Entra

Start here

• Understand Conditional Access: Start with how authentication and policy requirements fit together.
• Audit device code flow: Find legitimate use before testing a default block.
• Review PIM alerts: Find identity recommendations and check the affected accounts before fixing them.

In this section

• Audit device code flow before blocking it
  Find device code sign-ins and test a Conditional Access block before enforcing it.
• Block unknown and unsupported platforms
  Block unknown client platform claims with a carefully tested Conditional Access policy.
• Check Entra LAPS password history
  Retrieve available Entra LAPS password history with Get-LapsAADPassword.
• Common misunderstandings of Conditional Access
  Check how authentication and policy requirements combine before treating a blocked sign-in as resolved.
• Getting more data from the CA Insights and Reporting Workbook
  Quick tip on using workbooks to create KQL queries and get more data than provided by the workbook
• Hello for Business Guidance
  Check cloud Kerberos trust prerequisites before using Hello for on-premises SSO.
• Improving Microsoft's authentication rollout templates
  Save time on Entra rollout communications with Microsoft's customizable end-user materials.
• Microsoft Graph PowerShell examples for Application Management
  Use reviewed Graph PowerShell samples to report application credential expiry.
• PIM Alerts is a hidden gem
  Review PIM security alerts for useful identity recommendations and in-portal fixes.
• Scope application access to mailboxes
  Limit Exchange application permissions to the mailboxes an app actually needs.
• Use a browser profile for cloud admin accounts
  Keep admin sessions separate while allowing device-based Conditional Access checks.
• Use the authentication registration report
  Filter the Graph authentication registration report instead of querying every user's methods.