Up until recently, Azure AD login to virtual machines was severely limited, because your device had to be joined to the same Azure AD as the virtual machine. For many, this was fine, but with external consultants this soon becomes cumbersome.

However, this is no longer the case, and you can actually sign in with any user in the same tenant as the virtual machine (No B2B currently). Let me show you how!

Continue reading “Signing into Azure joined virtual machine from any device” →

The Azure AD Terraform Provider has finally gotten support for Entitlement Management, let’s test it out! But let’s first discuss a few scenarios where this can come in handy.

Continue reading “Terraforming your way through Azure AD Entitlement Management” →

Azure AD Cross-tenant synchronization is a feature currently in preview, that allows a tenant to synchronize its users as guests into other tenants, maintaining attributes and eventually deleting the guests when no longer needed (such as when an employee leaves the company). In this blogpost we will take a look under the hood of the feature, trying to understand how this feature really works.

Continue reading “A look under the hood of Azure AD cross-tenant synchronization” →

This blogpost will be a quick howto for configuring an Azure Resource Manager (ARM) Service Connection in Azure DevOps, using a Service Principal with a certificate. Why should you use a certificate instead of a secret? It is more secure, that’s it.

Continue reading “Azure DevOps ARM Service Connection using certificate” →

So, you are attacking Azure? Or you want to test out something in the context of a user assigned identity? In this blogpost I’ll show you how create an access token for any Azure API, Microsoft Graph API, etc. for a user assigned identity.

Continue reading “Creating an access token for a user assigned identity in Azure” →

Many people have to work with several Azure AD and Microsoft 365 tenants, several user accounts in the same tenant, or a combination of both. I often see people working using a single browser, or using incognito mode, signing in and out all the time.

I work with several customers, several lab and demo environments, several different users – often in the same tenant, and I work super effectively. How? Let me show you!

Continue reading “How I work effectively with multiple Azure AD tenants and user accounts” →

Azure Bastion just got a new feature in preview called “Shareable Links”. Without this feature, in order to grant a user access to use Azure Bastion to connect to a virtual machine, you will need to delegate reader access in Azure. At minimum you’ll need “reader” on the bastion host itself, on the virtual network connected to the VM and the VM itself.

While these permissions are not “scare”, it leaves you with permissions to handle somehow. The new sharable links feature, however, eliminates this by allowing you to create – well – a link that you can share that directly allows a user to connect to a VM using Azure Bastion.

Continue reading “Recommendations for Azure Bastion shareable links” →

Ok, so creating hunting queries in Sentinel using Terraform works fine, but it is very funky to actually understand, even though it works. First of all, you need to use the log_analytics_saved_search resource, nothing more. However, for the keen observer, this resource does not support entity mapping and no MITRE ATT&CK. Or does it? 😉

Continue reading “Deploying Sentinel hunting queries using Terraform” →

Long time, no blogging. Been busy starting a company. Working a lot with Microsoft Sentinel lately, so lots of content will be coming surrounding that. This time, we’ll do a short one:

Tables in log analytics are weird. Or, at least they can cause headaches because the available columns vary based on what content you ingest.

Continue reading “Microsoft Sentinel, error in EntityMappings: The given column does not exist” →

Dropping a quick Terraform module that automatically rotates the password of an Azure AD application, outputting the value into an Azure DevOps variable group. This can be super handy when maintaining a tenant by code, allowing developers to “order” app secrets.

Continue reading “Terraform module for automatically maintaining Azure DevOps variable group with app secret” →