The other day, I was doing some research in my lab, and had to register a new passkey a couple of times. At some point, I stumbled upon the device code flow in the Microsoft Authenticator app. I was aware of this flow, but I suddenly realized how easy it is to create a new passkey on a rogue/remote device, using social engineering. One more reason to block it! Here is the flow. I’ll add a new work or school… 

Today, a quick post about setting up token lifetime policies in Entra ID. In some use cases, organizations require a short access token for highly privileged apps or resources. That said, this is probably NOT needed for the typical apps we all use day-to-day. With Entra token lifetime policies, you are able to manage the token lifetime of access tokens, SAML tokens, and ID tokens. It’s important to understand that it does not apply to refresh and session tokens. So, if… 

Application policies in Entra have been around for a while now to manage the use of secrets, but I don’t see many folks using them. It’s probably because secrets are still widely used, and an unlimited lifetime for secrets results in less yelling from developers. Everyone’s happy. Yet, attackers love secrets and use them all the time. In obvious places, like app registrations, but also on service principals, where you don’t expect them. You cannot see or add them in… 

Two new policies have been added to the recently introduced Application Policies in Entra ID! Admins can now restrict or block multi-tenant applications, and applications that support consumer sign-in (personal Microsoft accounts) Looking closer, we now have two options added to the blade: Block multitenant applications – Policy that blocks new multitenant applications, and prevents existing applications from switching to multitenantBlock consumer account applications – Policy blocking applications from targeting personal Microsoft accounts unless exempted or created before the specified…