Azure Bastion just got a new feature in preview called “Shareable Links”. Without this feature, in order to grant a user access to use Azure Bastion to connect to a virtual machine, you will need to delegate reader access in Azure. At minimum you’ll need “reader” on the bastion host itself, on the virtual network connected to the VM and the VM itself.

While these permissions are not “scare”, it leaves you with permissions to handle somehow. The new sharable links feature, however, eliminates this by allowing you to create – well – a link that you can share that directly allows a user to connect to a VM using Azure Bastion.

Continue reading “Recommendations for Azure Bastion shareable links” →

Ok, so creating hunting queries in Sentinel using Terraform works fine, but it is very funky to actually understand, even though it works. First of all, you need to use the log_analytics_saved_search resource, nothing more. However, for the keen observer, this resource does not support entity mapping and no MITRE ATT&CK. Or does it? 😉

Continue reading “Deploying Sentinel hunting queries using Terraform” →

Long time, no blogging. Been busy starting a company. Working a lot with Microsoft Sentinel lately, so lots of content will be coming surrounding that. This time, we’ll do a short one:

Tables in log analytics are weird. Or, at least they can cause headaches because the available columns vary based on what content you ingest.

Continue reading “Microsoft Sentinel, error in EntityMappings: The given column does not exist” →

Dropping a quick Terraform module that automatically rotates the password of an Azure AD application, outputting the value into an Azure DevOps variable group. This can be super handy when maintaining a tenant by code, allowing developers to “order” app secrets.

Continue reading “Terraform module for automatically maintaining Azure DevOps variable group with app secret” →

Azure AD Certificate-Based Authentication is now in public preview, with a surprisingly good documentation. Usually I have to guess how 50% of a feature actually works, but this time they have gone all-in with technical details of just about everything. What is a blogger to do? Well, let’s configure it and see if we can sneak a peek behind the scenes 🙂

Continue reading “Digging into Azure AD Certificate-Based Authentication” →

Ever had an Azure AD tenant id, and wondered which tenant this is? While checking the APIs behind the new Azure AD cross-tenant access settings, I found a new API that can help you with this!

Continue reading “Finding Azure AD domain from tenant id” →

There is no reason to have your services available from the entire internet, if you don’t need to, but often it can be difficult to maintain allow lists for public cloud IP addresses. Not anymore. I have built a Terraform module that updates itself from the Microsoft provided JSON of IP addresses.

Look at my GitHub project here. 🙂

So, as one does, I was checking out the different Microsoft Graph AppRoles, which are the application scopes available. And then I found this:

Now, I now cross tenant access is something Microsoft has been working on for a while, and I have seen some preview stuff presented, but I have no access to any preview at all at this point. However, let’s see what we can find!

Disclaimer: Do not use this in production, as it is only a private preview feature I discovered.

Continue reading “Checking out Azure AD cross tenant access policies” →

I just had a previous blogpost about Workload Identity Federation, where I went into the details of how authentication works. This time, I want to use GitHub actions, which is the currently supported method. There are some limitations to the documentation today, but hopefully we will be able to do things like accessing KeyVaults and other services, not only using Azure CLI.

Continue reading “Another deep dive into Azure AD Workload Identity Federation using GitHub actions” →

Workload Identity Federation is a rather new concept in Azure AD, where service principals do not have keys in a directory, but in stead is federated to an external OpenID Connect (OIDC) provider, such as Okta, Ping, Github, GCP, AWS and – well – Azure AD.

A part of an earlier blogpost used a JWT in a client credential grant, signed by a KeyVault based certificate, to authenticate as an application. This time, this JWT will not be signed by a certificate, but instead by an OIDC provider.

Continue reading “A deep dive into Azure AD Workload identity federation” →