iiinova — where your digital self keeps evolving

Fabian Bader @fabian.bader.cloud · 12/03/2026

My Disobey talk "Are passkeys as secure as you think" is now available on YouTube youtu.be/DQ4dnXibaoM?...

Fabian Bader @fabian.bader.cloud · 02/01/2026

#ConsentFix is a great way for attackers to work around some protective layers but not all. @naunheim.cloud , @cbrhh.bsky.social and I wrote a blog post on detection and mitigations. Hope you find it useful and can adapt it to your environment. www.glueckkanja.com/de/posts/202...

083

Fabian Bader @fabian.bader.cloud · 18/11/2025

Custom data collection in Microsoft Defender for Endpoint was just announced in the November release notes. Documentation is already available learn.microsoft.com/en-us/defend... Predictive shielding sounds also very interesting... #MDE #XDR

020

Fabian Bader @fabian.bader.cloud · 21/10/2025

Microsoft Defender just got the September 2025 update ◽Improved core service startup behavior ◽ Security fixes for missing input validation of RPC services ◽Fixed threat exclusion handling ◽Restored performance optimization for network file access learn.microsoft.com/en-us/defend...

050

Fabian Bader @fabian.bader.cloud · 22/08/2025

Token Protection in Microsoft Entra Conditional Access for Windows is now GA! 🎉 #EntraID #Token learn.microsoft.com/en-us/entra/...

061

Fabian Bader @fabian.bader.cloud · 12/08/2025

Defender AV Platform v4.18.25070.5 ◽Enhanced Passive Mode Scanning Behavior ◽Improved Tamper Protection Handling ◽Digital Signature Verification Performance Boost ◽Refined ASR Rule Exclusion Processing #MDAV #MDE #ASR

051

Fabian Bader @fabian.bader.cloud · 26/06/2025

One of the results of the joined research with @dirkjanm.io is entrascopes.com Basically the yellow pages for Microsoft first party apps. #TROOPERS25

2256

Fabian Bader @fabian.bader.cloud · 22/06/2025

Rerunning my test scenarios for the #TROOPERS25 presentation...

041

Fabian Bader @fabian.bader.cloud · 09/05/2025

First time I made it on the @msftsecresponse leaderboard 🍾 msrc.microsoft.com/leaderboard

Made it on #58 of the MSRC leaderboard Q1 2025

290

Fabian Bader @fabian.bader.cloud · 07/05/2025

Planning for some days off from work. What to put in the duffle back beside a good book and some sunscreen? My new favorite card game of course. #FOCI #FamilyOfClientID

a card deck from the back, fanned out, reading "Family of Client IDs" with a tree in the middle

120

Fabian Bader @fabian.bader.cloud · 02/05/2025

Application Based Authentication on Microsoft Entra Connect Sync is near. With this change you will be able to use a TPM backed certificate in Entra Connect Sync for authentication. This is a welcome change to prevent the compromise of this high privileged account. #Entra #Certificate

0102

Fabian Bader @fabian.bader.cloud · 04/04/2025

Since it's already April, let's have a look at the top 10 passwords in Q1 2025. If yours is not part of the list, good for you 😅

020

Fabian Bader @fabian.bader.cloud · 02/04/2025

Transition to enhanced modeling of Threat Intelligence data in Microsoft #Sentinel by 31 July 2025 That's a tight schedule, better get started soon.

100

Fabian Bader @fabian.bader.cloud · 31/03/2025

Hope you enjoyed the game. Seems we are close by 😅

110

Fabian Bader @fabian.bader.cloud · 25/03/2025

The MVP wall of names is always a nice experience. So many great people on there. #MVPBuzz #MVPsummit

050

Fabian Bader @fabian.bader.cloud · 23/03/2025

Well, football yes but no coding

110

Fabian Bader @fabian.bader.cloud · 22/03/2025

#MVPSummit we are coming @ugurkoc.de Oliver Kieselbach Christoph Burmeister

2140

Fabian Bader @fabian.bader.cloud · 14/03/2025

Ever wondered what DNS, LDAP, Kerberos and TLS connections when you request a certificate in an on-prem environment with Certificate Enrollment Web Services in the mix? I certainly did at some point and found this nice diagram when "migrating" my drawing to draw[.]io

170

Fabian Bader @fabian.bader.cloud · 05/03/2025

Mattias Borg and Pierre Thoor set the mood with "Cyber Chasers" #ELDK2025

020

Fabian Bader @fabian.bader.cloud · 05/03/2025

@cbrhh.bsky.social on stage with "A comparison: Is Entra Private Access the better VPN?" #ELDK2025

130

Fabian Bader @fabian.bader.cloud · 05/03/2025

Paula Januszkiewicz rocking the stage @ #ELDK2025

030

Fabian Bader @fabian.bader.cloud · 21/02/2025

🛡️If you work with any Microsoft Security product #YellowHat is the conference for you. Technical deep dives, no marketing, and an amazing speaker lineup. Register today to join the livestream for free on yellowhat.live #XDR #MDE #MDI #Sentinel

