<?xml version="1.0" encoding="UTF-8"?><rss xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:atom="http://www.w3.org/2005/Atom" version="2.0"><channel><title><![CDATA[Cloudy With a Chance of Security]]></title><description><![CDATA[Advice to secure your cloud based resources and identities!]]></description><link>https://www.chanceofsecurity.com/blog</link><generator>RSS for Node</generator><lastBuildDate>Tue, 14 Apr 2026 19:18:06 GMT</lastBuildDate><atom:link href="https://www.chanceofsecurity.com/blog-feed.xml" rel="self" type="application/rss+xml"/><item><title><![CDATA[Break-Glass Accounts Done Right: Securing Emergency Access in Microsoft Entra]]></title><description><![CDATA[Emergencies happen every day. Most of the time, they happen to someone else. Until the day they happen to you - then what? We all know things can go wrong, but most organizations do not spend much time thinking about what happens when they lose access to their own environment. That is understandable right up until the moment a misconfiguration, outage or any other emergency turns it from a theoretical problem into a very real one. That is why emergency access matters. In this post, I will...]]></description><link>https://www.chanceofsecurity.com/post/break-glass-accounts-done-right-securing-emergency-access-in-microsoft-entra</link><guid isPermaLink="false">69c195c3adda444fefaf0982</guid><category><![CDATA[Microsoft Entra]]></category><category><![CDATA[Microsoft Azure]]></category><category><![CDATA[Microsoft Security]]></category><category><![CDATA[Microsoft Defender]]></category><pubDate>Tue, 07 Apr 2026 05:00:16 GMT</pubDate><enclosure url="https://static.wixstatic.com/media/390163_7e2b75ebbeb146159c57d70d5e2695d9~mv2.png/v1/fit/w_1000,h_1000,al_c,q_80/file.png" length="0" type="image/png"/><dc:creator>Sebastian F. Markdanner</dc:creator></item><item><title><![CDATA[Introducing M365IdentityPosture: Community-Driven Identity Reporting for Microsoft 365]]></title><description><![CDATA[Have you ever felt that the native reporting options in the Microsoft Cloud are lacking? Well, you’re not alone - let’s talk about it. Visibility into your Microsoft Cloud identity and security configurations has never been more important… or more fragmented. While Microsoft offers native reporting options for specific parts of our environments, they are often too narrow, incomplete, or difficult to use without significant additional processing. That gap led to the creation of...]]></description><link>https://www.chanceofsecurity.com/post/introducing-m365identityposture-community-driven-identity-reporting-for-microsoft-365</link><guid isPermaLink="false">68fbd0aff591df2a57b75d3c</guid><category><![CDATA[Microsoft Entra]]></category><category><![CDATA[Microsoft Purview]]></category><category><![CDATA[Microsoft Security]]></category><category><![CDATA[Microsoft Azure]]></category><category><![CDATA[Microsoft Defender]]></category><pubDate>Mon, 16 Mar 2026 06:00:20 GMT</pubDate><enclosure url="https://static.wixstatic.com/media/390163_4fa604bb134a4d24b085b5618835b017~mv2.png/v1/fit/w_1000,h_1000,al_c,q_80/file.png" length="0" type="image/png"/><dc:creator>Sebastian F. Markdanner</dc:creator></item><item><title><![CDATA[Securing Microsoft Business Premium Part 06: Securing Email with Defender for Office 365]]></title><description><![CDATA[Sharing is caring — While that is a mantra I follow myself, collaboration needs to be done securely. Email is often the first and most widely used collaboration tool in any organization, which makes Exchange Online a natural place to start when securing collaboration. In today’s work environment, collaboration with others is essential, both internally and externally. To support this, collaboration must be easy for users while remaining secure and manageable for administrators. In this part of...]]