Entra

Find device code sign-ins and test a Conditional Access block before enforcing it.

Limit Exchange application permissions to the mailboxes an app actually needs.

Sign-in Frequency (SIF) is a commonly misunderstood control, one many orgs use to inflict unnecessary suffering on their employees 😩 It probably doesn’t work the way you think it does and is often used in less than ideal ways… So let’s look at how it works and when to use it. Original documentation excerpt introducing sign-in frequency and the risks of repeatedly asking users for credentials. Historical November 2025 documentation screenshot. Its broad session-revocation wording must not be treated as a guarantee for every application; use current, qualified guidance.

Keep admin sessions separate while allowing device-based Conditional Access checks.

Lets see what we can do about minimizing passkey deployment issues with Compliance and App Protection Policy requirements :)

Disabling Seamless SSO is a simple checkbox, but figuring out what might break is a different story...

Review PIM security alerts for useful identity recommendations and in-portal fixes.

👮 Restricted Management Admin Units (RMAU) in #EntraID Hackers HATE This Hidden Entra ID Feature Most Admins Never Use@NathanMcNulty breaks it down for us 👇 🎧 Get the full podcast episode at https://t.co/gnvH23WorW pic.twitter.com/nxBwCQ6BwS — Merill Fernando (@merill) March 29, 2025 I recently had a chance to discuss Restricted Management Administrative Units (RMAUs) with Merill, and one of my favorite uses for these is to protect groups that are used in Conditional Access policies so they aren’t accidentally modified or deleted. I’m also a big fan of using Access Packages to control membership of these groups for things like exclusions from geofencing policies, user action policies, blocking policies, etc.

Save time on Entra rollout communications with Microsoft's customizable end-user materials.

Check cloud Kerberos trust prerequisites before using Hello for on-premises SSO.

Check how authentication and policy requirements combine before treating a blocked sign-in as resolved.

Block unknown client platform claims with a carefully tested Conditional Access policy.