Sign in

Thomas Naunheim

@naunheim.cloud
849 followers 191 following 55 posts

#Microsoft MVP | #CloudSecurity Architect ☁️ | #Entra #AzureAD 🔑 + #AzureSecurity 🛡️ | #CommunityRocks | #Schaengel

PostsRepliesMedia
Thomas Naunheim @naunheim.cloud · 09/09/2026
Do you have your Control Plane under control? 🚨 #EntraOps 1.0 is now available 🚀 - an open-source platform to govern and monitor your Enterprise Access Model in #MicrosoftEntra: entraops.com. Here is what’s new in this release 👇
010
Thomas Naunheim @naunheim.cloud · 15/06/2026
Speaking at #TROOPERS26 next week and I can't wait. Joining @martinsohn.dk to talk about attack paths to #PAW and real-world risks of tiered admin models with #IntuneRBAC. Plus something we've been working on for months... See you in Heidelberg! www.troopers.de #EntraOps #Bloodhound
001
Thomas Naunheim @naunheim.cloud · 31/01/2026
[New blog post] Analyzing #MicrosoftEntra 🤖 Workload Identity Activity Through 🪙 Token-Based Hunting: I’ve published a #KQL function to hunt activities by tokens from non-human identities and share some experimental queries and insights in this article. www.cloud-architekt.net/token-huntin...
cloud-architekt.net
Analyzing Workload Identity Activity Through Token-Based Hunting
This post introduces the MicrosoftCloudWorkloadActivity KQL function and shows how to hunt token-based activity of workload identities across Microsoft cloud workloads. It covers key parameters, filte...
031
Reposted by Thomas Naunheim
Fabian Bader @fabian.bader.cloud · 02/01/2026
#ConsentFix is a great way for attackers to work around some protective layers but not all. @naunheim.cloud , @cbrhh.bsky.social and I wrote a blog post on detection and mitigations. Hope you find it useful and can adapt it to your environment. www.glueckkanja.com/de/posts/202...
083
Thomas Naunheim @naunheim.cloud · 02/11/2025
Had the great privilege and a lot of fun joining 🎙️#EntraChat together with my friend and MVP fellow @samilamppu.bsky.social! 🙏 Big thanks to @merill.net for having us - it was a pleasure to be part of the podcast. I hope everyone listening enjoyed it as much as we did recording it!
061
Thomas Naunheim @naunheim.cloud · 30/07/2025
The availability of GraphApiAuditEvents in #MicrosoftDefender brings significant value to every environment, enhancing capabilities for detecting and hunting #MicrosoftGraph API calls. In my recent research, I’ve created a few resources that I’m happy to share with the community.
100
Thomas Naunheim @naunheim.cloud · 17/07/2025
🚀🔎 Track Sensitive Graph API Calls with my new #KQL Function for #MicrosoftDefenderXDR Microsoft has released the new advanced hunting table "GraphAPIAuditEvents" which offers great opportunities to investigate activities based on #MicrosoftGraph API calls.
132
Thomas Naunheim @naunheim.cloud · 17/05/2025
My session, “Defending Tier 0: Taking Control of Your Cloud’s Control Plane,” from last year’s #HIPConf is now available on YouTube. The session focused on securing privileged access and implementing a tiered administration model in #MicrosoftEntra. youtu.be/pVPEieHtOVM
youtu.be
Defending Tier 0: Taking Control of Your Cloud's Control Plane
YouTube video by Semperis
051
Thomas Naunheim @naunheim.cloud · 09/04/2025
I've published a #KQL function ("WorkloadIdentityInfoXDR") for #MicrosoftDefender to enhance details of #MicrosoftEntra #WorkloadID from various sources, incl. the new table "OAuthAppInfo" but also IdentityInfo table and #ExposureManagement. (1/2) 🔗 github.com/Cloud-Archit...
111
Thomas Naunheim @naunheim.cloud · 08/04/2025
Cloud #IdentitySummit 2025 is back! Save the date and join this community event with #IdentitySecurity, #MicrosoftEntra, and #CloudIdentity deep dive sessions in Dortmund, Germany. Call for Papers is open now: sessionize.com/cloud-identi... Stay tuned for more details: www.identitysummit.cloud
031
Thomas Naunheim @naunheim.cloud · 17/03/2025
IdentityInfo table in #MicrosoftDefender has been expanded to include eligible roles from #MicrosoftEntra. I’ve developed a #KQL function to get a summarized overview of all directory role assignments, enriched with details from my #EntraOps classification: github.com/Cloud-Archit...
