Entra ID
Lessons from the field. Always landing on my feet.
Entra SSPR and Passkey Readiness for Microsoft-Provided SMS/Voice Delivery Retirement
Microsoft is advancing three related parts of the Entra authentication and recovery experience between now and next March: On September 1, 2026, users enabled for SMS or voice begin moving into the Microsoft-managed passkey Registration Campaign. …
Block Device Code Phishing in Entra Without Breaking Legit Workflows
Device code phishing is nasty because the user does not hand over a password. They hand over a session. The lure sends the victim to a legitimate Microsoft device sign-in page. The victim enters a short code. Entra ID issues tokens to the attacker’s …
Block Prompt Injection at the Network Layer with Microsoft Entra Prompt Injection Protection
A while back I built an LLM Firewall with AWS Lambda, an API screening demo that returns an allow/block decision for common prompt-injection patterns. That lab does not connect to an LLM; deploying the pattern in front of a model requires a separate …
Detecting OAuth Redirect Abuse with Microsoft Sentinel and Entra ID
On March 2, 2026, Microsoft published an advisory on OAuth redirection abuse enabling phishing and malware delivery. Microsoft described phishing-led campaigns where attackers register OAuth apps with attacker-controlled redirect URIs, then send …
March–June 2026 Entra ID Changes: Passkey Profiles and Conditional Access Enforcement
Microsoft made passkey profiles and synced passkeys generally available in March 2026, then adjusted a separate Conditional Access enforcement rollout to begin June 15, 2026. Both changes entered tenants through Microsoft-managed schedules, although …