Dynamic Technical Solutions, Inc.

06/22/2026

🔐 Honest question: if every user in your tenant passed MFA tomorrow, how many would survive a real phishing page? "MFA is on" and "phishing-resistant" are not the same sentence, and NIST's July 2025 revision made that official.

Your factor count was never the bar. Phishing resistance is. That rule sorts every Entra method into three tiers: enable, restrict, or turn off.

✅ FIDO2 keys, Windows Hello, and CBA clear AAL3 (non-exportable)
✅ Device-bound passkeys in Authenticator sit in the phone's secure chip (non-synced)
✅ Synced passkeys are phishing-resistant but cap at AAL2

⚠️ Push and TOTP are still relayable through a proxy
⚠️ SMS and voice are SIM-swappable and being phased out
⚠️ Email OTP and security questions fail outright

Breakdown is in the first comment. Open your Authentication Methods policy and check: is anything in the DISABLE column still on for privileged users? Tell me what you find, and a like helps another defender catch theirs.

🔔 Subscribe to my LinkedIn security articles for the next one: https://lnkd.in/eSxv_ZzK

06/17/2026

🛡️ Quick question: if you let staff read work email on personal phones (you do), did you decide how that data is protected on purpose, or did it just happen?
Most BYOD programs reach for full device management (MDM) on phones the company does not own. That is the wrong layer. The exposure lives inside the app, and there is a lighter control aimed right at it: Mobile Application Management (MAM).
✅ Containerize corporate data on an unenrolled phone in about an afternoon
✅ App PIN, encryption, and selective wipe that never touches personal photos
✅ No privacy fight, no enrollment project, no help desk overhead
⚠️ Only protects apps built on the Intune App SDK
⚠️ Does not assess device health (pair it with Conditional Access)
⚠️ A control retires June 30 that silently stops enforcing if you miss it
The full article (with the clean MDM-vs-MAM governance line you can drop into policy) is in the first comment. Read it, then check whether any BYOD policy still leans on the retiring grant before month end. If it reframed the question, a like puts it in front of more defenders.

🔔 Subscribe to my LinkedIn security articles to get the next one when it drops. https://www.linkedin.com/in/shawnmay-dtsprincipalarchitect/recent-activity/newsletter/

https://www.linkedin.com/pulse/you-dont-need-manage-phone-data-shawn-may-s1zie

Most BYOD programs solve the wrong problem. They reach for full device management when the actual exposure lives one layer up, inside the app.

06/14/2026

🔐 The scariest moment of your day is one you never see: an admin approves a normal-looking prompt, and an attacker walks off with their live session. No password cracked. No alarm. They are just in - as your admin.

This is the biggest hole in "but we have MFA." The push or text gets relayed live - they steal the session, not the code.

Entra ID shuts this down for your riskiest accounts. The rule is simple: no security (FIDO2) key, no admin powers.

✅ Give admins a hardware security (FIDO2) key - the strongest login there is
✅ Force it with a Conditional Access policy, so only the key gets in
✅ Keep the session short - a stolen token dies almost instantly

⚠️ A "passkey on your phone" is not strong enough for admins
⚠️ Register the keys before you flip the switch, or you lock yourself out
⚠️ Test in report-only first: no surprises, no angry tickets

Full walkthrough in the first comment. Roll it out to admins first and tell me how it went - if it saved you a headache, a like helps the next CISO dodge it.

🔔 Subscribe for the next: https://lnkd.in/e-58ecWq

06/13/2026

🗝️ Quick question: when a new hire needs a license, who clicks it - and how long do they wait? If the answer is "an admin, and a day or two", you are paying for a manual step Entra can erase.

Entra IGA access packages turn license assignment into governance: the package adds the user to a group, and group-based licensing applies the SKU on its own.

✅ Zero manual license clicks (the group does it)
✅ Self-service requests with real approval gates
✅ Access expires on its own, and the seat is reclaimed
✅ A clean audit trail for every grant and removal

⚠️ Up-front design work (role-assignable groups, policies)
⚠️ Group-based licensing needs the right licensing tier
⚠️ Break-glass and service accounts still need a plan

The full walkthrough is in the first comment. Read it, map one SKU to an access package this week, and tell me how many manual grants it kills - a like puts it in front of more identity folks.

🔔 Subscribe to my LinkedIn security articles to get the next one.

04/08/2026

I see this confusion all the time. Many teams block USB mass storage and assume they have also closed off USB security keys. They have not.

After 20+ years working as a senior cybersecurity consultant across large and international environments, I can tell you this misunderstanding shows up far more often than people want to admit.

Let me just say this topic can be confusing, but here is the reality. If you are enforcing USB restrictions, conditional access, device compliance, or phishing-resistant MFA in your Microsoft environment, there are a few realities the business, clients, and users SHOULD understand.

A USB security key is not the same thing as a USB thumb drive. Blocking one does not automatically block the other. That matters in Microsoft cloud environments because identity decisions are being made across Entra ID, the device state, and the browser session. If those controls are not aligned, what exactly do you think is being enforced?

This is where production reality bites. A user can be on a managed device, in a supported browser, and still present an authentication method your team forgot to account for. Or the opposite, a legitimate strong factor gets broken because security teams treated all USB the same.

That gap creates policy failures, user friction, and false confidence. False confidence is the dangerous one.