Sharing is Caring!
Check out this article via web browser: How to add granular amr claims to your SAML apps in Entra ID In my last post, I covered how Entra ID now automatically sends the amr and acr claims for Salesforce, so its phishing-resistant MFA check finally has something to check. That part is automatic, no config needed. Every other SAML app doesn t get that automatically. Per Microsoft s own optional…
Check out this article via web browser: Lock or sign-out when Yubikey is removed from the device I didn t know there was already a solution for this, and maybe you are looking for it too. I learned about this from the Blue Security Podcast. Meet: YubiKey Locker Yubico With YubiKey Locker, implement a protocol-agnostic security key removal policy that seamlessly integrates across various operating…
Check out this article via web browser: Writing Maester tests using AI From idea to Pull Request I love Maester. No doubt about that. I ve made several contributions to this open-source project before, but it took me a lot of effort to learn how the underlying structure worked as a non-developer, and this challenge can be hard for a lot of Entra or Microsoft 365 admins out there. Lucky for those…
Check out this article via web browser: Admin control for SSO prompts in Windows; finally, an off switch! If you ve been paying attention to the EEA sign-in changes over the past while, you ll know Microsoft started prompting users before reusing their Windows credentials to sign in to other Microsoft apps and services. Good for user choice, less great if you re an admin who just spent years…
Check out this article via web browser: Passkeys by default and retirement of Microsoft-provided SMS and voice authentication A guide to stay calm I don t have all the answers, but I promise to keep this post updated with all the details I find. Microsoft dropped a bomb by announcing it will stop funding phone-based MFA, such as SMS and voice, and that passkeys will become the new standard. For…
Check out this article via web browser: KB employeeLeaveDateTime show empty (null) This is a knowledge base item. I hope it will help you someday. The issue When syncing the employeeLeaveDateTime attribute to Entra ID, the value shows null. In this example, I use Graph Explorer to check the value. The solution As also mentioned here, the issue is a lack of permissions. This attribute is sensitive…
Check out this article via web browser: Why Windows is the hardest passkey surface in 2026 and what Entra admins should expect Written by: Corbado If you have rolled out passkeys to a mixed device fleet, you might have probably noticed the following pattern. Some users log in smoothly and barely create a ticket (e.g. iPhone users), while others, like Windows users, do. Behind runs the same…
Check out this article via web browser: Entra ID SAML authnmethodsreferences (AMR) now supports phishing-resistant MFA If you ve been following the Salesforce phishing-resistant MFA (PRMFA) requirement story, you know the clock has been ticking. Salesforce has been pushing organizations to enforce phishing-resistant MFA for Salesforce administrators. The tricky part? Until now, Microsoft Entra ID…
Check out this article via web browser: Domainless SAML federation in Microsoft Entra External ID If you ve ever set up direct federation with a SAML Identity Provider in Microsoft Entra External ID, you ll know the pain. You configure everything correctly, invite a guest user, and then they hit a cryptic error at sign-in: AADSTS5000819: SAML Assertion is invalid. Email address claim is missing or…
Check out this article via web browser: Use Device Code Flow to register a passkey in Microsoft Authenticator App The other day, I was doing some research in my lab, and had to register a new passkey a couple of times. At some point, I stumbled upon the device code flow in the Microsoft Authenticator app. I was aware of this flow, but I suddenly realized how easy it is to create a new Read More…