Just saying upfront: I have nothing against the forced passkey rollout itself. I think it's great, long overdue and finally we can get rid of outdated practices.

However, i'm working in a highly regulated environment with loads of compartmentalised departments. Which means things sometimes move.... slowly. I just see their 1 February deadline while they're still basically properly rolling out all their passkey features and I just think 'come on man... how do i make a planning around this?'

I'm talking procedures updates, end user information, handing over from the admins to the service desks (again, highly compartmentalised).

Their features of passwordless SSPR, having passkeys as first sign up, actually showing proper registration of passkeys in the account information. Some of their features even have a completion date past their sms / voice disruption.

Am I just exaggerating here or does it just feel they don't even have their own house in order when it comes to this ?

#SanityCheck

TLDR; Set up entra break glass accounts BEFORE something happens :)

I had a close call today. I had messed up intune authenticator deployment and my work phones authenticator was reinstalled. I could restore accounts from my iCloud backup, but all the Office accounts needed to relogin and wasnt possible with out MFA. Being a global admin, this was a huge problem. Luckily i was saved by sms authentication, but this isnt available much longer.

Creating our break glass accounts has been on my todo list for over a year, but i had "more important" things to do. This intune misconfiguration woke me up that global admin access can be lost this easily. The problem is that both global admins use iphones and this change could have made both authenticators useless.

Anyway, this is a reminder/warning to everyone who hasn't set up break glass accounts. The safest solution seems to be a security key, so dont rely on ny mobile apps.

https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/security-emergency-access

Conditional Access policy plans are now in public preview. A plan groups your CA policies as rules under shared conditions, so things like break-glass exclusions only need to be set once.

I did a first test. When you merge policies that target All users, the exclusions stay in each rule. And plan rules don’t show up in Get-MgIdentityConditionalAccessPolicy, so your current backups miss them.

I wrote a script to find policies you can merge, and one to back up plans through the new endpoint:
https://lazyadmin.nl/office-365/conditional-access-policy-plans/

Official docs: What are Conditional Access policy plans?

Just kind of looking for a sanity check here.

For the last 48 hours or so we are unable to dismiss risky users (or "confirm safe" for that matter). Have tried GUI and Graph Powershell.

The operation completes successfully - and shows in the audit log, but the user remains risky.

I work for an MSP and we have this issue across a dozen or so tenants. I was unable to find anybody else complaining about this.

Authentication methods | Policies Blade on Entra is coming up with Error 404 Not Found. Has something changed? We've logged under Global Admin credentials.

Edit to add these are UK tenants and on 28/10/26 appears be be OK now.

Disclaimer: I have several years of experience administering an Entra tenant but never more than one at a time.

So my org might be partially taking over another org through some kind of cockamamie agreement where the two organizations largely keep their identities but start sharing some backend resources like IT.

Both organizations currently have Entra tenants, and they want to keep their own email domains, etc. -- anything user-facing so users see basically no difference. And there would almost never be a need for users from both tenants to be put into Microsoft 365 groups, security groups, etc.

Both orgs will have identical cybersecurity requirements. Our current tenant meets this requirements but I don't think the one we are taking over does today.

Would it be best to keep and administrate both Entra tenants for now? Is there a way I can get some benefits of de-deplication of effort while still having 2 tenants?

I have a customer (Company B) that's deploying passkeys for contractors (Company A). The contractors have an Android phone with a work profile from Company A. Company B wants me to set up a device-bound passkey inside Authenticator in the Work Profile for Company A. Is this possible?

Currently my customer is seeing errors on the passkey in the work profile, but it works fine in the personal profile. Is there a known issue with this setup? Thanks in advance.

Error text: something went wrong "restart the process on your other device to try again later"

Managing multiple Conditional Access policies often means configuring the same users, resources, and exclusions repeatedly. This can make policy management time-consuming and harder to maintain consistently.

The Conditional access policy plans feature help you define shared targeting settings once and create separate rules for different security requirements, all under one plan. They do this through two key features: shared targeting and rules.

• Shared targeting: Define who the policies apply to, which resources they protect, and which accounts to exclude. These settings are shared across the plan, so admins don’t have to configure them repeatedly.
• Rules: Create separate rules for different security requirements, such as requiring MFA or compliant devices. Each rule uses the shared targeting but enforces its own access controls.

