HPlum78

Well that interesting and is worth picking up with MS....

I posted this over there.... www.aka.ms/GetTechCertifiedwww.aka.ms/GetTechCertified there are some data course open to education from MS.

Anyone else getting Windows Vista vibes from this OS?

MS are offering courses for public sector employees along with the subsequent certs, take a look it maybe worth getting involved: www.aka.ms/GetTechCertifiedwww.aka.ms/GetTechCertified

I know that this is an older post but... Entra Connect is not supported on Server 2025, and MS will not offer any if you run into issues.... Server 2022 is the latest OS that is supported. (don't learn this the hard way!)

It's sounds like a CRM... Dynamics 365 can be used to do this, also I thought that SendGrid supported oAuth so just need an app registration. Authenticated SMTP is not the only way to skin this cat as SendGrid (as most others do) support DKIM/ SPF as well. How to Set Up SPF and DKIM for SendGrid - DMARCLY

$CmpGroups | where {$_.Name -contains "10.0 (20348), Windows Server 2022 Standard"} | select -ExpandProperty Group To expand on @psydii comment above, that would pull out the computers that are that version and OS name then pump the computer objects out or you can pipe it in to measure or export- or (enter cmdlet here) Given that you put that into a var called $CmpGroups Sorry I am spewing code and making assumptions so here is what should be the first bit: $CmpGroups = Get-ADComputer -Filter {Enabled -eq $True} -Properties OperatingSystem, OperatingSystemVersion | group-Object -Property OperatingSystemVersion, OperatingSystem

oh and when it dont fit in the window pipe it in to FL so | FL on the end of the above...

Get-ADComputer -Filter {Enabled -eq $True} -Properties OperatingSystem, OperatingSystemVersion | group-Object -Property OperatingSystemVersion, OperatingSystem

Get-ADComputer -Filter {Enabled -eq $True} -Properties OperatingSystem | group-Object -Property OperatingSystem

You may have seen that MFA spoofing/ phishing is becoming a much bigger thing so have included the MS link below as something that should be done in this space to protect highly privileged accounts, along with some links to the details of how and what is being used: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/rockstar-2fa-a-driving-force-in-phishing-as-a-service-paas/ https://www.beyondidentity.com/resource/how-to-defend-against-rockstar-2fa-bypass-attacks-targeting-microsoft-and-google https://news.sophos.com/en-us/2024/12/19/phishing-platform-rockstar-2fa-trips-and-flowerstorm-picks-up-the-pieces/ https://learn.microsoft.com/en-us/entra/identity/conditional-access/policy-admin-phish-resistant-mfa

You are bang on with this, the times I look at these requests (from big IT suppliers as well) and think to myself really all of those! in my mind it comes down to being lazy and taking the boiler plate auth flow code and doing absolutely zero to it and just bolting it into the code to make the application work... I bet 90% of the ones I see dont need or do anything with the attributes/ permissions that they are requesting but they simply dont scope the request down to accomplish what it is they are trying to achieve. Not so good from a data security/ security perspective mind. Check these requests and turn off the end users ability in your tenants that allows them to accept these as well.

Ah well color me surprised Typing.com have got back to me and they are one of the better companies out there and have scoped their app right down to only what they need, and have confirmed that they are not scraping all of the attributes for the user out of the tenant. That dont mean you should not be mindful of just what you are accepting when clicking on that consent button for application permissions, and any that are asking for application rather than delegated permission should be a NO until you are absolutely happy with that requirement.

