Entra.Chat

In this episode of Entra Chat, we sit down with Christina Morillo, the Senior Director of Information Security for the New York Football Giants, to explore her inspiring transition from an identity specialist to a top-tier security leader. Christina shares her “ground floor” start at a technical help desk and her progression through network administration and specialized identity roles at Microsoft. Her story is a powerful testament to the “learn-it-all” mindset, illustrating how a deep baseline in Active Directory and a genuine curiosity about the broader security landscape paved the way for her current leadership role in a high-profile organization.
The conversation dives deep into the essential skills required to grow from a niche technical role into a broader Director or CISO position. Christina emphasizes that while technical proficiency is the foundation, “soft skills” such as storytelling and the ability to pitch security solutions as business value are what truly allow a leader to secure executive buy-in. She encourages professionals not to restrict themselves to one domain but to embrace both breadth and depth, leveraging community engagement to understand the shared struggles across different security verticals.
Subscribe with your favorite podcast player or watch on YouTube 👇

Sponsored by:
Entra ID Credential Gaps That Cause Outages
In Microsoft Entra ID, outages often start small: an expired client secret, or a lapsed certificate quietly breaks an integration. Traditional controls don’t easily track credential expiry, so issues surface only after something fails. Teams are left asking:
* Which app secrets are expiring and when?
* Which certificates are at risk?
* How many integrations are we managing?
Unanswered, these questions lead to avoidable outages, spikes in service desk tickets, and users losing access and bringing projects to a halt. ENow AppGov Credential Monitor continuously tracks expiring secrets and certificates across your Entra ID apps, alerting your team before credentials expire and integrations fail. Get a 7-day free trial to see how it can help you stay ahead.

About Christina Morillo
Christina Morillo is a seasoned cybersecurity and technology executive with over two decades of cross-domain experience leading enterprise security, cloud architecture, and identity programs. As an Information Security Officer and trusted advisor, and in her current role as Senior Director of Information Security at The New York Football Giants, she blends technical depth with strategic leadership to drive resilience, regulatory alignment, and business impact.
Her career spans diverse industries, including financial services, big tech, and professional sports, bringing a unique perspective to every challenge. Christina is also a published O’Reilly author (Zero Trust Networks: Second Edition & 97 Things Every Information Security Professional Should Know) and is passionate about making security and technology accessible, relatable, and actionable for all.
LinkedIn - https://www.linkedin.com/in/christinamorillo/
📗 Chapters
00:00 Intro Chat
00:21 Meet Christina Murillo
01:38 From Helpdesk to Identity
05:40 Discovering the World of Security
07:26 Transitioning to a Broader Security Role
11:47 The Power of Curiosity and Collaboration
19:31 Embracing AI and New Technologies
22:01 Storytelling and Pitching to Executives
28:24 Adapting to Constant Industry Change
32:41 Tailoring Career Advice for Today’s World
Podcast Apps
🎙️ Entra.Chat - https://entra.chat
🎧 Apple Podcast → https://entra.chat/apple
📺 YouTube → https://entra.chat/youtube
📺 Spotify → https://entra.chat/spotify
🎧 Overcast → https://entra.chat/overcast
🎧 Pocketcast → https://entra.chat/pocketcast
🎧 Others → https://entra.chat/rss
Merill’s socials
📺 YouTube → youtube.com/@merillx
👔 LinkedIn → linkedin.com/in/merill
🐤 Twitter → twitter.com/merill
🕺 TikTok → tiktok.com/@merillf
🦋 Bluesky → bsky.app/profile/merill.net
🐘 Mastodon → infosec.exchange/@merill
🧵 Threads → threads.net/@merillf
🤖 GitHub → github.com/merill


Get full access to Entra.News - Your weekly dose of Microsoft Entra at entra.news/subscribe