For example, suppose you want to apply different security settings across device platforms, such as Windows and macOS. Then you can configure as follow:

• Shared targeting: Target all employees accessing Microsoft 365 resources and exclude emergency access accounts.
• Rule 1: Platform: macOS; Grant control: Require multifactor authentication (MFA).
• Rule 2: Platform: Windows; Grant control: Require the device to be marked as compliant.

Both rules use the same shared targeting settings while enforcing different security requirements.

With this feature, you can reduce repeated configurations, keep targeting consistent across rules, and simplify the management of multiple access requirements.

Hello, we have a use case for a few guests to temporarily join the tenant. We are in a regulated industry and can't trust their own tenant's MFA.

My thought was to have a setup group excluded from various CA policies, , go into My Sign In security portal and create a passkey. But it tells me to create a passkey we must sign in with MFA first. But they don't have a MFA method. And you can't create a TAP for a guest account.

Do I just need to create a garbage MFA method like authenticator first?

Happy Monday!!

We hope everyone is having a great Monday, and today let's introduce the finalists for the Workplace Ninjas US 2027 Golden Clippy for "Entra IDol of the Year"

Merill Fernando, the amazing creator of Maester, which a ton of people use to strengthen their security posture in M365 overall. He also was a creator of the Microsoft ZeroTrust website, and many different things that improve the lives of engineers worldwide. It's hard to argue against a name more synonymous with Entra.

Fabian Bader, our dear friend who won't be able to join us this year, but we cannot leave this rockstar off the ballot. This stalwart genius of all things Entra and Security, and key member of our sponsor glueckkanja AG, is a fan-favorite speaker in any event he attends.

Eric Woodruff, CIDPRO, the reigning champion of this award goes for his 2nd straight title. Eric, from Semperis has been focusing much of his time on Passkeys, passwordless workflows, and identity thought leadership.

Morten Waltorp Knudsen [MVP], the creator of Experts Live Denmark, incredible community advocate, and double threat in both Entra and Security has been making some amazing strides in Entra over the last year or so, with some PIM tools, and incredible sessions showing why he won the Chuck Norris Award last year.

Mike Soule, our local nominee for this award has been doing some great work over the last year on both EntraOps and Maester. He's a great advocate, who is continuing to build interesting and dynamics technology along with being a key member of Sentinel Technologies.

These 5 are special people and makes this one of the more competitive categories as they battle the evil empire known as Active Directory.

Check out our speakers and agenda here: Home - Workplace Ninjas US 2027. Online registration by Cvent

Don't miss our event and join us to help crown a winner in this amazing area. Every attendee that joins us in Scottsdale gets to help decide the winner of each category. Register now:

https://workplaceninjas.us

Hi all,

I’m a SOC analyst at an MSSP. One of our clients is part of an ongoing password spray campaign. They haven’t implemented our hardening recommendations yet, so for now we’re monitoring for any successful sign-ins.

The problem

We keep getting interactive sign-ins with ResultType 50074 (“Strong Authentication is required”). The app is always OfficeHome, from hosting-provider IPs, with a Chrome/72 user agent (typical tooling).

AuthenticationDetails contains one step only:

• authenticationMethod: missing, authenticationMethodDetail: empty
• succeeded: false
• authenticationStepResultDetail: “MFA required in Azure AD”

There is no “Password / Correct password” step, so we can’t tell whether the password was actually valid.

Our MSSP has been treating 50074 as “password correct, stopped at MFA”. A few days ago we got one for a specific user, and the client revoked sessions and reset the password. Today the same user got 50074 again from the same tooling.

Conditional Access confusion

The sign-in shows CA status: Success, but on the CA tab nothing applied:

AuthenticationRequirementPolicies shows requirementProvider: user / Per-user MFA, so I think the interrupt is coming from per-user MFA, not CA. I’d appreciate confirmation.

What we’ve checked (30 days)

• A normal valid-password 50074 in this tenant logs two steps: “Correct password”, then “MFA required”.
• This tool’s wrong-password attempts (50126) do log a Password step.
• The same /24 produced both 50126 and 50074 against the same users.
• No successful sign-ins (ResultType 0) from this tooling anywhere in the tenant.
• A few legitimate users also have single-step 50074s with no “Correct password” step under any record with the same CorrelationId.

