Martin Strnad

🔒 Secure Bits 💡 𝗔𝘂𝘁𝗼𝗺𝗮𝘁𝗶𝗰 𝗪𝗶𝗻𝗱𝗼𝘄𝘀 𝗮𝘂𝗱𝗶𝘁𝗶𝗻𝗴 𝗶𝗻 𝗗𝗲𝗳𝗲𝗻𝗱𝗲𝗿 𝗳𝗼𝗿 𝗜𝗱𝗲𝗻𝘁𝗶𝘁𝘆 𝗻𝗼𝘄 𝗴𝗼𝗲𝘀 𝗯𝗲𝘆𝗼𝗻𝗱 𝗱𝗼𝗺𝗮𝗶𝗻 𝗰𝗼𝗻𝘁𝗿𝗼𝗹𝗹𝗲𝗿𝘀 You can now enable Windows event auditing on 𝗔𝗗 𝗖𝗦, 𝗔𝗗 𝗙𝗦 and 𝗠𝗶𝗰𝗿𝗼𝘀𝗼𝗳𝘁 𝗘𝗻𝘁𝗿𝗮 𝗖𝗼𝗻𝗻𝗲𝗰𝘁 servers automatically. The servers have to run the 𝘀𝗲𝗻𝘀𝗼𝗿 𝘃𝟯.𝘅 to get the audit configuration automatically. 🛠️ 𝗪𝗵𝗲𝗿𝗲 𝘁𝗼 𝘁𝘂𝗿𝗻 𝗶𝘁 𝗼𝗻: Microsoft Defender portal → Settings → Identities → General → Advanced features → 𝗔𝘂𝘁𝗼𝗺𝗮𝘁𝗶𝗰 𝗪𝗶𝗻𝗱𝗼𝘄𝘀 𝗮𝘂𝗱𝗶𝘁𝗶𝗻𝗴 𝗰𝗼𝗻𝗳𝗶𝗴𝘂𝗿𝗮𝘁𝗶𝗼𝗻 𝗪𝗵𝗮𝘁 𝘁𝗵𝗲 𝘀𝗲𝗻𝘀𝗼𝗿 𝗰𝗼𝗻𝗳𝗶𝗴𝘂𝗿𝗲𝘀: - Directory services advanced auditing: audit entries in the SACL of the domain root object - NTLM auditing: the required registry values - Domain object auditing: the SACL on the Configuration partition - AD FS: object-level auditing on the AD FS configuration container, plus the Audit Application Generated policy (Success and Failure) - AD CS: the required value in the CA audit filter in the CA registry configuration - Entra Connect: the Audit Logon policy (Success and Failure) - The local Windows audit policies The sensor writes the settings to the local system policy of the server and repeats the check once every 24 hours. ⚠️ 𝗕𝗲𝗳𝗼𝗿𝗲 𝘆𝗼𝘂 𝘁𝘂𝗿𝗻 𝗶𝘁 𝗼𝗻: - AD FS: event auditing in AD FS Management and verbose logging stay manual (Set-AdfsProperties -AuditLevel Verbose) - If Sensor v2.x is still in use, you have to do it manually - GPO settings can conflict with the local settings that the sensor applies 📄 𝗖𝗵𝗲𝗰𝗸 𝘆𝗼𝘂𝗿 𝗰𝘂𝗿𝗿𝗲𝗻𝘁 𝘀𝘁𝗮𝘁𝗲 𝗳𝗶𝗿𝘀𝘁: New-MDIConfigurationReport -Path "C:\Reports" -Mode Domain -OpenHtmlReport (DefenderForIdentity PowerShell module) Do your AD FS, AD CS and Entra Connect servers already run the v3.x sensor? Author: Martin Strnad #DefenderForIdentity #ActiveDirectory #ADCS #ADFS #EntraConnect #SecureBits #HorizonSecured

🇺🇸 𝗕𝗹𝘂𝗲𝗧𝗲𝗮𝗺𝗖𝗼𝗻 𝗶𝘀 𝗮𝗹𝗺𝗼𝘀𝘁 𝗵𝗲𝗿𝗲! I’ll be back in Chicago this week for BlueTeamCon, speaking on Sunday at 10:00 AM. My session: 🎤 𝗔𝗰𝘁𝗶𝘃𝗲 𝗗𝗶𝗿𝗲𝗰𝘁𝗼𝗿𝘆 𝗣𝗼𝘀𝘁-𝗠𝗼𝗿𝘁𝗲𝗺: 𝗔𝘀𝘀𝘂𝗺𝗽𝘁𝗶𝗼𝗻𝘀 𝘃𝘀 𝗥𝗲𝗮𝗹𝗶𝘁𝘆 I’ll demonstrate three important Active Directory vulnerabilities that still exist in real environments, but are either unknown or not discussed enough. 📍 Swissôtel Chicago, Illinois 📅 Sunday, September 13 | 10:00 AM If you’re attending and you’re into Active Directory security, come join me. See you in Chicago! 👋 #BlueTeamCon #CyberSecurity #ActiveDirectory #WindowsSecurity #BlueTeam #ADSecurity @BlueTeamCon

🔒 Secure Bits 💡 𝗦𝘁𝗶𝗹𝗹 𝗿𝘂𝗻𝗻𝗶𝗻𝗴 𝘁𝗵𝗲 𝗱𝗲𝗳𝗮𝘂𝗹𝘁 𝗔𝘂𝘁𝗵𝗲𝗻𝘁𝗶𝗰𝗮𝘁𝗶𝗼𝗻 𝗺𝗲𝘁𝗵𝗼𝗱𝘀 𝗽𝗼𝗹𝗶𝗰𝘆 𝗶𝗻 𝗘𝗻𝘁𝗿𝗮 𝗜𝗗? Most tenants I look at still have SMS and Voice call enabled for all users — left over from the old per-user MFA/SSPR settings, never revisited after the move to the unified Authentication methods policy. 