Entra.Chat

Microsoft-managed SMS and voice MFA will stop working on February 1, 2027. That deadline makes passkey planning urgent, but enabling a new authentication method is only the first milestone.
In this episode of Entra.Chat, Merill speaks with Jai Maharaj, Product Manager at Microsoft, about the practical journey from legacy MFA to a passwordless Microsoft Entra environment. Jai explains what is actually being retired, why organizations can still use a customer-managed telecom provider, and how passkey profiles support synced and device-bound passkeys for different user personas.
The user-experience case is compelling: Microsoft reports roughly 69 seconds for password plus traditional MFA compared with about three seconds for a synced passkey. The security case is stronger still. Passkeys resist phishing by design, but Jai stresses that deploying them does not make an organization phishing-resistant until it enforces the right authentication strength and addresses the passwords and legacy applications still in the environment.
The conversation then follows the complete identity lifecycle. How do you ensure the right person receives a passkey during onboarding? How do you verify someone requesting a sensitive role? How do you recover an account without relying on knowledge-based help-desk questions? Jai connects those scenarios to Microsoft Entra Verified ID, verifiable credentials, Face Check, identity verification partners, and self-service account recovery.
Sponsored by
Scan, Score, and Secure Your Applications in Entra
Application identities represent one of the largest attack surfaces in Entra and are often among the least consistently governed. ENow AppGov Score helps IT and identity teams understand where risk exists. Its 25-check assessment evaluates Entra ID application integrations against Microsoft-recommended governance practices, analyzing:
* App registrations and enterprise apps for excessive permissions
* Expired or unmanaged secrets and certificates
* Risky consent grants
* Privileged service principals
Results are delivered as a clear, defensible risk score with actionable findings. No scripts. No manual inventory. Just a fast, read-only scan that reveals app sprawl, identity misconfigurations, and blast radius so you can prioritize remediation and strengthen your security posture.
Subscribe with your favorite podcast player or watch on YouTube 👇
About Jai Maharaj
Jai Maharaj is a Senior Product Manager at Microsoft. He works with customers and engineering teams across Microsoft Entra, with experience spanning ID Governance, Verified ID, External ID, and passkeys. He helps enterprise and public-sector organizations move from legacy authentication methods to phishing-resistant authentication.
* LinkedIn - https://www.linkedin.com/in/jai-maharaj-0938305a/
Related Links
* Microsoft-managed SMS and voice retirement timeline (discussed at 02:19 and 06:31) - https://learn.microsoft.com/entra/identity/authentication/concept-sms-voice-retirement
* Customer-managed telecom provider FAQ (mentioned at 03:41 and 07:13) - https://learn.microsoft.com/entra/identity/authentication/phone-providers-faq
* Passkey profiles, synced passkeys, and device-bound passkeys (discussed at 09:44) - https://learn.microsoft.com/entra/identity/authentication/how-to-authentication-passkeys-fido2#passkey-profiles
* Passkey concepts and Microsoft performance figures (mentioned at 14:22) - https://learn.microsoft.com/entra/identity/authentication/concept-authentication-passkeys-fido2#what-are-passkeys
* Microsoft Entra Verified ID Face Check (introduced at 31:57) - https://learn.microsoft.com/entra/verified-id/using-facecheck
* ASD/ACSC Essential Eight maturity model (mentioned at 33:41) - https://www.cyber.gov.au/business-government/asds-cyber-security-frameworks/essential-eight/essential-eight-maturity-model
* Microsoft Entra account recovery overview (discussed at 36:59) - https://learn.microsoft.com/entra/identity/authentication/concept-account-recovery-overview
* Verified ID identity verification partners (discussed at 37:12) - https://learn.microsoft.com/entra/verified-id/idv-partners
* Microsoft Entra licensing (discussed at 39:27) - https://learn.microsoft.com/entra/fundamentals/licensing
* Verified ID and Face Check pricing model (discussed at 39:27) - https://learn.microsoft.com/entra/verified-id/verified-id-pricing
* Deploy phishing-resistant passwordless authentication (mentioned at 52:34) - https://learn.microsoft.com/entra/identity/authentication/how-to-deploy-phishing-resistant-passwordless-authentication
