Full transcript
0:00Entra ID. It's the cloud identity
0:02provider that your organization is
0:05probably using for you to log in and
0:07interact with your online Microsoft
0:09account. So you can access SharePoint,
0:11Microsoft Teams, One Drive, Outlook,
0:14your email, your calendar, everything.
0:16But it's not without some security gaps
0:19and some that are present by default.
0:22So, just recently at the Besides Nova
0:24Information Security Conference, Besides
0:27Northern Virginia, I got to catch up
0:28with a good friend of mine, Shawn Metaf.
0:31And Shawn is a genius at all things
0:33Microsoft, specifically Active Directory
0:36and Azure Active Directory, now called
0:38Entra ID. These days, he's the identity
0:40security architect at Trusted SEC,
0:42Microsoft Certified Master in Active
0:44Directory, which sounds pretty badass,
0:46and former Microsoft MVP, and he
0:48maintains a blog at adsecurity.org.
0:51and we've showcased this before in other
0:53videos, but his blog here is a
0:55phenomenal resource for anyone that
0:57might be up to anything in Entra ID or
1:00Active Directory. He puts out a ton of
1:02sweet information for free. So,
1:03honestly, this whole video is just based
1:05off of his work. My kudos, credit,
1:07credit where credit is due. Big thanks
1:09to Sean. I did ask permission. Hey, can
1:11I use some of the stuff from your recent
1:12talk at besides Nova because he gave a
1:15talk titled How to Entra ID Security
1:18Quickly. Like what are the toggles and
1:21switches, settings and configurations
1:23that could harden and improve your
1:25security posture so you don't get
1:27hacked? The craziest thing is a lot of
1:30these are default settings that need to
1:33be changed and folks just don't know or
1:35realize it. So I wanted to shine a
1:37spotlight on this resource so you could
1:39get a little bit smarter and secure your
1:41Entra ID environment. Like did you know
1:44that any user users by default are able
1:47to register applications and create
1:50whole new tenants by default? Now I'm
1:53not going to go through each and every
1:54individual thing included in that blog
1:57post and include it in Sean's talk, but
1:59he has been generous enough to share the
2:01slides. So of course I'll leave a link
2:02for those in the video description if
2:04you're interested. But they even give
2:06you the quick links to be able to go
2:08make the changes and switch things up
2:10and correct this. Sean has all the sweet
2:13context of what's what and a little bit
2:14more background information on all of
2:16this. But when you're getting to the
2:18brass tax, when you're getting to the
2:19super tactical stuff, even just the tip
2:21of the iceberg, what users can do, what
2:24guests can do. Too many people don't
2:26realize this, but Entra ID guests have
2:29the same view rights like read
2:31capability as regular users. And guests
2:33can invite other guests. Anyway, the
2:36slides include some sweet links, so we
2:38could honestly just go click to get in
2:40and edit these changes. So, just for
2:42demonstration sake, I am going to walk
2:44through a couple of these in my own
2:45Entra ID tenant. I have one of the old
2:47school like free developer tenants that
2:49unfortunately I don't think Microsoft
2:51does anymore. Oh, I got to do
2:52multiffactor authentication. Let me log
2:54in. Super sorry. But with that, you
2:57should probably in fact always have some
3:00multiffactor authentication. Ideally
3:02phto2 using a security key is ultimately
3:05what we're hoping for. But look at this.
3:07I'm logged in and just the default
3:09setting. This is a flat vanilla instance
3:11of a Microsoft enter ID tenant. Users
3:14can register applications. No, don't
3:16want that. Restrict non-admin users from
3:19creating tenants. Yeah, they probably
3:20shouldn't be able to do that. Users can
3:22create security groups. No, we should
3:24make sure that is set to no. I want to
3:26walk through a couple more of these
3:28nasty default configurations, but I
3:31think it's still super important to know
3:32how these could be abused, how they
3:34could be exploited and taken advantage
3:36of. If you're doing some security
3:38testing or red teaming, you got to have
3:40some of that training. So, real quick, I
3:42did want to let you know Altered
3:43Security is doing their awesome Black
3:45Friday deal. It's 20% off all of their
3:48courses and boot camps. Boot camps in Q1
3:51and Q2 of next year, 2026. and 5% off
3:54when you're purchasing two or more
3:55items. They're even hosting an awesome
3:57event, Alt Setcon 2025, 3-day in-person
4:00Red Team training with tons of
4:02industryleading on premise and Azure
4:04cloud like Entra ID content. 10% off to
4:07be able to jump into that event and no
4:09coupon code is required. It's all just
4:11by default when you go check out the
4:13website. That Black Friday deal is
4:14running from now till December 17th. So,
4:16I hope you jump in. If you aren't
4:18already familiar with Altered Security
4:19and the awesome stuff that they're up
4:21to, they have phenomenal training labs,
4:23resources, education courses, even
4:26certifications to get smart in Active
4:28Directory, Azure Active Directory, your
4:30Entra ID, stuff in the cloud, stuff on
4:32prem, CRTP, Active Directory certificate
4:35services, advanced stuff, evasion labs,
4:38and of course the cloud material that I
4:40think is really, really necessary in
4:42today's day and age, and all of the
4:44awesome stuff even on the Linux side of
4:46the house. Check out the boot camps.