𝗪𝗵𝘆 𝘁𝗵𝗮𝘁'𝘀 𝗮 𝗽𝗿𝗼𝗯𝗹𝗲𝗺: 🔹 SMS and voice call are phishable — SIM swap, real-time relay, or a convincing helpdesk call will get through 🔹 If Conditional Access accepts any MFA method, attackers will simply target the weakest one enabled 🔹 Old OATH hardware/software tokens left enabled "just in case" widen the attack surface once phishing-resistant methods are already in place 𝗪𝗵𝗮𝘁 𝘁𝗼 𝗲𝗻𝗮𝗯𝗹𝗲 𝗶𝗻𝘀𝘁𝗲𝗮𝗱: 🔹 𝗣𝗮𝘀𝘀𝗸𝗲𝘆 (𝗙𝗜𝗗𝗢𝟮) — phishing-resistant, security keys and platform authenticators 🔹 𝗠𝗶𝗰𝗿𝗼𝘀𝗼𝗳𝘁 𝗔𝘂𝘁𝗵𝗲𝗻𝘁𝗶𝗰𝗮𝘁𝗼𝗿 — passwordless phone sign-in, nothing sent over SMS 🔹 𝗤𝗥 𝗰𝗼𝗱𝗲 — handy for shared devices and frontline workers 🔹 𝗖𝗲𝗿𝘁𝗶𝗳𝗶𝗰𝗮𝘁𝗲-𝗯𝗮𝘀𝗲𝗱 𝗮𝘂𝘁𝗵𝗲𝗻𝘁𝗶𝗰𝗮𝘁𝗶𝗼𝗻 — scope it to the group that actually needs it, not all users 🛠️ 𝗪𝗵𝗲𝗿𝗲 𝘁𝗼 𝗰𝗵𝗮𝗻𝗴𝗲 𝗶𝘁: Entra admin center → Protection → Authentication methods → Policies. Enable and target the stronger methods first, confirm adoption, then disable SMS, Voice call, and legacy OATH tokens for "All users." ⚠️ Check Sign-in logs before you disable anything — you want to know who still relies on SMS/voice today, or you'll get a wave of helpdesk tickets tomorrow. 💬 𝗪𝗵𝗮𝘁 𝗱𝗼𝗲𝘀 𝘆𝗼𝘂𝗿 𝗔𝘂𝘁𝗵𝗲𝗻𝘁𝗶𝗰𝗮𝘁𝗶𝗼𝗻 𝗺𝗲𝘁𝗵𝗼𝗱𝘀 𝗽𝗼𝗹𝗶𝗰𝘆 𝗹𝗼𝗼𝗸 𝗹𝗶𝗸𝗲 𝗿𝗶𝗴𝗵𝘁 𝗻𝗼𝘄 — still default, or hardened? Author: Martin Strnad #Microsoft365 #EntraID #MFA #AuthenticationMethods #SecureBits #HorizonSecured #CyberSecurity #Passkey

🔒 Secure Bits 💡 𝗠𝗮𝗻𝗮𝗴𝗶𝗻𝗴 𝘁𝗵𝗲 𝘀𝗮𝗺𝗲 𝗴𝗿𝗼𝘂𝗽𝘀 𝗶𝗻 𝗺𝘂𝗹𝘁𝗶𝗽𝗹𝗲 𝗘𝗻𝘁𝗿𝗮 𝘁𝗲𝗻𝗮𝗻𝘁𝘀? 𝗧𝗵𝗮𝘁 𝗺𝗮𝘆 𝗻𝗼 𝗹𝗼𝗻𝗴𝗲𝗿 𝗯𝗲 𝗻𝗲𝗰𝗲𝘀𝘀𝗮𝗿𝘆. 📆 Newly added feature in May 2026 Organizations with multiple Entra tenants often end up maintaining the same access groups repeatedly across environments. One group for employees in Tenant A. Another group for the same employees in Tenant B. And then someone has to keep them in sync. Microsoft is 𝗲𝘅𝘁𝗲𝗻𝗱𝗶𝗻𝗴 𝗖𝗿𝗼𝘀𝘀-𝗧𝗲𝗻𝗮𝗻𝘁 𝗦𝘆𝗻𝗰𝗵𝗿𝗼𝗻𝗶𝘇𝗮𝘁𝗶𝗼𝗻 to support security group synchronization, allowing groups and their memberships to be synchronized between tenants automatically. 🤔 𝗪𝗵𝘆 𝘁𝗵𝗶𝘀 𝗺𝗮𝘁𝘁𝗲𝗿𝘀 Access management is usually driven by groups. The larger the organization, the bigger the problem becomes. When groups are duplicated across tenants: - Memberships drift over time - Offboarding becomes inconsistent - Access reviews become harder - Administrators spend time maintaining the same identities multiple times 🧠 𝗪𝗵𝗮𝘁'𝘀 𝗿𝗲𝗮𝗹𝗹𝘆 𝗵𝗮𝗽𝗽𝗲𝗻𝗶𝗻𝗴 Instead of synchronizing only users, organizations can synchronize selected groups and their memberships. That means when you 𝗮𝗱𝗱 𝗼𝗿 𝗿𝗲𝗺𝗼𝘃𝗲 𝗮 𝘂𝘀𝗲𝗿 from the source group, the membership 𝘂𝗽𝗱𝗮𝘁𝗲𝘀 𝗶𝗻 𝘁𝗵𝗲 𝘁𝗮𝗿𝗴𝗲𝘁 𝘁𝗲𝗻𝗮𝗻𝘁. Applications, SharePoint sites, Teams, and other resources can rely on synchronized groups instead of manually maintained copies. Group 𝗺𝗲𝗺𝗯𝗲𝗿𝘀𝗵𝗶𝗽 𝗶𝘀 𝗺𝗮𝗻𝗮𝗴𝗲𝗱 𝗶𝗻 𝗼𝗻𝗲 𝗽𝗹𝗮𝗰𝗲 and propagated to connected tenants. 