Entra-Id

The Problem A small business running Microsoft 365 with no existing Intune footprint wanted phishing-resistant, hardware-bound MFA their Macs: the same Windows Hello for Business-equivalent experience, but for macOS. Apple’s answer is Platform SSO (PSSO) with a Secure Enclave-backed key, and Microsoft’s Entra ID plugin supports it. The problem: virtually every piece of public documentation for this assumes Intune. This organization didn’t have an Intune license and didn’t want to buy one just to push a single configuration profile. ...

Introduction Securing Azure Entra ID (formerly Azure AD) is crucial for maintaining a robust security posture. This post covers essential security measures and how to implement them effectively. Cleaning Up App Registrations Identifying Unused Applications First, identify app registrations with expired credentials: # Get app registrations with expired secrets/certificates Get-AzureADApplication | Where-Object { $_.PasswordCredentials.EndDate -lt (Get-Date) -or $_.KeyCredentials.EndDate -lt (Get-Date) } Verification Process Check service principal sign-in logs for the last 30 days Disable service principals showing no activity Delete the corresponding app registration Implementing MFA Requirements Assessing MFA Status Navigate to Authentication Methods > User Registration Details to identify users without MFA: ...