I have to do some maintenance of an Entra Ad connect system at my company. This was deployed before I got here and is currently running as expected. However, when it was installed the passwords for the service account were never recorded anywhere. They also havent been changed since the install based on dates.

I just started looking at this today and Im collecitng all the info first. As far as i can see there are a few places where the service account password might be needed to be update.

1. The windows services (services.msc) are running under this account.
2. The synchronization connection to the domain is running under this account. This looks to be changed in the AAD connect gui.
3. I havent confirmed this yet but I may also need to run Add-ADSyncAADServiceAccount

Im reading through this guide from MS. Since were on 2.3.20 AADconnect the abandon section is unneeded right?

https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-sync-change-serviceacct-pass

Ive never had to do this before and dont want to bork my AAD connect. So any tips, gotchas, or other things to watch out for would be appreciated.

I have a YouTube channel Control Alt Delete Tech Bits https://www.youtube.com/@Controlaltdeletetechbits that I started a couple of months ago, the channel is focused around the Microsoft ecosystem, Entra, Intune, Windows 11 etc. I have weekly quizzes such as today's 'What is the primary purpose of the Microsoft Intune Support Assistant?' and new content every 2 weeks. I'd also love some feedback on how I could improve the channel, I've been improving one thing per video, such as thumbnails etc, Thanks for reading.

Here are some of my videos.

How to Set Up Temporary Access Pass and Custom Banned Passwords in Microsoft 365 : https://youtu.be/qjDVmUfy510?si=5ORKzSjptBewJFJl

How to Set Up Microsoft 365 SSPR and Custom Branding in Microsoft Entra : https://www.youtube.com/watch?v=xLpV5dmvDmE&list=PLKDYXd3_Deyw1uFh9WJGhKv2ohXSWmh_a&index=4

How to manage copilot in Microsoft 365 and how to block risky signs with conditional access : https://youtu.be/ItBZlJm7CQY?si=We9YmSlUaHVL9kiT

Use Microsoft Defender for Office 365 attack simulator to run phishing simulations: https://youtu.be/rGGpGX84fT4?si=GVwkNE2xe9LYpjEE

What is Microsoft Intune support assistant and how to use it : https://youtu.be/XVs8KdiOK7g?si=T0N2Pvd86zB5dfrq

Playlist here: https://youtube.com/playlist?list=PLKDYXd3_Deyw1uFh9WJGhKv2ohXSWmh_a&si=OAETdhGONvyzYlQj

Also have a Windows 11 playlist here: https://youtube.com/playlist?list=PLKDYXd3_Deyxo2oN16GIEu119lUkaZ1Xs&si=UmFUPbGoHDK2mNo3

With videos such as How to use quick assist for remote support on Windows 11: https://youtu.be/yR646xdVzCQ?si=LhooBwA-G24jbACn & How to Bypass Microsoft Account Sign in While Installing Windows 11 :https://youtu.be/xHO4UWML1\_8?si=s9dGYUZaMOpvxn1H

Hello, we have at company i worked for, sso.

They ask me to provide sso access to some users, to a specific app. BUT the manager dont want the users inform at this time.

If i add this users to an sso for the spesific application does the users informed? I add my personal account, and no email have send to my that i have access to this app.

But i want to be sure.

Thanks!

I hopped into an org that had no centralized management. Upon replacing workstations I've been hybrid joining them to Entra to use WHFB, etc.

I want to add an onsite server for "some" internal files, print server, etc.

Their domain controller is abandoned but is still dc for DHCP, DNS, etc.

My plan is to stand up new dc on new domain, add existing domain as secondary zone, and add file server on new domain.

When I use entra connect will my entra identities sync down?

Am I fine to use newdomain.com same as entra domain, or should I do a subdomain?

Thanks for any help and insight to potential pitfalls.

On my old AD side, I have a OU dedicated for what I consider "soft deleted" users, meaning users who were terminated, but accounts were kept active for email and other purposes. In Entra, is there a best practice for tagging or otherwise earmarking an account as such?

Part of it would be that for things that are automatically provisioning, the tag/criteria I'd use would allow me to filter them out from provisioning, or perhaps filter out of a dynamic group that gets used for provisioning, etc.

