Securing Microsoft Entra ID: Lessons from the Field – Part 1

This blog provides practical guidance for securing Microsoft Entra ID in hybrid environments, emphasizing identity as the primary attack surface and detailing common misconfigurations and attacker techniques (phishing, token theft, device code flow abuse). It covers upgrading Entra Connect to application-based authentication and protecting service principal certificates (preferably with TPM), reassessing or deprecating Seamless SSO with regular Kerberos key rotation, and hardening Conditional Access by enforcing phishing-resistant MFA for all privileged roles, properly scoping policies (e.g., blocking device code flow for all cloud apps), and monitoring anomalous sign-ins. The post offers concrete best practices to align with Zero Trust and reduce exposure to identity-based threats.