Hypotheses

• H1: The password was correct, and Entra just didn’t log the primary auth step (logging inconsistency).
• H2: No password was validated. The tool reaches the MFA requirement through some other flow, such as passwordless phone sign-in or replaying a session artifact.

If H1 is true, the attacker had the post-reset password within days, which changes the response completely.

Prior research

• Same question asked here a month ago, no definitive answer: https://www.reddit.com/r/entra/comments/1wjrl1x/entra_id_signin_logs_can_error_50074_alone/
• https://learn.microsoft.com/en-us/answers/questions/2237830/i-cant-access-azure-i-have-this-error-code-50074
• https://admindroid.com/error-code-50074-user-did-not-pass-the-mfa-m365-challenge

Questions

1. Can 50074 be returned without successful primary auth? Is there Microsoft documentation either way?
2. When is the “Correct password” step omitted from AuthenticationDetails?
3. Has anyone gotten a definitive answer from a Microsoft support case on this?

I am still an L1 so I might have misunderstood something so please do point it out if I am wrong, thanks!

Currently attacking an issue with around 3000 users who for various reasons I can’t go into for security reasons can’t realistically use passkeys(Fido) due to logistics and time to deploy or WHfB with them being on desktops with no TPM.

Predominately desktop users.

most of these users had originally provided their personal mobile for auth but due to our conditional access polices we just require they have a method registered - never been an issue, because we trust device compliance.

Now SMS/voice is being deprecated, I have some questions.

Will the users with sms/voice methods registers have to set up a new auth method? Or will the presence of them having it there be enough to allow them though our caps?

We could use certificate based authentication.

No access to byod devices.

So what are my options?

Hi everyone,

We're currently migrating approximately 3,000 Windows 11 endpoints from traditional Active Directory domain join to Microsoft Entra Join, while also piloting Microsoft Global Secure Access (GSA), particularly Entra Private Access.

We use WinRM / PowerShell Remoting extensively for remote administration and troubleshooting.

However, we're now trying to determine how WinRM should be configured when GSA is involved, especially when the target device is outside our corporate network.

Our questions:

1. Has anyone successfully used WinRM / PowerShell Remoting through Entra Private Access to remotely manage Windows endpoints?
2. Are you able with AD device connecting to Entra devices?
3. Does this work across all combinations of AD-joined and Entra-joined source and target devices?
4. Can an Entra-joined endpoint running the GSA client accept inbound WinRM connections from another endpoint, without a traditional VPN or direct network connectivity?
5. Since Entra-joined devices don't automatically register in traditional AD DNS, how do you handle device discovery, name resolution and changing IP addresses?
6. Are specific GSA application segments, Private Access connectors, routing configurations or firewall rules required for TCP 5985/5986?
7. Are there particular authentication requirements or limitations involving Kerberos, NTLM, HTTPS certificates or Entra identities?

We understand that WinRM itself does not require DNS when connecting directly by IP address, and that WinRM can work with Entra-joined devices. Our main concern is whether GSA provides the necessary network path to reach remote endpoints, particularly when both devices are using the GSA client.

Thanks in advance!

Hey everyone,

I'm starting my prep for the SC-300 (Identity and Access Administrator) and I'm looking to put together a small study group or find a few accountability partners.

Right now, my main resources are John Christopher's Udemy course and hands-on lab environments.

I'm aiming to sit for the exam in about three months (late January 2027). It would be great to get a WhatsApp or Telegram group going or do a weekly check-in to bounce lab questions off each other, troubleshoot Conditional Access scenarios, and keep the momentum going so we actually book the test.

If you're on a similar timeline or just starting your SC-300 prep, drop a comment or shoot me a DM and we can get a chat set up!

This has been happening to me for the last day or so in my own tenant and my other tenant, While attempting to load sign in logs after a while it goes to No-Sign ins found? I havent heard any reports online. In the admin center I dont see anything specifically relating to Sign in Logs not loading. Is anyone else having issues? Thank you.

Hi, I have noticed within the last few days that my Block International Logins policy that I have been testing only applies to Windows and my iPhone. I have been testing only allowing logins from the US, Canada and Mexico, But upon testing on a Galaxy S26 Ultra and S23 Ultra in this case. I am able to get into each account even after signing out and signing back in clearing cache cookies etc. Has anyone else had issues with certain CA Policies such as this one being an issue with Androids specifically?