Passkeys are one of those technologies that sound simple on paper.
Turn them on.Users register them.Passwords go away.Everyone is more secure.
But in the real world, passkey rollouts are not just an authentication setting. They are a product rollout, a user experience change, a support change, and an operational change all at once.
In this episode, I spoke with Vincent Delitz from Corbado, who has worked on large-scale passkey deployments in customer identity scenarios, including public-sector and consumer environments with millions of users. While the examples come from the CIAM world, many of the lessons apply directly to workforce identity and Microsoft Entra deployments as well.
Sponsored by:
Cloud RADIUS built for Entra + Intune environments
EZRADIUS was designed and built by ex-Microsoft engineers with deep Entra and Intune experience. It integrates seamlessly into the Microsoft ecosystem, making it easy to migrate from your on-prem NPS server to a modern, zero-trust network with full support for cloud-first and hybrid environments.
* Deploy in minutes: no on-prem servers, no Windows updates
* Certificate-based auth: EAP-TLS support for Microsoft Cloud PKI or any CA
* Intune compliance checks for zero-trust Wi-Fi and VPN access
* Built for teams of 10 to 10,000: no minimums, no enterprise gatekeeping
* Pay only for users that connect with usage-based pricing
Start your 30-day trial (no credit card required) or book a demo to see how “EZ” it is.
Here are five practical lessons from the conversation.
1. Know why you are rolling out passkeys
Before you start the rollout, be clear on the reason.
Most organisations adopt passkeys for one or more of these reasons:
SecurityPasskeys are phishing-resistant and remove many of the risks that come with passwords, SMS OTP, and other phishable methods.
User experienceSigning in with Face ID, Touch ID, Windows Hello, or a security key can be faster and easier than typing passwords and completing MFA prompts.
Cost reductionIn customer identity scenarios, passkeys can reduce SMS OTP costs. In workforce scenarios, they can reduce password reset and sign-in related help desk calls.
The key lesson is this: your rollout strategy should match your goal.
If your goal is security, you need to think about when and how to retire phishable methods.If your goal is adoption, you need to make passkeys the easiest path.If your goal is cost reduction, you need to measure whether users are actually moving away from the older methods.
Simply enabling passkeys is not the same as achieving the outcome.
2. Use a staged rollout, not a big bang
One of the biggest mistakes is assuming you can turn on passkeys and immediately remove passwords.
That sounds clean from a security perspective, but in reality it can create confusion, support tickets, and failed sign-ins.
A better model is a staged rollout:
Stage 1: Offer passkeys as an option
Start by making passkeys available. Let users register and begin using them without taking away existing methods immediately.
Stage 2: Nudge adoption
Do not leave passkeys buried as “just another sign-in method.” Make them visible. Make them the preferred option where possible. Help users understand why they should use them.
Stage 3: Gradually retire phishable methods
Once you can see that a user or group has been successfully using passkeys for a period of time, then you can start reducing reliance on passwords, SMS, or other weaker methods.
Stage 4: Fix recovery
This is the part many teams forget.
Once passkeys become the primary sign-in method, account recovery becomes the new weak point. If recovery still relies on phishable methods or manual help desk processes, attackers will target that path instead.
A passkey rollout is not complete until recovery is also secure.
3. Passkeys move complexity from the backend to the user’s device
With passwords, SMS OTP, or push notifications, a lot of the complexity sits in the backend.
With passkeys, much more happens on the client side.
That means success depends on things like:
The user’s device.The browser version.The operating system.The credential manager.Whether Bluetooth is enabled.Whether the passkey is synced.Whether the user is on a managed device or BYOD.Whether a password manager has changed the sign-in experience.
This is a big mindset shift.
For example, cross-device passkey sign-in often relies on Bluetooth proximity checks. That is great when it works. But what happens if Bluetooth is disabled on a kiosk, blocked by policy, or unavailable on a shared device?
In the episode, we discussed a real-world example where a rollout assumed passkeys would work for retail staff using shared kiosks, only to discover later that Bluetooth was disabled in that environment.

