Security Community Spotlight: Luca Romero Arrieche Heller
Meet Luca, Modern Workplace and Cloud Consultant at SoftwareOne Iberia, a Microsoft Partner. Luca has been working with Microsoft Security and cloud technologies for over a decade, closely following the evolution of the Microsoft Security ecosystem. Today, Luca focuses on Modern Work and security transformation projects, including large-scale Microsoft 365 migrations, enterprise messaging modernization with Exchange Online, endpoint management deployments with Microsoft Intune, and identity-driven security architectures across Microsoft environments. In addition to implementation projects, Luca also delivers technical workshops focused on threat protection and Microsoft security technologies, helping organizations better understand and implement solutions such as Microsoft Defender XDR, Microsoft Entra ID, endpoint security, and Zero Trust strategies to strengthen their overall security posture. Here’s what Luca had to say about his winding road through Microsoft Security and its Community. All responses are quotes from Luca. Microsoft Security Community How would you describe your Microsoft Security Community involvement or advocacy, globally and/or locally? When did you begin? My involvement with the Microsoft Community began early in my career through regional Microsoft community and influencer programs in Brazil. During that time, I became involved with Microsoft Virtual Academy (MVA) and started writing security-focused technical articles based on real project experience. My early technical journey began working with on-premises technologies such as ISA Server, Exchange Server, and Active Directory, which provided a strong foundation in Microsoft infrastructure and security. Through community participation and my blog, I began documenting real-world implementations and lessons learned related to Microsoft Security and cloud technologies. Over the years, my professional work has remained closely connected to the Microsoft ecosystem, implementing technologies such as Advanced Threat Analytics (ATA), Advanced Threat Protection (ATP), Microsoft Defender XDR, Microsoft Entra ID, and Microsoft Intune in enterprise environments. Today, my community advocacy is strongly connected to real-world experience, focusing on Zero Trust architectures, identity protection, modern endpoint security, and large-scale Microsoft 365 transformations and migrations. I noticed you’ve also answered a number of questions and have helped provide solutions in Microsoft Tech Community forums. How did you come across this and what inspired you to help? I have always been encouraged to participate in the technical community and share knowledge. Since the early days of TechNet, I have been involved in learning from others and contributing whenever possible. The culture of collaboration within the Microsoft ecosystem played an important role in my professional development. Many of the challenges I faced early in my career were solved thanks to the knowledge shared by the community. Because of that, contributing back feels natural. In the Microsoft Security Tech Community forums, I often see questions that are very similar to challenges I face in my daily work as a consultant. Sharing my experience becomes a practical way to help others navigate similar situations. Experience is important not only for solving problems, but also for knowing where to look and how to approach a solution. When I see questions without answers or clear guidance, I try to contribute by sharing practical insights, troubleshooting approaches, and real-world solutions. What do you find most rewarding about being a member of the Microsoft Security Community? What I find most rewarding is knowing that the community played a direct role in shaping my professional journey. Early in my career, I learned extensively through forums, technical discussions, and shared knowledge. That collaborative environment enabled me to grow into increasingly complex enterprise projects. Over the years, I have followed the evolution of Microsoft Security solutions... the community has always been part of that journey. Today, being able to contribute insights gained from large-scale security architectures, identity modernization, and enterprise Microsoft 365 migrations is my way of giving back. Additionally, as a founding member of Microsoft Virtual Academy, I published security-focused technical articles and created my blog to document real-world implementations, always referencing sources and applied knowledge. Speaking of Microsoft Security solutions...which feature or product has provided the most impact? How has it helped you or your customers? The combination of Entra ID Protection with Conditional Access and the unified visibility of Defender XDR (are the Microsoft Security products that have) delivered the greatest impact by reducing compromised credential risks and accelerating incident response through