4:47Check out their in-person training. They
4:49just have a ton of sweet stuff. All
4:51linked below in the video description. I
4:53hope you snag some of the Black Friday
4:55deals. Huge thanks to Altered Security
4:57for all their support with this video
4:58and their continued support of the
5:00channel. Keep letting us do what we do.
5:02Thank you so much. So, back to our
5:04security hardening little checklist
5:06here. What else do we got? User device
5:09setting defaults. Users have the default
5:12ability to enter join devices without
5:14requiring multiffactor authentication.
5:17Before we tweak that, I think there is
5:19one more still in the users page for the
5:21guest defaults because more often than
5:24not, you could just have a totally rogue
5:26guest that still has access to your
5:29tenant and can listen in and view and
5:31read and see all the things going on
5:33inside your cloud identity provider.
5:35Here, guest users have the same ability
5:38to view Entra ID resources as regular
5:41users. That should be toggled down at
5:43the very bottom. Guest user access is
5:45restricted to properties and memberships
5:47of their own directory objects when you
5:50can make that the most restricted like
5:52limit the what's the right term there?
5:54Like principle of lease privilege,
5:56access control, attack surface. Like you
5:58don't want to let guests be able to do
6:00that. In my own tenant, apparently that
6:02was just guest users have limited access
6:04to properties. But I do want that to be
6:06restricted. And then we could scroll
6:08through here in case you haven't done
6:09this before. It's worth taking a look.
6:11What else could you limit like LinkedIn
6:14accounts allow users to connect with
6:16their LinkedIn? No. And I click save.
6:20And that's that. Down below on this user
6:23settings page though, they do have a
6:24section for us to manage external
6:27collaboration settings. And those are
6:29your guests. This one is super
6:31important, too, because again, I think
6:32it's something that people just don't
6:34even realize. The guest invite settings.
6:37By default, anyone in the organization
6:39can invite guest users, including guests
6:42and non-admins. So, employee Joe Schmo
6:46Rachel in marketing can just invite
6:49whoever they want. You can limit this
6:51down to like your own risk assessment
6:53and threat model. You could turn it all
6:55the way up. No one in the organization
6:57can invite guest users, including
6:59admins, being the most restrictive.
7:01Maybe only users assigned to specific
7:03admin roles. Again, Sean Metcaf's slides
7:06cover this, and I really want to keep
7:08pointing back to this. That is the
7:09resource that I want you to take away
7:11from this thing. The defaults are all of
7:13this, but we could really toggle that
7:15down to Yeah. Okay. Only users assigned.
7:17I'm glad I got the call right for that.
7:19Collaboration resources, collaboration
7:21restrictions could be pretty locked
7:23down, too. Is that at the bottom here?
7:25Yeah, collaboration restrictions. Make
7:28that hardened, please. I can just type
7:31in the domain or tenant that we use
7:34currently here. And then we can save
7:36this page. Good enough. Secure. At least
7:38better than we were. Can't boil the
7:41ocean. Got to chip away one at a time
7:43here. The defaults for device setting
7:45security though, we should also tweak
7:47and tune. Remember by default that was
7:49any user could join whatever device they
7:52want to Microsoft Entra and it did not
7:54require multiffactor authentication
7:56which we should have. So the device
7:58settings here again the slide includes
7:59the quick and easy link. We can specify
8:02some members here. I can just go ahead
8:03and add my administrator. I actually
8:06want to add only the administrator user
8:08not the group. That's just the name that
8:10I had set up for it. It is the global
8:12administrator role but that's the name
8:14that I set for them. I don't want it to
8:15be too confusing when that's displayed
8:16maybe in other later screens. I'm going
8:18to toggle this to no, don't register
8:21devices. And I will require multiffactor
8:23authentication at a minimum. Though
8:25realistically, we should probably set up
8:27a conditional access policy. We'll get
8:29to mention conditional access policy
8:32super duper soon. But I don't really
8:34want to fall down that rabbit hole
8:35because my goodness, there is a lot to
8:37talk about. Let me click save on that.