That is the sort of issue you want to find before go-live, not after a three-month project.
The practical takeaway: test the real environments your users will sign in from. Not just your own managed test devices.
4. Your backend logs may not tell the full story
This was one of the most important lessons from the episode.
Passkey success rates can look great in backend logs, but still miss a large part of the user experience.
Why?
Because many failures happen before the backend sees anything useful.
A user may not have the passkey on the current device.The credential manager may not appear.The browser may have a bug.The user may cancel the Face ID or Touch ID prompt.The passkey may have been deleted locally.The device may try to use the wrong credential manager.The user may think registration worked, even though the backend blocked it.
From the backend, you might only see the successful challenges. That can make your success rate look much better than the lived experience.
This is why observability matters.
For customer identity platforms, you may be able to add frontend telemetry and track where users get stuck. In workforce scenarios, you may not be able to instrument the Entra sign-in page directly, but you can still look for signals elsewhere:
Which users are passkey-capable?Which devices and browsers are being used?Which users registered passkeys but are not using them?Which support tickets map to specific OS, browser, or credential manager combinations?Which groups are still falling back to passwords or SMS?
The lesson: do not rely on a single “success rate” number. It may hide the real rollout problems.
5. Support multiple passkeys and explain the mental model
A common mistake is limiting users to one passkey.
That may sound tidy, but it does not match how people actually work.
A user may have a Windows laptop, a Mac, an iPhone, an Android phone, a password manager, and a physical security key. Some passkeys sync. Some do not. Some are device-bound. Some are stored in iCloud Keychain, Google Password Manager, Bitwarden, 1Password, Windows Hello, or on a physical key.
If users can only register one passkey, they may be locked out when they move to another device.
A better approach is to allow multiple passkeys and make it clear what each one is for.
For example:
One passkey in iCloud Keychain.One in Google Password Manager.One in an enterprise password manager.One physical security key.One backup key for critical accounts.
This also means communication matters.
Users do not always understand terms like “FIDO2,” “WebAuthn,” “AAGUID,” “attestation,” or even “passkey.” They understand things like:
Sign in with your face.Sign in with your fingerprint.Use your security key.Use the passkey saved on this device.
The more technical your language, the more likely users are to get confused.
This applies internally as well. Even project teams need a shared vocabulary. Are you talking about synced passkeys? Device-bound passkeys? Security keys? Windows Hello for Business? Platform credentials? Roaming authenticators?
If the project team is confused, the users definitely will be.
Bonus lesson: Attestation matters, but not for every user
We also discussed attestation, which is one of those topics that can get confusing quickly.
In simple terms, attestation lets an authenticator prove what type of device or security key it is. This is useful when you want to control exactly which authenticators are allowed.
For example, for privileged admins, you may want to require specific physical security keys issued by the organisation. In that case, attestation can help you enforce that only approved keys are used.
But synced passkeys are different.
If a passkey is stored in iCloud Keychain, Google Password Manager, Bitwarden, or another synced credential manager, it can move across devices. That breaks the model where you can prove it belongs to one specific physical authenticator.
So the practical model may be:
Use stricter device-bound passkeys and attestation for privileged users.Allow synced passkeys for broader user populations where usability and adoption matter more.Be clear about the trade-off.
Synced passkeys may not give you the same level of device control as a hardware key, but they are still a huge improvement over passwords and many phishable MFA methods.
Final thoughts
The big takeaway from this episode is that passkey success is not just about enabling the feature.
You need to plan for adoption, device readiness, recovery, support, telemetry, and user education.
Passkeys can absolutely improve security and user experience, but only if the rollout is treated as a real change program.
The teams that succeed will be the ones that ask the hard questions early:
Why are we rolling this out?Which users are ready?Which devices are not?What will break on day two?How will users recover access?How will we know whether adoption is actually happening?
Passkeys are the future of authentication, but the rollout still needs careful planning.
Subscribe with your favorite podcast player or watch on YouTube 👇