identity, endpoint, and cloud workload correlation. Back to the Microsoft Community- what advice do you have for others who would like to get involved? My advice is simple: start by learning, then share what you have genuinely implemented in practice. The community values real-world experience, technical honesty, and genuine collaboration. It’s not about visibility — it’s about adding value. Be consistent, support others, and document your journey. Impact follows naturally. Linking up with Luca Do you have anything you’d like to promote or recommend? I recommend diving deeper into Intune, Defender, and Exchange Online, especially focusing on the integration between identity, endpoint protection, and email security within a well-structured Zero Trust Where can people get in touch with you or follow your content? LinkedIn: https://www.linkedin.com/in/lucarheller GitHub: https://github.com/LucaARHeller Blog: https://lucaheller.wordpress.com/ Microsoft Tech Community: LucaHeller Please share anything else essential to you. Before thinking about advanced security tools, it is essential to understand how the underlying technologies work. Whether it is something simple like DNS resolution, how authentication flows operate, or how policies are applied across enterprise environments, these foundational concepts are what allow security architectures to be built correctly. For me, combining strong technical fundamentals with modern security technologies and real-world implementation experience is what enables organizations to build secure and resilient Microsoft environments. Luca’s story is a strong reminder of what makes the Microsoft Security Community thrive: practical contributions grounded in real-world experience. Through training, documenting, and showing up to help others, Luca demonstrates how continuous learning and compassion can benefit everyone. The community is better for his continued involvement, and his journey is an invitation for others to participate, share what they’ve learned, and keep strengthening security together. __________________________________________________________________________________________________________________________________________________________________ Learn and Engage with the Microsoft Security Community Log in and follow this Microsoft Security Community Blog. Follow = Click the heart in the upper right when you're logged in 🤍. Join the Microsoft Security Community and be notified of upcoming events, product feedback surveys, and more. Get early access to Microsoft Security products and provide feedback to engineers by joining the Microsoft Security Advisors. Join the Microsoft Security Community LinkedIn Group and follow the Microsoft Entra Community on LinkedIn.AI with Zero Trust Security
Adopt a Zero Trust approach that lets you verify every access request — human, machine, or AI — before it reaches your most critical resources. As AI agents, semantic search, and automation accelerate how work gets done, you can reduce risk by explicitly validating identity, enforcing least-privilege access, and assuming breach across every step of your environment. Apply layered, continuous protection across identities, endpoints, networks, data, AI resources, applications, and infrastructure so attackers can’t exploit any weak links. Michael Madrigal, Security Product Manager, shares how you can protect productivity and keep pace with an evolving threat landscape, by continuously assessing risk, securing resources at runtime, and adapting policies as conditions change. Govern AI agents like identities. Apply visibility, scoped access, and controls to limit blast radius. Take a look at Zero Trust for AI. Connect only trusted endpoints. Block non-compliant devices and VMs from accessing resources by enforcing endpoint health and policy checks. Get started with Zero Trust for AI. Build security that adapts by design. Continuously assess risk and automate response across identities, endpoints, apps, data, and infrastructure. Get started with Zero Trust for AI. QUICK LINKS: 00:00 — Zero Trust for AI 01:41 — Overview of Zero Trust 02:43 — Identities 04:38 — Endpoints 04:50 — How Zero Trust applies to your network 06:51 — How Zero Trust applies to your data 07:31 — How Zero Trust applies to AI resources 08:24 — App Layer 08:31 — Infrastructure 09:49 — Security 10:23 — Wrap up Link References Check out https://aka.ms/GoZeroTrust Watch our series at https://aka.ms/ZTMechanics Unfamiliar with Microsoft Mechanics? As Microsoft’s official video series for IT, you can watch and share valuable content and demos of current and upcoming tech from the people who build it at Microsoft. Subscribe to our YouTube: https://www.youtube.com/c/MicrosoftMechanicsSeries Talk with other IT Pros, join us on the Microsoft Tech Community: https://techcommunity.microsoft.com/t5/microsoft-mechanics-blog/bg-p/MicrosoftMechanicsBlog Watch or listen from anywhere, subscribe to our podcast: https://microsoftmechanics.libsyn.com/podcast Keep getting this insider knowledge, join us on social: Follow us on Twitter: https://twitter.com/MSFTMechanics Share knowledge on LinkedIn: https://www.linkedin.com/company/microsoft-mechanics/ Enjoy us on Instagram: https://www.instagram.com/msftmechanics/ Loosen up with us on TikTok: https://www.tiktok.com/@msftmechanics Video Transcript: -Zero Trust security is all about one simple idea. Never assume trust, always verify. Whether it’s a person, an AI agent, or an app trying to access your resources, nothing is trusted by default. Equally, protections should be designed to work seamlessly behind the scenes, keeping your business operations secure without impacting productivity. By design, it follows three core principles to guard entry to your network and protect critical assets, you need to first verify explicitly, which means always confirm who, in terms of a person or a device, or what in the case of AI or other processes, is requesting access to your environment. Second, enforce least privilege access means granting only the permissions needed to specific resources to get work done, and then only for as long as necessary. And third, assume breach is where you assume that your environment has already been compromised, so that you have proactive defenses in place to protect your most critical assets. -In fact, whether you’ve already adopted Zero Trust or are just starting to consider it, with AI now working alongside of us, the need for this approach has never been greater. For example, if data isn’t properly classified and protected, AI which uses powerful semantic search can quickly surface information that was once hard to find and potentially share it with the wrong people. -Additionally ungoverned AI agents can often have extensive permissions across systems, enabling agents to move through your organization at unparalleled speed to complete tasks. But if compromised, they can cause significant damage before anyone even notices. And as AI reshapes both work and the risk landscape, this series will show how Microsoft helps you to implement Zero Trust seamlessly. Today, I’ll start with an overview of the Zero Trust architecture. We’ll look at the vulnerabilities that can arise and the core defenses, both new and existing, that you can deploy to mitigate them. Think of your IT environment as a flow. -From the identities, including system processes, and endpoints trying to gain access, all the way across your network, to the sensitive data, AI resources, applications and infrastructure they need to reach. Along that path, every step introduces risk, and attackers don’t need to compromise everything. They only need to exploit one weak link. That’s why protection must be layered across identities, endpoints, your entire network layer, data, AI resources, your apps, and infrastructure, because each introduce unique risks and act as a potential entry point. At every layer, real-time policy enforcement and protections are essential to ensure that any entity requesting access is thoroughly assessed and verified before gaining access to requested resources. -Let’s go deeper, starting with identities across human users, agents, and your workloads. Human identities are a prime target for phishing, impersonation, and credential theft. So you need to start by limiting access to what each person needs then adding phishing-resistant authentication to confirm users are who they say they are and only reach what they’re authorized for. -That’s where, for example, Conditional Access in Microsoft Entra comes in, verifying every request using passkeys and other strong methods. Microsoft Purview’s Data Security Posture Management additionally helps you track how users interact with data and AI, so you can spot risks early and strengthen your posture. Integration with Defender for Cloud Apps mean you can block risky apps from being used, and with Global Secure Access in Entra, you can also enforce identity-integrated network controls to keep unsafe requestors out. Non-human identities like agents, on the other hand, don’t fall for phishing, but they’re still vulnerable. They can be hijacked through user or agent interactions, and if they have broad access, a single misconfiguration or excess permissions can open the door to major breaches. -Here, the new Entra Agent ID gives each AI agent its own unique, manageable identity, letting you apply the same visibility, governance, and Zero Trust controls you use for human users, but now for non-human actors too. For example, Conditional Access can evaluate agent risk in real time for each authorization request to resources and defined access packages using ID governance with human agent sponsor approval, can scope agents for just enough access to what they need to carry out authorized tasks. -Then, similar to human identities, Insider Risk Management in Purview will also automatically assign risk levels to agents