Nathan McNulty
@nathanmcnulty.com
Loves Jesus, loves others | Husband, father of 4, security solutions architect, love to learn and teach | Microsoft MVP | @TribeOfHackers | 🐘infosec.exchange@nathanmcnulty
It makes me laugh every time I see something like this, lol Like, there is some criminal out there that thought, hmm, I'm gonna sign up for a free Azure trial, set up an Azure Monitor group, and abuse it to send out malicious email 🧠 This is why we can't have nice things :p
Conditional Access in the portal has been flaky for me most of the day, and then randomly this showed up in a few tenants 😎 This is a really nice view, makes it so much easier to find the right policies and notice where you are missing control 🥳
Whelp, it seems they are going to keep me around for another year, now in two categories :p A huge thanks to everyone here who shares and asks great questions - I wouldn't be in this program if it weren't for you :) Looking forward to sharing even more this year!
Periodic reminder that even Microsoft recommends disabling Device code flow The primary two areas I see this used are Teams phones / Conference room type equipment and administrative CLI tools, and you should still block by default and exclude as needed learn.microsoft.com/...
Apparently M365 Developer tenants only enforce 1 factor for SSPR for admins... 🫠 Almost had a heart attack and opened a ticket with MSRC, lol I've checked several retail tenants now, and they are all properly enforcing 2 factors 😅
Do you know what your agents are doing? Worried about what kind of websites they might be looking at? Now you can apply the same web content filtering policies to them as you do to your users! 😅 learn.microsoft.com/...
Whelp, it seems GitHub Copilot went from one extreme to the next It was obvious and understandable something had to change as the premium request model was unsustainably generous, but the new token based model ends up being way more expensive than Codex, Claude, or openrouter.ai
No big deal, just Purview admin portal shipping telemetry to Google...
Holy crap they did it! They backported support for AppContainers from 7.7 to 7.6 🥳 For those who many not be familiar with AppContainers - it's sandboxing. We can sandbox PowerShell. I repeat, we can freaking sandbox PowerShell, natively! github.com/PowerShel...
Can anyone tell me what the point is in reporting malicious domains in Defender XDR if it's not even getting looked at within 24 hours? Even free services already identified this as bad... Daniel Card pointed this one out, seemed pretty easy but I guess not 🤷♂️
I cannot wait to use this phrase on a call "That was useful in a painful way" 🤣
I may need an intervention... I'm pretty sure I just said "user-based service accounts are better than service principals, actually"... and in the given context, it was 100% true Service Principals have some really dumb limitations that make user accounts a better fit 🥴
I love getting gaslit by Azure all the time... Automation accounts and Function apps only support PowerShell 7.4, even though 7.5 was released 1.5 years ago and 7.6 was released a few months ago "Please consider updating it soon." 😒 No Azure, you consider updating it soon...
For all the shady stuff I've done so far, it's funny a simple request to use the Bearer token from the integrated browser against the CLI is what got me in trouble :p
Did you know there are at least 6 ways to store data about users in Entra? 😅 Outside of normal user object attributes, directory extensions tend to be one of the best fits for most things, except for sensitive data - use custom security attributes ;) learn.microsoft.com/...
You can allow xAI models in M365 Copilot, and this note is... 🫠🤣
Wait... agents get to have Linux desktops in Cloud PC but users don't?
This is pretty cool. You can build consent URLs for Logic Apps for use in phishing, and it looks like Microsoft has added warnings to this consent dialog :) It's been a long time since I used the URL like this - anyone know when this change happened?
Do you exclude MFA on joined/registered devices? If so, do you require MFA for device join/registration? I see this often because these controls aren't considered at the same time, and that's how we get this gap: Attacker steals user/pass -> register device -> no MFA required
OMG, XDRInternals dumping MDE device timeline straight into Azure Data Explorer 🤯
Brand new feature being developed in 2026 using secrets for authentication 👎
Support for TAP and Phone Sign In are done! It was surprisingly harder than expected to get the phone sign-in flow to work properly :p Working on cross-platform browser auth now, and hopefully will be able to add it to XDRInternals this weekend
"Because everyone else lowered the bar, we decided to join them" is so on-brand...
