Nathan McNulty

11 Aug

Huge improvements to nodoc! I redesigned orchestration so Sol now drives continual improvement of the playbooks :) Putting the process through evals, codex-spark now drives CDP/npm scripts and static analysis, luna handles review and next steps, and sol manages and approves 🔥

11 Aug

I practically stole this project from Aled Mehta (@x_delfino), and I can't express how much I appreciate his work The project helps understand internal APIs services are built on, like portal apps, and can really help with assessment and configuration nodoc.nathanmcnulty.com

github.comnodoc/specifications at main · nathanmcnulty/nodocdocumenting undocumented interfaces. Contribute to nathanmcnulty/nodoc development by creating an account on GitHub.

11 Aug

This project has been incredibly useful in building PowerShell modules and other automation Many products lack public bulk actions, like creating USB devices in Purview, but you can point an agent at these specifications and build tools in minutes 🔥

9 Aug

They always hide the good stuff in the notes :) I've always liked Enterprise State Roaming, but many places never enabled it. Now the feature has been superseded by Windows settings backup and restore which will be enabled by default starting with the upcoming 26H2 release 🥳

8 Aug

Did you know Entra has recommendations for configuration settings and can even send email alerts on expiring app/service principal credentials? Ideally, I recommend using Maester which has far broader coverage, but this is a nice built-in feature :) entra.microsoft.com/...

18 July

It makes me laugh every time I see something like this, lol Like, there is some criminal out there that thought, hmm, I'm gonna sign up for a free Azure trial, set up an Azure Monitor group, and abuse it to send out malicious email 🧠 This is why we can't have nice things :p

16 July

Conditional Access in the portal has been flaky for me most of the day, and then randomly this showed up in a few tenants 😎 This is a really nice view, makes it so much easier to find the right policies and notice where you are missing control 🥳

16 July

Whelp, it seems they are going to keep me around for another year, now in two categories :p A huge thanks to everyone here who shares and asks great questions - I wouldn't be in this program if it weren't for you :) Looking forward to sharing even more this year!

WHAT?!?

Periodic reminder that even Microsoft recommends disabling Device code flow The primary two areas I see this used are Teams phones / Conference room type equipment and administrative CLI tools, and you should still block by default and exclude as needed learn.microsoft.com/...

18 June

To check if it is in use, you can filter sign-in logs to Authentication protocol - Device code, or you can run Graph PowerShell: Get-MgBetaAuditLogSignIn -Filter "AuthenticationProtocol eq 'deviceCode'" I usually recommend an exclusion group managed by PIM or Access Packages :)

17 June

Apparently M365 Developer tenants only enforce 1 factor for SSPR for admins... 🫠 Almost had a heart attack and opened a ticket with MSRC, lol I've checked several retail tenants now, and they are all properly enforcing 2 factors 😅

10 June

Do you know what your agents are doing? Worried about what kind of websites they might be looking at? Now you can apply the same web content filtering policies to them as you do to your users! 😅 learn.microsoft.com/...

😭

Whelp, it seems GitHub Copilot went from one extreme to the next It was obvious and understandable something had to change as the premium request model was unsustainably generous, but the new token based model ends up being way more expensive than Codex, Claude, or openrouter.ai

28 May

No big deal, just Purview admin portal shipping telemetry to Google...

22 May

Holy crap they did it! They backported support for AppContainers from 7.7 to 7.6 🥳 For those who many not be familiar with AppContainers - it's sandboxing. We can sandbox PowerShell. I repeat, we can freaking sandbox PowerShell, natively! github.com/PowerShel...

16 May

Can anyone tell me what the point is in reporting malicious domains in Defender XDR if it's not even getting looked at within 24 hours? Even free services already identified this as bad... Daniel Card pointed this one out, seemed pretty easy but I guess not 🤷‍♂️

16 May

I cannot wait to use this phrase on a call "That was useful in a painful way" 🤣

14 May

I may need an intervention... I'm pretty sure I just said "user-based service accounts are better than service principals, actually"... and in the given context, it was 100% true Service Principals have some really dumb limitations that make user accounts a better fit 🥴

13 May

I love getting gaslit by Azure all the time... Automation accounts and Function apps only support PowerShell 7.4, even though 7.5 was released 1.5 years ago and 7.6 was released a few months ago "Please consider updating it soon." 😒 No Azure, you consider updating it soon...

