A policy can only govern an object the policy engine can resolve. An application appearing in your sign-in logs, does not guarantee that a corresponding service principal exists in your tenant! Why?

That single assumption is where things quietly break.

Microsoft have hundreds of first-party apps in a global directory, but they not all lives in your tenant by default. A service principal is only created on first consent - or when an admin registers it manually, so many background services, infrastructure apps and newer products (Global Secure Access/ZTNA clients, Defender for Mobile, Intune Tunnel, Windows Sign In, AVD and Windows 365…) never trigger that flow for some.

The result: apps your users authenticate against every day, showing up in your sign-in logs - with no service principal to exclude in etc. Conditional Access there use restictions or App Protection policies (my sample in the blog post), simply have nothing to bind to, so the app silently falls outside your controls. "All Apps" policy has more in it than you think, and you can't exclude an app that doesn't exist as an object (like App Protection on the Global Secure Access client in my own usecase in the weekend here).

So I built two scripts to close the gap (can be I change some stuff in the future FYI):

> Find-MissingServicePrincipalsFromSignInLogs.ps1 - this cross-references interactive + non-interactive sign-in logs against your existing SPs and prints a ready-to-paste list of what's missing.
> CreateMissingServicePrincipals.ps1 - registers the missing SPs (with -WhatIf preview first).

A single 24-hour run on a small production tenant (my own 😄) with ~965 existing SPs surfaced dozens of gaps - apps generating sign-ins daily with nothing for policy to resolve against. See it all in the blog post here!

Key takeaways:
> Don’t assume you can exclude everything - if the service principal doesn’t exist, the app is invisible to policy enforcement
> Sign-in logs are your source of truth - if traffic flows, it should have an SP.
> Some AppIDs can't be registered (Microsoft limitation, not your config) - the script flags these as [SKIP].
> This isn't a one-time fix - build periodic discovery into your baseline.

Full write-up, scripts and the Global Secure Access exclusion list here to see more 👇

Have you any expirence with other senarios, where they was missing? 🤔 Let me hear in the comments!

#Microsoft #EntraID #ConditionalAccess #ZeroTrust #AppProtection #GlobalSecureAccess #GSA #Security #Identity #PowerShell #MVP #MVPBuzz #Community #TheBugHunter

I run Zoft. Workflow automation.

Customers need to Connect Outlook / Microsoft 365 and land on a normal consent screen, not “unverified publisher.”

Need someone who has finished this for a multi-tenant SaaS:

1. Entra ID app registration (multi-tenant)
2. Publisher verification (Partner Center / CPP Partner ID on the app)
3. Microsoft Graph delegated scopes working for other tenants
4. Admin-consent path when the customer’s tenant requires it

Outlook scopes we use today: Mail.ReadWrite, Mail.Send, Calendars.Read, User.Read, offline_access. Same verified publisher will cover Teams / SharePoint / Excel later.

Please help me with setting up things.

I am really getting tired of these exams testing for edge cases that happen somewhere around 1-2% in a tenant configuration.

Where exactly would something like this be used? Can somebody give me some more context and explanation for what this question is even asking or trying to ask?

[https://i.imgur.com/giwtiK9.png\](https://i.imgur.com/giwtiK9.png)

In a production environment if I want to apply Exchange Online Plan 2 licensing to users and the users are being synced from the on-prem Active Directory, then the only steps required are:

1. to create a security group online

2. to add all the users to that group

3. and then add the Exchange Online licensing to that group

And if the users are already using a business premium license and you only want to enable some additional license eg power bi something to only a few users within that group.. Then you only need to create a new security group with those few users and add the other license to that group.

But AI tells me the answer is A - Configure the options for Exchange Online (Plan 2) on a template user.

How's that possible?

Is anyone else having issues with mcas.ms and getting "someting went wrong" on everywhere it is?

Hey team, hope everyone is doing well.
Has anyone run into this issue with Microsoft Entra Cloud Sync before?
I have the Cloud Sync agent installed on a domain-joined VM. The agent services are running and the VM has normal internet access.

In Entra, the provisioning status shows:
HybridIdentityServiceAgentTimeout

I've checked the basics:
• VM is domain joined
• Logged in using a Domain Admin account
• DNS forwarding has been configured
• UPN suffix has been fixed
• Agent services are running, RSAT installed on DC
• No WinHTTP proxy
• login.microsoftonline.com:443 works
• login.windows.net:443 works
• management.azure.com:443 works
• autoupdate.msappproxy.net:443 works
• servicebus.windows.net:443 is failing

The firewall is a FortiGate. I'm looking at allowing *.servicebus.windows.net and *.msappproxy.net over TCP 443, with SSL inspection bypassed for those two endpoints.
Still no luck.
Any other bright ideas or things I should check? Has anyone had Cloud Sync working through a FortiGate and come across this exact timeout? We have recently moved towards Entra/Intune and this is our first site we are looking to Hybrid join.

Thanks!

In our Org every User is allowed to register specific Security Keys and also the MS Authenticator with Passkey option. We have one singular profile, which we also dont want to change because of security, which looks like the following:
Enforce attestation enabled, Passkey type is only Device-bound and Target specific AAGUIDs is also enabled.