in your environment based on their data activities so you can prioritize investigations and apply targeted controls. This way, every identity is verified with real-time access controls and strict policies under Zero Trust. Of course, identities are only part of the picture. Device endpoints, whether corporate or personally owned, can also pose serious risks if compromised or are non-compliant due to missing updates or policies. That’s because they can act as vectors for lateral movement or data exfiltration. -Additionally, AI means that endpoint considerations now also extend to computer-using agents, where this type of agent can interact using endpoints like full virtual machines to temporarily access resources within your network or from your cloud service providers. Regardless of the person or entity interacting with the endpoint as access requests move inward, as part of conditional access, they also pass through control layers to evaluate context and behavior. In real time, the policy engine can detect anomalies and enforce policy boundaries based on detected real-time risks and other conditions. -And endpoint management controls using Microsoft Intune can ensure that any connecting device or VM passes compliance checks before it can access your resources. As a rule, all endpoints should be continually assessed for health and configuration compliance, with non-compliant, stale, or unused devices automatically revoked from access. Here, native controls in Microsoft Defender for Threat Protection and continuous assessment use threat intelligence and forensics to expose patterns, automatically respond and raise defenses against trending attacks. We’ll dive deeper on what you can do to protect identities and endpoints in a another episode of this series. -For now, let’s switch gears for an overview of the resources that can be targeted by compromised identities and endpoints and how Zero Trust applies. In other words, your network, sensitive data, AI resources, internal and cloud applications, as well as infrastructure components, which are often the ultimate objective for attackers. Your network importantly serves as a bridge between malicious actors and your most valuable resources. Here, your first layer of defense uses network and device-based firewalls to filter traffic and help prevent unwanted connections. Network segmentation then adds protections in case of breach to limit lateral movement to other internal resources. These can be combined and are stronger when tied directly with identity controls in Entra using Global Secure Access for strengthened security. -Next, the ultimate target of any security breach is your data, which can fall risk to theft, manipulation, or leakage. Here, Microsoft Purview delivers a unified Zero Trust control set. For unstructured data in Microsoft 365 and beyond, it identifies sensitive data and applies sensitivity labels that act as protection guidance, driving consistent enforcement such as encryption access controls and DLP across collaboration and AI experiences. And for structured data across Fabric and other clouds, the same sensitivity labels extend protection intent to data stores, enabling consistent access controls and policy enforcement so sensitive data is protected wherever it’s used, including AI workloads. Equally, AI resources, models, agents, APIs, data pipelines, and compute, are critical components of your Zero Trust architecture. If compromised, they can leak sensitive data, generate malicious outputs, or enable lateral movement across systems. Protection means securing the resources themselves, not just access, by assessing prompts and outputs with Microsoft Foundry’s Prompt Shields and runtime protections. Securing compute environments like GPU-enabled virtual machines used for AI with isolation and compliance controls using Microsoft Defender for Cloud. And continuously monitoring agent behavior for anomalies and assigning risk scores with Agent 365 for centralized governance. -Together, capabilities like these and more create a layered defense so your AI resources remain secure across the lifecycle. From here in our architecture, the app layer is where AI meets data. That’s because this layer is increasingly powered by AI and semantic search. It enables users to retrieve information with more efficiency. These capabilities are now common in productivity tools, including collaboration platforms and business systems. While these experiences enhance user productivity, they also amplify attacker capabilities if access is compromised, whether through a stolen credential or a risky insider. -This is where Microsoft Defender for Cloud Apps plays a critical role. With visibility into all apps in use, risk-based controls to govern app behavior, and data protection policies to prevent misuse and data exfiltration. And at the foundation of everything in the Zero Trust architecture is infrastructure, spanning cloud environments, servers, containers, and