🛠️ 𝗪𝗵𝗲𝗿𝗲 𝗶𝘀 𝘁𝗵𝗶𝘀 𝘂𝘀𝗲𝗳𝘂𝗹 Even though this is a niche use for most of you, these are places where this comes handy: - Mergers and acquisitions - Multi-tenant enterprises - Subsidiaries with separate tenants - Shared services organizations 🛡️ 𝗗𝗼 𝘁𝗵𝗶𝘀 𝗯𝗲𝗳𝗼𝗿𝗲 𝘀𝘆𝗻𝗰𝗵𝗿𝗼𝗻𝗶𝘇𝗶𝗻𝗴 𝗴𝗿𝗼𝘂𝗽𝘀 - Review which groups are truly authoritative - Limit synchronization scope - Monitor privileged groups carefully - Validate access assignments in target tenants ⚠️ 𝗜𝗺𝗽𝗼𝗿𝘁𝗮𝗻𝘁 Synchronizing groups also means 𝘀𝘆𝗻𝗰𝗵𝗿𝗼𝗻𝗶𝘇𝗶𝗻𝗴 𝗺𝗶𝘀𝘁𝗮𝗸𝗲𝘀. If an incorrect membership grants access in the source tenant, that access may now propagate automatically to other tenants as well. Treat synchronized groups as a privileged identity management process, not just an administrative convenience. ✅ This is one of those features that seems insignificant, but can reduce operational overhead in multi-tenant environments while improving consistency and governance. 💬 Question for admins Is Cross-Tenant Group Synchronization a feature you were waiting for or is it a nice-to-have? 𝘈𝘶𝘵𝘩𝘰𝘳 𝘰𝘧 𝘵𝘩𝘦 𝘱𝘰𝘴𝘵: Martin Strnad #Microsoft365 #EntraID #IdentityManagement #CloudSecurity #SecureBits #HorizonSecured

🔒 Secure Bits 💡 𝗠𝗶𝗰𝗿𝗼𝘀𝗼𝗳𝘁 𝗶𝘀 𝗳𝗶𝗻𝗮𝗹𝗹𝘆 𝗯𝗿𝗶𝗻𝗴𝗶𝗻𝗴 𝗮 𝗗𝗡𝗦𝗦𝗘𝗖 𝗲𝗻𝗮𝗯𝗹𝗲𝗺𝗲𝗻𝘁 𝘄𝗶𝘇𝗮𝗿𝗱 𝘁𝗼 𝗘𝘅𝗰𝗵𝗮𝗻𝗴𝗲 𝗢𝗻𝗹𝗶𝗻𝗲. This is a very welcome change. DANE is available in Microsoft 365 for almost a year now and yet the only way to date was to set it via PowerShell. To give you some context, DANE (DNS-based Authentication of Named Entities) helps 𝗽𝗿𝗼𝘁𝗲𝗰𝘁 𝗦𝗠𝗧𝗣 communication against TLS downgrade and certificate spoofing attacks by validating certificates through DNSSEC. But until now, enabling DANE properly was often: - Too complicated - Poorly documented (mainly in early stages) Especially in hybrid or larger environments, many admins simply avoided it. That's why Microsoft will announce 𝗗𝗡𝗦𝗦𝗘𝗖 𝗲𝗻𝗮𝗯𝗹𝗲𝗺𝗲𝗻𝘁 𝘄𝗶𝘇𝗮𝗿𝗱 someday in the Q3 of 2026. It will be available in Exchange admin center. 🛡️𝗧𝗵𝗶𝘀 𝘀𝗵𝗼𝘂𝗹𝗱 𝗵𝗲𝗹𝗽 𝗮𝗱𝗺𝗶𝗻𝘀: - Validates DNS prerequisites - Reduces configuration risk during MX transition - Provision the customer-specific DNSSEC‑capable mail flow endpoint (new MX) 🧠 What’s interesting here is that Microsoft is not just supporting DANE - they’re now trying to make deployment way easier to support it's adoption. ⚠️ 𝗜𝗺𝗽𝗼𝗿𝘁𝗮𝗻𝘁: DANE still depends on properly configured DNSSEC and correct MX/TLS certificate alignment. A wizard won’t fix broken DNS architecture. But honestly - lowering the operational barrier is exactly what this technology needed. 💬 Are you already using DANE for Exchange Online or still waiting for Microsoft to simplify deployment? 𝘈𝘶𝘵𝘩𝘰𝘳: Martin Strnad #Microsoft365 #ExchangeOnline #CyberSecurity #EmailSecurity #DNSSEC #DANE #SecureBits #HorizonSecure

🔒 Secure Bits 💡 𝗕𝗿𝗲𝗮𝗸-𝗴𝗹𝗮𝘀𝘀 𝗮𝗰𝗰𝗼𝘂𝗻𝘁𝘀: 𝗳𝘂𝗹𝗹 𝗴𝘂𝗶𝗱𝗲 (𝗣𝗗𝗙) In my last post I talked about the “worst day” scenario: CA misconfig → admins locked out. Most orgs think they’re covered… until they test it. As promised, 𝗵𝗲𝗿𝗲’𝘀 𝘁𝗵𝗲 𝗳𝘂𝗹𝗹 𝗣𝗗𝗙 𝗴𝘂𝗶𝗱𝗲 that walks you through a practical break-glass setup: ▪️ Naming ▪️ Permissions ▪️ Role-Assignable Security Group ▪️ Custom Break-glass Administrator role (Optional) ▪️ Restricted Management Administrative Unit (RMAU) ▪️ Authentication Methods ▪️ Conditional Access Configuration ▪️ Monitoring & Alerting ▪️ Operational Procedures 📎 Download the PDF here: academy.horizon-secured.com/… 𝘈𝘶𝘵𝘩𝘰𝘳: Martin Strnad 💬 When was the last time you tested your break-glass access? #EntraID #IdentitySecurity #ConditionalAccess #SecureBits #HorizonSecured