About Vincent Delitz
Vincent Delitz is the Co-founder and Managing Director at Corbado, the passkey intelligence platform designed specifically for enterprise CIAM teams. Based in Munich, Vincent is a software engineer turned founder who has been deeply focused on the technology since the term “passkeys” first emerged in 2022.
Through Corbado, he helps large-scale B2C enterprises understand why passkey adoption might be flat, identify what’s breaking logins, and successfully scale passkeys alongside their existing IDPs (including Entra, Okta, Auth0, Ping, ForgeRock, or in-house solutions). Corbado is trusted by major organizations like VicRoads (supporting 5 million users), as well as leaders in financial services and e-commerce. As a speaker, Vincent frequently shares his expertise on passkey adoption and the often-overlooked “Day 2” passkey problems that don’t appear in standard vendor documentation.
LinkedIn - https://www.linkedin.com/in/vincent-delitz/
🔗 Related Links
* How to enable passkeys (FIDO2) in Microsoft Entra ID - https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-authentication-passkeys-fido2
* Enterprise Passkey Deployment Challenges - https://www.corbado.com/blog/enterprise-passkey-deployment-challenges
* Corbado - https://www.corbado.com/
📗 Chapters
04:10 The Consumer vs. Workforce Scale
07:49 Uncovering the True Motivations for Passkeys
11:06 The Four Stages of Going Passwordless
12:51 Day 2 Problems and Implementation Hurdles
17:02 Real-World Device and Network Limitations
22:53 Why Passkey Success Rates Are Misleading
27:20 Best Practices for Large-Scale Deployments
32:16 Demystifying Passkey Attestation and AGUIDs
38:48 Handling Support Tickets and Adoption Strategies
Podcast Apps
🎙️ Entra.Chat - https://entra.chat
🎧 Apple Podcast → https://entra.chat/apple
📺 YouTube → https://entra.chat/youtube
📺 Spotify → https://entra.chat/spotify
🎧 Overcast → https://entra.chat/overcast
🎧 Pocketcast → https://entra.chat/pocketcast
🎧 Others → https://entra.chat/rss
Merill’s socials
📺 YouTube → youtube.com/@merillx
👔 LinkedIn → linkedin.com/in/merill
🐤 Twitter → twitter.com/merill
🕺 TikTok → tiktok.com/@merillf
🦋 Bluesky → bsky.app/profile/merill.net
🐘 Mastodon → infosec.exchange/@merill
🧵 Threads → threads.net/@merillf
🤖 GitHub → github.com/merill


Get full access to Entra.News - Your weekly dose of Microsoft Entra at entra.news/subscribe