5 May

For all the shady stuff I've done so far, it's funny a simple request to use the Bearer token from the integrated browser against the CLI is what got me in trouble :p

30 Apr

Did you know there are at least 6 ways to store data about users in Entra? 😅 Outside of normal user object attributes, directory extensions tend to be one of the best fits for most things, except for sensitive data - use custom security attributes ;) learn.microsoft.com/...

30 Apr

You can allow xAI models in M365 Copilot, and this note is... 🫠🤣

29 Apr

Wait... agents get to have Linux desktops in Cloud PC but users don't?

Shiny brain

This is pretty cool. You can build consent URLs for Logic Apps for use in phishing, and it looks like Microsoft has added warnings to this consent dialog :) It's been a long time since I used the URL like this - anyone know when this change happened?

7 Apr

Do you exclude MFA on joined/registered devices? If so, do you require MFA for device join/registration? I see this often because these controls aren't considered at the same time, and that's how we get this gap: Attacker steals user/pass -> register device -> no MFA required

7 Apr

Fun side note - you can't actually block device join/registration - that grant control is not supported But you can require a method that no user could possibly have ;) Alternatively, use Temporary Access Pass to allow scenarios you want "block by default, allow by exception"

3 Apr

WhoAmI - Dynamics edition 😂

30 Mar

OMG, XDRInternals dumping MDE device timeline straight into Azure Data Explorer 🤯

Soon ™️

Brand new feature being developed in 2026 using secrets for authentication 👎

27 Mar

Support for TAP and Phone Sign In are done! It was surprisingly harder than expected to get the phone sign-in flow to work properly :p Working on cross-platform browser auth now, and hopefully will be able to add it to XDRInternals this weekend

25 Mar

"Because everyone else lowered the bar, we decided to join them" is so on-brand...

19 Mar

*chuckles* I'm in danger

😅

Cut your cloud spending bills with this one weird trick! lol, honestly, I can't believe how well this worked 😅

14 Mar

Feed M365 Copilot a simple markdown file asking for a Word doc, and of course it chokes and dies... It's truly impressive just how bad this product is :-/

14 Mar

Merged some good XDRInternals updates :) Connect-XdrBySoftwarePasskey does exactly what it says, super easy to automate AI access to the portal 🤖 Get-XdrIdentityUserTimeline lets you extract the whole 180 days of user timeline data if you need it github.com/MSCloudIn...

14 Mar

Final validation is done for the Defender for Endpoint device actions including Live Response and the library I'll post an update once that is merged, but this one is so freaking cool. Both interactive and non-interactive support for Live Response, up to 10 devices per minute.

Apparently OnlyCopilotFans is a thing... 🤢

Doing some napkin math, I estimate just under 3 hours (fully optimized) to wipe 200K devices via Intune API If an attacker were unaware of API limits being per app, that bumps to ~5.5 hours under ideal conditions What happens if all admin devices are wiped first? 🤔 😳 🥺 😭

When you don't require security keys and a dedicated device for your privileged admin roles

If you think Intune's multi-admin mode is going to save you from a phished Global Admin, I have bad news... GA can just create a second admin and approve their change ;)

I love how you design a harness with delays, and AI is like, no bro, that's gonna take to long, let me change that for you 😂

They couldn't have called it biztalk? 🙃

2 Mar

azd + maester = 😲 Soon ™️

1 Mar

If you have considered using my script to create software passkeys using ESTSAUTH cookies on a pentest or red team exercise, I have published a more secure option for you ;) Create an Azure Key Vault, grant yourself Key Vault Crypto Officer, and run this: github.com/nathanmcn...