orchestration systems. The consequences of compromised infrastructure can be severe, with service outages, ransomware, instability, and more. Microsoft Defender for Cloud delivers comprehensive workload protection across Azure, AWS, and GCP, including vulnerability scanning and advanced threat detection for your infrastructure. And you can leverage Azure Confidential Computing infrastructure for your most sensitive workloads, which encrypts data while in use in memory using hardware-based trusted execution environments and processes that only after requests are explicitly verified. -And of course, as we go across each layer, security configurations should not be set and forgotten. Continuous validation with constant monitoring and adaptive policies is a critical part of maintaining Zero Trust. Across all layers in the Zero Trust architecture, SecOps needs to be continuously assessed, monitored and optimized with controls to minimize and detect risks. Here, Microsoft Defender with Sentinel as its integrated SIEM extends detection and response across endpoints, identities, SaaS apps, email and collaboration tools, and more. -Please stayed tuned to Microsoft Mechanics to watch the rest of our series with hands-on guidance for implementing Zero Trust across identities and endpoints, data, AI resources, and apps, and your network and infrastructure, at aka.ms/ZTMechanics. And for additional resources, check out aka.ms/GoZeroTrust with free workshops and more. Subscribe to our channel if you haven’t already, and thanks for watching.Get started with a modern zero trust remote access solution: Microsoft Global Secure Access
🚀 Get started with a modern Zero Trust remote access solution! Say goodbye to outdated VPNs 👋 and embrace the future of secure connectivity with Microsoft Global Secure Access Private Access. 🔐 Built on the principle of least privilege, this solution ensures users only access the resources they need. Combined with Conditional Access, it provides powerful, policy-driven protection for both specific and broad on-premises resources. Whether you’re just starting your cloud journey or ready to break free from legacy VPNs, Global Secure Access Private Access is the game changer you’ve been waiting for. 👉 In this session, we’ll cover: ✅ How to get started with Global Secure Access Private Access ✅ Installing & managing the Global Secure Access client ✅ Monitoring traffic flow for visibility and control Let’s embark on this journey to enhanced security and seamless access together! 🗓️ Date: 4 October 2025 ⏰ Time: 18:00 (CEST) 🎙️ Speaker: Kasper Sven Mozart Johansen 📌 Topic: Get started with a modern zero trust remote access solution: Microsoft Global Secure AccessEntra Group Source of Authority CONVERSION: Enabling Cloud-First Identity Management
As organizations modernize their identity infrastructure, Microsoft Entra’s Group Source of Authority (SOA) Conversion feature enables a granular migration of group management from on-premises AD to Microsoft Entra ID without disabling sync or rearchitecting the entire directory. What Is Group Source of Authority? Group SOA defines where a group object is mastered either in on-prem AD or in Entra ID. With SOA conversion, administrators can selectively convert AD-synced groups into cloud-native groups, making them editable and governable directly in Entra ID. Permissions Required To perform SOA conversion, the following Microsoft Entra roles and Graph API permissions are required: Hybrid Administrator: Required to call Microsoft Graph APIs to read and update SOA of groups. Application Administrator or Cloud Application Administrator: Required to grant user consent to the app or Graph Explorer. Graph API Permission Scope: Group-OnPremisesSyncBehavior.ReadWrite.All must be granted to the app calling the onPremisesSyncBehavior endpoint. Prerequisites Before initiating SOA conversion, ensure the following: Licensing Microsoft Entra Free or Basic license is sufficient. Sync Clients Microsoft Entra Connect Sync: Minimum version 2.5.76.0 Microsoft Entra Cloud Sync: Minimum version 1.1.1370.0 Group Eligibility Groups must not be mail-enabled or tied to Exchange on-premises (DLs or MESGs). If provisioning back to AD is planned, change group scope to Universal. How to Convert Group SOA from AD to Entra Here’s a simplified step-by-step guide: Identify Target Groups Use Entra Admin Center or Graph Explorer to list synced groups. Confirm they are not Exchange-dependent. Grant Permissions Use Graph Explorer or your app registration to grant Group-OnPremisesSyncBehavior.ReadWrite.All. Execute SOA Conversion If we see Group1, which is in scope of conversion is synchronized from on-prem. Execute the below from Graph Explorer to convert “Group1” to cloud managed PATCH https://graph.microsoft.com/beta/groups/{group-id}/OnPremisesSyncbehavior { "isCloudManaged": true } We can verify the change by executing below query on Graph API Explorer This