8:40Now, obviously, there's a lot more we
8:41could tweak and tune and change the
8:43settings for any of the configurations
8:45if we were to really go through one by
8:48one, like with a fine tooth comb to see
8:50how we could limit the attack surface
8:51and lock down our environment. Again, I
8:53just wanted to give you these resources.
8:55Wanted to shine a spotlight on this cuz
8:56I don't know how many of you have even
8:58done that. Have you ever particularly
9:00audited your security posture in your
9:03Entra ID environment? Here we're moving
9:05into a section that I have another video
9:07on like the illicit consent grant attack
9:08and a lot of the altered security
9:10training covers some of this stuff. When
9:11users are presented with an app or
9:14application that they could install into
9:16the Entra ID environment or connect and
9:18log in kind of with it, that basically
9:21gives a couple permissions that whatever
9:23the app wants. And at one point, any
9:26user could just like willy-nilly accept
9:28and approve and allow consent for all of
9:31those permissions and privileges for any
9:33app across the entire org. Now, I think
9:36that's been a little bit tightened up.
9:37You can see the defaults here are now a
9:39little bit more managed, but we could
9:41tighten that even further. Again, link
9:43here. Super convenient. Let Microsoft
9:46manage your consent settings. Good.
9:48Let's keep that how it is. Reviewing
9:50Sean's blog post. I guess that original
9:52configuration where again anyone could
9:54do anything allowing consent for any
9:57app. Uh that I think has changed and it
10:00no longer looks like this. However, it
10:01might in some environments. So again,
10:03worth checking in. Oh, then we fall down
10:06the rabbit hole for the rolls. Holy
10:09crap. There are 117
10:13Entra ID rolls as of October 2025. That
10:17makes it really tough to know what's
10:19what. In fact, this whole image, I
10:21think, is intentionally and purposefully
10:23useless because it's just how over so
10:26overwhelming how many that there are.
10:29Now, there are 28 of them. According to
10:32Sean, again, all his work, 28 roles
10:34marked as privileged. Those are the
10:37important roles. Those are the ones that
10:38should be protected, but it has a little
10:41bit of nuance. Like something called
10:43global reader isn't the same as global
10:46administrator, and it doesn't really
10:47need the same level of protection for
10:50those kinds of accounts. Like obviously
10:51global administrator should have much
10:54higher scrutiny, much higher security
10:56than global reader, but all of these are
10:59ones that you should probably track and
11:00make sense of given 28 is a heck of a
11:03lot better than 117. Good insight, good
11:06knowledge here though. The ones that are
11:08in bold, kind of tough to see, but
11:10application administrator, cloud
11:11application administrator, directory
11:13writers, global admin, uh, etc., etc.,
11:15etc., Those are marked as privilege and
11:17should be a higher priority for
11:19protection without a doubt. What they
11:21call tier zero roles though are the ones
11:24that are the highest level of concern.
11:27Like these are the absolute keys of the
11:29kingdom. That's the crown jewel.
11:32Obviously, global administrator members
11:34or users with these roles should always
11:37have multiffactor authentication on. Big
11:40shout out 502 and more sweet slides from
11:43Shawn in other presentations that he's
11:46given. Dude, he's everywhere. This is
11:48phenomenal. We got to get Shawn in a
11:50video and see if he could school me and
11:52teach me a lot of this uh entra ID stuff
11:54cuz I got a lot to learn. So obviously
11:56global administrator is now like the
11:59cloud and online equivalent to the
12:01domain administrator like we might be
12:03used to in kind of traditional oh
12:04endpoint classic pentest network
12:06pentesting stuff, right? in the identity
12:08space in cloud. That's the global
12:10administrator. But there are a couple
12:12others that we should even honestly be
12:14tracking. Stuff like hybrid identity
12:16administrator. Don't know if you've seen
12:18that one before. Partner tier 2 support.
12:21Oh, that can reset passwords
12:23willy-nilly. Like that could be used as
12:26a privilege escalation vector. Like any
12:29individual principal could promote
12:31themselves because they could adjust
12:33kind of the permissions. It looks like
12:35same with privileged authentication
12:37administrator. [laughter]
12:39So much so that Microsoft says do not
12:42use do not use this. And there's
12:44privileged role administrator. Users
12:47with this role can manage role
12:49assignments in Entra ID as well as
12:52Microsoft Entra privilege identity
12:54management. That role grants the ability
12:56to manage assignment for all Microsoft
12:59Entra roles including the global admin
13:02role. Yeah. Wow. Okay. These are things
13:05that we should kind of at least be aware
13:07of, right? He rolls through the same
13:09sort of methodology with making sure
13:11there are no standard user accounts that
13:13are in these highly privileged roles.
