Sign in

Christopher Brumm

@cbrhh.bsky.social
77 followers 66 following 11 posts
PostsRepliesMedia
Christopher Brumm @cbrhh.bsky.social · 04/05/2026
👍 let me know if it works
100
Christopher Brumm @cbrhh.bsky.social · 04/05/2026
If you're using Private Access you maybe want to enable Intelligent Local Access for Delivery Optimization (I think it is TCP7680) for your client networks. ILA -> chris-brumm.com/2025/11/19/I... DO -> learn.microsoft.com/en-us/window...
learn.microsoft.com
Delivery Optimization Frequently Asked Questions
List of frequently asked questions for Delivery Optimization.
110
Reposted by Christopher Brumm
Merill Fernando 💚 @merill.net · 10/01/2026
🚨 Global Secure Access ≠ “replace VPN and done.” I just published a new podcast with Chris Brum where we break down real-world Microsoft GSA deployments 🧵👇
152
Reposted by Christopher Brumm
Fabian Bader @fabian.bader.cloud · 02/01/2026
#ConsentFix is a great way for attackers to work around some protective layers but not all. @naunheim.cloud , @cbrhh.bsky.social and I wrote a blog post on detection and mitigations. Hope you find it useful and can adapt it to your environment. www.glueckkanja.com/de/posts/202...
083
Christopher Brumm @cbrhh.bsky.social · 05/03/2025
Take a look at the article I linked. It says: "Microsoft Entra Internet Access for Microsoft services capabilities are included in a Microsoft Entra ID P1 or Microsoft Entra ID P2 license."
000
Christopher Brumm @cbrhh.bsky.social · 17/01/2025
@fabian.bader.cloud, @naunheim.cloud and I have also looked into the topic of TokenSmith and are describing the Blue Team perspective (including an effective detection) in this blog: www.glueckkanja.com/blog/securit...
glueckkanja.com
Compliant Device Bypass in Microsoft Intune – Detection, Response & Mitigation
In this blog post, glueckkanja's MVP Fabian Bader, Chris Brumm and Thomas Naunheim gather details about the Compliant Device Bypass in Microsoft Intune Company Portal. After additional research, they ...
040
Christopher Brumm @cbrhh.bsky.social · 17/01/2025
Unfortunately, that was only a matter of time! This video combines two of the most dangerous tools at the moment associated with phishing - and it's surprisingly simple! www.youtube.com/watch?v=Dp1z... Do we have defense options? Read on 👇
youtube.com
TokenSmith Meets Evilginx: Token Theft Combined with Entra Conditional Access Bypass
YouTube video by SYNACK Time
1104
Christopher Brumm @cbrhh.bsky.social · 10/01/2025
A Compliant Network behaves like a Named Location and triggers the Continuous Access Evaluation trigger. This will force the user to reauthenticate if the token is CAE enabled (and the Service is SharePoint Online). -> learn.microsoft.com/en-us/entra/... -> learn.microsoft.com/en-us/entra/... 4/4
learn.microsoft.com
Continuous access evaluation in Microsoft Entra - Microsoft Entra ID
Responding to changes in user state faster with continuous access evaluation in Microsoft Entra
000
Christopher Brumm @cbrhh.bsky.social · 10/01/2025
Why should you do this? You get the option to protect your resources behind the compliant network control by configuring a Conditional Access policy -> learn.microsoft.com/en-us/entra/... This policy is regarding to my tests really powerful to protect against replayed tokens. 3/4
learn.microsoft.com
Enable Compliant Network Check with Conditional Access - Global Secure Access
Learn how to require known compliant network locations in order to connect to your secured resources with Conditional Access.
111
Christopher Brumm @cbrhh.bsky.social · 10/01/2025
Means: you can install the Global Secure Access Client on all your clients and route the traffic to all the Microsoft Endpoints through GSA. -> learn.microsoft.com/en-us/entra/... The client is available for Windows, Mac, Android and iOS and it is really easy to deploy. 2/4
learn.microsoft.com
The Global Secure Access Client for Windows - Global Secure Access
The Global Secure Access client secures network traffic at the end-user device. This article describes how to download and install the Windows client.
100
Christopher Brumm @cbrhh.bsky.social · 10/01/2025
Global Secure Access and Token Replay - a thread... Did you know that "Microsoft Entra Internet Access for Microsoft" is included in your Entra ID P1 license? -> learn.microsoft.com/en-us/entra/... 1/4
learn.microsoft.com
What is Global Secure Access? - Global Secure Access
Learn how Microsoft's Security Service Edge (SSE) solution, Global Secure Access, provides network access control and visibility to users and devices inside and outside a traditional office.
271
Reposted by Christopher Brumm
Fabian Bader @fabian.bader.cloud · 09/01/2025
gist.github.com/CloudProtect... This one does a very good job because it considers if the device is joined/registered any only looks at the AADGraph. For this resource its not normal that a non-registered device is accessing it
gist.github.com
Use Defender XDR advanced hunting query capabilities to detect possible device compliance bypass attacks for Entra ID Conditional Access according to the vulnerability disclosed by Yuya Chudo (https:/...
Use Defender XDR advanced hunting query capabilities to detect possible device compliance bypass attacks for Entra ID Conditional Access according to the vulnerability disclosed by Yuya Chudo (http...
021
Christopher Brumm @cbrhh.bsky.social · 29/12/2024
Any tips? That's a really strange coincidence - ours needs to be replaced too...
100
Reposted by Christopher Brumm
Fabian Bader @fabian.bader.cloud · 19/12/2024
I hope every SOC is monitoring incoming emails for signs of anomalous incoming mail amounts to your users. If this happens the execution of any RMM by the target user is a high alert you should follow up on.
231
Reposted by Christopher Brumm
Fabian Bader @fabian.bader.cloud · 19/12/2024
🔊 @cbrhh and I will be part of this year's Experts Live DK with our session: The state of passkey in 2025 #ELDK2025 conference.expertsli...
131
Christopher Brumm @cbrhh.bsky.social · 19/12/2024
Great news! 🎉 I have the opportunity to speak in March at the #eldk2025 in Copenhagen! I will do a comparison of Entra Private Access and a classic VPN solution and show why Global Secure Access is much closer to my understanding of Zero Trust Network Access. Hope to see you there!
062