Merill Fernando 💚

Merill Fernando 💚

@merill.net

Product Manager @microsoft | Creator of bluesky.ms • cmd.ms • idPowerToys.merill.net • Graph X-Ray • 🇦🇺 • 🇱🇰 • Posts my own http://youtube.com/@merillx Sign up to my newsletter https://entra.news

6.1K followers4.4K following3.8K posts

Merill Fernando 💚
@merill.net

Bazzinga! Now you don't need to choose between Maester and Microsoft's Zero Trust Assessment. You can have both in one handy report! More to come 🤩

Merill Fernando 💚
@merill.net

Did you know that Maester Cloud comes with a built in risk register that helps you track the status of Maester findings. No more spreadhsheets and losing track. There's more coming to help you actually fix and secure your tenants with https://maester.cloud

Merill Fernando 💚
@merill.net

Let him cook!!! 😂 🔥 Maester ❤️ Microsoft Zero Trust Assessment Two of my babies are growing up together. Maester Packs lets you install, pin & run third-party test packs. The first one we ship is Microsoft’s Zero Trust Assessment. Its results land right in your Maester report. Coming soon 👀

Merill Fernando 💚
@merill.net

Inherited a tenant full of apps with client secrets that never expire, high risk AI agents? Don't start with the scariest one. Jeff Sakowicz works on the Microsoft Entra agent and application platform, and his order of operations is different: 1️⃣ Stop the bleeding. 1/6

View full thread
Merill Fernando 💚
@merill.net

We also cover why mail is the flag attackers are trying to capture, why tenants that turned off user consent years ago should revisit the modern consent policy, the protections Microsoft runs in every tenant by default, and a checklist for admins before they click Accept. 5/6

Merill Fernando 💚
@merill.net

This week on Entra.Chat with Jeff Sakowicz Full episode: entra.news/p/stop-th... 6/6

entra.chatEntra.Chat | Merill Fernando | SubstackEntra Chat is a weekly podcast hosted by Merill Fernando and delivers practical insights for Microsoft administrators and security professionals through conversations with identity experts who've been in the trenches. Episodes feature seasoned Entra practitioners sharing real-world deployment experiences and Microsoft Entra team members who build the features you use daily. Get the inside track on best practices, implementation strategies, and upcoming capabilities directly from those who design and deploy Microsoft identity solutions. Join us for actionable takeaways you can apply immediately in your Microsoft 365, Azure, and Entra environments. --- Entra.Chat, its content and opinions are my (Merill Fernando) own and do not reflect the views of my employer (Microsoft). All postings are provided “AS IS” with no warranties and is not supported by the author. All trademarks and copyrights belong to their owners and are used for identification only.
Merill Fernando 💚
@merill.net

Inherited a tenant full of apps with client secrets that never expire, high risk AI agents? Don't start with the scariest one. Jeff Sakowicz works on the Microsoft Entra agent and application platform, and his order of operations is different: 1️⃣ Stop the bleeding. 1/6

View full thread
Merill Fernando 💚
@merill.net

2️⃣ Burn down the debt from both ends: the most privileged apps (app-only access to every mailbox goes to the top) and the wholly unused ones. 3️⃣ Delete what nobody uses. 3/6

Merill Fernando 💚
@merill.net

In Jeff's words, "If you get rid of an unused identity, you might be knocking an item off of seven lists." A weak secret, an insecure redirect URI, overprivileged access and a legacy protocol, gone in one move. Just make sure it doesn't only run at tax season. 4/6

Merill Fernando 💚
@merill.net

Inherited a tenant full of apps with client secrets that never expire, high risk AI agents? Don't start with the scariest one. Jeff Sakowicz works on the Microsoft Entra agent and application platform, and his order of operations is different: 1️⃣ Stop the bleeding. 1/6

Merill Fernando 💚
@merill.net

Create an app management policy that blocks new password credentials, with an enforcement date so only apps created after it are affected. Check how disruptive it will be and have an exception process ready first. 2/6

Merill Fernando 💚
@merill.net

Teaser clip from this week's Entra Chat podcast that comes out tomorrow. We are doing a deep dive into Entra's app platform and who better than Jeff Sakowicz who leads Entra's app platform for apps, service principals and Agent ID

