How I Detect the Illicit Consent Grant Attack in Microsoft Entra ID
Eduard Arbona — identity security engineer. Contributions merged into Maester and Azure Sentinel;...
Tag archive
Eduard Arbona — identity security engineer. Contributions merged into Maester and Azure Sentinel;...

Entra break-glass (emergency access) accounts: cloud-only, excluded from every policy, watched closely, and tested before you need them.

ConnectWise disabled seven application identities, including Cloud Backup, Teams, and SharePoint Online, following unauthorized access that compromised Mic
Microsoft disclosed in September 2026 that a threat actor tracked as Storm-3068 compromised a single...
A post by Devine Nyaenya
Conditional Access report-only mode: how to go from report-only to enforce...
n8n Microsoft Graph login still says "Need admin approval" after consent? Check the client ID, the scope set, delegated vs application, and /common.

An identity architect’s perspective on device trust, passwordless authentication, endpoint management...
How the right in-place migration approach can preserve eligible user profiles, establish Intune...
A CVSS 10.0 vulnerability (CVE-2026-69836) in Microsoft Entra ID was actively exploited before Microsoft patched it. The flaw allowed unauthenticated remote code execution. Microsoft has mitigated the issue, but the attack window remains a concern.
5 steps to migrate Entra ID risk policies to Conditional Access before the October 1, 2026...
Introduction: Navigating the OIDC Landscape with Entra ID Implementing OpenID Connect...