Related Entra.Chat Episodes
* Microsoft Is Auto-Enabling Passkeys in March 2026 - https://entra.news/p/microsoft-is-auto-enabling-passkeys
* Mastering Microsoft Entra ID: Real-World Passkey Deployment Tips - https://entra.news/p/mastering-microsoft-entra-id-real
* Entra Ignite Recap: Synced Passkeys, Agent ID & The Future of Identity - https://entra.news/p/entra-ignite-recap-synced-passkeys
Chapters
00:00 Intro
02:19 Why Microsoft Is Retiring Managed SMS and Voice
03:32 What the February 2027 Deadline Means
09:27 Synced vs Device-Bound Passkeys
14:22 From 69 Seconds to Three
19:02 Making Passkeys Easier for Users
23:14 Customer Passkey Deployment Lessons
28:41 The Secure Bootstrapping Problem
31:57 Verified ID and Face Check
33:41 Essential Eight and High-Value Access
36:24 Self-Service Account Recovery
39:27 Licensing and Recovery Economics
44:45 Why Face Check Augments Passkeys
49:40 Enforce Phishing Resistance and Build a Roadmap
Podcast Apps
Apple Podcast - https://entra.chat/apple
YouTube - https://entra.chat/youtube
Spotify - https://entra.chat/spotify
Overcast - https://entra.chat/overcast
Pocketcast - https://entra.chat/pocketcast
Others - https://entra.chat/rss
Merill’s socials
YouTube - youtube.com/@merillx
LinkedIn - linkedin.com/in/merill
Twitter - twitter.com/merill
TikTok - tiktok.com/@merillf
Bluesky - bsky.app/profile/merill.net
Mastodon - infosec.exchange/@merill
Threads - threads.net/@merillf
GitHub - github.com/merill


Get full access to Entra.News - Your weekly dose of Microsoft Entra at entra.news/subscribe

An Entra GSA migration should not mean throwing away years of useful SSE policy work and rebuilding every application, segment, and rule by hand.
Existing configuration carries hard-won intent: which populations need access, which destinations should be blocked, and which exceptions keep the business running. Migrate2GSA creates a path to preserve the useful parts while making the migration a deliberate cleanup opportunity.
In this episode of Entra.Chat, I spoke with Andres Canello, Principal Product Manager at Microsoft and creator of Migrate2GSA. Andres demonstrates how the open-source toolkit exports configuration from third-party products, converts it into a common CSV schema, gives administrators an intentional review step, and provisions the approved configuration into Global Secure Access through Microsoft Graph.
The goal is not to configure the product end to end or remove human judgment. Andres describes it as a way to accelerate the repetitive 80%. Conflicting segments default to “do not provision,” existing applications are skipped, generated Conditional Access policies remain disabled, and there is no delete API call in the toolkit.
The conversation also covers greenfield provisioning, backup and restore, reusable consultant baselines, and the unusual development story behind more than 30,000 lines of PowerShell. Andres explains why detailed, published specifications produced better AI-generated code than incremental prompting—and why the intent and edge cases in an open-source contribution matter more than who typed the implementation.
Subscribe with your favorite podcast player or watch on YouTube.
About Andres Canello
Andres Canello is a Principal Product Manager at Microsoft, where he works at the intersection of modern identity and Secure Service Edge. Over his 15 years at Microsoft, he was a founding member of the Entra Global Secure Access team, helping shape the product before it launched, and has since guided some of the largest identity and secure-access deployments in the industry, from banks and miners to national governments. He’s the creator of Migrate2GSA, an open-source migration toolkit used by organizations around the world, which he built end-to-end using AI-assisted, spec-driven development.
* Andres Canello on LinkedIn
* Andres Canello on X/Twitter
Sponsored by
Maester Cloud turns every Maester and Microsoft Zero Trust Assessment run into a durable evidence trail. See new failures, fixes, accepted risks, and posture changes across every tenant - without digging through old HTML reports.
* Keep 5+ years of tenant history in your chosen Azure region
* Compare runs, spot drift, and get change alerts
Become a Founding Supporter for $99/month to fund open-source Maester development, shape the roadmap, and get self-hosted private-preview access plus 10% off hosted for life.
