#ADFS

My next blog article is online - Ask yourself if you still really need #ADFS #ADFS #AzureAD #Authentication #Office365 #insight24 #wmug_nl

New version of #AADInternals out now, including remote dumping of #ADFS configuration database🔥 Read the blog at: Credits to @vesat, @doughsec, @BakedSec, @_dirkjan, @gentilkiwi, @MGrafnetter, and @Cyb3rWard0g for your help and previous work!

Microsoft Defender for Identity (#MDI) on #ADFS. Did you know that after installing the sensor on ADFS, you must make one important setting or the sensor will not run at all? I mentioned last time that installing MDI on ADFS is supported. A lot of administrators don't know this or don't consider it important and don't install Microsoft Defender for Identity on ADFS. Yet ADFS is very often the entry point for a threat actor. And when they do install the sensor, they are surprised that the sensor doesn't run and don't know why... After installing the sensor on ADFS, you need to make one important setting in the Microsoft Defender for Identity setting portal - set the FQDN of at least some domain controllers via clicking on the ADFS server. Without this setting, the sensor on ADFS will not boot at all and less experienced administrators usually have no idea why.

Updated my #ADFS #TTP blog post to cover the latest #AADInternals functionality. 👉 #redteam #blueteam #infosec #cybersec

If you are using #ADFS this is might be an interesting one. You can now integrate ADFS sign-in logs to #AzureAD sign-in view through 'Azure AD Connect' and export them to #LogAnalytics.

The nice people of @WEareTROOPERS have finally published the recording of my last year talk about compromising #ADFS! Should I submit a proposal this year too? Video: Slides:

ADFS Customization – Branding per domain for #AzureAD/#Office365 #ADFS #EMS

Defender for Identity release 2.193 ◽️New security alert: Abnormal Active Directory Federation Services (AD FS) authentication using a suspicious certificate ◽️Remediation actions can use SYSTEM on the domain controller #MDI #Security #ADFS #AD

How Do I Know If My AD Environment Is Impacted By The November 8th 2022 Patch? ✅ #ActiveDirectory #ADFS #AD #Updates

Howdy folks! We've just made #ADFS diagnostics simpler. Check out the new diagnostics module at #ADFSHelp. Check it out, give us feedback.

We are happy to announce that ADFS Modern Authentication can now be used with the native Apple Mail application on macOS Sequoia and iOS 17.6.1 (or later)! Get the details at #MSExchange #ADFS #ModernAuth #AppleMail

Howdy folks, we have released Microsoft Defender support to monitor and detect intrusions on #ADFS servers. We recommend close monitoring of your ADFS servers just like you would do for domain controllers.

Finalising slide deck for my @WEareTROOPERS / #TROOPERS22 presentation "Eight ways to compromise AD FS certificates". Can't wait to share the #ADFS attack graph details next week!! #GoldenSAML #redteam #blueteam #cybersec #infosec

Just noticed that the amazing "Remediation And Hardening Strategies For Microsoft 365 To Defend Against UNC2452" @Mandiant whitepaper has a version 1.2 with two additional techniques from version 1.1 📜 Awesome reference on #AzureAD, #M365, #ADFS security

Public preview release! #SSO in #WVD anyone via both web and client? Yes! Learn here how to Configure #ADFS single sign-on. Great work David Belanger / Christian Montoya More info ⬇️

If you want to deny access to #O365 using legacy protocols on #ADFS and you target usernamemixed endpoint, remember that #Windows10 uses this endpoint when logging in on the PC to obtain a PRT, so be sure to allow for this, for example using this ADFS Rule

Integrating #AzureAD with on-prem #ActiveDirectory and #ADFS

Adfsbrute - A Script To Test Credentials Against Active Directory Federation Services (ADFS), Allowing Password Spraying Or Bruteforce Attacks #ActiveDirectory #ADFS #Adfsbrute #BlueTeam

#ADFS Customization – add custom help form to the login page #Office365 #AzureAD

Wow, finally I can see the new certificate based authentication option in #AzureAD. Many customers have been waiting for this as part of moving away from #ADFS when using #CBA. Happy testing !