Post

Folks, if you have Entra ID P1, you already own a fix for stolen refresh tokens. You may never have turned it on. New Entra Chat with Alex Pavlovsky and Marilee Turscak, both PMs on Microsoft Entra, on Global Secure Access and compliant network. 1/7

The attack: phish a refresh token or a PRT cookie, then replay it from your own machine. Alex's fix: a Conditional Access policy that blocks everything outside the compliant network. "None of that works with compliant network in place." 2/7

What you need: 1. Entra ID P1 (no advanced GSA licence) 2. The GSA client on your devices, or a remote network 3. One policy: all users, all resources, block any network except compliant network locations Start in report-only. 3/7

How it works: GSA and Entra ID run as one engine. The GSA edge tells Entra this is a legitimate GSA device from a specific tenant, and Entra trusts that signal. A device in tenant B can't satisfy compliant network in tenant A. 4/7

Agents "do not give up." GSA can tell agent traffic from user traffic. Marilee's demo: a policy blocks the DELETE method for agents only. The agent can't delete the Dropbox file. The user still can. 5/7

Universal CAE: if Entra flags an admin on an SSH session over GSA, Alex says that session is dead in about two to five minutes, even with 90 minutes left on the token. As of the week before recording, device compliance changes trigger it too. 6/7