Related Links
* Plan and troubleshoot UserPrincipalName changes in Microsoft Entra ID (mentioned at 04:07)
* Azure AD Mailbag: Conditional Access Q&A by Andres Canello (mentioned at 06:43)
* Migrate2GSA documentation (mentioned at 45:37)
* Migrate2GSA source repository (mentioned at 45:37)
Related Entra.Chat Episodes
* How to Migrate from Legacy VPNs to Entra Private Access (Real Strategies from a Veteran)
* Global Secure Access Explained: Real-World Rollouts, Mistakes, and Best Practices
* Identity-Centric Network Security: Entra Global Secure Access Architecture & Benefits
Chapters
00:00 Intro
01:05 Andres Canello's 15 Years in Microsoft Identity
06:43 A Conditional Access Mistake Admins Still Make
11:29 From Early Customer Pilots to Entra GSA
13:21 Why SSE Migrations Should Not Start From Scratch
18:31 Beyond Migration: Backup Restore and Greenfield
23:27 Export Convert Review and Provision
27:02 How Specifications Made AI-Generated PowerShell Work
35:22 Conflict Detection and the Human Review Gate
39:14 Microsoft Graph Provisioning with Safety Built In
43:35 Automating the Repetitive 80 Percent
46:15 Contributing to Migrate2GSA
Podcast Apps
* Entra.Chat
* Apple Podcast
* YouTube
* Spotify
* Overcast
* Pocketcast
* Other podcast apps
Merill’s socials
* YouTube
* LinkedIn
* Twitter
* TikTok
* Bluesky
* Mastodon
* Threads
* GitHub


Get full access to Entra.News - Your weekly dose of Microsoft Entra at entra.news/subscribe

Conditional Access no longer begins and ends with identity signals.
Microsoft Purview can now influence the controls Entra administrators are asked to implement. From insider-risk conditions in Conditional Access to inline protection for sensitive data moving toward unsanctioned AI apps. That means Entra teams need enough Purview knowledge to understand what triggers a policy, how users experience it, and who should respond when an alert fires.
In this episode of Entra.Chat, Merill speaks with Ray Reyes, Principal Security Consultant at Engage Squared and author of Mastering Microsoft Purview Deployment in the Era of AI. Ray explains Data Loss Prevention and Insider Risk Management in plain language, then follows their integrations into Microsoft Entra ID, Microsoft Defender XDR, and Global Secure Access.
The conversation moves beyond product configuration. A policy can be technically simple and still require identity, network, data-security, HR, management, and data-owner teams to agree on scope, ownership, education, escalation, and remediation. Ray’s practical advice is to understand the neighbouring Microsoft security products at a high level and deploy Purview gradually: start in audit mode or with a limited group, learn from the impact, and expand with the business.
Ray also shares the story of the charity he and his wife started in Nepal, how it grew from supporting roughly 30 street children to reaching thousands, and how that chapter changed his perspective on work and stress. He and Merill close with an honest discussion about burnout, layoffs, gratitude, personal branding, and building a career safety net outside any one employer.
Sponsored by
Recent layoffs have left a lot of strong professionals in limbo.
That’s why we built Sponsor a Seeker, a simple way for the community to lift each other up.
For just $29, you can gift a full 3-month Job-Hunt Pass packed with: • Unlimited resume & job description scans • AI-powered rewrites that actually beat ATS systems • Professional cover letter generation
Every dollar goes directly to the seeker.
You can: → Sponsor someone like Alex M. (recently laid off front-end engineer) → Or request sponsorship for yourself
Either way, you’re helping keep momentum alive in a tough market.
👉 Take action here: pastthebots.com/sponsor
Let’s turn “I was laid off” into “Someone had my back.”
Thank you for being part of this community, Rod Trent Past the Bots
Subscribe with your favorite podcast player or watch on YouTube.
About Ray Reyes
Ray Reyes is a Principal Security Consultant at Engage Squared and the author of Mastering Microsoft Purview Deployment in the Era of AI. He previously worked at Microsoft, where he led data-security subject-matter expertise across Asia Pacific and Japan and helped customers deploy Microsoft Purview and Microsoft Defender XDR. His work now spans identity, data security, and the wider Microsoft security stack.