Merill Fernando 💚
@merill.net

BOOM! This is the biggest thing since sliced bread in the Entra world. Security Default is no longer a giant ON/OFF switch. You can now exclude just individual users from policies!! 1/3

Merill Fernando 💚
@merill.net

It gets even better. You can now have Security Defaults and layer on additional Conditional Access policies. Now you get the best of both worlds. 2/3

Merill Fernando 💚
@merill.net

BOOM! This is the biggest thing since sliced bread in the Entra world. Security Default is no longer a giant ON/OFF switch. You can now exclude just individual users from policies!! 1/3

Merill Fernando 💚
@merill.net

I love this new feature we just added to Maester.Cloud Maester 2.3 has 100s of new tests, in Maester Cloud you get to decide if you want to include them in your daily runs. You can even pick which tenants should get the new tests.

Merill Fernando 💚
@merill.net

Maester Cloud is now on the Microsoft and Azure Marketplaces 🎉 Every subscription helps fund my time building Maester. Marketplace customers can also be featured on our supporters wall. Go to https://maester.cloud → pick Azure Marketplace Please repost to help spread the word 🙏

Merill Fernando 💚
@merill.net

Did you know that if you have Entra ID P1 there is a new way to block your stolen refresh token from being replayed by the attacker? Find out 🧵👇 1/7

View full thread
Merill Fernando 💚
@merill.net

Want to learn more Entra ID? Follow me and turn on notifications from my profile. With notifications turned on, you'll never miss my short nuggets of Entra knowledge. 7/7

Merill Fernando 💚
@merill.net

Did you know that if you have Entra ID P1 there is a new way to block your stolen refresh token from being replayed by the attacker? Find out 🧵👇 1/7

View full thread
Merill Fernando 💚
@merill.net

Did you know that if you have Entra ID P1 there is a new way to block your stolen refresh token from being replayed by the attacker? Find out 🧵👇 1/7

Merill Fernando 💚
@merill.net

Folks, if you have Entra ID P1, you already own a fix for stolen refresh tokens. You may never have turned it on. New Entra Chat with Alex Pavlovsky and Marilee Turscak, both PMs on Microsoft Entra, on Global Secure Access and compliant network. 1/7

View full thread
Merill Fernando 💚
@merill.net

Universal CAE: if Entra flags an admin on an SSH session over GSA, Alex says that session is dead in about two to five minutes, even with 90 minutes left on the token. As of the week before recording, device compliance changes trigger it too. 6/7

Merill Fernando 💚
@merill.net

Folks, if you have Entra ID P1, you already own a fix for stolen refresh tokens. You may never have turned it on. New Entra Chat with Alex Pavlovsky and Marilee Turscak, both PMs on Microsoft Entra, on Global Secure Access and compliant network. 1/7

View full thread
Merill Fernando 💚
@merill.net

How it works: GSA and Entra ID run as one engine. The GSA edge tells Entra this is a legitimate GSA device from a specific tenant, and Entra trusts that signal. A device in tenant B can't satisfy compliant network in tenant A. 4/7

Merill Fernando 💚
@merill.net

Agents "do not give up." GSA can tell agent traffic from user traffic. Marilee's demo: a policy blocks the DELETE method for agents only. The agent can't delete the Dropbox file. The user still can. 5/7

Merill Fernando 💚
@merill.net

Folks, if you have Entra ID P1, you already own a fix for stolen refresh tokens. You may never have turned it on. New Entra Chat with Alex Pavlovsky and Marilee Turscak, both PMs on Microsoft Entra, on Global Secure Access and compliant network. 1/7

Merill Fernando 💚
@merill.net

The attack: phish a refresh token or a PRT cookie, then replay it from your own machine. Alex's fix: a Conditional Access policy that blocks everything outside the compliant network. "None of that works with compliant network in place." 2/7

Merill Fernando 💚
@merill.net

What you need: 1. Entra ID P1 (no advanced GSA licence) 2. The GSA client on your devices, or a remote network 3. One policy: all users, all resources, block any network except compliant network locations Start in report-only. 3/7