></description><link>https://www.chanceofsecurity.com/post/securing-microsoft-business-premium-part-06</link><guid isPermaLink="false">6782819cd4ab7994252d1bbc</guid><category><![CDATA[Microsoft Defender]]></category><category><![CDATA[Microsoft Security]]></category><pubDate>Mon, 02 Mar 2026 06:00:32 GMT</pubDate><enclosure url="https://static.wixstatic.com/media/390163_1643b48fd49a474dab2a518c623bf683~mv2.png/v1/fit/w_1000,h_1000,al_c,q_80/file.png" length="0" type="image/png"/><dc:creator>Sebastian F. Markdanner</dc:creator></item><item><title><![CDATA[How to Configure Inbound SMTP DANE &#38; DNSSEC in Exchange Online]]></title><description><![CDATA[We’re already sending emails securely, now it’s time to secure inbound email as well! Back in 2022, Microsoft enabled outbound SMTP DANE with DNSSEC for all Exchange Online customers, including MSA (hotmail, live, outlook), ensuring encrypted delivery when sending to domains that support it. Finally, at the tail end of 2024, Microsoft enabled inbound SMTP DANE with DNSSEC across all Exchange Online tenants in a public preview. This adds transport-layer security for receiving email - something...]]></description><link>https://www.chanceofsecurity.com/post/how-to-configure-inbound-smtp-dane-dnssec-in-exchange-online</link><guid isPermaLink="false">69810a5599fa9e70ea603f88</guid><category><![CDATA[Microsoft Security]]></category><pubDate>Mon, 16 Feb 2026 06:00:20 GMT</pubDate><enclosure url="https://static.wixstatic.com/media/390163_c864e77824b549dfbead0436446686c3~mv2.png/v1/fit/w_1000,h_1000,al_c,q_80/file.png" length="0" type="image/png"/><dc:creator>Sebastian F. Markdanner</dc:creator></item><item><title><![CDATA[Modern Email Security Explained: From Sender Authentication to Transport Security]]></title><description><![CDATA[Sending an email securely requires more moving parts than most people expect, you don’t notice when it works. You really  notice when it doesn’t! Email is still one of the most critical, and most abused, communication channels in modern IT environments. While most organizations rely on email every day, not enough people knows how emails, and the security surrounding it, actually works under the hood. This post breaks down the core building blocks of modern email security, from sender...]]></description><link>https://www.chanceofsecurity.com/post/modern-email-security-explained-from-sender-authentication-to-transport-security</link><guid isPermaLink="false">6986602e96663872685fb95f</guid><category><![CDATA[Microsoft Defender]]></category><category><![CDATA[Microsoft Entra]]></category><pubDate>Mon, 09 Feb 2026 06:00:43 GMT</pubDate><enclosure url="https://static.wixstatic.com/media/390163_d5c2a0918dc746f99348c668c4c18b9a~mv2.png/v1/fit/w_1000,h_1000,al_c,q_80/file.png" length="0" type="image/png"/><dc:creator>Sebastian F. Markdanner</dc:creator></item><item><title><![CDATA[The Hidden Steps Microsoft Forgot to Document: Securing Azure App Service Authentication Behind Front Door with Private Link]]></title><description><![CDATA[Today I want to walk through how to configure Azure App Service Authentication when your App Service sits behind Azure Front Door and is accessed through a Private Link. On a dreadful day in october 2025, I received something that most IT people fear - a request from a client! The request included information from the client, that they were struggling with authentication on a Web App deployed behind Azure Front Door using Private Link. What looked like a straightforward setup quickly turned...]]></description><link>https://www.chanceofsecurity.com/post/hidden-steps-azure-app-service-authentication-front-door-private-endpoint</link><guid isPermaLink="false">68f93ba774c5ec8ff3bdf361</guid><category><![CDATA[Microsoft Azure]]></category><category><![CDATA[Microsoft Entra]]></category><pubDate>Tue, 02 Dec 2025 07:00:26 GMT</pubDate><enclosure url="https://static.wixstatic.com/media/390163_b53029047bf7472990bb01e03b199c63~mv2.png/v1/fit/w_1000,h_1000,al_c,q_80/file.png" length="0" type="image/png"/><dc:creator>Sebastian F. Markdanner</dc:creator></item><item><title><![CDATA[Mastering Microsoft Entra Authentication Contexts - Part 4: Monitoring and Reporting with KQL &#38; M365IdentityPosture]]></title><description><![CDATA[We’ve covered what Authentication Contexts are, why they matter, and how they help us  strengthen access and data security in Microsoft 365. Now it’s time to answer the next question - how do we monitor and report on their usage? Unfortunately, there’s no built-in way to gain that visibility today. Neither Entra ID nor Microsoft 365 provides a simple method to inventory or audit Authentication Contexts across our estate including Conditional Access, PIM and Sensitivity labels. To close that...]]