Eric Woodruff

Seeing new attributes pop-up is a strong signal that something is brewing in Entra ID. Ever wish this could be surfaced in an automated way? Enter changes.entra.ms - An automated system that scrapes #Entra for changes on a daily basis. #EntraID #infosec #mvpbuzz

What happens when security teams inherit identity 🔗 Read more: www.helpnetsecurity.com/2026/05/26/e... #identitysecurity #CISO #cybersecurity @ericonidentity.com

Anthropic - AI can do cyber without much human. Me - AI can you help me with this research:

I’ve been finding the #Entra Usage & Insights report useless lately when it comes to #passkey reporting. Why? It’s broken. It’s concerning that this seems to be an ongoing issue that isn’t tenant specific and Microsoft hasn’t caught it. #EntraID ericonidentity.com/2025/09/02/e...

I have a new post out on the @netspi.bsky.social blog today. This one is on extracting sensitive information from the Azure Load Testing service. www.netspi.com/blog/technic...

Quote of the day: “MSFT has architected themselves into this corner” #fwdcloudsec25 @ericonidentity.com

Going right from @wearetroopers.bsky.social in Heidelberg to @fwdcloudsec.org in Denver ✈️ - from one excellent conference to another! I’m looking forward to speaking Monday @ 2:00pm in track 1 on the dangers of #nOAuth, with some new and tweaked slides and talking points! #Entra #EntraID

nOAuth revisited by @ericonidentity.com at @wearetroopers.bsky.social

At @wearetroopers.bsky.social I dropped new research on #nOAuth, an abuse of #EntraID that allows you to spoof users in vulnerable SaaS applications. The attack is still alive and well. You can read all about it here: #Entra #M365 #infosec www.semperis.com/blog/noauth-...

On the way to #TROOPERS25. The short flight is down… just waiting for the long one to Frankfurt. Looking forward to talking about #nOAuth with #Entra… sadly it’s still a thing 😑 #EntraID #infosec @wearetroopers.bsky.social

Did you know you can send LAPS passwords to Entra on Server OS? Neither did @adamgrosstx.bsky.social or I until yesterday! Just need to hybrid join the server(s) and set the GPO to backup to "AAD"! Neat!

Obligatory photo from airplane en route to the #mvpsummit

The last two months have been a chaotic whirlwind of emotions and activity. I needed to talk about it, so I did: jakehildreth.github.io/blog/2025/03...

Yesterday morning, I woke up to an email from Microsoft with the subject "Congratulations on your Microsoft MVP award". I immediately thought it was a phish, but I dug a bit further. It's real! 🤯 I was selected as an MVP in "PowerShell" and "Identity & Access"!

📢 To all attendees, sponsors, and speakers of MC2MC Connect! 📸 We have uploaded all the event photos to the Gallery page on the MC2MC Connect website, so you can look back and relive the day! 🔗 connect.mc2mc.be/gallery/ #MC2MC #ConnectMC2MC #MC2MCConnect

If you work in, around, near, adjacent, or so on, to #identity, including #infosec and #Entra, you should fill out the #IDPro skills survey. It takes five minutes and really helps in understanding the industry landscape. www.surveymonkey.com/r/L9QB6T2

I received an interesting #M365 subscription email the other week, that turned out to be a scam. I figured I'd pick it apart, and found it curious enough to share the details. #entra #infosec #m365security #azure ericonidentity.com/2025/02/20/a...

We’re pleased to announce the next speaker for MC2MC Connect: @ericonidentity.com 🚀 In this session, Eric will dive deep into the most common questions about app registrations, enterprise apps, and service principals. 🔍🛡️ 🔗 tinyurl.com/5dxvnsn4 #MC2MC #ConnectMC2MC

Zuckerberg "loved" an AI slop image on a spam page that also posts AI images of children with amputations, elderly people, fake images of graves, links offsite to ad-loaded pages, etc. Exciting stuff for me www.404media.co/zuckerberg-l...

