IAM

Changelog 2025-04-09 - initial version 2025-04-11 - updated with AADInternals OSINT tool Tenant public information Your tenant-id With the page https://www.whatismytenantid.com/, you can find your TenantID How does it work? We can check the Network tab of the browser and find a query to the OpenID Configuration endpoint based on the domain: https://login.microsoftonline.com/{{YOUR-DOMAIN-HERE}}/.well-known/openid-configuration ^ We can also find a tenant location with the tenant_region_scope field. ^ Whatismytenantid doesn’t work? You can get the same from the website https://gettenantpartitionweb.azurewebsites.net/! ...

Identity Provider Story Basic assumptions: in-browser authentication, with OAuth2/OpenID Connect (but also applicable for SAML), for Web, SPA and Mobile applications. Let’s start with a story: The user enters the address ‘https://portal.my-company.com’ to check company news; without an active session in the application (cookie or token), the application will be redirected to the Identity Provider (IdP) - authentication is required. After the identity verification and authorization, an IdP session will be created and the user redirected to the application. ...

Make life easier with Entra ID as Code TL;DR It is the end of 2024; daily, we use the following: CI/CD pipelines for infrastructure as code (IaC) deployment to create Services, Applications, Storages, etc, permissions (RBAC) from resources to resources (App Service WebApp1 should read Blob Storage WebApp1Storage), secrets, we hate them, but we found a solution to avoid secrets with Managed Identity and Workload Identity solutions, What is the plan for us? We will use Azure Portal and Entra ID blade to manage our applications, permissions, and secrets. We can create and update our app registrations via the browser. Can we improve our Entra ID and Entra External ID with IaC, as shown in the screenshot (Picture 1) below? ...

TL;DR It is not easy for Entra ID Tenant administrators to choose the best authentication method for their employees, vendors, and partners. You must consider the scenario, the environment, and the passwordless technology. I’m focusing only the passwordless MFA authentication methods in the corresponding changes in the Entra ID - the MFA will be required. Side note: Microsoft announced that MFA will be required for a couple of services, like Azure Portal or CLI. The document mentions that Security defaults will force MFA or should be enabled by Conditional Access Policies for users accessing the defined services. We will see how the final implementation will look like (I promise to update the post with the final state). ...