7 articles in this category
I pointed BloodBash, a free offline BloodHound alternative, at an old company tenant I still control but stopped watching years ago. It found 4 standing Global Administrators nobody remembered, but only after I worked around an undocumented licensing wall, and it completely missed a real privilege path I had to find by hand.
From Twitter’s admin tools to the AI agent that wiped a production database in 9 seconds: how identity debt builds up, and the exact controls that would have stopped each breach.
SyncJacking is an attack technique that exploits Entra Connect Sync hard-matching to let an on-premises AD attacker take over cloud-privileged Entra ID accounts. Microsoft enforced hard-match blocking for role-assigned users on June 1, 2026, but most tenants still have gaps. Here is how to audit your hybrid environment and lock down privileged identities before attackers exploit the window.
JWT (JSON Web Token) is the token format that powers modern API authentication, OAuth 2.0, and enterprise SSO. This guide explains exactly what a JWT contains, how the three-part structure works, its relationship to OAuth 2.0 and OIDC, how to generate tokens securely, and the attacks that break insecure implementations.
A leaked service principal secret with Contributor access caused a lateral movement chain that took three days to contain. Most organizations have more non-human identities than users, but fewer than 10% have a credential rotation policy that actually runs. This guide covers credential lifecycle automation, ownership attribution, workload identity federation, and the KQL queries that surface your riskiest NHIs before they become incidents.
The average enterprise Entra ID tenant has a guest-to-member ratio approaching 1:1, and most of those guest accounts predate the conditional access policies built for employees. This guide covers Cross-Tenant Access Settings, invitation restrictions, CA policy gaps, Azure RBAC cleanup, Entra ID Access Reviews with auto-deny, and the KQL queries needed to find stale guests before they become incidents.
Most Azure tenants accumulate hundreds of client secrets across service principals, with no owner tracking and no rotation discipline. Workload identity federation eliminates this category of risk entirely by replacing stored credentials with OIDC token exchange. This guide covers the migration playbook from secrets to federation across GitHub Actions, Terraform, and AKS at scale.