140
Thomas Naunheim @naunheim.cloud · 08/03/2025
I had the great pleasure of speaking about #MicrosoftEntra Token Hunting 🍪🔎 at #YellowHat 🚧👷‍♂️. You can find the slides from my session here: 📄 github.com/Cloud-Archit... All #KQL sample queries are available in my repo: 👨‍💻 github.com/Cloud-Archit...
172
Thomas Naunheim @naunheim.cloud · 26/02/2025
I have the great pleasure of joining a shared session with @samilamppu.bsky.social at the M365 Security & Compliance User Group tonight. Last preparations are now in full swing... You can find more details about the meetup and register for this free online event here: www.meetup.com/m365sandcug/...
030
Thomas Naunheim @naunheim.cloud · 11/02/2025
Enhancements in #MicrosoftEntra (diagnostic) logs: Several interesting sign-in properties (including Session ID, status for Token Protection, or GSA traffic) have been added to the sign-in logs and available in #MicrosoftSentinel. (1/3)
132
Reposted by Thomas Naunheim
Ugur Koc @ugurkoc.de · 29/01/2025
I'm building a new home for IntuneBrew and would like to share my progress so far. IntuneBrew.com will serve as the project's landing page, featuring a Quick Start Guide and an overview of key features.
2114
Thomas Naunheim @naunheim.cloud · 29/01/2025
Do you like to know if ownership of privileged objects in #MicrosoftEntra has been delegated to lower privileged users? Graph semantics in KQL and XSPM allow building powerful queries and analyzing data as graphs. I've started to include data from #EntraOps to analyze delegated ownership. (1/3)
141
Thomas Naunheim @naunheim.cloud · 23/01/2025
Final touches and rehearsal for my #TECTalk on #TokenSecurity in #MicrosoftEntra tonight. I'll be discussing attack scenarios on various token types and how TPM, Token Protection, CAE & Global Secure Access can help prevent token theft. Register for the free webinar: www.quest.com/event/the-ex...
021
Thomas Naunheim @naunheim.cloud · 17/01/2025
How can you detect and mitigate #MicrosoftEntra Compliant Device Bypass in the #MicrosoftIntune Company Portal? What are the potential attack paths? @fabian.bader.cloud, @cbrhh.bsky.social and I had additional research and summarized our results in this blog post: www.glueckkanja.com/blog/securit...
glueckkanja.com
Compliant Device Bypass in Microsoft Intune – Detection, Response & Mitigation
In this blog post, glueckkanja's MVP Fabian Bader, Chris Brumm and Thomas Naunheim gather details about the Compliant Device Bypass in Microsoft Intune Company Portal. After additional research, they ...
1266
Thomas Naunheim @naunheim.cloud · 09/01/2025
#MicrosoftEntra Attack & Defense Playbook Update: @samilamppu.bsky.social and I have updated some content: 🔃 #EntraConnect: New capabilities by MDI sensor & XSPM 🎯 #AiTM: Attack scenarios on MDA sessions 🛡️ #MITRE: Updated TTP coverage & map Check out the latest version: github.com/Cloud-Archit...
github.com
GitHub - Cloud-Architekt/AzureAD-Attack-Defense: This publication is a collection of various common attack scenarios on Microsoft Entra ID (formerly known as Azure Active Directory) and how they can b...
This publication is a collection of various common attack scenarios on Microsoft Entra ID (formerly known as Azure Active Directory) and how they can be mitigated or detected. - Cloud-Architekt/Azu...
1106
Reposted by Thomas Naunheim
MC2MC @mc2mc.be · 20/12/2024
We’re excited to announce the next speakers for MC2MC Connect: @naunheim.cloud and @ugurkoc.de 🚀 In their session, they’ll show how to configure Platform SSO in Intune and highlight its benefits for user experience and security. 🎟️ tinyurl.com/5dxvnsn4 #MC2MC #ConnectMC2MC
043
Thomas Naunheim @naunheim.cloud · 17/12/2024
Am 11.04.2025 findet die #ExpertsLiveDE in Leipzig statt, mit vielen spannenden Vorträgen zu Cloud, Workplace, AI und Security. Ich freue mich sehr, dieses Jahr dabei sein zu dürfen und über #TokenTheft in #MicrosoftEntra sprechen zu dürfen. Weitere Infos sowie Tickets: www.expertslive.de
051
Reposted by Thomas Naunheim
Fabian Bader @fabian.bader.cloud · 02/12/2024
March 6th 2025 👷👷‍♀️👷‍♂️ #YellowHat yellowhat.live
yellowhat.live
Yellowhat | Cyber Conference
172
Thomas Naunheim @naunheim.cloud · 27/11/2024
Do you like to learn more about tokens and ways to protect them in #MicrosoftEntra? Join my #TECTalk on January 23rd to explore the various kind of token artifacts, post authentication attacks and mitigations to prevent #TokenTheft. Register for free at www.quest.com/event/the-ex...