I do have a terminated date in one of the extension attributes, but it uses that crazy time format used for the start date so not sure I could leverage it in a rule.

has anyone seen a way to reduce the number of redirects when a user logs into a sso app.

sso does work from the device but right now we see the flow ( app -> entra id (idp) -> app )

it seems to provide some cache between apps as long as the browser doesn't close completely, but hoping to get some of that cache benefit after the browser closes as well.

i see some articles about additional browser security for 3rd party cookies that happened a few versions ago. its not clear if this impacts anything.

How to handle third-party cookie blocking in browsers - Microsoft identity platform | Microsoft Learn

i'm also curious if this is just the way it is because our app is on one domain and microsoft auth is on microsoftonline.com.

if you compare the experience of opening any Microsoft app like tenant.sharepoint.com, its almost instant open (windows laptop, mac osx, ios).

Hi all

In my scenario I have an EntraConnect using PTA and Group Based filtering (it's a PoC, planned to spam for 3months). In my Sync Scope I have the OU where all Users; Groups and Computer Account reside. For the objects I want to Sync, I add them to the filtered group.

Users and Groups objects are syncing fine. Once I add them to the filtered group and run a sync, it gets exported to EntraID. The same doesn't happen with the Computer Account I'm trying to Hybrid Join

I've already tried/done:

• Enable Hybrid Join
• Add the Computer account to the Group I'm using for filtering
• Double-check the OU, if the device is part of the Sync Scope
• Run Initial sync

From the workstation side:

• Computer Object doesn't have a UserCert populated yet

• Workplace Join task scheduled exist with status as Ready

Any suggestion is appreciated

I manage the two tenants for a pair of separate but related companies that do a fair amount of collaboration in SharePoint, etc. To facilitate this, I set up cross-tenant sync between the tenants a couple of years ago and it’s solved the problem of people in tenant A not being able to share with some in tenant B (or vice-versa) because they were in different orgs.

However, I am not clear on how deleted user accounts are handled in this scenario. I had always assumed that if I deleted an account from native (i.e. originating) tenant, the synced account on the guest tenant would be deleted as well at the next sync.

But I hadn’t been really paying close attention to this since setting it up and looking at the list of Entra accounts on each tenant now this doesn’t appear to be the case because I see numerous instances where I deleted the account on the native tenant, but the synced external account still exists on the guest tenant.

Tried to do some further research and now I’m thinking since cross-tenant is a one-way sync my prior assumption was incorrect and I actually need to manually delete the synced guest accounts after deleting the accounts on the native tenant. But I don’t see that explicitly stated in any of the materials I’ve found, so I remain uncertain.

If you’re using cross-tenant sync, I’d appreciate any insights you can share on what expected behavior is for deleted accounts and how to handle them.

Thanks!

I recently came across an article discussing the emerging threat of the FastHTTP used in bruteforce campaign. The article mentions that FastHTTP is suspected to be used for unauthorized access attempts via brute-force logins and spamming Multi-Factor Authentication (MFA) requests. 

They advised checking the Entra ID sign-in logs and Microsoft Purview audit logs to track related activities and see if any unusual patterns or requests are logged. 

The article also shared a PowerShell script to check for the presence of the FastHTTP "user agent" in audit logs. I ran the script for my organization but found nothing. If anyone has found the FastHTTP user agent, could you please share how it appears in the data? Thanks in advance!

https://www.speartip.com/fasthttp-used-in-new-bruteforce-campaign/

I noticed that all our clients where we have deployed the GSA client have stopped synchronizing their time. Checking the time settings in Windows using the default time.windows.com ntp server. Trying to sync manually from cmd using "w32tm /resync /rediscover" gave the error "The computer did not resync because no time data was available.". I then disabled the GSA client and tried to resync, and it worked immediately. Then I discovered that UDP is currently not working on the "Internet" profile through the GSA client
https://learn.microsoft.com/en-us/entra/global-secure-access/reference-current-known-limitations?tabs=windows-client#internet-access-limitations

Are there any known workarounds for this issue?

An important feature you should know about!! 