></description><link>https://www.chanceofsecurity.com/post/mastering-microsoft-entra-authentication-contexts-part-4-monitoring-and-reporting</link><guid isPermaLink="false">68d9a4b6cb09911e236ef3f9</guid><category><![CDATA[Microsoft Entra]]></category><category><![CDATA[Microsoft Azure]]></category><pubDate>Mon, 03 Nov 2025 06:00:11 GMT</pubDate><enclosure url="https://static.wixstatic.com/media/390163_491deb00072145159b0da6b09d44fc63~mv2.png/v1/fit/w_1000,h_1000,al_c,q_80/file.png" length="0" type="image/png"/><dc:creator>Sebastian F. Markdanner</dc:creator></item><item><title><![CDATA[Mastering Microsoft Entra Authentication Contexts - Part 3: Advanced Data Protection]]></title><description><![CDATA[With identities and access strengthened in part 2 , it’s time to turn our focus to real-world data protection  with Authentication Contexts. One of the more underused capabilities of Authentication Contexts is their power to secure data across the environment, whether through direct enforcement using Sensitivity Labels or by protecting user sessions via Microsoft Defender for Cloud Apps. In this post, we’ll explore exactly that: how to secure organizational data using Authentication...]]></description><link>https://www.chanceofsecurity.com/post/mastering-microsoft-entra-authentication-contexts-part-3-advanced-data-protection</link><guid isPermaLink="false">68d2a6cd0bf4ea1c491477b8</guid><category><![CDATA[Microsoft Entra]]></category><category><![CDATA[Microsoft Purview]]></category><pubDate>Mon, 20 Oct 2025 05:57:00 GMT</pubDate><enclosure url="https://static.wixstatic.com/media/390163_eebe1d677d1440afbb953dc26bfca8f0~mv2.png/v1/fit/w_1000,h_1000,al_c,q_80/file.png" length="0" type="image/png"/><dc:creator>Sebastian F. Markdanner</dc:creator></item><item><title><![CDATA[Mastering Microsoft Entra Authentication Contexts – Part 2: Real-World Access &#38; Action Controls]]></title><description><![CDATA[In Part 1 of this mini-series, we explored the what, why, and how of Microsoft Entra Authentication Contexts, laying the foundation for what they are and how they work. In this second part, we’ll build on that foundation with real-world examples of how Authentication Contexts can secure user access and critical actions. Along the way, we’ll walk through configurations, share recommendations, and look at the Conditional Access policies that tie it all together. So, let’s dive straight in and...]]></description><link>https://www.chanceofsecurity.com/post/mastering-microsoft-entra-authentication-contexts-part-2</link><guid isPermaLink="false">689f91d2054d02f5f63133a0</guid><category><![CDATA[Microsoft Entra]]></category><pubDate>Mon, 29 Sep 2025 05:00:24 GMT</pubDate><enclosure url="https://static.wixstatic.com/media/390163_12b4c36ab3334823be5d66366d469981~mv2.png/v1/fit/w_1000,h_1000,al_c,q_80/file.png" length="0" type="image/png"/><dc:creator>Sebastian F. Markdanner</dc:creator></item><item><title><![CDATA[Mastering Microsoft Entra Authentication Contexts – Part 1: What They Are, Why They Matter, and How to Use Them]]></title><description><![CDATA[Over my last few posts, I’ve casually mentioned Authentication Context a few times, so I thought it was about time we gave the feature a proper spotlight. Within Microsoft Entra, we sometimes encounter scenarios where we need to enforce specific conditions for certain sub-actions or unique requirements. While Conditional Access can directly enforce conditions in most cases, there are times when it’s trickier — especially if we want to enforce a condition for a single  action or resource....]]