Nathan McNulty Profile picture
May 19, 2021 10 tweets 5 min read Read on X
Did you know that you can get a free M365 E5 subscription with 25 user licenses to learn, create automation, and develop applications?

I know most folks never get the chance to admin this stuff, so sign up now, and let's walk through this together :)

developer.microsoft.com/en-us/microsof…
Upon visiting the Microsoft 365 Dev Center, it will ask you to sign in with your Microsoft account.

This will be the Microsoft account that your developer tenant will be associated with, but not the one you use to log into it.

You should see something like this 👇 Image
So we simply fill out a few forms that let Microsoft know what we intend to do.

Please do not abuse this or use it for business purposes.

I build automation scripts, test SSO like SAML/OIDC with various apps, and build documentation for sharing with others for learning. ImageImageImage
And just like that, we now have our own M365 Developer account where we can set up our E5 subscription! Image
So the next step is to click the big blue "Set up E5 subscription" button and follow the wizard.

Note: Microsoft has a really bad password limitation on sign up, so use a crappy one and change it once you've logged in

2nd note: Kudos to MS on requiring MFA, even if it is SMS :) ImageImageImage
You should now see 92 days or so (I did this a bit ago) remaining on the subscription, and you can renew this over and over as long as you are using it appropriately.

While you are here, you can definitely add their sample data packs which might be helpful to learn with :) Image
Next thing we can do is log into the Azure Portal by going to portal.azure.com

Click the hamburger menu icon (that's what we're calling it, right?), and click Azure Active Directory.

You should now see that you are a Global Admin with Azure AD Premium P2

Feel the power! ImageImage
So you now have a dev tenant that you can just look around and play in.

Check out Azure AD, poke around, create users, groups, etc.

I have an AD lab that I will be connecting to this, and I'll be creating threads in the near future on setting up everything we can in M365.
If you have specific things you want to see, let me know

Plan is Azure AD first (Roles/PIM, Apps/SP's/SSO, Conditional Access, Users, Groups, AUs, etc), then Exchange/SharePoint/ConfigMgr migration stuff, and finally set up the full Defender/MCAS suite

Bedtime for now though :)
Many people asked about renewals, so I'm tossing a little update on here

I've logged into this tenant about 40 times in the last 90 days and played around with various settings, and I added my GitHub to my dev account with a few dozen commits.

That was all it needed to renew 👇 Image

• • •

Missing some Tweet in this thread? You can try to force a refresh
 

Keep Current with Nathan McNulty

Nathan McNulty Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @NathanMcNulty

Jan 25
Hello for Business works great with AD integrated apps (Kerberos/NTLM), but it requires setting up a trust model

Very poorly generalized, Hello uses certificates that AD doesn't understand, so we need a way to request a Kerberos ticket with the certs

This is crazy easy now 🧵
Before I share how easy it is now, I want to share why people still hate Hello because its history was way more complicated

Originally we had certificate trust which required full PKI deploying certificates to all of your devices and AD

Doing this properly was really hard...
So with Server 2016, Microsoft introduced a massive improvement - key trust

This meant we only needed to put certificates on domain controllers

This was so much easier, but it still required PKI and setting up the templates

And a hybrid model was added to support Azure AD... Image
Read 6 tweets
Jan 24
I think the most common misunderstanding of Conditional Access is its relationship to authentication, and this results in not understanding how the rest of the controls actually work

Conditional Access performs authorization by evaluating tokens from the authentication service
This provides important insights 💡

CA policies cannot block anything until AFTER authentication occurs

This means CA cannot help with password spray/credential stuffing. This is why we have Password Protection and Smart Lockout.

learn.microsoft.com/en-us/entra/id…
learn.microsoft.com/en-us/entra/id…
This also means an attacker blocked by a CA policy either has a valid username/password or has a stolen token

When we don't understand this, we don't monitor and respond, and we give attackers more time with valid credentials

Identity Protection helps here, but it isn't perfect
Read 7 tweets
Jan 20
You likely aren't collecting all available events to the Unified Audit Log

First, not all events are enabled or retained optimally. Consider creating this policy in the Purview portal (leave users and record types blank to collect everything).