Since a new Update from Microsoft which changed the process a little bit and changed the GUI from the different windows inside of the registering process you get the below window/instruction. This is really bad for us because on the one hand, it doesnt work. When I scan it and put it for example inside of the Apple Passwords. Then i get prompted to name this passkey in the end and just then this whole process doesnt continue and only throws errors. This is probably because of only Device-Bound. On the other hand why am i even allowed to put the Passkey to anything else then the MS Authenticator when our Settings inside of Entra dont allow synced Passkey in the first place........
When i disable Bluetooth on my Device this window notices it but it just presents "Bluetooth disabled".
When I am inside of the Security Informations and want to register a Passkey i even get prompted to choose the type of Securitykey. But this whole process doesnt care if i click USB-Device because if i click it then i get also the above mentioned window presented. I dont want to register anything on my phone, my user dont want to either. So why force it anyways........ This doesnt make any sense, how can this be user friendly. Spaghetti Code from A to Z...
JUST LET MY USERS REGISTER THE YUBIKEY WITHOUT ANY FORCE TO USE MS AUTHENTICATOR OR SYNCED PASSKEYS IN GENERAL.

Is it possible to disable this window? How are you handling this Microsoft slop?

I've done some labs of enterprise / app reg and am slowly starting to understand it.

Just want to concrete my knowledge.

Obviously you have delegated vs application, delegated being the intersection of the app's consent and the user's permissions.

So from an administrative perspective, how do you know whether what you're granting is application or delegated? If admin user consent was turned off and users could consent themselves, that would mean all admin consents would be application, but it's often not the case, and I don't think the Microsoft GUI has a way, it just says "grant" then brings up a sign in window for the admin and displays some friendly descriptions.

I sort of found a way by cross referencing those with the Microsoft permissions docs and I think enterprise apps > activity differs to enterprise apps > permissions? The former being what user has asked for?

I'm just wondering if there's a recommended or definitive way of checking prior to approving, as checking after approving is more straight forward as it shows in the application permissions explicitly delegated vs application in the table as shown in the screenshot.

Hello everyone,

I am working at microsoft as a security engineer for entra identity. I have 4 years of experience in this product. Please feel free to loop me and consider me in any queries. I would be happy to help you and share my knowledge. I can advise on what exactly it is but for a break fix please contact ms support

MS says this started around 11AM est, however was anyone else seeing authentication issues around 7AM EST?

Working with Schema, Directory, and Open extensions can become a huge pain in the ass, especially when you're trying to understand an inherited environment, or as a consultant.

So I built Entra Extensions Manager, an open-source browser-based portal for discovering, investigating, and managing them.

It includes extension management, usage monitoring, value validation, Graph/PowerShell snippets, audit logs, multi-tenant switching, and more.

There's also a Demo mode with a completely simulated tenant, so you can try everything without signing in or touching your own data.

The hosted version is browser-only, and the entire project can also be self-hosted in your own environment if that’s preferred.

If you work with custom extensions in Entra, I'd love to hear what you think!

Full announcement + demo:
https://www.chanceofsecurity.com/post/introducing-entra-extensions-manager

We’re happy to announce our next local event sponsored by ControlUp with Workplace Ninjas US Miami, which will take place at the ControlUp offices in Fort Lauderdale.

The event will be October 26th from 10-4 PM.

The Call for Papers is now officially open:

https://sessionize.com/workplace-ninjas-us-Miami/

Signup to attend here:

https://www.eventbrite.com/e/workplace-ninjas-us-miami-meetup-tickets-1999031261315

I´m happy to share this to the #community, as a new and nice tool for Microsoft Global Secure Access, aka #GSA, will soon see the public after some long time I have keept it "private" - the GSAClientDiagnosticsToolkit! 🥳

This is a PowerShell module for, tired of chasing down why the GSA Client won't connect and more. This module runs end-to-end diagnostics for you + have some test to an upcomming blog post about the use in Conditional Access Policies I will release too - so stay tuned for the post post soon! 🔥

Some of the part is:
> GSA service health & Entra device/PRT status
> Forwarding profile registry + timestamp validation
> DNS, TLS & mTLS connectivity to GSA endpoints
> Proxy detection (system/transparent/authenticating)
> Private Access rules, tunnels and application segment checks (via Microsoft Graph and local policy)
> mTLS auth certificate check, backup and repair
> Validate the GSA Service Principals you need to exclude from App Protection policies - with live tenant status shown too!

One command, a nice report, and you know exactly what's healthy and what's not!

Windows + PowerShell. Open source, dropping soon 👀

#Microsoft #PowerShell #GlobalSecureAccess #GSA #Entra #Identity #Security #ZTNA #SSE #MVP #MVPBuzz #Community

So, this in an interesting one! Where group sync from Entra ID to Active Directory not long ago when GA, User sync is coming to preview!

The docs on this are lengthy, which you can find here: https://learn.microsoft.com/en-us/entra/identity/hybrid/cloud-sync/how-to-configure-entra-to-active-directory

I shamelessly did a condensed write-up on it here: https://ourcloudnetwork.com/sync-entra-id-users-to-active-directory-with-cloud-sync/ which touches on all the key points and considerations.

I don't think this has been officially launched in Public Preview yet from Microsoft. The UX in Entra hasn't updated, but you can activated it with some hidden links.. However, as the documentation is now live it's free to explore :)

Hi What that errors mean i want make Sign up for my webstie

I'd like to have two loaner devices in our company without a primary user, in case one breaks down. However, I can't allow users to log in with a password because our Entra ID passwords are in 1PW and can be up to 20 characters long. Is there any way I can set up a passwordless authentication method via Windows Web Sign-in, and what options do I have?

Last week everything was working great. Then school started and all went to hell. We are hybrid we were using Entra Connect to sync with one server on standby in staging mode. But monday password resets would not work at all. It would either timeout or say the password is not strong enough. 30 character random passwords would not work either. I switched our student ou to sync with the new Entra Cloud Sync and it did the same thing and made no difference. We dont have a password policy set on our AD controller except for it has to be 8 characters. Minimum password age is set to 0. I checked the service account to make sure its delegated to that ou. Any help would be appreciated.

Is it correct, that it is stupid to use another authenticator like google authenticatior instead of ms for entra account?