></description><link>https://www.chanceofsecurity.com/post/mastering-microsoft-entra-authentication-contexts-part-1</link><guid isPermaLink="false">688e83b27ae5e5096a959dba</guid><category><![CDATA[Microsoft Entra]]></category><category><![CDATA[Microsoft Purview]]></category><category><![CDATA[Microsoft Defender]]></category><pubDate>Mon, 18 Aug 2025 05:00:21 GMT</pubDate><enclosure url="https://static.wixstatic.com/media/390163_efcfca91324e4479a82689ae98ebd448~mv2.png/v1/fit/w_1000,h_1000,al_c,q_80/file.png" length="0" type="image/png"/><dc:creator>Sebastian F. Markdanner</dc:creator></item><item><title><![CDATA[PIMActivation: The Ultimate Tool for Microsoft Entra PIM Bulk Role Activation]]></title><description><![CDATA[Getting annoyed or impatient when activating eligible roles in PIM — especially multiple roles at once? You’re not alone. Today, I’m sharing a solution to take the pain out of the process. Whenever I talk with clients, colleagues, or students about Microsoft Entra Privileged Identity Management (PIM), the first complaint I hear is always the same: activating roles is a headache!  After hearing this one too many times, I decided to do something about it. What started as a quick PowerShell...]]></description><link>https://www.chanceofsecurity.com/post/microsoft-entra-pim-bulk-role-activation-tool</link><guid isPermaLink="false">68874c4e6ab2534c7b0a6cf2</guid><category><![CDATA[Microsoft Entra]]></category><category><![CDATA[Microsoft Azure]]></category><pubDate>Mon, 04 Aug 2025 05:00:18 GMT</pubDate><enclosure url="https://static.wixstatic.com/media/390163_4ce4d06b564c4094ac4d49e4f40fffe8~mv2.png/v1/fit/w_1000,h_1000,al_c,q_80/file.png" length="0" type="image/png"/><dc:creator>Sebastian F. Markdanner</dc:creator></item><item><title><![CDATA[Microsoft Entra Restricted Management Administrative Units: Delegating Control Without Sacrificing Security]]></title><description><![CDATA[Today, I’ll take a closer look at Microsoft Entra Administrative Units (AUs)  and Restricted Management Administrative Units (RMAUs) Despite being incredibly useful, AUs and RMAUs are still underutilized in many environments. As organizations scale and responsibilities shift across teams, the need for scoped delegation becomes increasingly important. AUs let you define clear administrative boundaries, while RMAUs go a step further by blocking even high-privileged roles from managing sensitive...]]></description><link>https://www.chanceofsecurity.com/post/microsoft-entra-restricted-management-administrative-units</link><guid isPermaLink="false">6838b72b05d24dc7562d1a04</guid><category><![CDATA[Microsoft Entra]]></category><pubDate>Mon, 09 Jun 2025 05:00:15 GMT</pubDate><enclosure url="https://static.wixstatic.com/media/390163_0def8049a809483b9aa235f0bd9d9689~mv2.png/v1/fit/w_1000,h_1000,al_c,q_80/file.png" length="0" type="image/png"/><dc:creator>Sebastian F. Markdanner</dc:creator></item><item><title><![CDATA[Securing Microsoft Business Premium Part 05: Efficient Identity Management for External Users with Microsoft Entra]]></title><description><![CDATA[Managing external users is one of the most tedious—but also critical—challenges in a Microsoft Business Premium environment. With authentication , authorization , and password  security covered in earlier posts, we're now prepared to dive into identity and access management (IAM) specifically for external and guest users. Collaboration beyond organizational boundaries presents unique security challenges, particularly in balancing streamlined access and robust security practices. Microsoft...]]