* LinkedIn → linkedin.com/in/ray-reyes-598062125
Related Links
* Mastering Microsoft Purview Deployment in the Era of AI by Ray Reyes (mentioned at 00:00 and 02:25)
* Microsoft Purview overview (discussed from 03:29)
* Adaptive Protection in Microsoft Purview (discussed at 22:09)
* Learn about Data Loss Prevention for Network Data Security (discussed at 33:31)
* Configure Microsoft Entra Internet Access content filtering (discussed at 34:18)
* The Resilience Project: Finding Happiness through Gratitude, Empathy and Mindfulness by Hugh van Cuylenburg (mentioned at 47:25)
Related Entra.Chat Episodes
* How Microsoft Is Securing AI Agents in Entra — Conditional Access, Zero Trust & the “Block” Debate
* How to Migrate from Legacy VPNs to Entra Private Access
* What’s New in Microsoft Entra — May 2026: Passkeys, Agents & Cloud Sync
Chapters
00:00 Intro
03:29 Why Purview Matters to Entra Admins
05:39 How Microsoft Purview Evolved
09:46 Data Loss Prevention Explained
16:04 Insider Risk and Employee Departures
22:09 Adaptive Protection Meets Conditional Access
25:00 Education and Alert Ownership
28:51 Breaking Down the Security Silos
33:31 Network Data Security and Unsanctioned AI
38:29 How to Roll Out Purview Safely
41:20 Ray’s Charity Work in Nepal
47:10 Resilience Burnout and a Career Safety Net
Podcast Apps
Apple Podcast - https://entra.chat/apple
YouTube - https://entra.chat/youtube
Spotify - https://entra.chat/spotify
Overcast - https://entra.chat/overcast
Pocketcast - https://entra.chat/pocketcast
Others - https://entra.chat/rss
Merill’s socials
YouTube - youtube.com/@merillx
LinkedIn - linkedin.com/in/merill
Twitter - twitter.com/merill
TikTok - tiktok.com/@merillf
Bluesky - bsky.app/profile/merill.net
Mastodon - infosec.exchange/@merill
Threads - threads.net/@merillf
GitHub - github.com/merill


Get full access to Entra.News - Your weekly dose of Microsoft Entra at entra.news/subscribe

Xbox Security runs a gaming-specific Microsoft Entra baseline across more than 70 tenants every night.
The scale is striking: about 50 controls, dozens of independently operated game-studio tenants, and one parallel pipeline that checks whether each environment still matches Xbox’s security intent. When a Conditional Access policy moves to report-only or a required service principal loses a permission, the next run finds it.
In this episode of Entra.Chat, Merill speaks with Audrey Long, Principal Cloud Security Architect in Xbox Security at Microsoft, and Sam Erde, SecureShield Architect at Patriot Consulting and a Maester maintainer. Audrey explains how Xbox Security extended Maester with custom PowerShell, GitHub Actions, a multi-tenant service principal, federated identity credentials, dashboards, ticketing, and time-bound exceptions.
The result is more than a posture report. Findings flow into an operational lifecycle with owners and deadlines. Studios get readable reports, deep links to the affected object, and remediation guidance. Security teams can answer audit questions without interrupting all the tenant admins, while the Maester pipeline keeps read-only observability separate from remediation authority.
The conversation also covers why a Microsoft-wide baseline needs adapting for gaming acquisitions, how custom tests encode an organization’s intent, why security configuration deserves regression tests, the Investigate status Audrey’s team helped introduce, and how administrators can use AI as a first-draft assistant for PowerShell and CI/CD without outsourcing validation.
Subscribe with your favorite podcast player or watch on YouTube
Sponsor
Maester Cloud turns every Maester and Microsoft Zero Trust Assessment run into a durable evidence trail. See new failures, fixes, accepted risks, and posture changes across every tenant—without digging through old HTML reports.
* Keep 5+ years of tenant history in your chosen Azure region
* Compare runs, spot drift, and get change alerts
Maester Cloud is in active development. Join the waitlist for hosted, self-hosted, or enterprise onboarding updates.
About Audrey Long
Audrey Long is a Principal Cloud Security Architect in Xbox Security at Microsoft. She focuses on Microsoft Entra and identity security, as well as securing Azure, AWS, and Google Cloud environments across Xbox and its game studios. In this episode, she shares how her team built a gaming-specific Entra baseline and operationalized it across more than 70 tenants.
