Hey guys looking for suggestions.

Our users connect in via VPN, authentication with their Entra account and then mfa using Duo.

They also have their own mobile devices which they access email / OneDrive / SharePoint etc on - we lock these down with app protection policies so they can't screenshot / copy data out etc.

Business wants to prevent people connecting and spoofing their location, using commercial vpn's like Nord.

I've tried using defender for cloud apps, but on my first attempt using Proton VPN, it did not tag the IP as an anonymiser / VPN, so the solution doesn't give me much hope.

I can sign up to a service that gives us commercial VPN ranges, and add those to named locations in Entra, but the limit is 2000 addresses, which isn't feasible. Plus the addresses change all the time.

Anybody got any other suggestions?

Hello my fellow Identity people! The r/ActiveDirectory community has a couple of events coming up, and you're welcome at both.

But wait, this is the Entra subreddit!

I am a firm believer that AD and Entra should be spoken of in the same sentence. Hybrid is the future. Hybrid is the path forward. So rather than fighting each other, let's work together.

Our meetups try to keep it to as little sales and marketing as possible (right now zero). It's just identity people doing identity things.

Tomorrow: Open Q&A

No agenda and no registration. Bring a question or just listen in.

When: October 16, 2026 @ 10:00 CT (UTC-5) / 15:00 UTC - 60 minutes

Where: Horizon Secured Discord - https://discord.gg/mVFquFqpsW

November Active Directory Community Virtual Meetup - November 3rd

A more structured session: panelists, a few prepared discussion topics, and open Q&A.

When: Tuesday, November 3, 2026 @ 10:00 CT (UTC-6) / 16:00 UTC - 90 minutes

Register (free): https://events.humanitix.com/active-directory-community-virtual-meetup-4-november-2026

Both get recorded and posted to YouTube afterwards if you can't make it live: https://youtube.com/@ActiveDirectoryCommunity

Starting November 4, users without an admin role can create agent identity blueprints. Whoever creates one becomes the owner, manages its credentials and can spin up agent identities from it.

Your user consent settings are the only thing deciding what those agents can reach.

Is that a default you want? I wrote up how to turn it off and find existing blueprints.

https://lazyadmin.nl/office-365/microsoft-entra-lets-users-create-agent-blueprints-by-default/

Currently I’m managing a tenant with 60+ subscriptions in Azure.

We operate in the following way:
- Separate cloud only admin
- No standing privileges on admin accounts
- No direct assignments on users, only security groups (exception for break glass accounts)

Currently we use Role Assignable Groups in combination with PIM, so if Admin A needs to get Owner permission on a subscription, he can PIM (because of eligible assignment) to a security group that is actively assigned to the Owner role on that subscription.

At the moment we’re rapidly approaching the limit of 500 role assignable groups within a tenant. The main goal of having these role assignable is to limit who can modify these security groups (such as group administrators).

We tried using RMAU’s to secure these groups, we got it working with PIM but only with active assignments.

My main question is, how should we continue?

I want to limit which security principles can modify security groups used in Azure in some way.

Some possible options I’m thinking of:
- RMAU in combination with access packages
- Switch to RMAU and permanent assignments in the groups but eligible in Azure

I'm working in a hybrid environment where users are federated to AD / ADFS. Some users have a need to log into applications with test accounts, which are also local AD accounts.

We tried having users go to the MyApps portal and use the "Sign in with a different account" link under the user profile icon, but whatever they type as username@domain.com, the domain being our federated domain kicks off desktop SSO and the user is logged in under their primary account (the account they are logged into Windows under).

If you attempt to sign in with a cloudnative onmicrosoft.com account, it works fine (the user is prompted for credentials), but many applications are reliant on AD group memberships, which (AFAIK) can't be granted to cloud-native accounts.

Is there any way to make this work without having users log into Windows as the test account? I guess App Roles are a potential workaround (since cloud native users can be granted app roles along with the AD group), but I'm surprised there isn't a simpler answer.

Hello everybody

We're trying to rollout passkeys for all users in our company.
We've decided to go with device bound passkeys in Microsoft Authenticator with attestation enabled.

