conditional-access
Lessons from the field. Always landing on my feet.
Microsoft Security Fall 2026: Five Changes to Prepare For
Microsoft’s fall security updates change several assumptions that are easy to leave buried in an old runbook: what a Security Administrator can do during an incident, whether Sentinel automation needs Security Copilot capacity, which risk-policy …
Block Device Code Phishing in Entra Without Breaking Legit Workflows
Device code phishing is nasty because the user does not hand over a password. They hand over a session. The lure sends the victim to a legitimate Microsoft device sign-in page. The victim enters a short code. Entra ID issues tokens to the attacker’s …
Detecting OAuth Redirect Abuse with Microsoft Sentinel and Entra ID
On March 2, 2026, Microsoft published an advisory on OAuth redirection abuse enabling phishing and malware delivery. Microsoft described phishing-led campaigns where attackers register OAuth apps with attacker-controlled redirect URIs, then send …
March–June 2026 Entra ID Changes: Passkey Profiles and Conditional Access Enforcement
Microsoft made passkey profiles and synced passkeys generally available in March 2026, then adjusted a separate Conditional Access enforcement rollout to begin June 15, 2026. Both changes entered tenants through Microsoft-managed schedules, although …