* LinkedIn - https://www.linkedin.com/in/aulong/
About Sam Erde
Sam Erde is part of the Maester core maintainer team, a Microsoft MVP, and a SecureShield Architect at Patriot Consulting. He focuses on Active Directory, Microsoft Entra ID, Microsoft 365 security, and practical PowerShell tooling for defenders.
LinkedIn - https://www.linkedin.com/in/samerde/
Related Links
* Maester, installation guide, and source code (mentioned at 02:19) - Maester · installation guide · GitHub source
* Continuous monitoring with Maester and GitHub Actions (mentioned at 14:38) - https://maester.dev/docs/monitoring/github/
* Writing custom Maester tests (mentioned at 22:39) - https://maester.dev/docs/writing-tests/
* Connect-Maester permissions and read-only access (mentioned at 24:38) - https://maester.dev/docs/connect-maester/
* Zero Trust Assessment: Secure your tenant (mentioned at 25:46) - https://entra.news/p/find-your-tenants-hidden-flaws-in
* Maester’s Investigate test-result status (mentioned at 34:02) - https://maester.dev/docs/writing-tests/formatting-test-results/
* Making Security Invisible for Game Developers (mentioned at 45:52) - https://opsmatters.com/videos/making-security-invisible-game-developers
Related Entra.Chat Episodes
* How to Secure Copilot Agents, Azure DevOps & Defender (+ more) with Maester 2.1 (Full Breakdown)
* Zero Trust Assessment: Secure your tenant
* How to Design Bullet-Proof Conditional Access Policies in Microsoft Entra ID
Chapters
00:00 Intro00:42 Meet Audrey Long02:19 From 50 Controls to 70+ Tenants05:11 Making an Entra Baseline Gaming-Specific08:32 Why Custom Maester Tests Matter11:07 Governance and Nightly Automation15:27 From Findings to Remediation18:07 Reports Studios Can Actually Use22:39 Building Custom Multi-Tenant Tests28:07 Security Intent as Regression Tests30:48 Catching Drift and Producing Audit Evidence41:39 CI/CD and AI for Security Admins
Podcast Apps
Entra.Chat - https://entra.chat
Apple Podcast - https://entra.chat/apple
YouTube - https://entra.chat/youtube
Spotify - https://entra.chat/spotify
Overcast - https://entra.chat/overcast
Pocketcast - https://entra.chat/pocketcast
Others - https://entra.chat/rss
Merill’s socials
YouTube - youtube.com/@merillx
LinkedIn - linkedin.com/in/merill
Twitter - twitter.com/merill
TikTok - tiktok.com/@merillf
Bluesky - bsky.app/profile/merill.net
Mastodon - infosec.exchange/@merill
Threads - threads.net/@merillf
GitHub - github.com/merill


Get full access to Entra.News - Your weekly dose of Microsoft Entra at entra.news/subscribe

Microsoft Entra Agent ID uses familiar application and service-principal objects under the hood, but its one-to-many hierarchy creates a different security boundary. A blueprint can be associated with many agent identities. When that blueprint belongs to a third-party provider and is trusted across customer tenants, the provider’s credential security becomes part of every customer’s risk model.
In this episode of Entra.Chat, Merill speaks with Katie Knowles, Senior Security Researcher at Datadog, about her three-part security analysis of Microsoft Entra Agent ID. Katie explains the blueprint, blueprint principal, agent identity, and agent-user relationships before walking through a cross-tenant compromise demonstration: compromised blueprint credentials, enumeration of associated agents, token requests in trusting tenants, permission inspection, and selection of a useful target identity.
That path does not automatically grant Global Administrator access. Its impact depends on what the target agent identity has been permitted to do. The important lesson is the control point: one blueprint can sit upstream of many identities, tenants, and permission sets.
Katie and Merill also discuss tenant-owned versus vendor-owned blueprints, the Agent ID Administrator role, first-party agent creation through Microsoft platforms, why production client secrets compound the blast radius, workload identity federation, separating blueprints by risk, reusing app-registration detections, and Microsoft Entra ID Protection for agents.
REGISTER: Hidden Risk of App Permissions in Entra ID
Many Microsoft Entra ID environments contain third-party and custom applications with permissions that are broader than necessary, and most organizations lack visibility into how those permissions are being used. Excessive Microsoft Graph permissions and unused access increase the risk of OAuth abuse and privilege escalation.