We have configured the Passkey profiles accordingly and enabled a registration campaign for our pilot users and they're getting prompted to setup the passkey as expected. We tried to set the campaign to Passkey and also Microsoft Authenticator, just in case...

The issue we're now facing is, that as soon as they click on the button to register the passkey, it's displayed that there's no authentication method available to setup.

When we setup the passkey in myaccount.microsoft.com it works without issues.

Does anybody have an idea, why it's not working with the registrattion campaign?

Thanks!

Hi everyone,

Does anyone have any details or timelines on the functionality to reset a password using passwordless methods Microsoft refers to in their SMS/Voice retirement FAQs?

https://learn.microsoft.com/en-us/entra/identity/authentication/concept-sms-voice-retirement-faq#what-about-sspr--self-service-password-reset--

We’re looking at an MTO integration between two large organisations and would value input from anyone who has been through it at scale.

Mainly interested in the pain points and the things you didn’t see coming: cross tenant sync, B2B identity issues, Teams and SharePoint collaboration, licensing, Conditional Access and MFA trust, or anything else that caught you out.

Any lessons learned or guidance would be much appreciated.

We haven't been able to use GSA services for a few minutes now.
https://www.reddit.com/r/sysadmin/comments/1x4ralq/microsoft_having_another_hickup_europe/

I tried to send an email invitation in my lab environment but the email didn’t the target. Checked the properties of the guest but everything was correct. What am I missing here ?

Hi everyone,

I'm looking for advice from people who may have faced a similar challenge.

We have several hundred locations where workstations are not Microsoft Entra ID joined and, due to business constraints, these devices cannot be enrolled to Entra ID in the foreseeable future.

At the same time, we have a significant number of Entra ID-integrated applications protected by Conditional Access policies. In many cases, these policies require the device to be Hybrid Entra Joined (or otherwise managed/compliant).

The issue is that when we exclude a specific application from such a Conditional Access policy, the application becomes accessible from any unmanaged device, not just from computers located in our company sites.

Have any of you found a way to limit access from non-Entra-joined devices only to devices located within corporate locations?

One idea I have is to route Microsoft traffic through an already established corporate VPN. In theory, all authentication traffic would then exit through our central office/public IP ranges, which are already configured as trusted locations in Conditional Access. As a result, access would only be possible from devices connected to the corporate network.

Has anyone implemented a solution like this in practice?

• Does this approach work reliably with Microsoft 365 and Entra ID authentication?
• Are there any pitfalls or security concerns I should be aware of?
• Have you used a different solution to achieve a similar goal?

I'd appreciate hearing about your ideas for above quesiton.

Thanks in advance!

Usually the Microsoft documentation will have (preview) in the title however I no longer see it for device sync. Does that mean it's GA now? I've been trying to find some information online but can't seem to find anything. Wondering if anyone else knows anything?

https://learn.microsoft.com/en-us/entra/identity/hybrid/cloud-sync/device-sync

• Description - Your tenant has 2 applications that can be moved to Managed Identity.
• Value - Managed Identity eliminates the need to handle credentials, increasing the security and resilience of your application.
• Action plan - This guidance is still being developed. This is a test recommendation. If you got it and want to know more please reach out to idappcore team for assistance or consult this documentation.

Although this seems in development my secure score is impacted :)

'My' affected applications are:
Azure Multi-Factor Auth Client - 20ed48d9-3ca7-46b2-a6f8-d9b7962ae1cc
Office 365 Exchange Online - 70207512-8ab6-4d2e-905a-8336e1f6d7bd

But I seem at loss how to proceed further, anyone any success with this Identity secure score item?

Happy Friday Everyone!

We’re happy to provide some details today about the Workplace Ninjas US Hackathon on the preday of January 11, 2027 at the event sponsored by WorkspaceDNA.

Firstly, our 5 captains are 5 special experts (3 MVPs and 2 former MSFT employees):

🪄 Merill Fernando, the master of Maester who was a judge last year, joins us as a team captain.

🔥 Ugur Koc, the reigning champion who absolutely crushed the competition last year delivering both an app and an agent will return looking to repeat.