060

Fabian Bader @fabian.bader.cloud · 16/02/2025

Good to see that Microsoft is highlighting this more prominent. Don't grant tenant root access to your global admins. 1️⃣Remove it 2️⃣Alert on it Action required: 1 user has elevated access in your tenant. You should take immediate action and remove all role assignments with elevated access

Action required: 1 user has elevated access in your tenant. You should take immediate action and remove all role assignments with elevated access

190

Fabian Bader @fabian.bader.cloud · 05/02/2025

Updated guidance on conditional access: Either target all resources with MFA or at least target Azure AD Graph through "Custom security attributes". #EntraID learn.microsoft.com/en-us/entra/ide…

Protecting directory information
If the recommended baseline MFA policy without app exclusions can't be configured due to business reasons, and your organization’s security policy must include these low privilege scopes, the alternative is to create a separate Conditional Access policy targeting Windows Azure Active Directory (00000002-0000-0000-c000-000000000000). Windows Azure Active Directory (also called Azure AD Graph) is a resource representing data stored in the directory such as users, groups, and applications. The Windows Azure Active Directory resource is included in All resources but can be individually targeted in Conditional Access policies

4195

Fabian Bader @fabian.bader.cloud · 22/01/2025

Two blogs, two messages. Which will it be. techcommunity.microsoft.com/blog/identit... techcommunity.microsoft.com/blog/identit...

140

Fabian Bader @fabian.bader.cloud · 21/01/2025

According to the Microsoft docs it's in Preview learn.microsoft.com/en-us/defend...

010

Fabian Bader @fabian.bader.cloud · 21/01/2025

Hello token friends, do you use the content of the access token as part of your application. Then be aware that Microsoft will switch to encrypted access token and this might break stuff. Switch to id token. #EntraID devblogs.microsoft.com/identity/acc…

21611

Fabian Bader @fabian.bader.cloud · 17/01/2025

Maybe we should have put our thinking in here are well and not only describe the limitation 😅

110

Fabian Bader @fabian.bader.cloud · 16/01/2025

Nice workaround 😬 learn.microsoft.com/en-us/entra/...

040

Fabian Bader @fabian.bader.cloud · 16/01/2025

😼 Ninjacats assemble. On March 6th '25 there will be the first #YellowHat conference 🔴Free Live Stream or 🏠attend in Amsterdam (very limited) yellowhat.live #XDR #Security

020

Fabian Bader @fabian.bader.cloud · 13/01/2025

Next version of TokenTacticsV2 has a new ace up it's sleeve. Also improved error handling and a new banner. Release in the next few days. #EntraID #PRT #Cookies

180

Fabian Bader @fabian.bader.cloud · 10/01/2025

That moment when you forget about some research project and a year later look in awe when you read other peoples work. 😅

050

Fabian Bader @fabian.bader.cloud · 07/01/2025

Now available in my tenant ADSynchronization.ReadWrite.All

040

Fabian Bader @fabian.bader.cloud · 06/01/2025

A new dedicated resource application to enable Active Directory to Microsoft Entra ID sync using Microsoft Entra Connect Sync or Cloud Sync is coming 😱 In the announcement the mentioned reason is "upcoming security hardening"... 6bf85cfa-ac8a-4be5-b5de-425a0d0dc016 #EntraID

34013

Fabian Bader @fabian.bader.cloud · 05/01/2025

Thanks that is one of them I was looking for. Here is the other one: learn.microsoft.com/en-us/entra/...

You can enroll your new devices to Intune even if you select Require device to be marked as compliant for All users and All resources (formerly 'All cloud apps') using the previous steps. Require device to be marked as compliant control does not block Intune enrollment and the access to the Microsoft Intune Web Company Portal application.

010

Fabian Bader @fabian.bader.cloud · 05/01/2025

Sure onmicrosoft[.]eu registered by an unknown entity at IONOS will not be used for nefarious things. Might want to add this to your tenant block list.

0133

Fabian Bader @fabian.bader.cloud · 03/01/2025

Start 2025 with Universal Continuous Access Evaluation (CAE). Only available through Global Secure Access (GSA) #Entra #GSA #CAE learn.microsoft.com/en-us/entra/glo…

040

Fabian Bader @fabian.bader.cloud · 19/12/2024

🔊 @cbrhh and I will be part of this year's Experts Live DK with our session: The state of passkey in 2025 #ELDK2025 conference.expertsli...

131

Fabian Bader @fabian.bader.cloud · 18/12/2024

Ich freue mich sehr bei der diesjährigen Experts Live Germany als Speaker dabei zu sein. expertslive.de

040

Fabian Bader @fabian.bader.cloud · 05/12/2024

In Germany tomorrow is Nikolaus. Don't forget to put our your shoe out for some mandarins, nuts and maybe a small surprise?

060

Fabian Bader @fabian.bader.cloud · 04/12/2024

Do you know the Azure IP Ranges site by @derdanu.bsky.social ? It's a great tool to filter IP ranges by service and even download them in different formats. azureipranges.azurewebsites.net

2185