Sarah Lean

[Entra - App Administrator role] 👾 I too often see Application Administrator role handed out tenant-wide. Why is this a problem? This role often has paths to very privileged actions via Application Permissions. You do not want an Application Administrator to lay down credentials to a privileged Service Principal that has application permissions and then inherit the permissions via SP impersonation. Chances are there is a path to Global admin from App Admin in a large organization. IMO Application Admin is one of the most dangerous roles in Entra ID right after privileged role and privileged auth admin. Consider any application that has dangerous application permissions such as Mail[.]ReadWrite, Files[.]ReadWrite[.]All, RoleEligibilitySchedule[.]ReadWrite[.]Directory, Directory[.]ReadWrite[.]All etc. This can then all be inherited by the Application Administrator. This may break your compliance data boundary. Also consider your Microsoft Entra AD Synchronization Service App too! (see later note) ✅ Solution(s): - Reduce Tenant Wide Role for App Admin and move to scope via application where possible. - Use Entra Application Policies to protect secrets being added to Sensitive Service Principals (especially do this for your breakglass application if you use an application for this!). App admin cannot edit Entra application Policies unless they have Security Administrator assigned too. 💯 Benefits: - Better than app owners as easier to audit and govern all from one pane. App Owners doesn't support groups so this is a good way around this. - You can use Identity governance features such as PIM, Access Reviews etc. - Reduced paths to Global Admin and other privileges. - Because access can be granted more granularly, Active assignments can be used for low privilege applications to reduce PIM fatigue. 🤪 Downsides - Conditional Access Policy targeting App Administrator doesn't support App Admin that is non-directory wide, similar to roles applied to an Admin Unit. This issue is easily remediated by applying strong CA to admin portals / Graph & PIM authentication Contexts. <FYI Credentials can be issued to Enterprise Applications too not just application Registrations. This can only be done with Graph/PS and is not available in the GUI. This is incredibly dangerous as there is no audit for the secret existing in the portal beyond the 30 day portal logs. If you are missing audit logs you will have no audit trail that this happened. Adding a credential only affects the instance in that particular tenant and not the Application Registration (even if the application registration i.e. the definition lives in another tenant)> #Entra #Security #Audit #Govern #Identity #Cybersecurity #Microsoft #MVPBuzz

168

6 Comments

Getting started with Intune and Entra managed devices may seem straight forward, but there are a lot of hidden settings which could cause you issues further down the line. In this post I've looked at the settings across M365 to help those making the jump into cloud management I've probably missed some, but will keep updating it https://lnkd.in/epUzhxd8

101

5 Comments

It's been a few months now since the public preview of Azure Migrate from VMware to Azure Local was announced and I'm pleased to say testing has been very positive. We have lots of customers who are interested in adopting Azure Migrate as their first choice for migrations, to move services off VMware, and we are using a wealth of experience to help them. Key Benefits: Azure Migrate from VMware to Azure Local allows you to replicate virtual machines, which minimises downtime when the migration occurs. It's an agent-less service that means you don't have to install agents on the VMs and hosts. The VM data is kept on-premise and not sent to Azure. The replication process is managed in one place - the Azure Portal. Static IP addresses can be preserved after migration. Please check out the official documentation for more details and feel to reach out if you want to discuss how we can help you with your migration journey! #AzureLocal #AzureMigrate #MVPBuzz https://lnkd.in/eZuQCEhU

58

9 Comments

Good to know! 🤔 Question: ❓ I wanted to take a snapshot of the image VM, so I asked the customer to shut down the VM. The customer started shutting it down from inside the VM. I then recommended stopping it from the Azure Portal. The customer asked, "What’s the difference between shutting down from inside the VM and stopping the VM from the Azure Portal? Answer: 💡 For taking a snapshot, it is generally recommended to shut down the VM from the Azure Portal rather than from inside the VM. This ensures that the VM is in a deallocated state, meaning no resources are being consumed, and the VM is fully stopped, which minimizes the risk of data corruption. Shutting down from inside the VM only stops the operating system but doesn’t fully deallocate the VM, which can result in an inconsistent snapshot if processes are still running. Now, the difference between the two methods: 🔒Shutdown from inside the VM: Powers off the operating system inside the VM but keeps the underlying VM running in Azure and consuming resources. 🚫Stop from Azure Portal: Completely stops and deallocates the VM, releasing compute resources and saving costs, although storage is still billed.

