Blog › Identity Security
Where modern intrusions actually start: token theft, consent abuse, Conditional Access gaps, and the sign-in record that tells you what a policy did rather than what it was meant to do.
3 articles
An Entra ID app registration holds a list of client secrets, not a value. Rotation adds one and removes nothing unless somebody does it deliberately.
Read more →ESC8 turns a coerced domain controller into domain-wide compromise with no password cracked, and the certificate it issues outlives your password reset.
Read more →Owning a service principal means owning its permissions. Most tenants don't monitor SP ownership changes. Here's the detection gap.
Read more →Other topics