You can protect your Break Glass account (Emergency Access Account) in Microsoft Entra ID from accidental deletion or modification, even by a Tenant Global Administrator. 

I recently published a blog on the powerful capabilities of Restricted Management Administrative Units in Microsoft Entra ID. This feature is a game-changer for securing critical accounts like executive and emergency access accounts, ensuring they are protected from unauthorized or accidental modifications  

 What you’ll discover:

• Step-by-step test cases(Added 5 test cases) for protecting sensitive accounts.
• Pro tips for managing Emergency Access Accounts effectively.
• Insights on leveraging Restricted Management to enhance security and compliance.

 Don’t let accidental changes compromise your organization’s security—find out how to take control of your identity management.

Head over to my blog to learn how to use this feature to secure your Microsoft Entra ID environment effectively!   

 Read more: https://www.thetechtrails.com/2025/01/microsoft-entra-id-restricted-management-secure-accounts.html 

Microsoft have just announced a new built-in role named "People Administrator" providing dedicated permissions for managing people-related settings and profile photos without needing the high privileges of Global admin or User admin roles. I wrote a short blog on it here:

Microsoft announce new People administrator role in Microsoft Entra

(Note: still waiting for this to appear in tenants...)

More info from the announcement:

When this will happen:

General Availability (Worldwide, GCC, GCC High, DoD): We will begin rolling out early February 2025 and expect to complete by late February 2025.

How this will affect your organization:

After this rollout, admins will be able to assign the new People admin role to users in:

• Entra Portal
• Microsoft 365 Admin Center

What are the capabilities of the People admin role?

1. Update profile photos for all users, including admins.
2. Update people settings for pronouns and name pronunciation, Profile card settings, and photo update settings for all users.

Why is this new role a better solution?

The People admin role allows organizations to delegate people-related tasks more effectively and securely. By limiting access to necessary settings, it reduces risks associated with higher privilege roles and aligns with user jobs focused on people administration.

The People admin role will enable organizations to:

• Delegate tasks without giving excessive permissions to other admins.
• Access new features and configurations in the People domain more easily.
• Maintain security by avoiding the use of highly privileged roles for routine tasks.

This role complements existing roles and enhances satisfaction with Microsoft administrative tools.

What you need to do to prepare:

We recommend admins:

1. Review the People admin role documentation to understand its capabilities.
2. Assess current roles to identify where the new role fits.
3. Communicate changes to staff if needed, highlighting improved delegation and people-related access.
4. Review your current configuration to determine the impact on your organization.

This rollout will happen automatically with no admin action required before the rollout. The People admin role will be available by default.

We have a hybrid on-prem AD-Entra environment with password sync write-back turned on. Have password reset self-service turned on in Entra, and enabled the necessary 2+ authentication methods for the test user. When I attempt to use the "Forgot password" link for an Entra login, I successfully get past the auth code sent to email and the code from authenticator app. When I put in a new password it always says

"This password does not meet the length, complexity, age, or history requirements of your corporate password policy."

I'm using randomly generated 16-20 character passwords with 3 different character sets required, out of 4 sets available. Yesterday I also edited our on-prem AD password policy to change the "Minimum password age" from 2 days to 0 days. Today I'm still not able to get the password reset function to accept any of my new password attempts.

I created a new tenant without a license, but when importing around 3,500 users, the tenant blocks every action I take and displays the message: 'The directory object quota limit for the Tenant has been exceeded. Please ask your administrator to increase the quota limit or delete objects to reduce the used quota.' However, the default quota for Microsoft Entra ID is supposed to be 50,000 objects.

https://preview.redd.it/1v5n4wwwryfe1.png?width=583&format=png&auto=webp&s=cb99cf2d61ecdbf391f75e818c6869d43b89223c

any idea

Hi. As everyone probably knows, Azure AD Graph access from applications will be gone as of Feb 1. There is an option to extend this to June 30 on a per-application basis.

https://learn.microsoft.com/en-us/graph/applications-authenticationbehaviors?tabs=http#allow-extended-azure-ad-graph-access-until-june-30-2025

We have 5 applications we needed to do this for and it seems like the commands completed successfully. However, I don't know how to verify this. When I do a Get-MgBetaApplication with the object ID and I try to look at the AuthenticationBehaviors, the 3 items I see are just blank (BlockAzureAdGraphAccess, RemoveUnverifiedEmailClaim, RequireClientServicePrincipal). They should be True/False from what I understand.

