Shiny brain

This is pretty cool. You can build consent URLs for Logic Apps for use in phishing, and it looks like Microsoft has added warnings to this consent dialog :) It's been a long time since I used the URL like this - anyone know when this change happened?

Do you exclude MFA on joined/registered devices? If so, do you require MFA for device join/registration? I see this often because these controls aren't considered at the same time, and that's how we get this gap: Attacker steals user/pass -> register device -> no MFA required

WhoAmI - Dynamics edition 😂

OMG, XDRInternals dumping MDE device timeline straight into Azure Data Explorer 🤯

Soon ™️

Brand new feature being developed in 2026 using secrets for authentication 👎

Support for TAP and Phone Sign In are done! It was surprisingly harder than expected to get the phone sign-in flow to work properly :p Working on cross-platform browser auth now, and hopefully will be able to add it to XDRInternals this weekend

"Because everyone else lowered the bar, we decided to join them" is so on-brand...

*chuckles* I'm in danger

😅

Cut your cloud spending bills with this one weird trick! lol, honestly, I can't believe how well this worked 😅

Feed M365 Copilot a simple markdown file asking for a Word doc, and of course it chokes and dies... It's truly impressive just how bad this product is :-/

Merged some good XDRInternals updates :) Connect-XdrBySoftwarePasskey does exactly what it says, super easy to automate AI access to the portal 🤖 Get-XdrIdentityUserTimeline lets you extract the whole 180 days of user timeline data if you need it github.com/MSCloudIn...

Apparently OnlyCopilotFans is a thing... 🤢

Doing some napkin math, I estimate just under 3 hours (fully optimized) to wipe 200K devices via Intune API If an attacker were unaware of API limits being per app, that bumps to ~5.5 hours under ideal conditions What happens if all admin devices are wiped first? 🤔 😳 🥺 😭

When you don't require security keys and a dedicated device for your privileged admin roles

If you think Intune's multi-admin mode is going to save you from a phished Global Admin, I have bad news... GA can just create a second admin and approve their change ;)

I love how you design a harness with delays, and AI is like, no bro, that's gonna take to long, let me change that for you 😂

They couldn't have called it biztalk? 🙃

azd + maester = 😲 Soon ™️

If you have considered using my script to create software passkeys using ESTSAUTH cookies on a pentest or red team exercise, I have published a more secure option for you ;) Create an Azure Key Vault, grant yourself Key Vault Crypto Officer, and run this: github.com/nathanmcn...

There is absolutely no way I could have written a test harness, not to mention automated bug fix and re-test, and then left it for 4 hours Guaranteed weeks of testing during my free time cut down to a couple of days of reviewing and approving So freaking cool 😎

Game changer - use cap locks for voice to speak :)

Don't have PKI but want to use TLS inspection in Global Secure Access? This script sets up Azure Key Vault Premium (HSM backed keys, $5/month), creates the CA certificate in Key Vault, gets the CSR from GSA, signs it with Key Vault, and adds it to GSA 🔥 github.com/nathanmcn...

New features for my Defender Reporting solution :) 1️⃣ Azure deployment option - Automation runbook exports vulnerability data and builds the dashboard, compressed data stored in blob storage - Optional Container App hosts dashboard using Entra auth github.com/nathanmcn...

Ever need to find out what Entra authentication methods your users are using but don't have Log Analytics/Sentinel? :) It's not as difficult as you might think! To get started, log into the Entra portal, go to Sign-in logs, set the date range to 1 month, then download the JSON:

So, uhh, "winget install node" might not do what you think 😬 Someone pointed this out to me thinking it might be a name squatting type attack, lol. Doesn't look like it is on the surface, but be careful out there ;)

It may not be the most comprehensive testing, but it's pretty awesome kicking off an assessment of all the cmdlets, parameters, etc. and having it verify the results are all in the correct formats, no warnings/errors, etc About to let it run wild in a dev tenant, wish me luck 😂

First of three legs on my way to WPNinjas US in Dallas. Only 13 hours of travel to go... 🤪 It'll totally be worth it to see everyone, hopefully help some folks with work, career, and family :) I'm way behind on planning, so hmu if you're going to be there!

I often make this mistake with Filter for devices in Conditional Access... and I bet you are doing it too 🤪 To target unregistered devices, you probably want to do INCLUDE with trustType/isCompliant NotEquals <value> Go double check your policies ;) learn.microsoft.com/...

Hey folks, just jumping on a live Entra Chat to talk about all the Ignite announcements with @merill.net, @naunheim.cloud, Martin Sandren, and Ru Campbell! Come join us at riverside.fm/studio/entra...

SECRET_INTERNALS_DO_NOT_USE_OR_YOU_WILL_BE_FIRED 😳

Fancy - looks like we'll have the ability to block Agents based on use cases and agent risk Curious to see if this goes the way of Workload Identity Premium after Preview

Defender for Identity can now automatically configure Windows Event Auditing on your Domain Controllers when using the new v3 sensor 🥳 learn.microsoft.com/...

We can now change Source of Authority on Contacts as well 🔥 Looks like we can change contact SOA using the https​://graph​.microsoft​.com/v1.0/contacts API endpoint too :)

A 138 character cmdlet in a production PowerShell module 🫠

Everybody is always worried about emergency access, but what about emergency shutdown? 😏

Just casually dropping nuanced licensing details on step 7 of a how to guide, as one does 🤷‍♂️

I demand to speak to a manager! :P

Ahh yes, Blizzard Antivirus, my favorite of all the Antivirus products 🤣

Brilliant Conditional Access masterclass at #MMSMusicCity by @nathanmcnulty.com and @conditionalaccess.uk Your policy is as strong as its poorest exclusion #MMSMOA

I can't stop laughing 😂

👋 Check out this new Microsoft Entra blog post 👇 Your shortcut to Microsoft Entra deployment success techcommunity.microsoft.com/t5/microsoft...

Intune now has dedicated security recommendations docs just like Entra 🔥 The Entra security docs are extremely popular, and I love seeing other teams publishing this kind of guidance Thanks to my collegaue (Josh Gatewood) for pointing this out! learn.microsoft.com/en-us/intune...

Did you know Entra ID Protection never automatically clears Medium or High risk? We either need to use Risk Based Conditional Access policies to remediate or an admin needs to manually remediate User risk = password reset Sign-in risk = require MFA learn.microsoft.com/...

It's happening! Converting AD resources to Entra resources is here, and even more docs just arrived 🥳 Delivered with the User SoA docs is something even bigger - architectural guidance for shifting from AD to Entra using Source of Authority conversion🔥 learn.microsoft.com/...

cyber awareness month is off to a great start...

Hahaha, wow... 😮 If you leave App passwords enabled and enforce MFA through per-user MFA, the MFA enrollment wizard actually makes the user to create an app password 🤯

If you've been evaluating the new(ish) Defender for Identity sensor (v3.0) that's in preview, there's a new config to support advanced identity detections :) Just add the tag "Unified Sensor RPC Audit" to the DC's (docs recommend asset rule management) learn.microsoft.com/...