🔒 Secure Bits 💡 𝗬𝗼𝘂𝗿 𝘁𝗲𝗻𝗮𝗻𝘁 𝗵𝗮𝘀 𝗖𝗔 𝗺𝗶𝘀𝗰𝗼𝗻𝗳𝗶𝗴𝘂𝗿𝗮𝘁𝗶𝗼𝗻. 𝗘𝘃𝗲𝗿𝘆 𝗮𝗱𝗺𝗶𝗻 𝗶𝘀 𝗹𝗼𝗰𝗸𝗲𝗱 𝗼𝘂𝘁. 𝗗𝗼 𝘆𝗼𝘂 𝗵𝗮𝘃𝗲 𝗮 𝘄𝗮𝘆 𝗯𝗮𝗰𝗸 𝗶𝗻? Most organizations don’t — or think they do, until they discover their break-glass accounts are untested, unmonitored, or built on outdated guidance. You don’t want to find that out the hard way, and you definitely don’t want to go through Microsoft’s Tenant Recovery process. 🤔 𝗪𝗵𝘆 𝗰𝗮𝗿𝗲? A lockout from a bad CA policy, a compromised admin, or a personnel emergency means opening a support ticket with Microsoft and waiting. In urgent situations, you don’t have 14 days for that process. 🧠 𝗪𝗵𝗮𝘁 𝘄𝗲 𝘀𝗲𝗲 𝗶𝗻 𝘁𝗵𝗲 𝗳𝗶𝗲𝗹𝗱 •𝗕𝗿𝗲𝗮𝗸-𝗴𝗹𝗮𝘀𝘀 𝗮𝗰𝗰𝗼𝘂𝗻𝘁𝘀 𝗮𝗿𝗲 𝗺𝗶𝘀𝘀𝗶𝗻𝗴 — Two geographically separated accounts is the baseline. •𝗚𝗲𝗻𝗲𝗿𝗶𝗰 𝗻𝗮𝗺𝗲𝘀 — admin@…, info@… are not break-glass accounts. •𝗙𝘂𝗹𝗹 𝗖𝗔 𝗲𝘅𝗰𝗹𝘂𝘀𝗶𝗼𝗻 𝗶𝘀 𝗱𝗲𝗮𝗱 — MFA is now enforced by Microsoft regardless. •𝗪𝗲𝗮𝗸 𝗮𝘂𝘁𝗵 𝗺𝗲𝘁𝗵𝗼𝗱𝘀 — Phone or certificate-based auth will fail exactly when you need it. •𝗨𝗻𝗽𝗿𝗼𝘁𝗲𝗰𝘁𝗲𝗱 𝗮𝗰𝗰𝗼𝘂𝗻𝘁𝘀 — Any admin can edit or delete them. •𝗡𝗼 𝗺𝗼𝗻𝗶𝘁𝗼𝗿𝗶𝗻𝗴 — If someone touches these accounts, you should know immediately. 🛠️ 𝗖𝗿𝗲𝗮𝘁𝗲 𝘁𝘄𝗼 𝗮𝗰𝗰𝗼𝘂𝗻𝘁𝘀 Use descriptive names on onmicrosoft[.]com with a random string — e.g. [email protected]. Assign 𝗚𝗹𝗼𝗯𝗮𝗹 𝗔𝗱𝗺𝗶𝗻𝗶𝘀𝘁𝗿𝗮𝘁𝗼𝗿 as a direct, permanent, active role. No eligibility. 🛠️ 𝗟𝗼𝗰𝗸 𝘁𝗵𝗲𝗺 𝗱𝗼𝘄𝗻 Place both accounts and their group inside an 𝗥𝗠𝗔𝗨 (requires Entra P1). Manage access via a custom PIM role — max 1-hour activation, approval required, auth context enforced (requires Entra P2). 🛠️ 𝗖𝗼𝗻𝗳𝗶𝗴𝘂𝗿𝗲 𝗮𝘂𝘁𝗵𝗲𝗻𝘁𝗶𝗰𝗮𝘁𝗶𝗼𝗻 Scope a passkey profile to the break-glass group with specific AAGUIDs for your hardware keys (YubiKey, Token2). Enforce via a custom authentication strength in a dedicated CA policy. Exclude the group from all other CA policies — run a What If to verify only your two break-glass policies apply. 🛠️ 𝗦𝗲𝘁 𝘂𝗽 𝗮𝗹𝗲𝗿𝘁𝗶𝗻𝗴 Stream AuditLogs and SignInLogs to a Log Analytics Workspace (requires Azure subscription). KQL alert rule on the break-glass Object IDs — any event fires immediately. 🛡️ 𝗦𝘁𝗼𝗿𝗲, 𝘁𝗲𝘀𝘁, 𝗱𝗼𝗰𝘂𝗺𝗲𝗻𝘁 Each passkey + PIN in a separate physical location. Define who can trigger the procedure and under what circumstances. Test end-to-end at minimum every 180 days — Microsoft recommends 90. Pick your cadence, but validate. 💬 When was the last time you tested these accounts? 𝘈𝘶𝘁𝘩𝘰𝘳: Martin Strnad PS: We will soon 𝗽𝘂𝗯𝗹𝗶𝘀𝗵 𝗳𝘂𝗹𝗹 𝗴𝘂𝗶𝗱𝗲 on this topic! #EntraID #IdentitySecurity #ConditionalAccess #SecureBits #HorizonSecured

