Lukas Beran

Lukas Beran

@lukasberan.com

Senior Security Researcher (DART) at Microsoft. Opinions are my own. #MSIncidentResponse #DART #Microsoft365 #EntraID #DefenderXDR #Sentinel

1.5K followers240 following648 posts

Pinned

๐Ÿ“บ ๐ˆ ๐ก๐š๐ฏ๐ž ๐ฆ๐ฒ ๐จ๐ฐ๐ง ๐˜๐จ๐ฎ๐“๐ฎ๐›๐ž ๐œ๐ก๐š๐ง๐ง๐ž๐ฅ! ๐Ÿ“บ I have started publishing detailed instructional videos primarily (but not exclusively) focused on cybersecurity and the Microsoft cloud. If you don't want to miss out on interesting industry tips and tricks, be sure to subscribe. ๐Ÿ‘‡ ๐Ÿ‘‡ www.youtube.com/@cswrldcom

๐‡๐จ๐ฐ ๐ญ๐จ ๐œ๐ซ๐ž๐š๐ญ๐ž ๐š ๐–๐๐€3 ๐–๐ข-๐…๐ข ๐ฉ๐ซ๐จ๐Ÿ๐ข๐ฅ๐ž ๐Ÿ๐จ๐ซ ๐–๐ข๐ง๐๐จ๐ฐ๐ฌ ๐ข๐ง ๐Œ๐ข๐œ๐ซ๐จ๐ฌ๐จ๐Ÿ๐ญ ๐ˆ๐ง๐ญ๐ฎ๐ง๐ž Microsoft Intune still cannot natively create a Wi-Fi profile with WPA3-Personal security at this time. Within the configuration templates, there is only Wi-Fi with WPA/WPA2 security, but WPA3 is missing.

If you have a Wi-Fi where WPA3 is enforced without hybrid mode with WPA2, then if you create a profile as WPA2, the device will not connect to it. So, if you have WPA3 enforced, you need to configure Wi-Fi using a custom profile and OMA-URI.

๐‡๐จ๐ฐ ๐‚๐จ๐ง๐๐ข๐ญ๐ข๐จ๐ง๐š๐ฅ ๐€๐œ๐œ๐ž๐ฌ๐ฌ ๐๐จ๐ฅ๐ข๐œ๐ข๐ž๐ฌ ๐€๐ซ๐ž ๐„๐ฏ๐š๐ฅ๐ฎ๐š๐ญ๐ž๐ ๐ข๐ง ๐Œ๐ข๐œ๐ซ๐จ๐ฌ๐จ๐Ÿ๐ญ ๐„๐ง๐ญ๐ซ๐š ๐ˆ๐ƒ Understanding how Conditional Access policies are evaluated in Microsoft Entra ID is absolutely essential if you are involved in their creation or management.

View full thread

However, it does not work this way with Conditional Access policies in Microsoft Entra ID. Applying the same principle to Conditional Access policies will very likely lead to significant security risks.

๐‡๐จ๐ฐ ๐‚๐จ๐ง๐๐ข๐ญ๐ข๐จ๐ง๐š๐ฅ ๐€๐œ๐œ๐ž๐ฌ๐ฌ ๐๐จ๐ฅ๐ข๐œ๐ข๐ž๐ฌ ๐€๐ซ๐ž ๐„๐ฏ๐š๐ฅ๐ฎ๐š๐ญ๐ž๐ ๐ข๐ง ๐Œ๐ข๐œ๐ซ๐จ๐ฌ๐จ๐Ÿ๐ญ ๐„๐ง๐ญ๐ซ๐š ๐ˆ๐ƒ Understanding how Conditional Access policies are evaluated in Microsoft Entra ID is absolutely essential if you are involved in their creation or management.

I often encounter fundamental misunderstandings regarding how the evaluation of Conditional Access policies takes place. Many administrators are accustomed to systems like firewalls, where there is an order or priority for evaluating created rules.

๐‡๐จ๐ฐ ๐ญ๐จ ๐ฎ๐ฌ๐ž ๐š๐œ๐œ๐ž๐ฌ๐ฌ ๐ฉ๐š๐œ๐ค๐š๐ ๐ž๐ฌ ๐ญ๐จ ๐ฆ๐š๐ง๐š๐ ๐ž ๐ ๐ซ๐จ๐ฎ๐ฉ ๐ฆ๐ž๐ฆ๐›๐ž๐ซ๐ฌ๐ก๐ข๐ฉ๐ฌ Access packages allow you to dynamically manage group, Teams, application, and SharePoint site membership based on user requests.

It works by creating an access package and then publishing it to users โ€“ either all users or a select group of users. Users can then activate the package from the My Access portal after meeting defined conditions.

๐‡๐จ๐ฐ ๐ญ๐จ ๐ ๐ž๐ญ ๐ฎ๐ง๐ฅ๐ข๐ฆ๐ข๐ญ๐ž๐ ๐ฆ๐š๐ข๐ฅ๐›๐จ๐ฑ ๐ฌ๐ข๐ณ๐ž ๐ข๐ง ๐„๐ฑ๐œ๐ก๐š๐ง๐ ๐ž ๐Ž๐ง๐ฅ๐ข๐ง๐ž Exchange Online Plan 1 licenses generally have a primary mailbox capacity of 50 GB. Exchange Online Plan 2 licenses have a capacity of 100 GB.

