I came across something quite surprising (to me at least) the other day, so I thought I would share it here in case others come across the same behaviour. What I found is that that the Entra ID audit log doesn’t always show an entry for removal of a member from a group. Specifically, if… Read More: Auditing removal of group members in Entra ID »
SharePoint Online offers a nifty security feature known as “app-enforced restrictions”. In this article, I will briefly describe the feature and show you how to enable it. I will also point out why there is a need to be aware of what is happening in the background in case turning it on causes issues for… Read More: Caution required when enabling SPO app-enforced restrictions »
With about six weeks to go until Microsoft starts to deprecate versions of Azure AD Connect released more than 18 months ago, it’s a good time to check which version you’re running. The version release history site for AAD Connect is displaying the statement below. It’s not immediately clear what the word “deprecation” actually implies… Read More: Deprecation of older AAD Connect versions »
If you are using Microsoft Authenticator for MFA or for signing in to your accounts then you should give some thought to enabling the App Lock feature. App Lock requires you to authenticate (using biometric or PIN) before opening the app for use. This is a very handy feature given the potentially sensitive information the… Read More: The App Lock feature in Microsoft Authenticator »
If, like me, you regularly lose track of what features exist where in the plethora of Microsoft cloud portals, hopefully this list will help you find your way. Or at least give you a URL as a starting point. I’ll attempt to keep this up-to-date, so if you see something missing please leave a comment… Read More: A list of Microsoft Portals »
One of my customers is using Password Hash Synchronisation (PHS) as their Azure Active Directory authentication method for users synced from on-premises AD. Not having had much experience with PHS, I was a little surprised to learn recently that PHS users have cloud passwords that do not conform to the default AAD 90 day expiry.… Read More: PHS and Password Expiry »
Earlier this week, I had a need to produce a list of Guest users in an Azure AD tenant who had not yet redeemed invitations that had been sent to them. It took me a little while to figure out the Powershell query for this, so I thought I would share it here. The state… Read More: Search for Azure AD B2B Guests who have not redeemed… »
The other day I tried (and failed) to find an easy way to query which applications were assigned to a specific Azure AD Application Proxy Connector Group. Of course if you only have a few applications, you can simply grind through each application in the Azure Portal and view the assignment (see screenshot below). If,… Read More: Report Azure AD Application Proxy Connector Group assignments »
If you’re working as part of a team in Azure AD Identity Protection and want to know who dismissed a risk event (e.g. a risky sign-in), it’s not obvious where to find the information. This article explains how to do it. Let’s take an example. You go into the Azure AD Identity Protection blade of… Read More: How to find out who dismissed a risk event in… »
Last week I spent a fair amount of time trying to integrate the Trend Micro Deep Security as a Service product with Azure AD using SAML. Unlike most of the SAML work I’ve done with Azure AD this one was not entirely straightforward. At the time of writing Trend Micro had no documentation specific to… Read More: Trend Micro Deep Security SAML integration with Azure Active Directory »