🔒 Secure Bits 💡 𝗠𝗶𝗰𝗿𝗼𝘀𝗼𝗳𝘁 𝗘𝗻𝘁𝗿𝗮 𝗕𝗮𝗰𝗸𝘂𝗽 𝗮𝗻𝗱 𝗥𝗲𝗰𝗼𝘃𝗲𝗿𝘆 𝗶𝘀 𝗻𝗼𝘄 𝗶𝗻 𝗣𝘂𝗯𝗹𝗶𝗰 𝗣𝗿𝗲𝘃𝗶𝗲𝘄 — and it fills a major gap in identity resilience. Someone disables a Conditional Access policy. A bulk import overwrites user attributes. A service principal loses its permissions. Until now, recovery meant digging through audit logs and manually reconstructing the state before. 𝗘𝗻𝘁𝗿𝗮 𝗕𝗮𝗰𝗸𝘂𝗽 𝗮𝗻𝗱 𝗥𝗲𝗰𝗼𝘃𝗲𝗿𝘆 changes that. It automatically creates 𝗱𝗮𝗶𝗹𝘆 𝗯𝗮𝗰𝗸𝘂𝗽𝘀 of critical directory objects — users, groups, apps, service principals, CA policies, auth methods — and retains 𝟱 𝗱𝗮𝘆𝘀 of history. No global admin can disable or modify them. 🛠️ 𝗪𝗵𝗮𝘁 𝗶𝘁 𝗱𝗼𝗲𝘀 You can browse backups, run 𝗱𝗶𝗳𝗳𝗲𝗿𝗲𝗻𝗰𝗲 𝗿𝗲𝗽𝗼𝗿𝘁𝘀 to see what changed, and recover objects to a previous state — all from the Entra admin center. Recovery can target all objects, specific object types, or individual objects by ID. The recovery model is straightforward: - Object added since backup → soft-deleted - Object modified → reverted to backup state - Object soft-deleted → restored 🔐 𝗔𝗰𝗰𝗲𝘀𝘀 𝗰𝗼𝗻𝘁𝗿𝗼𝗹 Two new built-in roles — 𝗕𝗮𝗰𝗸𝘂𝗽 𝗥𝗲𝗮𝗱𝗲𝗿 and 𝗕𝗮𝗰𝗸𝘂𝗽 𝗔𝗱𝗺𝗶𝗻𝗶𝘀𝘁𝗿𝗮𝘁𝗼𝗿 — support least-privilege access. Your security team can review backup state without triggering recovery. ⚠️ 𝗟𝗶𝗺𝗶𝘁𝗮𝘁𝗶𝗼𝗻𝘀 Hard-deleted objects cannot be recovered. On-prem synced objects are excluded from recovery. Not all properties are covered yet — manager, sponsor, and group ownership changes are out of scope. For organizations navigating 𝗡𝗜𝗦𝟮 and identity security requirements, a native, tamper-proof backup of the identity control plane is a welcome addition. Requires at least Entra ID P1. Available now in preview. 💬 How do you handle recoverability of your Entra ID tenant today? 𝘈𝘶𝘵𝘩𝘰𝘳 𝘰𝘧 𝘵𝘩𝘦 𝘱𝘰𝘴𝘵: Martin Strnad #Microsoft365 #EntraID #IdentitySecurity #BackupAndRecovery #CloudSecurity #NIS2 #SecureBits

🔒 Secure Bits 💡 𝗦𝗠𝗧𝗣 𝗔𝗨𝗧𝗛 𝗶𝗻 𝗘𝘅𝗰𝗵𝗮𝗻𝗴𝗲 𝗢𝗻𝗹𝗶𝗻𝗲 𝗶𝘀 𝗼𝗳𝗳𝗶𝗰𝗶𝗮𝗹𝗹𝘆 𝗴𝗼𝗶𝗻𝗴 𝗮𝘄𝗮𝘆 — 𝘁𝗵𝗲 𝘁𝗶𝗺𝗲𝗹𝗶𝗻𝗲 𝗶𝘀 𝗻𝗼𝘄 𝘂𝗽𝗱𝗮𝘁𝗲𝗱. Microsoft has published an 𝘂𝗽𝗱𝗮𝘁𝗲𝗱 𝗱𝗲𝗽𝗿𝗲𝗰𝗮𝘁𝗶𝗼𝗻 𝘁𝗶𝗺𝗲𝗹𝗶𝗻𝗲 𝗳𝗼𝗿 𝗦𝗠𝗧𝗣 𝗔𝗨𝗧𝗛 𝘂𝘀𝗶𝗻𝗴 𝗕𝗮𝘀𝗶𝗰 𝗔𝘂𝘁𝗵𝗲𝗻𝘁𝗶𝗰𝗮𝘁𝗶𝗼𝗻 in Exchange Online - and it will end fairly soon. If you still rely on SMTP AUTH for: - Applications and scripts - Printers and scanners - Legacy systems or monitoring tools … those systems 𝘄𝗶𝗹𝗹 𝘀𝘁𝗼𝗽 𝘀𝗲𝗻𝗱𝗶𝗻𝗴 emails once deprecation is enforced. ⏰ 𝗪𝗵𝗮𝘁 𝗶𝘀 𝘁𝗵𝗲 𝘁𝗶𝗺𝗲𝗹𝗶𝗻𝗲? - 𝗘𝗻𝗱 𝗼𝗳 𝗗𝗲𝗰𝗲𝗺𝗯𝗲𝗿 𝟮𝟬𝟮𝟲: SMTP AUTH Basic Authentication will be disabled for existing tenants. Administrators will still be able to enable it if needed. - 𝗝𝗮𝗻𝘂𝗮𝗿𝘆 𝟮𝟬𝟮𝟳: SMTP AUTH Basic Authentication will be unavailable for newly created tenants. OAuth will be the supported authentication method. - 𝗦𝗲𝗰𝗼𝗻𝗱 𝗵𝗮𝗹𝗳 𝗼𝗳 𝟮𝟬𝟮𝟳: Microsoft will announce the final removal date for SMTP AUTH Basic Authentication. 🤔 𝗪𝗵𝘆 𝘁𝗵𝗶𝘀 𝗺𝗮𝘁𝘁𝗲𝗿𝘀 SMTP AUTH is one of those things that often runs in the background. More often the not, critical service or system relies on it. When it breaks, the impact is very visible — invoices not sent, alerts not delivered, workflows failing — but the root cause is often not obvious. Fixing it usually isn’t a checkbox. It often requires 𝗰𝗵𝗮𝗻𝗴𝗶𝗻𝗴 𝗵𝗼𝘄 𝗮𝗽𝗽𝗹𝗶𝗰𝗮𝘁𝗶𝗼𝗻𝘀 𝘀𝗲𝗻𝗱 𝗺𝗮𝗶𝗹, not just tweaking a setting. 