View full thread

An interesting fact is that Microsoft 365 Business Premium licenses, which by default include Exchange Online Plan 1, are also entitled to this feature.

๐‡๐จ๐ฐ ๐ญ๐จ ๐ ๐ž๐ญ ๐ฎ๐ง๐ฅ๐ข๐ฆ๐ข๐ญ๐ž๐ ๐ฆ๐š๐ข๐ฅ๐›๐จ๐ฑ ๐ฌ๐ข๐ณ๐ž ๐ข๐ง ๐„๐ฑ๐œ๐ก๐š๐ง๐ ๐ž ๐Ž๐ง๐ฅ๐ข๐ง๐ž Exchange Online Plan 1 licenses generally have a primary mailbox capacity of 50 GB. Exchange Online Plan 2 licenses have a capacity of 100 GB.

However, this capacity can be extended by using Online Archive. With Exchange Online Plan 2, this capacity is unlimited. Technically speaking, the capacity is limited to 1.5 TB.

Is there any way to create a Planner task directly from an email? Ideally including the email content and attachments. I assumed this would be basic functionality, but I canโ€™t find such an option anywhere. #planner

Looks like Christmas is coming early this year ๐Ÿคทโ€โ™‚๏ธ

Nicky De Westelinck@nickydewestelinck.be

After Microsoft Security Copilot, Microsoft now also adds Microsoft Intune Suite in your Microsoft 365 E5 (and E3) licence! ๐Ÿ”ฅ #Microsoft365 #MSIntune ๐Ÿ”— aka.ms/IntuneM365Blog

Lukas Beran reposted

Lukas Beran reposted

New video: 5 common Entra ID guests mistakes (Entra B2B) โ€ข excessive directory visibility โ€ข ignored cross-tenant defaults โ€ข untrusted MFA & device states โ€ข open SharePoint sharing โ€ข no guest lifecycle There's tons more! But here's a starter WATCH: youtu.be/AXuj-U9p3jU

Lukas Beran reposted

Did you know Entra ID Protection never automatically clears Medium or High risk? We either need to use Risk Based Conditional Access policies to remediate or an admin needs to manually remediate User risk = password reset Sign-in risk = require MFA learn.microsoft.com/...

Microsoft introduced new Sentinel commitment tier for SMBs. The 50 GB commitment tier is available in public preview, with promotional pricing starting October 1, 2025, until March 31, 2026. Customers who sign up during this period will lock in promotional pricing until March 31, 2027.

Seriously, Apple? That plastic-like white back on your silver flagship iPhone looks awful. This might be the ugliest iPhone ever, and Iโ€™m seriously thinking about returning it purely because of the design.

Lukas Beran reposted

Replying to @nathanmcnulty.com

IMHO - Worry less about how long tokens are valid for, worry more about protecting the tokens, both on the client and during authentication Obviously we need phishing resistant auth, but also focus on client hardening (app control, EDR, etc.) and VPN/ZTNA with enforced CAE

๐—›๐—ผ๐˜„ ๐˜๐—ผ ๐—ฎ๐˜‚๐˜๐—ผ๐—บ๐—ฎ๐˜๐—ถ๐—ฐ๐—ฎ๐—น๐—น๐˜† ๐˜‚๐—ฝ๐—ฑ๐—ฎ๐˜๐—ฒ ๐—ฎ๐—ฝ๐—ฝ๐—น๐—ถ๐—ฐ๐—ฎ๐˜๐—ถ๐—ผ๐—ป๐˜€ ๐—ผ๐—ป ๐—ฐ๐—ผ๐—บ๐—ฝ๐˜‚๐˜๐—ฒ๐—ฟ๐˜€ ๐—ถ๐—ป ๐— ๐—ถ๐—ฐ๐—ฟ๐—ผ๐˜€๐—ผ๐—ณ๐˜ ๐—œ๐—ป๐˜๐˜‚๐—ป๐—ฒ Microsoft Intune does not have any built-in options for updating installed applications on Windows computers.

If you want to update applications on managed computers, you must manually create a new version of the given application and deploy it to all computers. However, this is quite a lot of manual work, and you also have to monitor the availability of new versions of installed applications.

Why do more organizations choose Microsoft Defender for Endpoint every year? - AI-powered protection across platforms โ€” Windows, Linux, macOS, Android, iOS, IoT - Pre-breach exposure management with attack path analysis and scoring - Attack disruption that automatically contains threats in real time

Lukas Beran reposted

It is important for organizations to prioritize intrusion prevention but also ensure that the right configurations are in place to identify the source of any intrusion or incident.

This new feature allows your organization to seamlessly back up Windows 10 or Windows 11 settings and effortlessly restore them on a Microsoft Entra joined device.

Seamless SSO is a legacy setting only for very old and unsupported systems. If you have it turned on, go and turn it off. If you must keep it on, aลฅ least rotate the kerberos deception key every month.

Nathan McNulty@nathanmcnulty.com

Seamless SSO is a security risk, and many orgs enabeld it without knowing and are now stuck wondering what might break if they turn it off... Since Microsoft provides no help identifying actual usage, I did some research so you can safely turn it off :) nathanmcnulty.com/bl...

Get the latest Windows quality updates during the out-of-box experience (OOBE) by default. This much awaited improvement is coming to your eligible Microsoft Entra joined or Microsoft Entra hybrid joined devices running Windows 11, version 22H2 and later.