If you consume multi-tenant apps in #EntraID, and they’ve been granted consent to do things in your tenant, you can spy on the auth choices your vendor makes - secrets or certs - in the logs available in your #Entra tenant. #infosec #m365 #azure ericonidentity.com/2025/01/13/s...

With all the speaking I burnt and crashed a bit towards the end of 2024. I plan on writing about the speaking experience… but first hoping to get back into writing more as I research stuff. Hope to have both a personal blog and Semperis blog article out this week 🤞.

Looking forward to when I can talk about the more interesting case 👀 #MSRC #Entra

Great advice; received a variant of this last week that had an old password I used to use in it 😅

Want to run roadrecon, but a device compliance policy is getting in your way? You can use the Intune Company Portal client ID, which is a hardcoded and undocumented exclusion in CA for device compliance. It has user_impersonation rights on the AAD Graph 😃

Oh by the way

The Moynihan Train Hall Starbucks is an absolute machine of efficiency.

🦋 Introducing bluesky.ms 👏 = A crowdsourced database of anyone and everyone in the Microsoft community on Bluesky. 👉 Add yourself and anyone you know today 👈 🫂 All are welcome. This is my v1, I'll add options to directly follow from the site itself but first 👇 LET'S FILL IT UP! 🙏

It is the biggest con in cyber security, hands down. There is *no data* that it changes cyber security *outcomes.* I theorize that most people intuitively know this, but because "improving click rate" is easy to track (and game), many performatively champion it as a "good metric" for security.

Which do I pick for SSO?!? #EntraID vs #AzureAD

Looking forward to that fresh MSRC case smell…

Celebrating 4 years of the "#MicrosoftEntra Attack & Defense Playbook" 🔐 ☁️ community project! Last week, @samilamppu.bsky.social and I took the opportunity to record a video about the journey of this project, from research to writing process. #MVPBuzz #TechCommunity www.youtube.com/watch?v=fBD1...

Device-bound #passkeys in #EntraID are finally GA https://aka.ms/Ignite2024/entra #AiTM #Security #FIDO2

When you’re cleaning up your lab and trying to recall what the server you named trashcan was for… 🧐

I created a starter pack for those just joining Bluesky to follow some great people talking #microsoft #identity and #security to get you started! Follow and Share! #msignite go.bsky.app/FkPKwkK

For those that *really* miss the old AAD portal: rc-aad.portal.azure.com#view/Microso... #Entra #EntraID

Still hard to not laugh when you see Microsoft apps having to resort to these naming conventions in your #Entra tenant 😅

I've been quiet on here for a while, but wanted to share the blog that details much of UnOAuthorized from my #bhusa talk yesterday. #blackhat #blackhat2024 #EntraID #azure #microsoft365 #microsoft #infosec www.semperis.com/blog/unoauth...

The obligatory starting my journey to the MVP Summit picture 😜😎 #mvpbuzz

Just published a new post: How to Securely Connect to Azure VMs and Use RDP Bastion, Virtual Network Gateway, VPN, Azure Cloud PowerShell and more #CyberSecurity github.com/HotCakeX/Har...

Reminder to anyone who has purchased a new #iPhone and uses #passwordless or the #microsoft authenticator app for #mfa for corporate #office365 or #EntraID iPhone backups/transfers will not rehydrate the app. Make sure you have a backup strong auth method. #m365 #azuread #azure #aad #infosec

as punishment for requesting gifs, we have broken images

Worst idea I've seen all day #okta #infosec #activedirectory #identity

The #Google #chrome response to #Microsoft #edge in the war to make the shittiest browser with the recent ad privacy changes...

If you've been living under the impression that 100% of all configuration changes in Entra ID are audited, or audited with value, you'd be wrong. A dive into a recent analysis of what's not there in #EntraID. #aad #mvpbuzz #entra #azuread #infosec #m365 ericonidentity.com/2023/08/29/d...