Thomas Naunheim @Thomas_Live

✈️ blog to kick off BH/DC week: Borrowing Windows Hello keys for authentication and persistence. dirkjanm.io/borrowing-wind…

🚧 Folks, we’re planning a major architecture change for Maester 3.0: a native test model with structured metadata, simpler contributions, centralized prerequisite handling, and compatibility for existing Pester tests. We want your feedback before finalizing the design 👇 github.com/maester365/mae…

@merill Thank you for the kind words and for sharing., @merill! 🙏

Video and slides for my #TROOPERS talk with @martinsohndk on cloud-managed PAWs are now available! Dive into attack paths and tier breach in #MicrosoftEntra and #MicrosoftIntune RBAC, and see how they can be detected using #EntraOps and #BloodHound. 🔗 troopers.de/troopers26/tal…

Folks, Maester 2.2 is here!! It was just a couple of months ago when we launched Maester 2.0 and the amazing Maester community has been SUPER busy. The biggest news is support for Active Directory is now in preview thanks to Mike Soule and we have some really cool plans for Active Directory with @PrzemyslawKlys and his awesome TestimoX AD suite. Stay tuned on this. We've added tests for so many new products (and sorry you need to sign in more times because not every Microsoft product uses Graph anymore 🤷‍♀️). That includes Copilot config, Dataverse, SharePoint, Github (as more folks move agentic devlops to GitHub this is going to be super important), new Intune and Entra ID checks and so much more. Here are the highlights 🔥 269 Active Directory checks across identity, policy, infrastructure, DNS, trusts, replication, and access control 🔥 5 Microsoft Purview checks to get your data security foundations ready for Copilot and AI 🔥 12 new SharePoint Online checks across the CIS and CISA baselines, now cross-platform with PnP.PowerShell 🔥 5 CIS GitHub organization controls and first-class GitHub connectivity 🔥 9 Global Secure Access checks for Private Access, forwarding profiles, Compliant Network, and Internet Access 🔥 4 Intune endpoint security checks for LAPS, attack surface reduction, App Control for Business, and Managed Installer 🔥 New Entra ID checks covering agent risk, directory sync safeguards, Conditional Access gaps, legacy MSOnline, and privileged first-party apps 🔥 A sharper report with markdown summaries, per-test durations, and critical findings sorted first 🔥 Contributor credits across maester.dev, so the people writing these tests get the recognition they deserve Huge thanks to our contributors Artem Borodai, @BrianReidC7, @cbrhh, Christopher Edwards, @fabian_bader, Henrik Piecha, @janbakker_, Jean-Philippe George, Jon Gross, Jonathan Hope, Loïc Michel, Massimo Mazzariol, Matthias F., Mike Soule, Morten Mynster Kristensen, Ofir Gavish, @SamErde, Simon Albers, Stephan van Rooij, @thomas_live, Thomas Schmidt, Travis McDade, Truls Dahlsveen (PS Please let me know if I've missed anyone) Plus a huge personal thank you from me to all the maester.cloud founding sponsors maester.cloud/founders who have helped me go full time on Maester. This release wouldn't have been possible without you. Learn all about this release at maester.dev/blog/maester-2…

@maarten_goet One of my favorite speaker gifts ever! 💡 It doesn’t just light up the room, but also brings back bright memories of a great time at YellowHat. 🤩

Another year, another ring added to the stack! 💍 Huge thanks to everyone who's supported the journey over the years! 🙌 #Thankful #MVPbuzz #MicrosoftMVP

@fabian_bader @sapirxfed Yes, I’ve updated the slides with minor changes to my talk at HIPConf. There’s also a recording of the session. Unfortunately, the most fun part - the live demos of my queries - wasn’t captured: hipconf.com/resources/toke…

