I practically stole this project from Aled Mehta (@x_delfino), and I can't express how much I appreciate his work The project helps understand internal APIs services are built on, like portal apps, and can really help with assessment and configuration nodoc.nathanmcnulty.com

Huge improvements to nodoc! I redesigned orchestration so Sol now drives continual improvement of the playbooks :) Putting the process through evals, codex-spark now drives CDP/npm scripts and static analysis, luna handles review and next steps, and sol manages and approves 🔥

They always hide the good stuff in the notes :) I've always liked Enterprise State Roaming, but many places never enabled it. Now the feature has been superseded by Windows settings backup and restore which will be enabled by default starting with the upcoming 26H2 release 🥳

Did you know Entra has recommendations for configuration settings and can even send email alerts on expiring app/service principal credentials? Ideally, I recommend using Maester which has far broader coverage, but this is a nice built-in feature :) entra.microsoft.com/...

It makes me laugh every time I see something like this, lol Like, there is some criminal out there that thought, hmm, I'm gonna sign up for a free Azure trial, set up an Azure Monitor group, and abuse it to send out malicious email 🧠 This is why we can't have nice things :p

Conditional Access in the portal has been flaky for me most of the day, and then randomly this showed up in a few tenants 😎 This is a really nice view, makes it so much easier to find the right policies and notice where you are missing control 🥳

Whelp, it seems they are going to keep me around for another year, now in two categories :p A huge thanks to everyone here who shares and asks great questions - I wouldn't be in this program if it weren't for you :) Looking forward to sharing even more this year!

WHAT?!?

To check if it is in use, you can filter sign-in logs to Authentication protocol - Device code, or you can run Graph PowerShell: Get-MgBetaAuditLogSignIn -Filter "AuthenticationProtocol eq 'deviceCode'" I usually recommend an exclusion group managed by PIM or Access Packages :)

Periodic reminder that even Microsoft recommends disabling Device code flow The primary two areas I see this used are Teams phones / Conference room type equipment and administrative CLI tools, and you should still block by default and exclude as needed learn.microsoft.com/...

Apparently M365 Developer tenants only enforce 1 factor for SSPR for admins... 🫠 Almost had a heart attack and opened a ticket with MSRC, lol I've checked several retail tenants now, and they are all properly enforcing 2 factors 😅

Do you know what your agents are doing? Worried about what kind of websites they might be looking at? Now you can apply the same web content filtering policies to them as you do to your users! 😅 learn.microsoft.com/...

😭

Whelp, it seems GitHub Copilot went from one extreme to the next It was obvious and understandable something had to change as the premium request model was unsustainably generous, but the new token based model ends up being way more expensive than Codex, Claude, or openrouter.ai

No big deal, just Purview admin portal shipping telemetry to Google...

Holy crap they did it! They backported support for AppContainers from 7.7 to 7.6 🥳 For those who many not be familiar with AppContainers - it's sandboxing. We can sandbox PowerShell. I repeat, we can freaking sandbox PowerShell, natively! github.com/PowerShel...

Can anyone tell me what the point is in reporting malicious domains in Defender XDR if it's not even getting looked at within 24 hours? Even free services already identified this as bad... Daniel Card pointed this one out, seemed pretty easy but I guess not 🤷‍♂️

I cannot wait to use this phrase on a call "That was useful in a painful way" 🤣

I love getting gaslit by Azure all the time... Automation accounts and Function apps only support PowerShell 7.4, even though 7.5 was released 1.5 years ago and 7.6 was released a few months ago "Please consider updating it soon." 😒 No Azure, you consider updating it soon...

For all the shady stuff I've done so far, it's funny a simple request to use the Bearer token from the integrated browser against the CLI is what got me in trouble :p

Did you know there are at least 6 ways to store data about users in Entra? 😅 Outside of normal user object attributes, directory extensions tend to be one of the best fits for most things, except for sensitive data - use custom security attributes ;) learn.microsoft.com/...

You can allow xAI models in M365 Copilot, and this note is... 🫠🤣

Wait... agents get to have Linux desktops in Cloud PC but users don't?

Shiny brain

This is pretty cool. You can build consent URLs for Logic Apps for use in phishing, and it looks like Microsoft has added warnings to this consent dialog :) It's been a long time since I used the URL like this - anyone know when this change happened?

Fun side note - you can't actually block device join/registration - that grant control is not supported But you can require a method that no user could possibly have ;) Alternatively, use Temporary Access Pass to allow scenarios you want "block by default, allow by exception"

Do you exclude MFA on joined/registered devices? If so, do you require MFA for device join/registration? I see this often because these controls aren't considered at the same time, and that's how we get this gap: Attacker steals user/pass -> register device -> no MFA required

WhoAmI - Dynamics edition 😂

OMG, XDRInternals dumping MDE device timeline straight into Azure Data Explorer 🤯

Soon ™️