marks the group as cloud-managed. AD sync will stop honoring changes to this group. Validate Conversion Confirm blockOnPremisesSync = true in the Entra Admin Center. Use audit logs to verify the change. Apply Governance Apply lifecycle policies, access reviews, and provisioning rules using Entra ID Governance. Use Cases: Migrating from On-Prem to Cloud Use Case 1: Retiring Legacy AD Groups Scenario: A customer has migrated all mailboxes to Exchange Online and no longer needs certain AD groups. Solution: Convert those groups to cloud-native Entra ID groups and delete them from AD, reducing footprint and simplifying governance. Use Case 2: Governing On-Prem Apps from the Cloud Scenario: A customer uses AD security groups to secure on-prem apps (e.g., Kerberos-based apps). Solution: Convert the group SOA to Entra ID, apply governance policies, and use Group Provision to AD to sync cloud-managed groups back to AD. Use Case 3: Migrating DLs and MESGs to Cloud Scenario: A customer wants to migrate all distribution lists and mail-enabled security groups to the cloud. Solution: Convert SOA to Entra ID, recreate mail-enabled groups in Exchange Online, and decommission AD-based mail groups. Use Case 4: Enabling Access Reviews Scenario: A federal customer wants to run access reviews on group memberships but the groups are AD-synced. Solution: Convert SOA to Entra ID, enabling full access review capabilities and lifecycle workflows. Use Case 5: Hybrid Identity Cleanup Scenario: A customer is migrating from Entra Connect Sync to Cloud Sync and wants to clean up group sprawl. Solution: Use SOA conversion to move group management to the cloud, then decommission legacy sync rules and OUs. Strategic Impact Group SOA Conversion is more than a technical enhancement, it’s a strategic enabler for identity modernization. It supports: AD DS minimization: Shrinking on-prem footprint. Cloud-first governance: Centralized access control and lifecycle management. Phased migration: Avoiding disruption while modernizing.Passwordless Authentication with FIDO2 Security Key for Remote Desktop Connection
Passwordless Authentication with FIDO2 Security Key for Remote Desktop Connection Hello Everyone, in this blog, we will explore how to use a FIDO2 security key to access a device using Remote Desktop Connection (RDP)—a Zero Trust approach where passwordless authentication is enforced. Recently, a customer asked me whether they could secure their device and enforce passwordless authentication for RDP access. While some FIDO2 security keys can also be used as smart cards with Certificate-Based Authentication (CBA), I will cover that topic in my next blog. In this post, let's focus on how we can use Windows 10/11, the RDPAAD (Remote Desktop Protocol Azure AD Protocol), and WebAuthn to connect to Entra ID-joined or Hybrid-joined devices using a FIDO2 security key. If a user has never used or registered a FIDO2 security key, they should register it by visiting My Sign-Ins, clicking on Security Info, and selecting Add sign-in method. Once the FIDO2 security key is registered, complete the sign-in process and ensure the user can successfully authenticate to web applications using the security key. Configuring RDP for Entra ID-Joined Devices: For Entra ID-joined devices, follow these steps to enable RDP access using a FIDO2 security key: Ensure the user is a member of the local Remote Desktop Users group on the remote device. o Open PowerShell as Administrator and load the Microsoft Graph PowerShell module to connect to Entra ID (if needed). o Run the following command to add the user to the Remote Desktop Users group: o net localgroup "Remote Desktop Users" /add "AzureAD\user200@farooquetech.in" We can validate the configuration by opening Computer Management and checking the Local Users and Groups settings: Open Computer Management (compmgmt.msc). Navigate to Local Users and Groups → Groups. Locate and open the Remote Desktop Users group. Check if the Entra ID user we added appears in the list. This confirms that the user has been successfully added and can sign-in to remote machine using RDP. At this point, we can open Remote Desktop Connection (mstsc.exe) and attempt to connect to the remote device. Open Remote Desktop Connection (mstsc.exe). Click on the Advanced tab. Under User Authentication, ensure we select "Use a web account to sign in to the remote computer." This ensures that the RDP session leverages passwordless authentication with FIDO2 and WebAuthn for secure access. Enter the NetBIOS name of the remote computer in Remote Desktop Connection (mstsc.exe) and click Connect. On the sign-in page, enter the Entra ID account for which FIDO2 Security Key authentication is enabled. When prompted to choose a passwordless authentication method, select Security Key. Insert your FIDO2 security key, follow the prompts, and complete the authentication process. This ensures a secure, passwordless RDP connection to the remote