13:15Walking through each of these and trying
13:17to be able to look for each of the
13:19different assignments, making sure
13:20they're using multiffactor
13:21authentication, and then he covers a
13:23heck of a lot more stuff like role
13:25assigned groups, what a lot of these
13:28privileges really are and what they look
13:30like. And this is kind of the schema and
13:31format. You've probably seen this
13:33before, right? Maybe in other videos,
13:34even evil jinx stuff that we've covered
13:36or the illicit consent grant attack. Oh,
13:39mail.
13:41Or user readwrite.all.
13:44So, you have an object to start.
13:47And then constraint. Those are worth
13:50tracking, but there are a lot of them
13:52once again. But if we drill down to the
13:55tier zero concerns as to what those
13:58permissions might be, obviously readrite
14:01all gives basically admin privileges.
14:05Looks like there's more damage that
14:06could be done with app ro assignment.
14:08Same thing with ro management and that's
14:11uh readwrite.all and this is readwrite
14:14directory. So again trying to figure out
14:16the constraint or what the access level
14:19is is important. Thankfully, that's just
14:21in the name, but these are the other big
14:24ones that we want to be tracking.
14:25Thankfully, only four, at least the ones
14:28that we could see be immediately
14:30jumpshotting to whole full power in the
14:33cloud ID tenant. Conditional access
14:35policies, that's going to be a whole
14:36another video on its own once I get
14:38smart on it for one thing. And I know
14:40there is just so much to talk about, but
14:42the craziest coolest thing with
14:44conditional access policy and why you
14:46absolutely should be using some of that
14:47if you aren't already handling some I
14:49think uh intra ID initial access
14:51conversations. you get to define and
14:54declare okay based off of what
14:56geographic locations device information
14:59or authentication method and actually
15:02ensuring requiring that they're using
15:04multiffactor authentication etc etc
15:07there are a ton of potential mishaps
15:10with your conditional access policy so
15:13he covers a lot of these shout out to
15:14Sean uh again link in the video
15:16description a big one though is
15:19entraconnect so intraconnect is the way
15:21that you bridge age together your on
15:24premise active directory environment to
15:26your cloud online intra ID or old active
15:30directory environment right Azure active
15:32directory now new name entra ID sorry I
15:34got to keep saying that over and over
15:35again I drill it through my own head but
15:37hackers could jump from that local
15:39onremise environment to the online
15:42environment and vice versa if they could
15:44track down oh the opportunities to get
15:47in there we've had a lot of those
15:48conversations with blood hound and
15:50trying to see oh how could we take on
15:51these different attack paths, but uh
15:54we're getting a little bit too far in
15:56the weeds here. When Shawn wraps this
15:58up, he does make this super sweet
16:00securing Entra ID quickly checklist. So,
16:04this is the crash course on just a
16:05couple of things that we got to play
16:07with like setting users to not be able
16:10to register applications, not letting
16:12them create tenants, and a lot of other
16:15sweet bullet points that I do want to
16:17leave behind for you as an exercise for
16:20the reader. But I hope this was still
16:22some sweet exposure. I hope this was
16:23still some good information and
16:25awareness as to what the defaults look
16:28like in Entra ID and how they do need
16:31you to tend to them to tweak them to
16:34make sure you can actually bolster, set
16:35up, harden, and lock down your Entra ID
16:38cloud environment. With that, I'm done
16:40rambling. Thanks for watching this
16:41video. Hey, I hope you go take a look at
16:42some of the sweet new Black Friday deals
16:44that Altered Security is up to. Again,
16:46link below in the video description. I
16:48think you'll find some really sweet
16:49stuff that you're interested in. Whether
16:50it's Active Directory hacking, Azure
16:52Active Directory, Entra ID, cloud online
16:55stuff now, and whether you're on
16:57whichever side of the fence, red team,
16:59blue team, purple team, I don't know,
17:00any color wheel, cyber security that we
17:02want, uh, I hope you know a little bit
17:04of how to defend these things, too.
17:07That's why having this, you know what,
17:08run through of the settings, security,
17:10things we can harden, configure to make
17:12security better, I hope that's still
17:14good info for you and more resources for
17:16you all to learn from. So, thanks for
17:18watching. See you in the next video.