57

5 Comments

Azure Virtual Desktop (AVD) - Optimisation Last week, I had conversations with two clients regarding their #AVD upgrade to Windows 11. We agreed that deploying a new Windows 11 AVD in parallel and subsequently migrating users across would be the best approach. Both clients requested one crucial task: "Chinwike, please review our AVD as the Azure cost is becoming outrageous. Please identify optimisations that can be applied." Following a thorough review, we identified areas for optimisation and achieved notable cost savings for them. This experience led me to realise that many businesses might have deployed AVD without conducting a proper review since entering production. Here are some cost-saving tips: 1- Over-provisioning:- One essential question I posed to my clients was: why do you have so many #hostpools, and why are they all the same VM size? Many clients tend to over-provision their AVDs to boost performance, opting for large VM sizes and neglecting to review true resource use and scale back. Additionally, the unnecessary creation of hostpools for every team can be concerning. We always recommend determining your workloads and personas early, then exploring alternatives such as using FSLogix app masking to hide apps from different user groups while on the same multi-session desktop. 2- Storage Accounts and Azure Files There is a common tendency to default to #AzureFiles Premium even when it's not required. I've observed businesses deploying storage accounts with GRS despite having no genuine business requirement for a secondary region. Each type of Azure storage account must have a valid business justification. One common error is assigning storage to Azure Files. Recently, I encountered an allocation of 5TB based on the 30GB default of FSLogix, which was the maximum for all their users. This allocation was excessive, as the actual usage after six months was less than 1TB, meaning the client was paying for unused space. It is crucial to calculate the required storage, provision a percentage, and scale as needed. #Nerdio is excellent at scaling up and down your storage account. 3-Clean Up:- Businesses often forget that Azure costs are consumption-based, even with reserved instances. The number of unused resource groups, image VMs, temporary VMs, storage accounts, and networks (VNet, NSGs) can be surprising. Regularly reviewing provisioned resources and evaluating their necessity will help save money. 4- Scaling In and Out of Session Hosts Defining business peak and off-peak hours and regularly reviewing this information is essential. Sometimes, businesses configure and forget, resulting in unnecessary expenses. Powering off and on a percentage of the session hosts ensures you do not pay for powered VMs during off-peak hours. Additionally, using the correct algorithms, whether depth-first or breadth-first, is vital. Reach out to Advania UK and let us help you save money on your Azure infrastructure using automation. #Azure

44

9 Comments

🚨Important change! To those using Hybrid Autopilot, an update to the Intune Connector for Active Directory is now available which uses a least privileged MSA to enhance security. The old connector will stop being supported in late May, beyond that new Hybrid AP enrolments will fail! Full details in the article below: https://lnkd.in/e5heTHzt

81

9 Comments

Patching Windows isn't something you just do for the Cyber Essentials renewal, it's a continual obligation which should be met as part of basic IT practice 📑 The most effective way to patch Windows is by using Autopatch, which is now available to Business Premium customers 🥇 I've written a guide on how to meet the 14 day requirement, and how you can optionally enable Hotpatch 🔥 https://lnkd.in/ewHdwwd7

73

8 Comments

Are your ADMX-backed policies in Intune coming out overcooked? Two weeks ago, an issue at one Azure Scale Unit left ADMX policies like OneDrive and Edge settings burnt and unusable: Error 65000. New and existing devices simply didn’t get them. In this blog, I break down: https://lnkd.in/eZtYV7yv -How ADMX ingestion is supposed to work -Why Error 65000 happens -What went wrong and how to check for it #Intune #MSIntune #Windows #Windows11 #WindowsAutopilot #Policies #Microsoft #Security

89

5 Comments

Reminder: As posted on 1 October, Microsoft has renamed the Microsoft 365 E5 Mini Suites in your tenant. 👉 Microsoft 365 E5 Security is now Microsoft Defender Suite 👉 Microsoft 365 E5 Compliance is now Microsoft Purview Suite https://topedia.net/XLX03J #Microsoft365 #MicrosoftDefender #MicrosoftPurview #M365Licensing

49

2 Comments

🚀 Struggling with slow logons in Azure Virtual Desktop or Windows 365? You’re not alone — it’s one of the most common complaints I hear from IT teams and end-users alike. In my latest video, I dive into the Virtual Desktop Optimization Tool (VDOT) — a simple but powerful way to strip out unnecessary services, AppX packages, and background tasks from your session hosts or Windows 365 desktops. ✅ Faster logons ✅ Snappier performance ✅ Better resource utilization (and maybe even lower costs) In the video, I’ll show you: 🔹 What VDOT does (and what it removes) 🔹 How to run it safely 🔹 Before vs. after comparisons (processes, services, logon times) 🔹 How to integrate it into your Nerdio setup If you manage AVD or Windows 365 and want to deliver a smoother user experience, this is well worth a look. 👉 Watch here: https://lnkd.in/e5UUUasZ Do you currently run optimization scripts in your environment? Would love to hear your experience in the comments 👇 #AzureVirtualDesktop #Windows365 #Nerdio #Intune #EUC #AVD

62

9 Comments