Measures for Securing Privileged Users in M365&Azure Every Organization Should Take
summary
84% of org admins lack proper privileged identity controls, so focus on locking down Global administrators in Entra ID: use cloud‑native, non‑mail enabled dedicated admin accounts, enforce phishing‑resistant auth (passkeys/PH2), and enable PIM with 1–2 hour activations plus authentication context and approvals. Demoed phishing proxy (evilginx) and cookie replay to show push MFA and session cookies can be abused. Require Conditional Access (P1) and Identity Protection (P2), use EDR/MDR and privileged access workstations, keep two monitored break‑glass accounts, and audit least‑privilege usage.
AI-written summary · about
chapters (14)
- 0:00Introduction and speaker intro
- 1:50Mindset for securing privileged users
- 4:19Why Entra ID is critical for security
- 9:01Shared responsibility in cloud security
- 14:18Common attack vectors in identity platforms
- 16:26Demo of credential theft risks
- 19:38Securing privileged access strategies
- 27:51Enforcing least privilege roles
- 29:58Privileged Access Workstations explained
- 32:27Conditional access for privileged users
- 36:58Break glass accounts and resilience
- 41:13Service accounts and Global Admin risks
- 45:45Complexity of identity management
- 49:22Q&A on privileged access workstations
related talks
49mTop 5 ways to secure Azure resources
45mSecuring Identity with Zero Trust
40mWhat’s Old is New: Hybrid Security for Microsoft Azure and On-Premises Tech
53mSurprising ways to escalate privileges in Entra ID
01h 01mFive best Azure Access Control practice
55mAzure Attacks Unpacked: Real-World Threats & Lessons
38mAbusing Azure Active Directory: From MFA Bypass to Listing Global Administrators
24mChaos to Control: Automating the Identity Life Cycle in the Cloud