Usman Abdullahi retweeted
This is one heck of a deep dive into Authentication Policies by Evgenij Smirnov.
ad2049.com/the-other-book-au…
Usman Abdullahi retweeted
So 2026 is the year of the Linux desktop after all. Maybe not what everybody had expected 😜
techcommunity.microsoft.com/…
Usman Abdullahi retweeted
What a way to score your first goal for the club 🤯
Gafar’s curler gave us the lead in our 2-1 victory against Bendel Insurance
Usman Abdullahi retweeted
“I don’t like seyi vibez but you see this particular song”
Oga waka go front and stop being silly
We don complete for him fanbase😂
Usman Abdullahi retweeted
this is me btw 👋
‼️ BREAKING: A 16-year-old hacker broke into an internal Microsoft analytics service with a forged, unsigned login token and ran SQL as admin, reaching databases that held over 17 trillion rows, including Bing search analytics and 17,990 employee email records.
The service, called Titan, checked every field on the token except its signature, so just claiming to be "admin" got him in, writes the researcher, who goes by Faav.
He says he only pulled metadata and two single rows of Bing data, never touched customer data, and reported the flaw to Microsoft the same night.
Microsoft locked the endpoint four days later, paid him $5,000, and had editorial control over his write-up, cutting sections and figures and reshaping how the impact was described before it went public.
Usman Abdullahi retweeted
Defender for Identity sensor v3 on ADFS, ADCS, and Entra Connect sync is now in preview! 🥳
Make sure you have at least one, reachable DC running the v3 sensor as well ;)
Usman Abdullahi retweeted
Nice walkthrough by Ru on working around Compliance and/or App Protection Policies for passkey registration
If you prefer to read instead of watch, you can check out my blog post here :)
nathanmcnulty.com/blog/2025/…
New video: why Entra passkey registration can break when Conditional Access requires Intune app protection policies e.g. on BYOD.
Also digging into how to read + understand Entra resource + audience logs, and think about the security trade-off the (exclusion) fix introduces.
WATCH: youtube.com/watch?v=pRXpblzS…
Usman Abdullahi retweeted
Risk-based CA policies are amazing, but they're often not deployed or configured optimally :(
I'm building a simplified deployment using azd for those interested:
github.com/nathanmcnulty/azd…
Below is a thread on how risk works and some best practices for implementing policies :)
Usman Abdullahi retweeted
Can someone explain to me how users will ignore all communications from IT but be like "yeah sure attacker, let me figure out how to register a passkey for you"?
🚨 Fake passkey updates are being used to take over Microsoft cloud accounts.
Once inside, threat actors add their own MFA methods and pull data from SharePoint, OneDrive, and mailboxes.
Inside the passkey phishing chain → thehackernews.com/2026/09/at…
Usman Abdullahi retweeted
I don't know if anyone has told you today but..
I love you.
This is probably the only place you'd hear it today.
I love you. I care about you.
Life is undeniably tough but it's not beyond what you can handle. Stay in the fight.
Heads up.
Again, I love you.
Usman Abdullahi retweeted
The flexibility my current job affords me is crazy. I don’t take it for granted and I hope I get this lucky in my next job.
Usman Abdullahi retweeted
Your employer is not your family.
Your family does not lay you off when Q3 numbers miss.
Love your job. Do great work. Build relationships. But keep your resume updated, your skills sharp, and your network alive.
Loyalty is a two-way street. If they can replace you in two weeks, you should be able to replace them in two weeks.
Usman Abdullahi retweeted
PSA: The premier league starts today, praise be to God. The team I support isn’t any news to some of you and if you’re a new follower, please take note.
I support Manchester United, that’s my religion, my culture and an integral part of my life.
We’re going to hold dissenting opinions, whether we support the same team or you support any other team. Please engage with sense and respect.
Idc whether you’re a friend or just an acquaintance, if you cuss me over my opinion, I’ll cuss your generation before I block you.
Nothing has really changed, I still hate Arsenal and nothing, I mean nothing will stop my hate from showing.
I love my team, I love Bruno a shitload too. Idk what this season holds for us but I’ll be supporting 100% like I have always done! Viva United! Up the Red Devils!!!
Usman Abdullahi retweeted
"These basic controls..." 🔥
Most orgs aren't even doing half of these, and the Entra team is calling them BASIC 🫠
Seriously, same stuff we talk about on here every day:
Require MFA for all users and admins
Block legacy auth
Block device code flow
Basic stuff, huge wins
Did you know Microsoft Entra security defaults require all standard users to register for MFA immediately upon their next login?
Microsoft does this for MILLIONS of Entra tenants where over 95% of whom don't have an IT team leave alone a security team (there are many mom and pop shops that use M365 for email).
Next year they will move millions of tenants and users to phishing resistant authentication when they turn off SMS and Phone. Yes they could have just taken the easy route of saying move to MFA with Authenticator app but they are going the extra step with pushing users to register for passkeys.
All this while many products and service still ask you to pay 'Enterprise' pricing just to do SSO and even MFA.
Usman Abdullahi retweeted
We know attackers are registering devices. They know we know🙃
So they’re getting smarter, and we need to stay one step ahead. @shahardorf & I wrote a new post on how to outsmart them, and it's pretty good! wiz.io/blog/detecting-entra-…
Usman Abdullahi retweeted
If you want a quick primer on passkeys, how they are phishing resistant, etc., check out the hacker summer webinar I did with @AlteredSecurity
There are new considerations with passkeys, but they're orders of magnitude better than passwords and MFA
youtu.be/kwEga-U96dw?si=2qHk…
