Zero Trust
Lessons from the field. Always landing on my feet.
Entra SSPR and Passkey Readiness for Microsoft-Provided SMS/Voice Delivery Retirement
Microsoft is advancing three related parts of the Entra authentication and recovery experience between now and next March: On September 1, 2026, users enabled for SMS or voice begin moving into the Microsoft-managed passkey Registration Campaign. …
Block Prompt Injection at the Network Layer with Microsoft Entra Prompt Injection Protection
A while back I built an LLM Firewall with AWS Lambda, a proxy that sits between users and the model to catch prompt injection. It worked, but it meant writing custom code for every app and having zero visibility into AI services I didn’t own. That’s …
March–June 2026 Entra ID Changes: Passkey Profiles and Conditional Access Enforcement
Microsoft made passkey profiles and synced passkeys generally available in March 2026, then adjusted a separate Conditional Access enforcement rollout to begin June 15, 2026. Both changes entered tenants through Microsoft-managed schedules, although …
Just-In-Time Access for AI Agents: Building a ZSP Gateway in Azure
AI coding assistants need Contributor access to deploy infrastructure. Backup automation needs Key Vault secrets at 2 AM. Security scanners need Reader access on a schedule. The easy answer is standing permissions—give each service principal what it …