092
Reposted by Thomas Naunheim
Merill Fernando 💚 @merill.net · 26/11/2024
So who wants a verified 'Microsoft' and 'Microsoft MVP' label on their profile and all the posts? I just finished setting up @bluesky.ms as a labelling service. Go subscribe to the label to start seeing labels on verified MVPs and Microsofties. 🧵👇
102466162
Thomas Naunheim @naunheim.cloud · 27/11/2024
New Release: #EntraOps 0.3.3! 🚀 This update includes bug fixes and enhancements to #MicrosoftSentinel workbooks and nested #MicrosoftEntra PIM for Groups. Get the latest version from the GitHub repository: github.com/Cloud-Archit...
0111
Thomas Naunheim @naunheim.cloud · 26/11/2024
Celebrating 4 years of the "#MicrosoftEntra Attack & Defense Playbook" 🔐 ☁️ community project! Last week, @samilamppu.bsky.social and I took the opportunity to record a video about the journey of this project, from research to writing process. #MVPBuzz #TechCommunity www.youtube.com/watch?v=fBD1...
youtube.com
Microsoft Entra ID Attack & Defense Playbook with Sami Lamppu
YouTube video by Thomas Naunheim
2173
Thomas Naunheim @naunheim.cloud · 25/11/2024
Next week, I have the great pleasure to speak together with @gregorreimling.bsky.social at APE XXL in Apenheul, NL. We'll be sharing best practices in various design areas of #Azure #EnterpriseScale. Get your tickets for a day full of #Azure breakout sessions and workshops: xxl.azure-ape.nl
020
Thomas Naunheim @naunheim.cloud · 23/11/2024
MVPs 🤓 meets a MVP 🏀 @gregorreimling.bsky.social, @samilamppu.bsky.social
150
Thomas Naunheim @naunheim.cloud · 22/11/2024
Just wrapped up day 3 of #MSIgnite with @adrianritter.bsky.social, @okieselb.bsky.social and @ugurkoc.de. Our latest video covers all the recent announcements and sessions about SSE, Data Governance, Intune's AI management on macOS, and #Copilot. Tune in! youtu.be/wjri-1EvPSw?...
youtu.be
Microsoft Ignite 2024 - Day 3 Recap
YouTube video by Thomas Naunheim
092
Thomas Naunheim @naunheim.cloud · 21/11/2024
Day two of #MSIgnite was packed with sessions about #MicrosoftEntra and #Intune: @ugurkoc.de, Oliver Kieselbach and I will talk about device query actions, some updates and showcases across Entra suite, and much more. Check out our latest video from Chicago. youtu.be/p10M1dx9mco?...
youtu.be
Microsoft Ignite 2024 - Day 2 Recap
YouTube video by Thomas Naunheim
183
Thomas Naunheim @naunheim.cloud · 20/11/2024
Day two of #MSIgnite: Delving into the latest announcements and features for #MicrosoftEntra has been a focus today for me, and I’ve enjoyed the following sessions.
370
Thomas Naunheim @naunheim.cloud · 20/11/2024
Just wrapped up Day 1 of #MSIgnite in Chicago with my colleagues and MVPs @ugurkoc.de and Oliver Kieselbach. Check out our recap video for the highlights and our thoughts on the latest announcements in Identity, Security and Workplace. #MicrosoftIgnite youtu.be/aNFJLIuE-UY?...
youtu.be
Microsoft Ignite 2024 - Day 1 Recap
YouTube video by Thomas Naunheim
091
Thomas Naunheim @naunheim.cloud · 20/11/2024
First day at my very first #MSIgnite: Excited to dive into the latest announcements, connect with experts from around the globe, catch up with my fellow MVPs. It was great to start the day with my colleagues and meet Raymond and Sander. Feel free to say hi 👋 and have a chat if you are around.
1181
Thomas Naunheim @naunheim.cloud · 16/11/2024
I had the great pleasure to speak and attend #HIPConf in New Orleans! I’ve seen many fantastic sessions and very interesting discussions. I had a great time and opportunity to meet @drazuread.bsky.social, Eric Woodruff, Karl Fosaaen and many other identity experts from the community.
381
Thomas Naunheim @naunheim.cloud · 14/11/2024
Kicking off day 2 at #HIPConf with a deep-dive session on token-based authentication and attacks by @drazuread.bsky.social.
020