Does anyone know if there's a way to verify that the BlockAzureAdGraphAccess parameter is now False?

Edit: As is tradition, I found the solution about 3 mins after posting this. Updating this post instead of deleting in case someone else has this issue.

Seems like Powershell won't read the setting properly, but if you use the Graph Explorer, it will get the properties and display them accurately.

Use Graph Explorer for your tenant and set it to beta and run the following GET. It will show all applications and if you have set the 'blockAzureADGraphAccess' property, it will be displayed.

https://graph.microsoft.com/beta/applications?$select=id,displayName,appId,authenticationBehaviors

The documentation for pass-through authentication says it does not automatically fail over to using password hash sync, and warns that you will need help from Microsoft Support if your pass-through authentication server goes down.

Is that just based on the assumption that your Global Admin uses a password and therefore can't log in when it's down?

Or will they actually lock you out when the on-prem connection goes down, even if you have a valid passwordless MFA method (FIDO2 for example)?

I need to complete the migration of MFA/SSPR to Authentication Methods, but we've actually been using Authentication Methods/Conditional Access over the legacy policies for a while now. I want to ensure that migrating doesn't change anybody's experience without giving them a heads up first.

What I've found is that because we haven't completed the migration, Legacy Policies are still respected under certain conditions -- i.e., there's an exclusion group defined for the SMS authentication method, but users in the exclusion group are still able to register and use SMS because the 'Text message to phone' Verification option is enabled under Per-User-MFA (though Per-User-MFA isn't deployed to anyone - edit: it's disabled for everybody).

What I'd like to do is confirm that all of our CA policies are working as expected, just not sure what do look for in the Audit logs that would show the legacy policy getting respected.

Good morning. I was wondering if anyone else here has had to audit Microsoft Entra App Registrations. I'm having a hard time figuring out if there are any decent ways of doing this.

Our goal is to primarily audit permissions and usage for each app registration. We want to know if the app is signing in (for example using Graph APIs) or if the app is being signed into. Keep in mind that we are talking about App Registrations, NOT Enterprise Apps. It's easy to view sign-in logs for Enterprise apps using the GUI. However, I can't seem to figure out how to do the same for App Registrations.

Thanks for your thoughts!

Are you leveraging the full potential of your Microsoft Business Premium license?
🔒 Cybersecurity isn’t optional—especially for SMBs. With 1 in 3 SMBs experiencing cyberattacks and the average breach costing $254,000 or more, your organization’s security should be a top priority.

In this first installment of my new blog series, Securing Microsoft Business Premium, I walk you through step-by-step foundational configurations to help you protect your organization. This guide is designed for IT admins, consultants, and SMB owners who want to harness the full security potential of Microsoft Business Premium.

What You’ll Learn:

✅ Email Security: Configure DKIM and DMARC to protect your domain from phishing and spoofing.
✅ Identity Hardening: Restrict risky default permissions, enforce least privilege, and secure collaboration in Microsoft Entra.
✅ Device Security: Remove local admin privileges during setup to reduce attack surfaces.
✅ Zero Trust Architecture: Understand its six pillars and align them with Microsoft Business Premium.
✅ Admin Notifications: Enable service and health alerts to stay proactive.

Why Read This Blog?

💡 Build a secure environment aligned with modern cybersecurity principles.
💡 Protect your business from phishing, malware, and unauthorized access.
💡 Prepare for advanced configurations (covered in future posts).

👉 Read the full post here:
🔗 Securing Microsoft Business Premium Part 01: Laying the Foundation

Key Highlights:

• Step-by-step guidance for securing identities, devices, and collaboration tools.
• Insights into foundational configurations across Microsoft 365 Admin Center, Entra ID, and Defender.
• Introduction to Zero Trust principles and how they protect SMBs.

👉 Follow me for updates on the next parts of the series as we dive into advanced security configurations tailored for SMBs!

Can we store Entra ID passkeys in iCloud? I could never get it working?