Join our live session on July 22 to learn how to:
* Evaluate delegated versus application permissions
* Build an effective app governance strategy
* Reduce unnecessary access without disrupting users
You’ll also see how a free AppGov Score assessment can help identify governance gaps and where unused permissions reporting fit into a least-privilege approach.
Subscribe with your favorite podcast player or watch on YouTube
About Katie Knowles
Katie Knowles is a Senior Security Researcher at Datadog focused on Azure security research, cloud identity, and securing emerging technologies.
* LinkedIn - https://linkedin.com/in/kaknowles
* X/Twitter - https://twitter.com/_sigil
* GitHub - https://github.com/siigil
* Website - https://kknowl.es/
* Microsoft MVP profile - https://mvp.microsoft.com/en-US/MVP/profile/a3547b6a-6a4d-4aa0-840f-23b858c43c8b
Related Links
* Entra Agent ID: The blueprint blast radius (mentioned at 51:39) - https://securitylabs.datadoghq.com/articles/agent-id-blueprint-blast-radius/
* Entra Agent ID: Inside a cross-tenant agent compromise (mentioned at 51:39) - https://securitylabs.datadoghq.com/articles/agent-id-inside-agent-compromise/
* Entra Agent ID: Protect, detect, respond (mentioned at 51:39) - https://securitylabs.datadoghq.com/articles/agent-id-protect-detect-respond/
* Disable agent identities in your tenant (mentioned at 04:00 and 49:33) - https://learn.microsoft.com/entra/agent-id/disable-agent-identities
* Investigating suspicious AI workflows in Microsoft Entra Agent ID: Agent’s user account (mentioned at 05:14) - https://redcanary.com/blog/threat-detection/entra-id-ai-workflows-teams/
* Entra Agent ID from a Security Perspective (mentioned at 20:38) - https://blog.compass-security.com/2026/06/entra-agent-id-from-a-security-perspective/
* Spying On Your ISVs Credential Choices (mentioned at 38:11) - https://ericonidentity.com/2025/01/13/spying-on-your-isvs-credential-choices/
* Who Are the Robots? Uncovering AI Agents Identities (mentioned at 51:39) - https://www.youtube.com/watch?v=mMxACHKIAwY
* AzTier (mentioned at 51:39) - https://aztier.com/
* Microsoft Entra Agent ID key concepts - https://learn.microsoft.com/entra/agent-id/key-concepts
* Workload identity federation - https://learn.microsoft.com/entra/workload-id/workload-identity-federation
* ID Protection for agents - https://learn.microsoft.com/entra/id-protection/concept-risky-agents
Related Entra.Chat Episodes
* If You Manage Entra Permissions, Watch This Before Deploying Agents - https://entra.news/p/if-you-manage-entra-permissions-watch
* From Windows Core to Leading Agent ID: Vince Smith’s Microsoft Story - https://entra.news/p/from-windows-core-to-leading-agent
* Attackers Are Targeting the AI Ecosystem You Cannot See - https://entra.news/p/attackers-are-targeting-the-ai-ecosystem
Chapters
00:00 Intro
01:12 Katie’s Three-Part Agent ID Research
05:40 Agent ID Objects Under the Hood
06:24 One Blueprint, Many Agent Identities
08:43 The Multitenant Trust Boundary
17:33 Cross-Tenant Compromise Walkthrough
28:29 First-Party and Third-Party Blueprints
36:56 Stop Using Client Secrets
38:40 Workload Identity Federation
46:24 Permissions and Privilege Boundaries
49:33 Detecting and Responding to Agent Abuse 51:29 What Comes Next for Agent ID
Podcast Apps
Apple Podcast - https://entra.chat/apple
YouTube - https://entra.chat/youtube
Spotify - https://entra.chat/spotify
Overcast - https://entra.chat/overcast
Pocketcast - https://entra.chat/pocketcast
Others - https://entra.chat/rss
Merill’s socials
YouTube - youtube.com/@merillx
LinkedIn - linkedin.com/in/merill
Twitter - twitter.com/merill
TikTok - tiktok.com/@merillf
Bluesky - bsky.app/profile/merill.net
Mastodon - infosec.exchange/@merill
Threads - threads.net/@merillf
GitHub - github.com/merill


Get full access to Entra.News - Your weekly dose of Microsoft Entra at entra.news/subscribe