Microsoft had 7 million internal tenants and almost lost control of their environment and your org might be facing the same problem at a smaller scale. In this episode, we sit down with Jeff Staiman, PM Area Lead for Tenant Governance at Microsoft, to break down the feature born from the Midnight Blizzard attack. We cover discovery, drift detection, governance relationships, secure tenant creation, licensing, and exactly where admins should start.
What Can Your AI Applications Access?
Organizations are investing heavily in AI-powered applications and agents, but many are discovering they lack the operational visibility and governance discipline needed to scale AI confidently and securely.
With continuous visibility into Entra ID applications, permissions, OAuth access, secrets, certificates, and application ownership, ENow App Governance Accelerator can:
* Reduce uncertainty around what SaaS apps can access
* Accelerate application reviews and approval processes
* Strengthen operational trust across security and leadership teams
* Prevent unmanaged application growth from becoming operational risk
* Enable lean IT teams to support AI expansion at scale
* Demonstrate governance maturity required for enterprise AI adoption
While most admins focus on securing their primary production environment, many organizations are sitting on hundreds of “test” or “shadow” tenants that were created by users with a simple Azure subscription. These unmanaged environments often lack proper security bars and can become entry points for sophisticated attackers.
The Wake-Up Call: Midnight Blizzard
The urgency for these new features was fueled by the 2024 Midnight Blizzard attack. In that instance, attackers compromised a legacy test tenant and used its old access rights to move laterally into Microsoft’s core environment. This highlighted a critical gap: securing one tenant isn’t enough if you don’t even know how many other tenants are connected to your organization.
Three Things You’ll Learn in This Episode:
* Automatic Discovery of the “Unknown”: Jeff explains how the Related Tenants feature uses signals like B2B sign-in logs, multi-tenant app consents, and billing relationships to automatically find every tenant connected to your corporate identity.
* Configuration Drift Monitoring: You can now define a “Golden Configuration” for your tenants. The service monitors over 200 resource types across Entra, Intune, Teams, and Exchange every six hours, alerting you the moment a security setting is weakened.
* The “Three-Step” Handshake: To prevent accidental or malicious takeovers, Microsoft has implemented a rigorous trust process. If two tenants don’t share a billing relationship, the governed tenant must explicitly invite the governing tenant before any control can be established.
A New Approach to Licensing
Something many admins will find surprising is the licensing model. Unlike many Entra features that require a license for every user, Tenant Governance is licensed based on the number of admins interacting with the features. This makes it far more accessible for organizations trying to secure a massive multi-tenant estate without a massive budget.
Why you should listen: Jeff dives deep into how Microsoft managed its own 7 million internal tenants and shares the roadmap for future discovery signals, including using Global Secure Access network telemetry to find tenants being accessed from corporate devices.
Whether you are managing a merger or just trying to clean up years of “test” environments, this episode provides the blueprint for moving from manual, one-tenant-at-a-time management to a deterministic, automated security posture.
Subscribe with your favorite podcast player or watch on YouTube 👇
About Jeff Staiman
Jeff Stammen is the PM Area Lead for Tenant Governance within the Identity and Access Management (IAM) team at Microsoft. A true company veteran of 31 years, Jeff originally joined Microsoft managing engineering compensation and famously architected Microsoft's core engineering leveling framework (Levels 59–61) directly from requirements delivered by Steve Ballmer. Today, he leads engineering and product efforts to secure multi-tenant cloud ecosystems at massive scale.
LinkedIn - https://www.linkedin.com/in/jeffstaiman/
🔗 Related Links
* Microsoft Entra Tenant Governance - https://learn.microsoft.com/en-us/entra/id-governance/tenant-governance/overview
📗 Chapters
00:00 Intro
00:18 Introducing Jeff Stammen
00:41 Jeff’s 31-Year Journey at Microsoft
01:25 The Midnight Blizzard Hack That Started It All
05:07 Tenant Governance: What It Is and Why It Exists
07:12 Where Should Admins Start?
09:57 Configuration Snapshots and Baselines
13:02 The M365 DSC Connection
15:18 What Resources Should You Monitor?
17:07 How Drift Detection Works
19:49 Multi-Tenant Monitoring Strategy
20:02 Related Tenants: Discovering Your Unknown Exposure
20:39 Licensing: Basic vs Premium Explained
22:48 Quotas and Resource Limits
24:27 Governance Relationships and Cross-Tenant Role Assignments
28:26 Two-Step vs Three-Step Governance Flow
31:15 Discovery Signals and Blind Spots
35:17 Tenant Restrictions: A Related Feature Worth Knowing
36:40 Secure Tenant Creation
38:10 Governance Policy Templates
40:01 Licensing Across Multiple Tenants
43:43 Final Recommendations: Where to Start Today
47:54 Wrap Up
Podcast Apps
🎙️ Entra.Chat - https://entra.chat
🎧 Apple Podcast → https://entra.chat/apple
📺 YouTube → https://entra.chat/youtube
📺 Spotify → https://entra.chat/spotify
🎧 Overcast → https://entra.chat/overcast
🎧 Pocketcast → https://entra.chat/pocketcast
🎧 Others → https://entra.chat/rss
Merill’s socials
📺 YouTube → youtube.com/@merillx
👔 LinkedIn → linkedin.com/in/merill
🐤 Twitter → twitter.com/merill
🕺 TikTok → tiktok.com/@merillf
🦋 Bluesky → bsky.app/profile/merill.net
🐘 Mastodon → infosec.exchange/@merill
🧵 Threads → threads.net/@merillf
🤖 GitHub → github.com/merill


