Post

Thomas Naunheim
@naunheim.cloud

How can you detect and mitigate #MicrosoftEntra Compliant Device Bypass in the #MicrosoftIntune Company Portal? What are the potential attack paths? @fabian.bader.cloud, @cbrhh.bsky.social and I had additional research and summarized our results in this blog post: www.glueckkanja.com/blog/securit...

glueckkanja.comCompliant Device Bypass in Microsoft Intune – Detection, Response & MitigationIn this blog post, glueckkanja's MVP Fabian Bader, Chris Brumm and Thomas Naunheim gather details about the Compliant Device Bypass in Microsoft Intune Company Portal. After additional research, they ...

6 reposts26 likes

Dirk-jan
@dirkjanm.io

Nice blog! I'm just wondering what the relevance of FOCI is in the story? You can't really use the foci capabilities in this case since the exclusion is client + resource based.

Fabian Bader
@fabian.bader.cloud

We mentioned it mainly because this way an attacker could use an existing refresh token or ESTAUTH from another client id, with worrying about compliant device enforcement.

Dirk-jan
@dirkjanm.io

Yeah it's a bit confusing now adding extra topics that aren't really related to the bypass. Makes more sense if it was part of your research flow though :)