></description><link>https://www.chanceofsecurity.com/post/securing-microsoft-business-premium-part-05-external-identity-management</link><guid isPermaLink="false">682bb40ad2929fc8ae964e8f</guid><category><![CDATA[Microsoft Entra]]></category><category><![CDATA[Microsoft Azure]]></category><pubDate>Mon, 26 May 2025 05:00:17 GMT</pubDate><enclosure url="https://static.wixstatic.com/media/390163_194cc4d8ba934310a60858f5a1c252f7~mv2.png/v1/fit/w_1000,h_1000,al_c,q_80/file.png" length="0" type="image/png"/><dc:creator>Sebastian F. Markdanner</dc:creator></item><item><title><![CDATA[Go With the Flow: Mastering Microsoft Entra User Flows—Self-Service Sign-Up in a Workforce tenant]]></title><description><![CDATA[Managing new guest accounts can be a daunting task—especially when you’re dealing with high turnover, distributed teams, or unknown user lists. Today, I’ll show you how Microsoft Entra  User Flows , otherwise known as Self-Service Sign-Up , can help automate and streamline this process within a workforce tenant . Organizations such as retail chains, shipping companies, or accounting firms frequently collaborate with diverse groups of customers , vendors , and external partners . Often, these...]]></description><link>https://www.chanceofsecurity.com/post/go-with-the-flow-mastering-microsoft-entra-user-flows</link><guid isPermaLink="false">67f2eced946c131642706b86</guid><category><![CDATA[Microsoft Entra]]></category><category><![CDATA[Microsoft Azure]]></category><pubDate>Mon, 28 Apr 2025 05:00:10 GMT</pubDate><enclosure url="https://static.wixstatic.com/media/390163_129dbe8cf97b4024b416a7d78cef81c2~mv2.png/v1/fit/w_1000,h_1000,al_c,q_80/file.png" length="0" type="image/png"/><dc:creator>Sebastian F. Markdanner</dc:creator></item><item><title><![CDATA[Securing Microsoft Business Premium Part 04: Passwords Unlocked – Mastering Self-Service Password Reset and Password Protection]]></title><description><![CDATA[With authentication  &#38; authorization  covered in the previous posts of the series, it's now time to dive into strengthening our password policies, empowering end-users, and enhancing overall password security. As I've gone over previously , passwords aren't exactly bulletproof, but for many organizations, transitioning to a fully passwordless setup overnight isn't realistic. While we steadily work towards that passwordless dream, managing and securing passwords across the organization can...]]></description><link>https://www.chanceofsecurity.com/post/securing-microsoft-business-premium-part-04-password-protection</link><guid isPermaLink="false">67d0233d6ee571608c161059</guid><category><![CDATA[Microsoft Entra]]></category><pubDate>Thu, 03 Apr 2025 05:00:11 GMT</pubDate><enclosure url="https://static.wixstatic.com/media/390163_f099de51c0f94d19a46fd8edbdce964e~mv2.png/v1/fit/w_1000,h_1000,al_c,q_80/file.png" length="0" type="image/png"/><dc:creator>Sebastian F. Markdanner</dc:creator></item><item><title><![CDATA[Securing Microsoft Business Premium Part 03: Authorization Best Practices from Zero Trust to Complete Access Control]]></title><description><![CDATA[In Part 02 , we explored authentication , the process of verifying user identities—ensuring users are who they claim to be. Today we’ll build on that by diving into authorization—the process of determining what  authenticated users are allowed. While authentication is a foundational element of any organization’s identity and access management strategy, secure identity verification alone isn’t sufficient. Authorization completes the picture by assigning the correct permissions and controls,...]]></description><link>https://www.chanceofsecurity.com/post/securing-microsoft-business-premium-part-03-authorization</link><guid isPermaLink="false">67a939d2b0242abbd99cf5f0</guid><category><![CDATA[Microsoft Entra]]></category><category><![CDATA[Microsoft Azure]]></category><pubDate>Wed, 19 Mar 2025 06:00:13 GMT</pubDate><enclosure url="https://static.wixstatic.com/media/390163_8a8c694f478543cfbb331b9b1011a897~mv2.png/v1/fit/w_1000,h_800,al_c,q_80/file.png" length="0" type="image/png"/><dc:creator>Sebastian F. Markdanner</dc:creator></item><item><title><![CDATA[God Mode with a Timer: Using Logic Apps to Restrict Elevated Access in Entra]]></title><description><![CDATA[In my last post  I covered how to monitor the GOD Mode in Azure (Coined by the great John Savill ). While visibility and monitoring are great capabilities, there’s a big issue: the permanent  nature of the access. - Let's fix that! The way Elevated Access currently works, there’s no built-in way to manage, or restrict it—not through PIM for time- and approval-based access, not with access reviews, and not with entitlement management either. Once access is enabled for a user, it stays...]]