Get full access to Entra.News - Your weekly dose of Microsoft Entra at entra.news/subscribe

Fabian and Thomas join the podcast to share their extensive experience and unpack the massive wave of updates coming to Microsoft Entra.
We talk about the massive shift toward Passkeys and registration campaigns, the impending migration from Entra Connect Sync to Cloud Sync, and the rapidly evolving world of Agent IDs and AI workloads. We also cover how Entra admins can leverage new Defender XDR features and Security Copilot agents to secure their environments.
Subscribe with your favorite podcast player or watch on YouTube 👇

About Fabian and Thomas
Fabian Bader is a Microsoft MVP and Cybersecurity Architect at glueckkanja, based in Hamburg, Germany. He is a well-known researcher in the Microsoft identity space, creator of the Cloud Brothers blog, and creator of the Maester and Token Tactics V2 tools. His work focuses on Microsoft Entra and the Defender suite, helping customers secure their cloud environments.
Thomas Naunheim is a Microsoft MVP and a Cybersecurity Architect at glueckkanja. He specializes in Microsoft Entra, identity and access management, and cloud security posture.
* Thomas LinkedIn - https://www.linkedin.com/in/thomasnaunheim/
* Fabian LinkedIn- https://www.linkedin.com/in/fabianbader/
🔗 Related Links
* What’s New in Microsoft Entra: May 2026 - https://techcommunity.microsoft.com/blog/microsoft-entra-blog/whats-new-in-microsoft-entra-may-2026/4517884
* Claude API Docs - https://platform.claude.com/docs/en/manage-claude/wif-providers/azure
* Microsoft Graph - https://learn.microsoft.com/en-us/graph/api/resources/agentid-platform-overview?view=graph-rest-1.0
📗 Chapters
00:00 Intro
01:18 The Year of Passkeys & Registration Campaigns
08:49 Windows Hello & Passkey Syncing
16:37 Migrating to Entra Cloud Sync
22:27 The Rise of Agent IDs & AI Workloads
28:21 Defender XDR Updates for Entra Admins
38:32 Security Copilot & Conditional Access Agent
45:48 Access Packages & New AI Admin Roles
Podcast Apps
🎙️ Entra.Chat - https://entra.chat
🎧 Apple Podcast → https://entra.chat/apple
📺 YouTube → https://entra.chat/youtube
📺 Spotify → https://entra.chat/spotify
🎧 Overcast → https://entra.chat/overcast
🎧 Pocketcast → https://entra.chat/pocketcast
🎧 Others → https://entra.chat/rss
Merill’s socials
📺 YouTube → youtube.com/@merillx
👔 LinkedIn → linkedin.com/in/merill
🐤 Twitter → twitter.com/merill
🕺 TikTok → tiktok.com/@merillf
🦋 Bluesky → bsky.app/profile/merill.net
🐘 Mastodon → infosec.exchange/@merill
🧵 Threads → threads.net/@merillf
🤖 GitHub → github.com/merill


Get full access to Entra.News - Your weekly dose of Microsoft Entra at entra.news/subscribe

