Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Hidden Gems: The Azure Active Directory Whitepapers

semperis.com | blog | #cloud | #active-directory | #documentation | #identity | #azure-ad | #ad-fs | #whitepapers

Summary

A roundup of Microsoft France's 13 Azure AD whitepapers: the most comprehensive overview of Azure AD services anywhere, plus a 110-page AD FS tutorial on claims, auth flows and client access policies.
Published
Collected

original ↗

Related coverage

blog · projectblack.io
Should I Azure AD Sync/Entra Cloud Sync Domain Admins?
Syncing Domain Admins into Entra ID lets attackers pivot from compromised on-prem AD to the cloud, and back via password writeback. CIS and Microsoft advise keeping privileged admin accounts cloud-only.
blog · semperis.com
Two New Microsoft Hybrid Services Dramatically Simplify Connecting your Active Directory to Azure
Microsoft previews passthrough authentication and seamless SSO—connecting on-prem AD to Azure AD without an AD FS farm or synced password hashes; a comparison of the hybrid authentication choices.
blog · semperis.com
Using AD FS To Change Your AD Password Anywhere, Anytime
How to let users change an expired AD password from anywhere via AD FS: covering the 'knows the password but must change it first' scenario and distinguishing password change from reset.
blog · netspi.com
Targeting Passwords for Managed and Federated Microsoft Accounts
Releases Invoke-ExternalDomainBruteforce, which detects whether a Microsoft domain is managed or federated, picks the right authentication flow, and automates password guessing against O365 and ADFS.
vulnerability · netspi.com
XSS Using Active Directory Automatic Provisioning
Azure AD SCIM provisioning synced user names into a web app without output encoding, giving script injection via the firstName field and a path to steal credentials with an imported JS file.
blog · semperis.com
How to Redefine Cyber Resilience: Start by Rethinking Hybrid Identity Protection
Semperis argues AI-driven attacks are outpacing identity teams as machine identities outnumber human ones 10:1, and urges building organization-wide cyber resilience around hybrid identity protection before the next crisis.
back