell. I repeat, we can freaking sandbox PowerShell, natively! github.com/PowerShel...

Can anyone tell me what the point is in reporting malicious domains in Defender XDR if it's not even getting looked at within 24 hours? Even free services already identified this as bad... Daniel Card pointed this one out, seemed pretty easy but I guess not 🤷‍♂️

I cannot wait to use this phrase on a call "That was useful in a painful way" 🤣

I may need an intervention... I'm pretty sure I just said "user-based service accounts are better than service principals, actually"... and in the given context, it was 100% true Service Principals have some really dumb limitations that make user accounts a better fit 🥴

I love getting gaslit by Azure all the time... Automation accounts and Function apps only support PowerShell 7.4, even though 7.5 was released 1.5 years ago and 7.6 was released a few months ago "Please consider updating it soon." 😒 No Azure, you consider updating it soon...

For all the shady stuff I've done so far, it's funny a simple request to use the Bearer token from the integrated browser against the CLI is what got me in trouble :p

Did you know there are at least 6 ways to store data about users in Entra? 😅 Outside of normal user object attributes, directory extensions tend to be one of the best fits for most things, except for sensitive data - use custom security attributes ;) learn.microsoft.com/...

You can allow xAI models in M365 Copilot, and this note is... 🫠🤣

Wait... agents get to have Linux desktops in Cloud PC but users don't?

Shiny brain

This is pretty cool. You can build consent URLs for Logic Apps for use in phishing, and it looks like Microsoft has added warnings to this consent dialog :) It's been a long time since I used the URL like this - anyone know when this change happened?

Do you exclude MFA on joined/registered devices? If so, do you require MFA for device join/registration? I see this often because these controls aren't considered at the same time, and that's how we get this gap: Attacker steals user/pass -> register device -> no MFA required

WhoAmI - Dynamics edition 😂

OMG, XDRInternals dumping MDE device timeline straight into Azure Data Explorer 🤯

Soon ™️

Brand new feature being developed in 2026 using secrets for authentication 👎

Support for TAP and Phone Sign In are done! It was surprisingly harder than expected to get the phone sign-in flow to work properly :p Working on cross-platform browser auth now, and hopefully will be able to add it to XDRInternals this weekend

"Because everyone else lowered the bar, we decided to join them" is so on-brand...

*chuckles* I'm in danger

😅

Cut your cloud spending bills with this one weird trick! lol, honestly, I can't believe how well this worked 😅

Feed M365 Copilot a simple markdown file asking for a Word doc, and of course it chokes and dies... It's truly impressive just how bad this product is :-/

Merged some good XDRInternals updates :) Connect-XdrBySoftwarePasskey does exactly what it says, super easy to automate AI access to the portal 🤖 Get-XdrIdentityUserTimeline lets you extract the whole 180 days of user timeline data if you need it github.com/MSCloudIn...

Apparently OnlyCopilotFans is a thing... 🤢

Doing some napkin math, I estimate just under 3 hours (fully optimized) to wipe 200K devices via Intune API If an attacker were unaware of API limits being per app, that bumps to ~5.5 hours under ideal conditions What happens if all admin devices are wiped first? 🤔 😳 🥺 😭

When you don't require security keys and a dedicated device for your privileged admin roles

If you think Intune's multi-admin mode is going to save you from a phished Global Admin, I have bad news... GA can just create a second admin and approve their change ;)

I love how you design a harness with delays, and AI is like, no bro, that's gonna take to long, let me change that for you 😂

They couldn't have called it biztalk? 🙃

azd + maester = 😲 Soon ™️

If you have considered using my script to create software passkeys using ESTSAUTH cookies on a pentest or red team exercise, I have published a more secure option for you ;) Create an Azure Key Vault, grant yourself Key Vault Crypto Officer, and run this: github.com/nathanmcn...

There is absolutely no way I could have written a test harness, not to mention automated bug fix and re-test, and then left it for 4 hours Guaranteed weeks of testing during my free time cut down to a couple of days of reviewing and approving So freaking cool 😎

Game changer - use cap locks for voice to speak :)

Don't have PKI but want to use TLS inspection in Global Secure Access? This script sets up Azure Key Vault Premium (HSM backed keys, $5/month), creates the CA certificate in Key Vault, gets the CSR from GSA, signs it with Key Vault, and adds it to GSA 🔥 github.com/nathanmcn...

New features for my Defender Reporting solution :) 1️⃣ Azure deployment option - Automation runbook exports vulnerability data and builds the dashboard, compressed data stored in blob storage - Optional Container App hosts dashboard using Entra auth github.com/nathanmcn...

Ever need to find out what Entra authentication methods your users are using but don't have Log Analytics/Sentinel? :) It's not as difficult as you might think! To get started, log into the Entra portal, go to Sign-in logs, set the date range to 1 month, then download the JSON:

So, uhh, "winget install node" might not do what you think 😬 Someone pointed this out to me thinking it might be a name squatting type attack, lol. Doesn't look like it is on the surface, but be careful out there ;)

It may not be the most comprehensive testing, but it's pretty awesome kicking off an assessment of all the cmdlets, parameters, etc. and having it verify the results are all in the correct formats, no warnings/errors, etc About to let it run wild in a dev tenant, wish me luck 😂

First of three legs on my way to WPNinjas US in Dallas. Only 13 hours of travel to go... 🤪 It'll totally be worth it to see everyone, hopefully help some folks with work, career, and family :) I'm way behind on planning, so hmu if you're going to be there!

I often make this mistake with Filter for devices in Conditional Access... and I bet you are doing it too 🤪 To target unregistered devices, you probably want to do INCLUDE with trustType/isCompliant NotEquals <value> Go double check your policies ;) learn.microsoft.com/...

Hey folks, just jumping on a live Entra Chat to talk about all the Ignite announcements with @merill.net, @naunheim.cloud, Martin Sandren, and Ru Campbell! Come join us at riverside.fm/studio/entra...

SECRET_INTERNALS_DO_NOT_USE_OR_YOU_WILL_BE_FIRED 😳

Fancy - looks like we'll have the ability to block Agents based on use cases and agent risk Curious to see if this goes the way of Workload Identity Premium after Preview

Defender for Identity can now automatically configure Windows Event Auditing on your Domain Controllers when using the new v3 sensor 🥳 learn.microsoft.com/...

We can now change Source of Authority on Contacts as well 🔥 Looks like we can change contact SOA using the https​://graph​.microsoft​.com/v1.0/contacts API endpoint too :)

A 138 character cmdlet in a production PowerShell module 🫠

Everybody is always worried about emergency access, but what about emergency shutdown? 😏