Microsoft Entra ID (formerly Azure Active Directory) is Microsoft's cloud-based identity and access management service for enterprise applications.
Microsoft's mandatory MFA enforcement blocks an Entra break-glass account with no MFA method from admin portals, a dev.to guide says. A vaulted password therefore fails when the lockout it was kept for arrives.
Reality
A fast SOC cut off the intrusion in minutes. The red team still reached the domain controller and the control network, because every control that failed afterwards was a permission somebody granted and nobody had reviewed.
Perspective Coverage
3 publishersReality
Microsoft has tracked passkey- and SSO-themed help desk impersonation since May 2026, with the calls steering employees into adversary-in-the-middle proxies and device-code grants that hand over live Microsoft 365 sessions.
Perspective Coverage
3 publishersReality
Microsoft shipped 22 updates, six of them scored 10.0, mostly in Entra ID, Exchange Online and Azure. Fixed server-side is not the same as verified in your tenant.
Reality
JadePuffer lets an AI agent run recon, credential theft, privilege escalation and resource deletion in Azure tenants, a dev.to analysis says. No operator pauses between the familiar steps, so cloud teams get less time between first access and deleted resources.
Reality
Front Door, API Management and private networking cost about $1,730 a month in West Europe in a dev.to Container Apps reference stack for .NET. With the .NET compute at $20 to $140 a month, the risk sits in the hand-offs between its layers.
Reality
AWS's CloudWatch Omni, generally available since September 23, lets Okta and Entra ID users investigate incidents without AWS console access. CloudWatch dashboard sharing has let outsiders view prebuilt graphs since 2020, so what Omni adds is the investigation itself, one of the reasons teams paid for third-party platforms.
Reality
Microsoft's Defender Experts say Storm-3068 reset one user's password and ran an Azure DevOps pipeline authorized to reach more than 50 resources. It pulled the kubeconfig files that authenticate to a Kubernetes cluster.
Reality
Microsoft will allow only scripts from its own CDN domains during Entra ID browser sign-ins under a Content Security Policy enforced from mid-October 2026. Browser extensions and tools that inject code into the sign-in page will stop working as the rollout completes in late October.
Reality
Microsoft says Storm-3168 used a compromised service principal to delete Azure storage accounts, a Key Vault and an App Service plan in about seven minutes. The deletions ran on roles it already held, so role scope and locks had to exist before the credentials leaked.
Reality
Consent phishing, the most common OAuth entry point according to SC World, leaves a victim tenant three audit events and no app registration record. Registration monitoring misses it, so the hunt moves to consent and delegated-grant operations in the defender's own logs.
Reality
A seller using the name TheHatman is offering employee directory exports from nine named enterprises. Hudson Rock ties the theft to infostealer credentials, not a compromise of the provider.
Perspective Coverage
5 publishersReality
Detection at the first hop forced CISA's red team onto donated access at Organization B. It did not stop the team reaching the same sensitive systems it reached at Organization A.
Perspective Coverage
5 publishersReality
Arctic Wolf says the cluster it tracks as PREY-0058 deploys no malware at all. A call from fake IT leads to a proxied login page, and the stolen session token comes back from inside the victim's own ASN.
Perspective Coverage
3 publishersReality
Microsoft told admins on Friday that SMS first-factor sign-in retires from February 2027, and that its own SMS and voice delivery ends on February 1, so tenants that want to keep phone codes must buy telephony elsewhere.
Reality
A two-stage eval forces every shortlist to hold the correct tool plus its four strongest BM25 siblings. Selection accuracy comes in at 90 to 97 percent. That puts the 5 percent paraphrase recall on the critical path.
Reality
Proofpoint tracked three waves of TeamFiltration password spraying against Microsoft 365 tenants in Chile between July 21 and August 16. The seven accounts that opened were all functional identities carrying provisioned passwords with no MFA.
Reality
The AWS post co-written with HEMA says the structured half of its internal knowledge was already in good shape, and that the procedural half had little written documentation to fall back on.
Reality
The September 2026 security updates leave affected tunnels stuck in Connecting. Microsoft's interim mitigation pins each profile to a single protocol and drops the fallback attempt while it works on a permanent fix.
Reality
Varonis Threat Labs' TrustSink needs an already-compromised Global Administrator or Authentication Policy Administrator account. Once the method is registered in the Authentication Methods Policy, it keeps capturing passwords through resets.
Reality