Post

Merill Fernando 💚
@merill.net

Folks, if you have Entra ID P1, you already own a fix for stolen refresh tokens. You may never have turned it on. New Entra Chat with Alex Pavlovsky and Marilee Turscak, both PMs on Microsoft Entra, on Global Secure Access and compliant network. 1/7

Merill Fernando 💚
@merill.net

The attack: phish a refresh token or a PRT cookie, then replay it from your own machine. Alex's fix: a Conditional Access policy that blocks everything outside the compliant network. "None of that works with compliant network in place." 2/7

Merill Fernando 💚
@merill.net

What you need: 1. Entra ID P1 (no advanced GSA licence) 2. The GSA client on your devices, or a remote network 3. One policy: all users, all resources, block any network except compliant network locations Start in report-only. 3/7

Merill Fernando 💚
@merill.net

How it works: GSA and Entra ID run as one engine. The GSA edge tells Entra this is a legitimate GSA device from a specific tenant, and Entra trusts that signal. A device in tenant B can't satisfy compliant network in tenant A. 4/7

0 reposts0 likes

Merill Fernando 💚
@merill.net

Agents "do not give up." GSA can tell agent traffic from user traffic. Marilee's demo: a policy blocks the DELETE method for agents only. The agent can't delete the Dropbox file. The user still can. 5/7

Merill Fernando 💚
@merill.net

Universal CAE: if Entra flags an admin on an SSH session over GSA, Alex says that session is dead in about two to five minutes, even with 90 minutes left on the token. As of the week before recording, device compliance changes trigger it too. 6/7