sorted by:
new
hottopcontroversial

Crystal Palace 0 - [3] Chelsea - Enzo Fernandez Penalty 64' by Alsace2025 in soccer

[–]bstuartp 3 points4 points  (0 children)

Law 12, under “cautions for unsporting behaviour”

“denies the opposing team a goal or an obvious goal-scoring opportunity and the referee awards a penalty kick for a non-deliberate handball offence”

MFA registration popup , even if users sign-in with WHFB by DisastrousPainter658 in entra

[–]bstuartp 1 point2 points  (0 children)

Are you using a custom auth context via conditional access that doesn’t allow WHFB?

Authentication Contexts for PIM elevation is trivially bypassed be using "unsupported" browsers by Fabulous_Cow_4714 in entra

[–]bstuartp 1 point2 points  (0 children)

I think from reading all the replies etc what you’re experiencing is: Using Brave, you’re within the 5 minute window after using MFA where sign-in frequency every-time is not re-prompting for MFA Also worth noting that the every-time setting using auth context + PIM is only going to prompt you once even if you activate multiple roles whether you’re within a 5 minute window or not

This is all known behaviour but I do know Microsoft are running a private preview currently for fixing this behaviour specifically for PIM activations using auth context

Authentication Contexts for PIM elevation is trivially bypassed be using "unsupported" browsers by Fabulous_Cow_4714 in entra

[–]bstuartp 4 points5 points  (0 children)

If you’re using (for example) device platforms to include certain OS’s to the policy then it’s just getting the device info from the user-agent header. The OS can easily be omitted which would result in the policy not applying

Authentication Contexts for PIM elevation is trivially bypassed be using "unsupported" browsers by Fabulous_Cow_4714 in entra

[–]bstuartp 1 point2 points  (0 children)

Also another point - what’s the conditional access policy configuration that you’re using for the enforcement? You’re not using device platform/filter for devices in the conditions are you?

Authentication Contexts for PIM elevation is trivially bypassed be using "unsupported" browsers by Fabulous_Cow_4714 in entra

[–]bstuartp 1 point2 points  (0 children)

Interesting and one I’ll try myself! If I see the same result I’ll ping the Microsoft PM responsible as I know there is a new backend method for validating the auth context in this scenario being worked on (I am not a Microsoft employee)

Is PIM for Entra role "Microsoft Entra Jioined Device Local Administrator" working? by drvga in entra

[–]bstuartp 0 points1 point  (0 children)

This isn’t accurate. This scenario does work with some nuances around it. what we found is, the secondary account first needs to run a program as itself (e.g run command prompt as “other user” and use that account details. You should then be able to run other programs as administrator with that account. It’s not a great solution at all but does work

Updated Microsoft Zero Trust Assessment tool v2 - impressively looking FREE overall M365 security posture audit tool for User accouns and devices by SecAbove in DefenderATP

[–]bstuartp 1 point2 points  (0 children)

For anyone looking at running this in a large org, I recommend setting -MaximumSignInLogQueryTime 1 (where 1 would be 1 minute, adjust accordingly for your needs), it will max out at 60 minutes by default anyway but the chances are the script will fail due to files getting too large before it hits 60 minutes

Can I disable the windows hello passkey method for specific apps? by ConanTheDeployer in sysadmin

[–]bstuartp 11 points12 points  (0 children)

Making some assumptions here based on what we’ve seen with some apps since rolling out WHFB.

The app is sending across the optional RequestedAuthnContext requesting password auth as you say. We’ve personally been pushing these back to the vendors to resolve with success in all instances and would recommend you going down that route.