@ first glance on Typing.com I cannot see what the app is actually asking for in terms of scopes and permissions, but my gut feeling is that its going to be User.Read.All. Here is the JSON for that: { "aboutMe": "String", "accountEnabled": true, "ageGroup": "String", "assignedLicenses": [{"@odata.type": "microsoft.graph.assignedLicense"}], "assignedPlans": [{"@odata.type": "microsoft.graph.assignedPlan"}], "birthday": "String (timestamp)", "businessPhones": ["String"], "city": "String", "companyName": "String", "consentProvidedForMinor": "String", "country": "String", "createdDateTime": "String (timestamp)", "creationType": "String", "customSecurityAttributes": { "@odata.type": "microsoft.graph.customSecurityAttributeValue" }, "department": "String", "displayName": "String", "employeeHireDate": "2020-01-01T00:00:00Z", "employeeId": "String", "employeeOrgData": {"@odata.type": "microsoft.graph.employeeOrgData"}, "employeeType": "String", "faxNumber" : "String", "givenName": "String", "hireDate": "String (timestamp)", "id": "String (identifier)", "identities": [{"@odata.type": "microsoft.graph.objectIdentity"}], "imAddresses": ["String"], "interests": ["String"], "isResourceAccount": false, "jobTitle": "String", "legalAgeGroupClassification": "String", "licenseAssignmentStates": [{"@odata.type": "microsoft.graph.licenseAssignmentState"}], "lastPasswordChangeDateTime": "String (timestamp)", "mail": "String", "mailboxSettings": {"@odata.type": "microsoft.graph.mailboxSettings"}, "mailNickname": "String", "mobilePhone": "String", "mySite": "String", "officeLocation": "String", "onPremisesDistinguishedName": "String", "onPremisesDomainName": "String", "onPremisesExtensionAttributes": {"@odata.type": "microsoft.graph.onPremisesExtensionAttributes"}, "onPremisesImmutableId": "String", "onPremisesLastSyncDateTime": "String (timestamp)", "onPremisesProvisioningErrors": [{"@odata.type": "microsoft.graph.onPremisesProvisioningError"}], "onPremisesSamAccountName": "String", "onPremisesSecurityIdentifier": "String", "onPremisesSyncEnabled": true, "onPremisesUserPrincipalName": "String", "otherMails": ["String"], "passwordPolicies": "String", "passwordProfile": {"@odata.type": "microsoft.graph.passwordProfile"}, "pastProjects": ["String"], "postalCode": "String", "preferredDataLocation": "String", "preferredLanguage": "String", "preferredName": "String", "provisionedPlans": [{"@odata.type": "microsoft.graph.provisionedPlan"}], "proxyAddresses": ["String"], "responsibilities": ["String"], "schools": ["String"], "securityIdentifier": "String", "serviceProvisioningErrors": [ { "@odata.type": "microsoft.graph.serviceProvisioningXmlError" } ], "showInAddressList": true, "signInActivity": {"@odata.type": "microsoft.graph.signInActivity"}, "signInSessionsValidFromDateTime": "String (timestamp)", "skills": ["String"], "state": "String", "streetAddress": "String", "surname": "String", "usageLocation": "String", "userPrincipalName": "String", "userType": "String", "calendar": { "@odata.type": "microsoft.graph.calendar" }, "calendarGroups": [{ "@odata.type": "microsoft.graph.calendarGroup" }], "calendarView": [{ "@odata.type": "microsoft.graph.event" }], "calendars": [ {"@odata.type": "microsoft.graph.calendar"} ], "contacts": [ { "@odata.type": "microsoft.graph.contact" } ], "contactFolders": [ { "@odata.type": "microsoft.graph.contactFolder" } ], "createdObjects": [ { "@odata.type": "microsoft.graph.directoryObject" } ], "directReports": [ { "@odata.type": "microsoft.graph.directoryObject" } ], "drive": { "@odata.type": "microsoft.graph.drive" }, "drives": [ { "@odata.type": "microsoft.graph.drive" } ], "events": [ { "@odata.type": "microsoft.graph.event" } ], "inferenceClassification": { "@odata.type": "microsoft.graph.inferenceClassification" }, "mailFolders": [ { "@odata.type": "microsoft.graph.mailFolder" } ], "manager": { "@odata.type": "microsoft.graph.directoryObject" }, "memberOf": [ { "@odata.type": "microsoft.graph.directoryObject" } ], "messages": [ { "@odata.type": "microsoft.graph.message" } ], "outlook": { "@odata.type": "microsoft.graph.outlookUser" }, "ownedDevices": [ { "@odata.type": "microsoft.graph.directoryObject" } ], "ownedObjects": [ { "@odata.type": "microsoft.graph.directoryObject" } ], "photo": { "@odata.type": "microsoft.graph.profilePhoto" }, "photos": [ { "@odata.type": "microsoft.graph.profilePhoto" } ], "registeredDevices": [ { "@odata.type": "microsoft.graph.directoryObject" } ] } So you tell me is that what you would normally allow access to?

As I cannot see the rules I would not be able to offer any real insights in to how your CA policies are working/ not working but here is some useful information: https://learn.microsoft.com/en-us/entra/identity/conditional-access/howto-conditional-access-policy-location https://learn.microsoft.com/en-us/security/zero-trust/zero-trust-identity-device-access-policies-common?view=o365-worldwide#assigning-policies-to-groups-and-users https://practical365.com/five-most-common-conditional-access-misconfigurations/ https://learn.microsoft.com/en-us/entra/identity/conditional-access/howto-conditional-access-insights-reporting The one thing I would absolutely make sure you have is a CAP exemption group with your brake glass accounts in, and added as an exemption to all of your CA policies so you dont lock yourself out of your Tenant!