></description><link>https://www.chanceofsecurity.com/post/restrict-elevated-access-microsoft-entra-logic-app</link><guid isPermaLink="false">67b65e8a2bd9affa71789b95</guid><category><![CDATA[Microsoft Azure]]></category><category><![CDATA[Microsoft Entra]]></category><pubDate>Mon, 03 Mar 2025 06:00:11 GMT</pubDate><enclosure url="https://static.wixstatic.com/media/390163_b977ab1652664f8a95aa29ab7f8e7d5e~mv2.png/v1/fit/w_1000,h_800,al_c,q_80/file.png" length="0" type="image/png"/><dc:creator>Sebastian F. Markdanner</dc:creator></item><item><title><![CDATA[Unlocking Microsoft Entra’s Elevated Access Logs: Better Security, Better Insights]]></title><description><![CDATA[Elevating access to manage Azure subscriptions is a valuable tool for administrators, particularly when dealing with unknown or orphaned subscriptions. However, with no built-in restrictions on when or how long this access can be used , monitoring these events is critical  to maintaining security and accountability. Global administrators occasionally need to enable Elevated Access  in Microsoft Entra to manage Azure subscriptions, but without proper oversight, this level of access can pose a...]]></description><link>https://www.chanceofsecurity.com/post/microsoft-entra-elevated-access-logs-better-security-better-insights</link><guid isPermaLink="false">67ae62087667bda10f7380bb</guid><category><![CDATA[Microsoft Azure]]></category><category><![CDATA[Microsoft Entra]]></category><pubDate>Tue, 18 Feb 2025 06:00:10 GMT</pubDate><enclosure url="https://static.wixstatic.com/media/390163_bb40e9d299fc4dfaa97a110528ab07d6~mv2.png/v1/fit/w_1000,h_800,al_c,q_80/file.png" length="0" type="image/png"/><dc:creator>Sebastian F. Markdanner</dc:creator></item><item><title><![CDATA[Securing Microsoft Business Premium Part 02: Your Authentication is Broken—Here’s How to Fix It]]></title><description><![CDATA[In the first part of this series , we laid the foundation for securing Microsoft Business Premium environments, covering the core security principles and configurations. Now, we shift our focus to authentication—the frontline of identity protection. Authentication is at the heart of securing any environment, and with evolving threats like phishing, credential stuffing, and AiTM attacks, ensuring robust authentication is non-negotiable. A compromised identity can grant an attacker unrestricted...]]></description><link>https://www.chanceofsecurity.com/post/securing-microsoft-business-premium-part-02-authentication</link><guid isPermaLink="false">67828112605f4e6cc404ff9b</guid><category><![CDATA[Microsoft Entra]]></category><pubDate>Mon, 10 Feb 2025 06:00:18 GMT</pubDate><enclosure url="https://static.wixstatic.com/media/390163_7911c1a8fb81455a905ede1f31dc37ec~mv2.png/v1/fit/w_1000,h_1000,al_c,q_80/file.png" length="0" type="image/png"/><dc:creator>Sebastian F. Markdanner</dc:creator></item><item><title><![CDATA[Your Microsoft Entra Tenant Isn’t as Secure as You Think – Fix It with Protected Actions!]]></title><description><![CDATA[Protecting highly critical configurations in our Entra tenants has never been easier! Join me as we explore Protected Actions  in Microsoft Entra and how they help us lock down security-sensitive operations. A solid Identity and Access Management (IAM) strategy based on Zero Trust principles strengthens security by enforcing separation of duties, elevating access requests , and ensuring Just-In-Time (JIT) access ,  among others. But what if you need to further restrict specific high-impact...]]></description><link>https://www.chanceofsecurity.com/post/microsoft-entra-protected-actions</link><guid isPermaLink="false">679ea014a443c466143959ea</guid><category><![CDATA[Microsoft Entra]]></category><pubDate>Mon, 03 Feb 2025 06:00:12 GMT</pubDate><enclosure url="https://static.wixstatic.com/media/390163_f31b2dfba1614cb1af258a010c94848f~mv2.png/v1/fit/w_1000,h_800,al_c,q_80/file.png" length="0" type="image/png"/><dc:creator>Sebastian F. Markdanner</dc:creator></item></channel></rss>