Recent content on Nathan McNulty
Passkey registration problems Passkeys in Microsoft Authenticator are fantastic, assuming you can get users logged in to the app successfully. Unfortunately, many companies that are serious about rolling out phishing resistant authentication are also serious about requiring device compliance and/or app protection policies, and they have run into issues where where these policies prevent users from…
A brief history Seamless Single Sign On was first introduced in late 2016 and provided a way for users to authenticate to Entra ID (Azure AD at the time) using a Kerberos ticket from Active Directory. Unfortunately, most environments had it enabled at one point or another thanks to one of the worst default options still prevalent in Entra today - because not only is it enabled by default, it is…
This post provides everything you need to ensure Advanced Auditing is fully configured and auditing everything we possibly can for both existing and new users. I recently shared guidance for this via social media (see below), and it felt like a perfect time to revisit my previous posts and combine everything into one comprehensive guide :) You likely aren't collecting all available events to the…
👮 Restricted Management Admin Units (RMAU) in #EntraID Hackers HATE This Hidden Entra ID Feature Most Admins Never Use @NathanMcNulty breaks it down for us 👇 🎧 Get the full podcast episode at https://t.co/gnvH23WorW pic.twitter.com/nxBwCQ6BwS — Merill Fernando (@merill) March 29, 2025 I recently had a chance to discuss Restricted Management Administrative Units (RMAUs) with Merill, and…
It was such an honor to join Merill Fernando on Entra Chat, and I hope to join him again in the future. Be sure to check out Entra Chat: https://entra.news/p/operational-groups-in-entra-with
I absolutely love the SCCM Operational collections from System Center Dudes, and while Intune has a different design that negates the need for scoping collections, there are still many scenarios that are helpful to have for targeting. https://www.systemcenterdudes.com/create-operational-sccm-collection-using-powershell-script/ This solution provides a set of scripts to help you maintain group…
Log Analytics workbooks are pretty intuitive, but KQL is one of those things that can take a while to learn and use effectively. One of the coolest things about workbooks is that it is actually building a KQL query in the backend based on our filter selections, and then we can usually edit the resulting query in Log Analytics based on the table (or other elements) we are interested in from the…
This solution provides automation that ensures all available auditable events are enabled for all users in a tenant. By default, not all events are collected, and many record types need to be enabled for every new user. This improves my previous automation script with several key changes: Published in Azure Automation gallery Fully automated setup Improved error handling Optional reporting My…
This solution will eventually be a PowerShell module, but the initial goal was to map out all of the internal service APIs used in the Defender portal and provide two capabilities - assessment and automatic configuration. I have been working on a customized version of Maester to handle Defender as a “Service” and create Maester tests to check configurations, but the delay and lack of…
Microsoft typically recommends against scheduled full scans, but there are a few scenarios where we still want to perform a full scan outside of scheduled scans - whenever Defender was not the active Antivirus (such as switching from a 3rd party Antivirus), as part of the base image creation process, or once a new machine has finished installing all new apps and policies.…
Note Development on this solution is on hold until some other projects are finished. Plan to revisit in the second half of 2025.
This solution analyzes the output from the MDE Client Analyzer for common issue or things we might typically want to know for troubleshooting purposes. The initial coverage goals: Basic health check failures Basic configuration recommendations Tamper Protection status/source including TPExclusions Summary of all scans (such as start time, detections, duration, etc. Advanced Auditing policies…
Note This is currently being rewritten and should be completed in February 2025 :)
You likely aren’t collecting all available events to the Unified Audit Log :( First, not all events are enabled or retained optimally. Consider creating this policy in the Purview portal (leave users and record types blank to collect everything). Retention is based on license… This policy only applies to users with the Microsoft 365 Advanced Audit SKU assigned, audit records are…
I had a great time hanging out and talking about a little bit of everything with some of the Trimarc folks. Thanks to Brandon for inviting me on! :)
Note This article was last updated on 01/30/2025 for readability and updated URLs
Note This article was last updated on 01/30/2025 for readability and updated URLs. I am working on updating this for the UI changes that have been made to Intune :)
Note This article was last updated on 01/30/2025 for readability and updated URLs. We no longer need to manually load modules as shown, and this article will be completely overhauled to include backup of LAPS passwords and BitLocker keys to Azure Key Vault as well :)
Note This article was last updated on 01/30/2025 for readability and updated URLs. I am working on updating this for the UI changes that have been made to Intune :)
Note This article was last updated on 01/30/2025 for readability and updated URLs
Note This article was last updated on 01/30/2025 for readability and updated URLs
Note This article was last updated on 01/30/2025 for readability and updated URLs
Note This article was last updated on 01/30/2025 for readability and updated URLs
Note This article was last updated on 01/30/2025 for readability and updated URLs
Note This article was last updated on 01/27/2025 for readability and updated URLs, and the content itself will be updated in the near future :)
Back in May of last year, I started building a new server and had planned to fully share the process of putting it together, setting up the OS, templates, etc. Instead, we had a baby, remodeled and sold our home, moved over 1500 miles, and had job constraints that forced me to rush putting it together :( New home server :D Dell R630 with 2x 14 core E5-2680 v4 CPUs Already ordered 1.2TB SAS drives…
Note Unfortunately, the images from this article were never able to be recovered, and it is unlikely I will be able to recreate them. Email security has come a long way, but there is still a lot of value in using this method if you don’t have access to better tools :)
Note This article was last updated on 01/27/2025 for readability and updated URLs, but content review and image updates are in process :)
Note This article was last updated on 01/27/2025 for readability and updated URLs, but content review is in process. New guidance is to enable the credential theft rule out of the box, and there are new rules to put in audit mode and add to the queries.
Note This article was last updated on 01/26/2025 for readability and changes to URLs.
Note This article was last updated on 01/26/2025 for readability and updated URLs
Note This article was last updated on 01/26/2025 for readability and updated URLs. Unfortunately, images were not able to be restored from a previous hosting provider :(
Note This article was last updated on 01/26/2025 for readability and updated URLs. Unfortunately, images were not able to be restored from a previous hosting provider :(
Note This article was last updated on 01/26/2025 for readability and updated URLs. Unfortunately, images were not able to be restored from a previous hosting provider :(
Note This article was last updated on 01/26/2025 for readability and new images due to UI changes made in Intune. I tried to keep the original style and flow, and the original post content can be found in the Twitter link at the end. A new article will revisit this and add new capabilities.