New feature in PIM - fire custom extensions on role activation
Add custom business logic to PIM role activation requests with custom extensions
Identity · Access · Cloud
Learning by doing
cloud stuff
Field notes, honest opinions and practical guides about Microsoft Entra, identity governance and cloud security.
Explore the notebook
Stian Strysse BjørgeSenior Identity Architect
Fresh from the field
Latest articles
Microsoft PIM is great - but it has some shortcomings that need fixing
If Microsoft made me Product Manager of PIM for a day, here's what I'd put on the backlog.
New feature in Entra ID Governance ELM - support for request on-behalf-of
Microsoft has just released a hot, new feature in their cloud IGA offering, Entra ID Governance (Entitlement Management), allowing request on-behal...
What's lurking in your Microsoft Graph app role assignments?
Gain insights for security and compliance reasons by reporting on all service principals in Entra ID (former Azure AD) having Microsoft Graph app R...
Defend against MFA phishing of Azure AD user identities
Securing identities in Azure AD with MFA is a no-brainer, but is it really enough? Let's look at attack vectors for the various MFA methods, and ho...
Follow 'just-enough-access' principle by scoping resources during role elevation in Azure PIM
Utilizing PIM and having no active privileged Azure RBAC or Azure AD roles by default, always requiring 'just-in-time' elevation, is an important r...
Securing user identities in Azure AD beyond MFA
In today's threat landscape it's important to be healthy paranoid and always re-think how attackers could potentially breach an organization's defe...
Building a comprehensive report on Azure AD admin role assignments in Powershell
Keeping an eye on Azure AD administrative role assignments is crucial for tenant security and compliance. Forget about the built-in PIM report in t...
Query Azure AD logs with KQL from Powershell
Kusto Query Language (KQL) is a powerfull tool to query Azure AD log entries from Log Anayltics in Azure. See how you can query log data using Powe...
Granting workload identities least-privilege mailbox access via Microsoft Graph
Workload identities, meaning apps, managed identities and other service principals, can be granted tenant-wide application access to all mailbox re...
Connecting to SharePoint Online using Managed Identity with granular access permissions
Microsoft Graph and SharePoint Online supports some granular access permissions using Sites.Selected application scope in Graph, and app access rol...
Stop using client secrets and certificates, start using Managed Identities
Managed Identities can be used instead of app client secrets and certificates for Azure resources authenticating to Azure AD. Let's look at what a ...
Control access to Azure Storage Blobs with Attribute-based Access Control conditions
Let's look at how to configure access to Azure Storage Blobs using Attribute-based Access Control (ABAC) paired with Custom Security Attributes
Block legacy authentication protocols using Azure AD Conditional Access policy
Let's look at blocking legacy authentication protocols in a global company's Azure AD with full control and ease of mind
Getting started with Custom Security Attributes in Azure AD
This blogpost explores the new Custom Security Attributes public preview feature in Azure AD
Getting started with Custom Extensions in Entitlement Management for Azure AD
Microsoft released a new public preview feature for Azure AD Identity Governance during Ignite this week, namely Custom Extensions for Entitlement ...
Getting started with Azure AD extension attributes
Learn how to add custom extension attributes to Azure AD objects
Getting started with Microsoft Graph
Let's go from zero to somewhat hero by getting familiar with topics like REST API, JSON, HTTP methods, access tokens, permission scopes, Graph Expo...
Getting started with Microsoft Graph - part 2
The second blogpost in the series explains the Microsoft Graph.
Getting started with Microsoft Graph - part 3
The third blogpost in the series explains the Graph Explorer.
Getting started with Microsoft Graph - part 4
The forth blogpost in the series explains the Graph Powershell SDK.
Getting started with Azure AD App Provisioning and single-sign-on
My first-ever blog post walks through how to configure automated user provisioning and single-sign-on from Azure AD to SaaS apps, specifically for ...
No articles found. Try another search.