⚗️ Michael Niehaus the creator of DeployR, hybrid autopilot lover, and the godfather of MDT will captain the 3rd team

🍺 Joery Van den Bosch graduates from team member to captain, hoping to unseat Ugur Koc and build something magical to celebrate his new role at Robopack

👩‍💻 Jonah Andersson, the brilliant new addition to our event and the hackathon will join us as the 5th captain. She’s an amazing talent and one of the biggest threats to taking down Ugur!

We also have some surprises coming, like a hacker team that will red team the hackathon teams to mess with them and have some fun at their expense, which is currently being formed led by Nathan McNulty and a few other surprise guests who will add a wrinkle or two to the event.

We’ll have some additional tricks or treats to make the competition interesting, because it wouldn’t be an event without a bit of entertainment.

Our major change this year, our captains will pick their teams from the people who attend the hackathon in a round robin format. We will be drawing the draft order soon, but this will primarily be live to give more people the amazing opportunity to be part of it.

One other thing, meet our amazing referee in Lindsay Shelton who will be making sure teams don’t try to cheat again this year. She’s ready to dole out all sorts of punishments for rule breakers!!

It wouldn’t be an event at WPNUS without great food and drinks.

We will be providing an open bar and an amazing “South of the Border” buffet with:

🍗 Chicken Tinga
🐷 Pork Carnitas
🥩 Carne Asada
🥗 Cilantro Rice, Pinto Beans, Cheese, Sour Cream, Salsa and much more!
🍟Churros with Mexican Chocolate

The winning teams will receive all sorts of amazing prizes post event including one of our 📎Clippy Awards!!

Register now: https://web.cvent.com/event/a9994d6b-9e67-4873-9401-737ca7fe088a/websitePage:84ea0617-1d40-48d4-81a3-cf4ea689d8fa

This is more for future reference, but I just spent a couple days troubleshooting an odd issue when testing out GSA in our environment. We currently use Cisco AnyConnect, and the idea is to migrate usage to GSA and private access for most of our common use cases, but retaining VPN in the meanwhile at least for our admin purposes.

What I ran into was that although I got GSA and private access working fine, when I would connect to the Cisco VPN, my DNS queries for "mydomain.com" would fail, and fail hard with a REFUSED.

In Entra, I had private DNS setup for "mydomain.com", and our Cisco is set to split tunnel that also had "mydomain.com" in there. A pretty normal setup.

My diagnostics revealed that when VPN is connected, GSA still has the NRPT policies to ensure queries for "mydomain.com" get picked up by it first. Cisco AnyConnect doesn't use NRPT (naughty...)... at any rate, GSA gets the query, and apparently (unconfirmed) would then run the query through the VPN adapter. Cisco AnyConnect sees a request coming from the virtual 6.6.0.0/16 network and drop it like a hot potato, leaving GSA with no choice but to return a REFUSED error.

The solution was kind of buried in some interoperability documents from Microsoft - none of it calls it out specifically and none mention Cisco VPN and split-DNS, but it's this:
In your Cisco VPN profile, go to split-DNS and your extended ACL and add 6.6.0.0/16 to the source network list.

Doing that allows DNS queries to pass on through. I haven't confirmed but I suspect in this case, DNS queries are actually being handled through the VPN and not GSA's private DNS proxy. Either way... both say they're authoritative for the same domain name, and end up pointing to the same servers, get the same results.

Eventually the idea is to move away from VPN but this little quirk was holding me up for quite a while, capturing logs and poring over the results. Note that this doesn't affect intelligent local access (ILA) in any way. In my private network settings I was testing, applications I setup to bypass when I was on the corporate network went through the VPN just fine, and the other test applications still went over GSA tunnels as expected.

I didn't find any posts anywhere that spelled out this exact scenario, so here I am posting the story on Reddit to hopefully help the next person out who may run across this.

On the other hand, if someone reading this thinks "oh, there's a better/different way to do it", I'm all ears. I was just happy to finally get it working to the point where all of my test scenarios are finally passing, but if there's something I missed, that would be good info too.