🛡️ 𝗪𝗵𝗮𝘁 𝗜 𝘄𝗼𝘂𝗹𝗱 𝗱𝗼 - If you are using SMTP AUTH to send emails to 𝗶𝗻𝘁𝗲𝗿𝗻𝗮𝗹 𝗿𝗲𝗰𝗶𝗽𝗶𝗲𝗻𝘁𝘀, you can use High Volume Email for Microsoft 365 - If sending to 𝗶𝗻𝘁𝗲𝗿𝗻𝗮𝗹 𝗮𝗻𝗱 𝗲𝘅𝘁𝗲𝗿𝗻𝗮𝗹 𝗿𝗲𝗰𝗶𝗽𝗶𝗲𝗻𝘁𝘀, use Azure Communication Services Email. - If you have an 𝗘𝘅𝗰𝗵𝗮𝗻𝗴𝗲 𝗦𝗲𝗿𝘃𝗲𝗿 𝗶𝗻 𝗵𝘆𝗯𝗿𝗶𝗱 𝗰𝗼𝗻𝗳𝗶𝗴, you can use Basic auth against the Exchange Server - If you are done changing your systems, I would advise to disable the SMTP AUTH beforehand. ⚙️ 𝗗𝗶𝘀𝗮𝗯𝗹𝗲 𝗦𝗠𝗧𝗣 𝗔𝗨𝗧𝗛 𝗶𝗻 𝘆𝗼𝘂𝗿 𝗼𝗿𝗴 1. Sign in to the Exchange admin center. 2. Click Settings > Mail Flow. 3. Toggle the setting labeled "Turn off SMTP AUTH protocol for your organization". 4. Click Save. Even after SMTP AUTH is disabled tenant-wide, it can still be enabled for individual users. Make sure that you run a PowerShell script to retrieve all the mailboxes where SMTP AUTH is enabled and disable it. ⚠️ 𝗜𝗺𝗽𝗼𝗿𝘁𝗮𝗻𝘁 First, identify if it’s still used via sign-in logs in Entra ID, then change your systems to use modern counterparts 𝗻𝗼𝘄, while you still have time to test and redesign them. 💬 Do you know exactly which apps or devices in your tenant are still using SMTP AUTH? 𝘈𝘶𝘵𝘩𝘰𝘳 𝘰𝘧 𝘵𝘩𝘦 𝘱𝘰𝘴𝘵: @strnad10 #Microsoft365 #ExchangeOnline #SMTPAuth #SecureBits #HorizonSecured #CloudSecurity

🔒 Secure Bits 💡 𝗧𝗵𝗲 𝗠𝗶𝗰𝗿𝗼𝘀𝗼𝗳𝘁 𝟯𝟲𝟱 𝗕𝘂𝘀𝗶𝗻𝗲𝘀𝘀 𝟯𝟬𝟬-𝘂𝘀𝗲𝗿 𝗹𝗶𝗺𝗶𝘁 𝗶𝘀 𝗼𝗳𝘁𝗲𝗻 𝗺𝗶𝘀𝘂𝗻𝗱𝗲𝗿𝘀𝘁𝗼𝗼𝗱. I still hear this form admins all the time: “𝘞𝘦’𝘭𝘭 𝘫𝘶𝘴𝘵 𝘮𝘪𝘹 𝘉𝘶𝘴𝘪𝘯𝘦𝘴𝘴 𝘉𝘢𝘴𝘪𝘤, 𝘚𝘵𝘢𝘯𝘥𝘢𝘳𝘥, 𝘢𝘯𝘥 𝘗𝘳𝘦𝘮𝘪𝘶𝘮 — 𝘸𝘦 𝘩𝘢𝘷𝘦 𝘭𝘪𝘬𝘦 450 𝘰𝘧 𝘵𝘩𝘦𝘮 𝘤𝘰𝘮𝘣𝘪𝘯𝘦𝘥.” Feels relatable? But that is not how it should be. 🤔 𝗛𝗲𝗿𝗲’𝘀 𝘁𝗵𝗲 𝗰𝗮𝘁𝗰𝗵 The 300-user limit applies to the entire Microsoft 365 Business family, 𝗻𝗼𝘁 𝗽𝗲𝗿 𝗽𝗹𝗮𝗻. Once you exceed it: - You’re outside licensing terms - You may be forced by Microsoft to move to Enterprise plans - Feature rollouts, Identity and security planning suddenly becomes messy (and expensive) This often shows up too late — during business growth, audits, or security projects. 🧠 𝗬𝗼𝘂 𝘀𝗵𝗼𝘂𝗹𝗱 𝗸𝗲𝗲𝗽 𝗶𝗻 𝗺𝗶𝗻𝗱 𝘁𝗵𝗮𝘁: - Business Basic + Standard + Premium share the same 300-seat cap - The limit is enforced at the tenant level - Going beyond it means licensing using Enterprise plans is the correct path 🛡️ 𝗠𝘆 𝗮𝗱𝘃𝗶𝗰𝗲 If you’re approaching ~250 users, 𝘀𝘁𝗮𝗿𝘁 𝗽𝗹𝗮𝗻𝗻𝗶𝗻𝗴 𝗲𝗮𝗿𝗹𝘆 and think about allocating capital for the licensing change. It’s not a small change. Licensing decisions directly affect 𝗘𝗻𝘁𝗿𝗮 𝗜𝗗 𝗳𝗲𝗮𝘁𝘂𝗿𝗲𝘀, 𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗰𝗼𝗻𝘁𝗿𝗼𝗹𝘀, 𝗮𝗻𝗱 𝗴𝗼𝘃𝗲𝗿𝗻𝗮𝗻𝗰𝗲. Don’t let these licensing limits surprise you. 💬 Did you know this limit applies across 𝘢𝘭𝘭 Business plans — or did you learn it the hard way? 𝘈𝘶𝘵𝘩𝘰𝘳 𝘰𝘧 𝘵𝘩𝘦 𝘱𝘰𝘴𝘵: @strnad10 #Microsoft365 #Licensing #EntraID #SecureBits #HorizonSecured #CloudSecurity