EDIT: I have a license for Entra ID Premium P2.

Solved: I created a new account and policy that blocked USA logins this time around that worked. The issue I think comes down to IPv6 and it picking up that it is in the USA.

​

I have two work accounts (company & client email).I got stuck in a Microsoft Authenticator sign-in loop with my client account. Reinstalling the app didn't help, as it keeps asking me to approve the sign-in through Authenticator itself lol 😭 I'm so sick of it.

Anyone faced this? How can I recover access to my client email?

This started when I factory reseted my phone due to a phone issue.

I’m troubleshooting Microsoft’s Unified Tenant Configuration Management (UTCM) preview and I’m stuck on deleting configuration monitors. Deletes return HTTP 404, with a message saying the monitor wasn’t found or that I lack permissions. The monitors show up in the portal, so they exist.

Environment:

• Licenses: Microsoft 365 Business Premium and MDAC
• The UTCM service principal (“Unified Tenant Configuration Management”) is set up with the required permissions, following Microsoft’s setup guidance(https://github.com/microsoftgraph/microsoft-graph-docs-contrib/tree/main/concepts/includes/utcm).
• The admin account has the Global Administrator role.

What I’ve tried:

• Deleting through the TenantBaseline web tool
• Deleting through the TenantBaseline PowerShell tool
• Deleting through the Graph Explorer(https://learn.microsoft.com/en-us/graph/api/configurationmonitor-delete?view=graph-rest-1.0&tabs=http)
• Deleting through the tenant governance feature in the Entra admin center

My questions:

• Has anyone else seen HTTP 404 on UTCM monitor deletes in a Business Premium tenant?

I’ve opened a support case with Microsoft and will update this thread with the outcome.

Had to unexpectedly format my phone, and Microsoft Authenticator which I use for work didnt backup the work account.

Signing in to any services now requires the 2FA code which cant be accessed. Trying to sign in, selecting SMS verification throws an error (code 399287).

I'm the admin for my org and I'm signed in to MS365 admin on my PC, so I have access until I run into a setting that again requires verification.

Any way to get passed this?

A few key things we want to mention today:

• Two weeks left on our Early Bird pricing of $650 for 3 action packed days at the gorgeous Scott Resort and Spa for Workplace Ninjas US 2027
• 30 Hotel Packages/Rooms remain at the Scott!! Don't worry we rooms as well at the overflow across the street at Embassy Suites as well!
• 82 Days left until things kickoff in Scottsdale!!
• Just a reminder, 60+ sessions from one of the finest collections of speakers you will find at any event anywhere: Cvent | Event Platform for In-person, Virtual, and Hybrid Events & Webinars
• Don't forget, this is the home of the AD vs. Entra Cage Match (Merill Fernando vs. Techspence)
• Percentage of ALL proceeds go to the Michael J Fox Foundation for Parkinsons

We continue working hard, building value, and creating experiences for all of you. Don't miss out. Dallas had rave reviews, and Scottsdale is gearing up to be twice as good!!

Things are heating up and people are READY!! Come and join us!

Register now: https://workplaceninjas.us

Hi everyone,

I am currently testing synced passkeys in Microsoft Entra ID and have successfully registered a synced passkey.

I am testing this on a corporate Windows 11 laptop that is Entra ID joined and has WHFB enabled.

Here is what I am experiencing:

• When I enter my Microsoft 365 email address, Windows Security automatically pops up with "Sign in with a passkey".
• It offers Windows Hello first, and I can successfully sign in using my Windows Hello PIN.
• However I want to authenticate using my synced passkey.
• I can click "Choose a different passkey" and manually select my synced passkey to authenticate.

My questions are:

1. Is it expected behavior for Windows Hello to take priority over a registered synced passkey?
2. Is there any way to make the synced passkey the default authentication method instead of Windows Hello?
3. Is this behaviour controlled by Windows, the browser or Microsoft Entra ID?
4. For organisations rolling out synced passkeys alongside Windows Hello for Business, how are you managing the user experience?

I am not looking to disable WHFB, but ideally I would like users who have registered synced passkeys to be offered that option first.

Interested to hear how others are handling this and whether there are any recommended configurations or best practices. Thanks