I feel really dumb for not knowing how to do this, but this is the first time I have been asked to do this when setting up SSO.

I am setting up SSO with Sense AI using Entra.We are the IdP. I have already configured single sign-on on my end creating the application, as well as configured directory sync (SAML). I am now being asked to configure log streams. We do not have Datadog, Splunk, etc. so the best route is to grab HTTP POST credentials. However, I have no idea how or where to find these.

URL:
HTTP Header Name:
HTTP Header Value:
Request Body Format: JSON or NDJSON

The instructions given to me through their setup portal, WorkOS, are as follows:

The HTTP POST log stream provider is a generic option to stream logs to an HTTPS endpoint.

You'll need to enter the following information in the form below:

• The URL which will accept HTTP POST requests.
• The HTTP Header Name, which could be the standard HTTP Authorization Header, or a custom header.
• The HTTP Header Value, which will be treated as a secret.
• The Request Body Format, choosing between Standard JSON and Newline Delimited JSON (NDJSON). The HTTP POST payload will include a batch of events in JSON. Choosing newline delimited JSON allows the payload to be split into individual event objects with a regex so that each event can be processed individually. With standard JSON, the payload will be a JSON array of event objects.

Any help is appreciated.

Hi everyone, it's my very first time as a beginner working on these things.

We have an admin account and three user accounts (user1, user2, and user3) on a hybrid-joined device. The device is hybrid-joined via the admin account, and the SSO state is tied to the admin account.

I created a Conditional Access policy that allows user1, user2, and user3 to access Office 365 products only if they are logged in from the office network and the device is hybrid-joined.

My question is: If user1 tries to log in to Office 365 products from the admin account session, will they be able to log in? The device is hybrid-joined, but the SSO and refresh token are tied to the admin account, not user1's account. What will happen in this scenario?

Also, if I am missing something on the SSO and Hybrid Joined, please feel free to enlighten me. My current understanding is that when I join my computer as Microsoft Entra Hybrid joined, a specific certificate is issued to my computer. When SSO is enabled, a particular refresh token is issued and tied to the user account that was used to join my computer as hybrid joined. When Conditional Access policies are applied, this refresh token is used to determine whether a particular user is allowed to log in/access Office 365 products or not.

Thanks in advance for your help!

You've probably noticed the 'Keep me signed in' prompt when logging into services with your personal Microsoft account. A convenient choice to skip re-entering your credentials every time, right?  

Starting February 2025, Microsoft will automatically keep you signed in to your account—no more prompts. Wait, this applies only to users with personal Microsoft accounts, not work/school accounts. 

However, is this a good thing? 🤔 

This change may sound convenient, but it has critical implications for security—especially for those using shared or public computers. Just imagine leaving your account signed in on a shared computer, tablet, or laptop. That’s like handing over the keys to your data! 

To stay secure, remember to do one of the following when using public devices: 

1. Sign out of all devices after use. 
2. Use private browsing to keep your history and search activities from being saved. This way, even if you forget to log out, your account stays safe. 

Why this change? For that, we need to wait for Microsoft's clear documentation. For now, it’s vital to adapt to this shift by following safer browsing practices. 

https://o365reports.com/2025/01/27/microsoft-personal-accounts-will-now-stay-signed-in-automatically/

Receiving admin emails on an unlicensed admin account? Receiving emails from multiple services or clients to a single mailbox? My latest blog post covers everything you need to know about Plus Addressing in Microsoft.

Summary: 
In this blog post, I delve into the powerful feature of Plus Addressing in Microsoft. This guide is designed to help you manage your emails more efficiently, whether you're dealing with admin emails on an unlicensed account or receiving communications from multiple services. I cover the setup process, the benefits of using Plus Addressing, and provide practical tips to make the most out of this feature. By the end of the post, you'll have a clear understanding of how to use Plus Addressing to streamline your email management and boost productivity.

👉Check it out here: Mastering Plus Addressing in Microsoft: Simplify Email Management

Key highlights:

• What is Plus Addressing and how it works
• Step-by-step setup guide
• Benefits of using Plus Addressing
• Practical tips for effective email management

Check out the full post and start mastering Plus Addressing in Microsoft today!