🔎 𝗙𝗿𝗼𝗺 𝘁𝗵𝗲 𝗙𝗶𝗲𝗹𝗱 — Real-World Findings from Security Assessments 💥 𝟳𝟭.𝟰% of infrastructures I’ve assessed 𝗱𝗼 𝗻𝗼𝘁 𝘂𝘀𝗲 𝗪𝗶𝗻𝗱𝗼𝘄𝘀 𝗦𝗲𝗿𝘃𝗲𝗿 𝗖𝗼𝗿𝗲 𝗲𝗱𝗶𝘁𝗶𝗼𝗻 To be honest, I don’t even remember seeing it in use by most customers — the 28.6% might just be environments I secured myself in the past and later reassessed. So, is there really a benefit to using Windows Server Core? 𝗬𝗲𝘀 — 𝗮𝗯𝘀𝗼𝗹𝘂𝘁𝗲𝗹𝘆. ✅ 𝗥𝗲𝗱𝘂𝗰𝗲𝗱 𝗮𝘁𝘁𝗮𝗰𝗸 𝘀𝘂𝗿𝗳𝗮𝗰𝗲 – fewer components = fewer vulnerabilities. Just compare running services: • GUI: 72 • Core: 45 • Nano (for curiosity’s sake): 32 ✅ 𝗟𝗼𝘄𝗲𝗿 𝗿𝗲𝘀𝗼𝘂𝗿𝗰𝗲 𝘂𝘀𝗮𝗴𝗲 – needs less RAM, CPU, and disk. ✅ 𝗙𝗮𝘀𝘁𝗲𝗿 𝗿𝗲𝗯𝗼𝗼𝘁𝘀 & 𝘂𝗽𝗱𝗮𝘁𝗲𝘀 – perfect for patching cycles. ✅ 𝗘𝗻𝗰𝗼𝘂𝗿𝗮𝗴𝗲𝘀 𝗽𝗿𝗼𝗽𝗲𝗿 𝗿𝗲𝗺𝗼𝘁𝗲 𝗺𝗮𝗻𝗮𝗴𝗲𝗺𝗲𝗻𝘁 – manage through jump hosts or PAWs in the right tier. ✅ 𝗦𝘁𝗶𝗹𝗹 𝘀𝘂𝗽𝗽𝗼𝗿𝘁𝘀 𝗠𝗠𝗖𝘀 – you can use Features on Demand to run tools like eventvwr, diskmgmt, etc., remotely. Of course, it comes with a learning curve. If things break, you might need to troubleshoot via console (like in VMware) — 𝗯𝘂𝘁 𝗶𝘀 𝘁𝗵𝗮𝘁 𝗿𝗲𝗮𝗹𝗹𝘆 𝗮 𝗱𝗼𝘄𝗻𝘀𝗶𝗱𝗲? That’s how we learn. 🔁 So what do you think — is Windows Server Core worth it? #WindowsServer #ServerCore #CyberSecurity #Infrastructure #Hardening #BlueTeam #HorizonSecured #FromTheField @BlueTeamDave

🔒 Secure Bits 💡 Did you know 𝗙𝗶𝗿𝗲𝘄𝗮𝗹𝗹 𝗥𝘂𝗹𝗲𝘀 𝗰𝗿𝗲𝗮𝘁𝗲𝗱 𝘃𝗶𝗮 𝗠𝗶𝗰𝗿𝗼𝘀𝗼𝗳𝘁 𝗜𝗻𝘁𝘂𝗻𝗲 𝗮𝗿𝗲 𝗻𝗼𝘁 𝘃𝗶𝘀𝗶𝗯𝗹𝗲 in Windows Firewall (WF) console? I’ve seen 𝗺𝗮𝗻𝘆 𝗮𝗱𝗺𝗶𝗻𝗶𝘀𝘁𝗿𝗮𝘁𝗼𝗿𝘀 𝗰𝗼𝗻𝗳𝘂𝘀𝗲𝗱 by this, so here’s a little trick. 𝗪𝗶𝘁𝗵 𝗔𝗰𝘁𝗶𝘃𝗲 𝗗𝗶𝗿𝗲𝗰𝘁𝗼𝗿𝘆 𝗚𝗣𝗢𝘀, 𝘆𝗼𝘂 𝘀𝗲𝗲: "𝐹𝑜𝑟 𝑦𝑜𝑢𝑟 𝑠𝑒𝑐𝑢𝑟𝑖𝑡𝑦, 𝑠𝑜𝑚𝑒 𝑠𝑒𝑡𝑡𝑖𝑛𝑔𝑠 𝑎𝑟𝑒 𝑐𝑜𝑛𝑡𝑟𝑜𝑙𝑙𝑒𝑑 𝑏𝑦 𝐺𝑟𝑜𝑢𝑝 𝑃𝑜𝑙𝑖𝑐𝑦." With Intune, 𝘁𝗵𝗲𝗿𝗲'𝘀 𝗻𝗼 𝗰𝗹𝗲𝗮𝗿 𝗶𝗻𝗱𝗶𝗰𝗮𝘁𝗶𝗼𝗻 in WF.msc that the firewall is being managed—it just works silently in the background. 𝗛𝗼𝘄 𝘁𝗼 𝗖𝗵𝗲𝗰𝗸 𝗳𝗼𝗿 𝗜𝗻𝘁𝘂𝗻𝗲 𝗙𝗶𝗿𝗲𝘄𝗮𝗹𝗹 𝗥𝘂𝗹𝗲𝘀: You won’t see them in the GUI, but you can verify them with: 🔹𝗖𝗵𝗲𝗰𝗸 𝘁𝗵𝗲 𝗥𝗲𝗴𝗶𝘀𝘁𝗿𝘆: KEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm 🔹𝗨𝘀𝗲 𝗣𝗼𝘄𝗲𝗿𝗦𝗵𝗲𝗹𝗹: Get-NetFirewallRule -PolicyStore ActiveStore | ?{$_.DisplayName -like "*NAME of your MS Intune rule*"} Btw. you can also find the rule in the Monitoring tab. 💡 Have you encountered other surprising limitations in Intune? Drop them in the comments! #Windows #Cybersecurity #MSIntune #MDM #Firewall #InfoSec @BlueTeamDave

𝗗𝗲𝗳𝗮𝘂𝗹𝘁 → 𝗛𝗮𝗿𝗱𝗲𝗻𝗲𝗱 Real configs. Real fixes. Windows & AD security. 𝗪𝗵𝗮𝘁 𝗱𝗼𝗲𝘀 𝘆𝗼𝘂𝗿 𝗔𝗗 𝗹𝗼𝗼𝗸 𝗹𝗶𝗸𝗲? On assessments I still see the “left side”: an OU tree grown by device type or location, plus 10–20 years of legacy clutter. It’s 𝗵𝗮𝗿𝗱 𝘁𝗼 𝘂𝘀𝗲 𝗳𝗼𝗿 𝗮𝗻𝘆 𝘀𝗲𝗿𝗶𝗼𝘂𝘀 𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆 work. If you mean security, design around Microsoft’s 𝗧𝗶𝗲𝗿𝗶𝗻𝗴 𝗠𝗼𝗱𝗲𝗹. Organize by tiers first (not by object type). A structure like the right side lets you actually work with tiering; inside each tier’s OUs you can still add what you need (device type, site, etc.). 