Microsoft Entra Agent ID Just Went GA Here’s What You Need to Know About Agent Permissions
If you’ve been waiting for the dust to settle on Microsoft Entra Agent ID before diving in, the wait is over. Agent ID hit General Availability on May 1st, and in this episode of Entra Chat, Erin Greenlee, a PM in the the Entra AuthN team joins to break down one of the trickiest parts of the new model: how permissions actually work.
The three-tier model you need to understand
The biggest mental shift with Agent ID is moving from the familiar single app registration model to a three-tier hierarchy. Here’s the short version:
* Agent Blueprint → the template for your agent. Think of it as a souped-up app registration that lives in one tenant and defines how the agent behaves. Every agent needs one, even if you’re only ever creating a single instance.
* Blueprint Principle → the identity that represents the blueprint inside each tenant it’s deployed to. This is the middle tier, and it has a superpower: permissions granted here cascade down to all current and future agent identity instances automatically.
* Agent Identity → the actual running instance of the agent. This is what authenticates, what shows up in your tenant logs, and what can hold its own individual permissions on top of whatever it inherits.
Required Resource Access is a hint, not a grant
One thing that trips people up early: adding permissions to the blueprint’s Required Resource Access (RRA) doesn’t actually grant anything. It’s a signal to admins adopting your agent. A polite list of “here’s what this agent will need to function.” The real grant happens later, either upfront during adoption or dynamically as the agent needs it. Expect agents to lean more on dynamic consent than traditional apps have, since agents evolve and request new permissions as tasks change.
Inheritance only works if you set it up
Permissions granted on the Blueprint Principle will only cascade down to agent identities if the resource app (e.g. Microsoft Graph) is explicitly marked as an inheritable resource on the blueprint. It’s an easy thing to miss, and if you skip it, your Blueprint Principle grants won’t flow through to your instances.
A free tool to visualise all of this
Erin built an interactive web app — using GitHub Copilot, no less — that makes all of the above click visually. It has a no-sign-in tutorial that walks you through the object relationships, a permission matrix view, and even generates the PowerShell or Graph API scripts to apply your configuration in real life. No changes are made to your tenant unless you explicitly ask it to. The source code is being open-sourced too, so you can fork and customise it if you want.
Watch the full episode to see Erin walk through the tool live, including how permission inheritance works in practice and a real-world debugging scenario that inspired the whole thing.
Subscribe with your favorite podcast player or watch on YouTube 👇

About Erin Greenlee
Erin is a member of the Entra AuthN team working on AI and Agent ID at Microsoft. She previously joined Entra Chat to discuss app permissions and consent, and she loves building tools that make complex identity concepts easier to understand.
LinkedIn - https://www.linkedin.com/in/eringreenlee/
Sponsored by:
Find App Access Gaps Before They Break Workflows
In Microsoft Entra ID, small visibility gaps lead to outages and delays. Expired secrets break integrations, while unclear ownership and excessive permissions slow access decisions. Teams still struggle to answer:
* Which apps access Microsoft 365 data?
* Is that access still justified?
* Who owns it?
AppGov Score helps you quickly identify these gaps. ENow App Governance Accelerator then exposes app-specific credential risks, permission issues, and ownership gaps before they disrupt operations.
Start with your AppGov Score, then upgrade to a 7-day free trial to take action.
🔗 Related Links
* https://aka.ms/erins-agent-helper

📗 Chapters
01:11 Agent ID General Availability
04:14 The Agent ID Visualizer Tool
05:35 Defining the Agent Blueprint
08:06 Understanding the Blueprint Principle
10:57 Agent Identity Instances Explained
13:37 Required Resource Access (RRA)
24:07 Inheritable Permissions and Cascading
30:18 Applying Changes with Scripts
Podcast Apps
🎙️ Entra.Chat - https://entra.chat
🎧 Apple Podcast → https://entra.chat/apple
📺 YouTube → https://entra.chat/youtube
📺 Spotify → https://entra.chat/spotify
🎧 Overcast → https://entra.chat/overcast
🎧 Pocketcast → https://entra.chat/pocketcast
🎧 Others → https://entra.chat/rss
Merill’s socials
📺 YouTube → youtube.com/@merillx
👔 LinkedIn → linkedin.com/in/merill
🐤 Twitter → twitter.com/merill
🕺 TikTok → tiktok.com/@merillf
🦋 Bluesky → bsky.app/profile/merill.net
🐘 Mastodon → infosec.exchange/@merill
🧵 Threads → threads.net/@merillf
🤖 GitHub → github.com/merill


Get full access to Entra.News - Your weekly dose of Microsoft Entra at entra.news/subscribe