Retention is based on license... Image
This policy only applies to users with the Microsoft 365 Advanced Audit SKU assigned, audit records are retained for 1 year. Audit records for users without this SKU are retained for 180 days (thanks CISA for the bump up from 90 days!)

Second, this still doesn't get everything..
Next we have to enable all the records for mailbox auditing

But wait, Microsoft totally pinky promises that you don't need to manage these records because they enable them for you



It would be nice if they actually enabled everything, but they don't :-/ learn.microsoft.com/en-us/purview/…Image
Read 6 tweets
Sep 6, 2024
A common ask I get often is:

I want to require fresh strong authenticaton from a compliant device (or specific devices) when someone activates a role via PIM

So let's walk through that scenario really quick

If anything is unclear, just try harder!

I'm kidding, ask away 😜
First, if the built-in phishing resistant auth strength works for you, use it

If not, we can customize exactly what we want (avoid requiring one not allowed in another poilcy)

We can even define AAGUIDs to specify exact models of keys that must be used

learn.microsoft.com/en-us/entra/id…
Image
Second, we need to create an authentication context

This is like a label used to tie PIM activation to a specific Conditional Access policy. The name can be changed any time 😉


In our access token, this is the 'acr' value
learn.microsoft.com/en-us/entra/id…
learn.microsoft.com/en-us/entra/id…Image
Image
Read 5 tweets
Aug 8, 2024
In this thread, I will provide Graph PowerShell commands to find synced users with admin privileges

Microsoft has been very vocal about not granting privileges to synced accounts for about 4 years now

Read this post by @Alex_T_Weinert:


Then check below techcommunity.microsoft.com/t5/microsoft-e…
@Alex_T_Weinert For those with PIM, these two scopes will help us get what we need (remove the /'s):

Connect-MgGraph -Scopes 'RoleAssignmentSchedule./Read.Directory','RoleEligibilitySchedule./Read.Directory'

If you don't use PIM, I believe you only need: RoleManagement./Read.Directory
First, we can get a list of all synced users who have an active assignment:

# Get active assignments
Get-MgBetaRoleManagementDirectoryRoleAssignmentSchedule -ExpandProperty RoleDefinition,Principal,DirectoryScope -All | ForEach-Object {
if ($_.Principal.AdditionalProperties."@odata.type" -match '.user' -and $_.Principal.AdditionalProperties.onPremisesSyncEnabled -eq $true) {
Write-Output "$($_.RoleDefinition.DisplayName),$($_.Principal.AdditionalProperties.userPrincipalName)"
}
if ($_.Principal.AdditionalProperties."@odata.type" -match '.group') {
$roleName = $_.RoleDefinition.DisplayName
$members = (Get-MgGroupMember -GroupId $_.PrincipalId).AdditionalProperties.userPrincipalName
if ($members.Count -ne 0) { $members | ForEach-Object { Write-Output "$roleName,$_" }}
}
#if ($_.Principal.AdditionalProperties."@odata.type" -match '.servicePrincipal') {
#    Write-Output "$($_.RoleDefinition.DisplayName),$($_.Principal.AdditionalProperties.appId)"
#}
}
Read 6 tweets
Jul 31, 2024
How non-privileged users can make themselves admin of your SaaS apps - a short story :)

Let's say your company uses Salesforce and has configured SAML for SSO with your Identity Provider

Salesforce's SAML implementation lets us pass identity and roles (permissions) on the token
So we create a security group named "Salesforce Admins" and add our admins to the group

Then we configure the claims rule in our Identity Provider to send the role value of System Administrator for members of a group with the display name of "Salesforce Admin" 🚩
Unfortunately, display names are almost never unique, so anyone that can create or modify a group to match the display name can now add admins by adding them to this group

In Entra, ANYONE can create a group by default or owners of groups can modify them, no admin roles needed Image
Read 5 tweets

Did Thread Reader help you today?

Support us! We are indie developers!


This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Don't want to be a Premium member but still want to support us?

Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal

Or Donate anonymously using crypto!

Ethereum

0xfe58350B80634f60Fa6Dc149a72b4DFbc17D341E copy

Bitcoin

3ATGMxNzCUFzxpMCHL5sWSt4DVtS8UqXpi copy

Thank you for your support!

Follow Us!

:(