Why did I leave Microsoft? To work full time on 🔥 Maester. Over 40,000+ tenants today rely on Maester to monitor their tenants daily. I wanted to make sure that the tests they are running continue to be relevant and evolve as Microsoft 365 and the security landscape evolves. So today I'm announcing the launch of Maester.Cloud Maester Cloud is the portal companion to Maester that lets you track your results over time. It is multi tenant, runs in your cloud (or ours) and more → check out the site for all the features. More importantly Maester Cloud is a way for me to fund the continued development of the open source Maester core and the tests in Maester. That is our mission. In fact I worked with the core team @fabian_bader , @Thomas_Live , @MySnozzberries and @SamErde to create the Maester Manifesto (maester.cloud/manifesto). It is our promise to the community. If you value Maester and would like to support and ensure that Maester continues to grow and be healthy, I would be beyond thrilled if your organisation can sponsor this effort. I would also appreciate it very much if you can share this post with your network to spread awareness. Thanks!

Identity round table at @WEareTROOPERS with @kfosaaen @sapirxfed @Thomas_Live @DrAzureAD @ericonidentity @4ndr3w6S @JsQForKnowledge @thomas_elling

Attendees at #TROOPERS this week enjoyed a fantastic line-up of talks, including sessions from our own @martinsohndk and @MGrafnetter. Thank you to everyone who stopped by these sessions!

keyboard_arrow_left Previous keyboard_arrow_right Next

🔗 Integration details: github.com/Cloud-Architek… 🛠️ Latest release: github.com/Cloud-Architek… Bringing EntraOps classification into BloodHound unlocks powerful detection & analysis scenarios. #EntraOps #BloodHound #MicrosoftIntune #IntuneRBAC #TROOPERS26 (2/2)

🔐 #EntraOps × #BloodHound: Attack Path Analysis for #MicrosoftIntune and more! Presented at #TROOPERS26 with @martinsohndk on Tiered Administration in #MicrosoftEntra and Cloud-Managed PAWs. We released #BloodHound OpenGraph for #EntraOps to visualize attack paths. 👇 (1/2)

Speaking at #TROOPERS26 in less than two weeks and I can't wait. Joining @martinsohndk to talk about attack paths to #PAW and real-world risks of tiered admin models with #IntuneRBAC. Plus something we've been working on for months... See you in Heidelberg! #EntraOps #Bloodhound

🧪 #Maester checks - coming to preview soon Maester checks that leverage the hashtag#EntraOps classification model via UnifiedIdentityInfoXdr are expanding scope beyond Microsoft Graph to cover additional Microsoft APIs.

I'm working on updates across the community projects that use the classification: 🔎 #KQL function updates My functions have been already updated, and WorkloadIdentityInfoXdr now includes also an experimental overall EntraOps investigation score github.com/Cloud-Architek…

🔐 #EntraOps API Permission classification goes beyond #MicrosoftGraph - delegated permission identification got a major upgrade. The upcoming version in #EntraOps brings a significantly expanded #EnterpriseAccess classification model for sensitive Microsoft API permissions.

keyboard_arrow_left Previous keyboard_arrow_right Next

To summarize the last 3 days. I love the US, and i love @fwdcloudsec 🤭 You can watch our talk now! I think it's not bad at all🙃 youtu.be/YYlNtyPuUnU?si…

⚗️ Heads-up: Early experimental version, tested in my lab. Joins multiple external data sources + large log tables - always use filters. Unfiltered runs in large environments can be expensive. Results combine SigninLogs + EntraIdSignInEvents for full details by Sentinel/XDR

⚠️ Enforcement change exposure: Detects sign-ins impacted by Microsoft’s “Improved enforcement” rollout - baseline-scopes-only requests hitting All-resources policies with resource exclusions. 🚫 Zero-enforcement filter: Surfaces sign-ins where no CA policy applied.

🔍 Hunting for #ConditionalAccess bypasses and baseline scope enforcement in #MicrosoftEntra?  ConditionalAccessAudiences  logs every resource evaluated by CAP - but only as raw GUIDs. I built a KQL query that resolves them to names + adds key signals. 🔗 github.com/Cloud-Architek…

keyboard_arrow_left Previous keyboard_arrow_right Next