𝗧𝗶𝗲𝗿𝗶𝗻𝗴 𝗠𝗼𝗱𝗲𝗹 𝗲𝘅𝗮𝗺𝗽𝗹𝗲 — adjust per risk, Microsoft shows 3, in real world you can have less or more: 🔹 𝗧𝗶𝗲𝗿 𝟬: critical infra that can affect the whole domain (DCs, WSUS, CA, …) 🔹 𝗧𝗶𝗲𝗿 𝟭: application servers used by users (File, Print, DHCP, …) 🔹 𝗧𝗶𝗲𝗿 𝟮: servers managed by an external provider (separate from internal admins) 🔹 𝗧𝗶𝗲𝗿 𝟯: user estate (endpoints, VDIs, terminal servers, …) Still unsure? 𝗥𝘂𝗻 𝗕𝗹𝗼𝗼𝗱𝗛𝗼𝘂𝗻𝗱 in your environment and you’ll see the paths. 𝗪𝗮𝗻𝘁 𝘁𝗼 𝘀𝘁𝗮𝗻𝗱 𝗼𝘂𝘁 𝗮𝗻𝗱 𝗱𝗼 𝗶𝘁 𝗽𝗿𝗼𝗽𝗲𝗿𝗹𝘆? Grab my free resources + courses on Tiering Model & AD hardening: ➡️ academy.horizon-secured.com/ 𝙇𝙚𝙖𝙧𝙣 • 𝘽𝙪𝙞𝙡𝙙 • 𝘿𝙚𝙛𝙚𝙣𝙙 #ActiveDirectory #WindowsSecurity #TieringModel #BlueTeam #CyberSecurity

🔒 Secure Bits 💡 𝗠𝗶𝗰𝗿𝗼𝘀𝗼𝗳𝘁 𝘄𝗶𝗹𝗹 𝗯𝗹𝗼𝗰𝗸 𝗮𝗰𝗰𝗲𝘀𝘀 𝗠𝗶𝗰𝗿𝗼𝘀𝗼𝗳𝘁 𝟯𝟲𝟱 𝗮𝗱𝗺𝗶𝗻 𝗽𝗼𝗿𝘁𝗮𝗹𝘀 𝘄𝗶𝘁𝗵𝗼𝘂𝘁 𝗠𝗙𝗔. Are you ready? Microsoft announced that sign-ins to the Microsoft 365 Admin Center 𝘄𝗶𝗹𝗹 𝗿𝗲𝗾𝘂𝗶𝗿𝗲 𝗠𝗙𝗔 — 📅 rollout started Feb 3, 2025, and from Feb 9, 2026 password-only sign-ins will be blocked. Accounts without MFA will simply 𝗯𝗲 𝗱𝗲𝗻𝗶𝗲𝗱 𝗮𝗰𝗰𝗲𝘀𝘀. ⚠️ This may sounds obvious — but in many tenants, this will catch many administrators of guard if you’re not prepared. 𝗪𝗵𝘆 𝘁𝗵𝗶𝘀 𝗺𝗮𝘁𝘁𝗲𝗿𝘀: 🔹 Admin portals are one of the highest-value targets in Microsoft 365 🔹 A single compromised admin account can lead to tenant takeover, data loss, or persistence 🔹 By doing this, Microsoft is removing the last excuse for “we’ll enable MFA later” 𝗪𝗵𝗮𝘁’𝘀 𝗿𝗲𝗮𝗹𝗹𝘆 𝗵𝗮𝗽𝗽𝗲𝗻𝗶𝗻𝗴: 🔹 MFA will be enforced at sign-in time, not just “recommended” 🔹 Legacy admin habits (password-only, shared admin accounts) will simply stop existing 🔹 If you haven’t updated emergency access accounts according to Microsoft’s latest recommendation, they will not be usable 𝗛𝗼𝘄 𝘁𝗼 𝗽𝗿𝗲𝗽𝗮𝗿𝗲 (𝗱𝗼 𝘁𝗵𝗶𝘀 𝗻𝗼𝘄): 🛠️ 𝗘𝗻𝗳𝗼𝗿𝗰𝗲 𝗠𝗙𝗔 𝗳𝗼𝗿 𝗮𝗱𝗺𝗶𝗻𝘀 𝗲𝘅𝗽𝗹𝗶𝗰𝗶𝘁𝗹𝘆 • Spread the word that this is happening amongst other admins • Use Conditional Access and target privileged directory roles • Require MFA for all admin roles, not just Global Admins 🛡️ 𝗙𝗶𝘅 𝘆𝗼𝘂𝗿 𝗯𝗿𝗲𝗮𝗸-𝗴𝗹𝗮𝘀𝘀 𝗮𝗰𝗰𝗼𝘂𝗻𝘁𝘀 • Break-glass accounts should each have a different form of MFA • Use: FIDO2 security keys, Certificate-based authentication, Software TOTP on FIDO2 key • A long password alone is not enough anymore • Quick start: use the Conditional Access template “Require multifactor authentication for Microsoft admin portals”and tailor it to your needs ⚠️ 𝗧𝗲𝘀𝘁 𝘆𝗼𝘂𝗿 𝗮𝗰𝗰𝗲𝘀𝘀 • Validate all admins can access Microsoft 365 portals before this is out • Verify emergency accounts work before you really need them ✅ Treat this change as a forced 𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗵𝘆𝗴𝗶𝗲𝗻𝗲 𝗰𝗵𝗲𝗰𝗸. If MFA breaks your admin access, the problem isn’t Microsoft — it’s your security posture. 💬 𝗗𝗼 𝘆𝗼𝘂 𝗮𝗹𝗿𝗲𝗮𝗱𝘆 𝗵𝗮𝘃𝗲 𝗠𝗙𝗔-protected admin access and break glass accounts, or are you still relying on passwords? Let us know. 𝘈𝘶𝘵𝘩𝘰𝘳 𝘰𝘧 𝘵𝘩𝘦 𝘱𝘰𝘴𝘵: @strnad10 #Microsoft365 #EntraID #ConditionalAccess #MFA #SecureBits #HorizonSecured