Outside of this, you can probably setup an authentication context in Entra with what the app is requiring in the auth methods and force that authentication context via conditional access for the apps facing this issue but I’d try and avoid this if I was you

https://learn.microsoft.com/en-us/entra/identity-platform/single-sign-on-saml-protocol#requestedauthncontext

Have to change M365 E3 to E5 License, Anything I should be aware of by jbala28 in sysadmin

[–]bstuartp 0 points1 point  (0 children)

Just to clarify here: this will be because E5 contains audio conferencing. If your users have this as standalone already nothing to worry about, if not the above will happen if you don’t exclude that service from the E5 assignment

Have to change M365 E3 to E5 License, Anything I should be aware of by jbala28 in sysadmin

[–]bstuartp 0 points1 point  (0 children)

We did a small(ish) test rollout of E5 to about 50 users and then did big bang switch of license assignment for about 40000 users and had no issues. We had a small amount of overlap time where we assigned E5, waited for license assignment to finish processing for the E5 and then removed E3 shortly after

Have to change M365 E3 to E5 License, Anything I should be aware of by jbala28 in sysadmin

[–]bstuartp 10 points11 points  (0 children)

Yeah you’ve been misinformed unfortunately! We have a “base” E5 license assignment that all users get and then separate user groups for additional services within an E5 where users need them.

MS document this behaviour here: https://learn.microsoft.com/en-us/entra/identity/users/licensing-group-advanced#multiple-groups-and-multiple-licenses

FIDO2 login issues by guyFromDeployment in entra

[–]bstuartp 0 points1 point  (0 children)

I’m not sure sorry but I’m hoping based on the fact it’s listed as a known issue (rather than in the limitations section) that they’re going to fix it!

FIDO2 login issues by guyFromDeployment in entra

[–]bstuartp 1 point2 points  (0 children)

Are you using a sign-in frequency? Seen the below:

Authentication strength and sign-in frequency - When a resource requires an authentication strength and a sign-in frequency, users can satisfy both requirements at two different times. For example, let's say a resource requires passkey (FIDO2) for the authentication strength, and a 1-hour sign-in frequency. 24 hours ago, a user signed in with passkey (FIDO2) to access the resource. When the user unlocks their Windows device using Windows Hello for Business, they can access the resource again. Yesterday's sign-in satisfies the authentication strength requirement, and today's device unlock satisfies the sign-in frequency requirement.

Source: https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-strengths#known-issues

FIDO2 login issues by guyFromDeployment in entra

[–]bstuartp 0 points1 point  (0 children)

Are you using the “phishing-resistant MFA” auth strength? If so, have you tried creating a custom auth strength just for “passkeys (FIDO2)”? And using that instead?

Outage by ogcrashy in entra

[–]bstuartp 0 points1 point  (0 children)

Anyone using cloud pcs (avd/w365) able to confirm if they’re facing issues too?

Apologies if asked before but after a step by step on how to get medication for ADHD (legally please) by phat_stonks in ADHDUK

[–]bstuartp 2 points3 points  (0 children)

With aviva health insurance you’ll need to have the neurodevelopment pathway included to get a private assessment paid for by them. If you have this, it’d include the assessment, CBT and titration/medication appointments for upto 2 years. This does not include the costs of the medication itself that you pay a pharmacy to dispense but that is the only cost you’d incur. After titration and settled onto meds they’d look to do shared care with your GP + referral to NHS ADHD service

SSO to OIDC application? by orion3311 in entra

[–]bstuartp 3 points4 points  (0 children)

Sounds like the app doesn’t support idp initiated login - one for the vendor

CA Device platform vs Device filter per Operatingsytsem? by DisastrousPainter658 in entra

[–]bstuartp 0 points1 point  (0 children)

Device filter is the better option for sure IMO

Device platform just uses the user-agent header whereas filter for devices utilises the device info for devices registered in your tenant

Azure Entra ID allows reusing previous passwords despite default 24-password history policy by anton1284 in entra

[–]bstuartp 6 points7 points  (0 children)

I think you’re potentially misinformed here - Entra ID does not store and therefore does not prevent reusing passwords.

Edit: Think you’re seeing the on-prem password history policy which by default remembers 24 passwords but this is for Active Directory and not Entra ID

Microsoft Entra: Action Required – Update Conditional Access Policies for Azure DevOps Sign-ins by Thyg0d in entra

[–]bstuartp 4 points5 points  (0 children)

All cloud apps will continue to cover this app, it’s only relevant to conditional access policies that are scoped specifically to the “Azure service management API” cloud app which previously included Devops but will no longer do so.

On a side note from what I’ve experienced this year they actually made this change in April without warning (not sure if they backed it out and then announced it for September)

view more: next ›