Blog › Identity Security
Where modern intrusions actually start: token theft, consent abuse, Conditional Access gaps, and the sign-in record that tells you what a policy did rather than what it was meant to do.
6 articles
Device code phishing passes MFA on Microsoft's own page. Find it in sign-in logs, catch the device registration that follows, and block the flow safely.
Read more →Revoke sessions in Entra ID kills refresh tokens, not issued access tokens, app sessions or guests. Contain in the right order and verify it from the logs.
Read more →adminCount stays set after an account leaves a protected group, and accounts with DCSync rights never get it. Find both, then watch replication rights.
Read more →An Entra ID app registration holds a list of client secrets, not a value. Rotation adds one and removes nothing unless somebody does it deliberately.
Read more →ESC8 turns a coerced domain controller into domain-wide compromise with no password cracked, and the certificate it issues outlives your password reset.
Read more →Owning a service principal means owning its permissions. Most tenants don't monitor SP ownership changes. Here's the detection gap.
Read more →Other topics