device. Put the PIN and also touch your finger on Security Key to complete authentication. A consent is prompt to allow RDP Connection, select Yes. Post Authentication, we will see the desktop successfully loads. Remote Desktop Connection Access to Hybrid Entra ID-Joined Devices: Now, let's discuss how to establish RDP access for Hybrid Entra ID-joined devices. The process for Hybrid-joined devices differs slightly because these devices are joined to both Active Directory (AD) and Entra ID. This means authentication must be validated in both directories. To achieve this, we need to register an Active Directory Read-Only Domain Controller (RODC) object in Entra ID. This RODC object helps issue a partial Kerberos Ticket Granting Ticket (TGT) to the user after authentication with Entra ID. Note: This RODC object is not linked to any on-premises AD domain controller—it is simply an empty object in Entra ID used to enable Kerberos authentication. Enabling Entra ID Kerberos Authentication: To enable Entra ID Kerberos authentication, follow these steps: Open PowerShell as Administrator. Install the AzureADKerberos module (if not already installed): Execute below powershell commands Import-module “Import-module "C:\Program Files\Microsoft Azure Active Directory Connect\AzureADKerberos\AzureAdKerberos.psd1" $domain = $env:USERDNSDOMAIN $userPrincipalName = admin@mngenvmcapXXX.onmicrosoft.com $domainCred = Get-Credential (Enter the Active Directory credentials) Once the command executes successfully, we can verify that the AzureADKerberos account has been created in Active Directory. Open Active Directory Users and Computer and under Domain Controller, check AzureADKerberos RODC object is created. This completes the AzureADKerberos configuration, enabling the use of FIDO2 Security Keys for authentication. Now, to establish an RDP connection, follow the same steps outlined earlier for Entra ID-joined devices. Enforcing Phishing-Resistant Passwordless Authentication for RDP: To ensure that Remote Desktop Protocol (RDP) always uses phishing-resistant passwordless authentication, we can enforce this through Conditional Access Policies in Entra ID. Sign in to the Entra ID portal. Go to Security → Conditional Access and create a new policy. Under Assignments, select the users or groups that require secure RDP access. In the Cloud apps or actions section, select “Microsoft Remote Desktop” with Application ID “a4a365df-50f1-4397-bc59-1a1564b8bb9c”. Under Grant Controls, choose Require authentication strength. Select Phishing-resistant authentication, which includes FIDO2 Security Keys Save and enable the policy. Note: For Hybrid Entra Joined machine, please ensure we do not use domain admin or any other AD high privileged account to logon else partial TGT will not be issued by Entra ID. I hope you found this blog helpful! In my next blog, I will cover how FIDO2 Security Keys can also be used for on-premises Active Directory domain-joined servers. Stay tuned!Setting up Microsoft Entra Verified ID, step by step
Are you confident who the people in your organization are interacting with online? Identity verification is fundamental in protecting your organization from impersonation. Get the knowledge you need to bring strong identity verification to your organization and improve confidence that digital interactions are safe and secure. The Microsoft Entra Verified ID team will kick off with a comprehensive understanding of how to set up Verified ID. We'll walk through key concepts, including Verified ID's significance in enhancing digital identity, security, and trust. Then we'll show you how to configure your environment, set up and issue your first credential, and use the Microsoft Entra admin center to manage credentials across your organization. This session is part of the Microsoft Entra Verified ID webinar series.[On demand] Never trust, always verify: Tips for Zero Trust with Intune
Get tips on how to leverage the latest automation and tooling in Microsoft Intune to enforce security policies that require healthy, compliant devices before access to apps and data is granted. Watch Never trust, always verify: Tips for Zero Trust with Intune – now on demand – and join the conversation at https://aka.ms/AlwaysVerify. To help you learn more, here are the links referenced in the session: Zero Trust Workshop Microsoft Zero Trust Microsoft Cybersecurity Reference Architectures For more free technical skilling on the latest in Windows, Windows in the cloud, and Microsoft Intune, view the full Microsoft Technical Takeoff session list.Kick Start Your Security Learning with a 7-lesson, Open-Source Course
This course is designed to teach you fundamental cyber security concepts to kick start your security learning. It is vendor agnostic and is divided into small lessons that should take around 30-60 mins to complete. Each lesson has a small quiz and links to further reading if you want to dive into the topic a bit more.
