Posts

Demystifying Android Web-Based Enrollment: The Conditional Access, Broker, and Defender Core "Gotchas"

-
Image
Credits: Google Microsoft’s shift to the modern Google Android Management API (AMAPI) brings a highly anticipated, low-friction onboarding experience to Android Enterprise Personally-Owned Work Profiles: Web-Based Enrollment. This mirrors the web-first workflow we’ve seen on iOS for a while, completely removing the traditional requirement for end-users to pre-download the heavy Intune Company Portal application from the public Play Store. However, moving to a modern, browser-driven enrollment framework completely changes how security tokens are passed under the hood. So if you are planning to deploy Android Web-Based Enrolment while maintaining a strict Zero-Trust tenant, you will almost certainly run into infinite authentication loops, hidden app blocks, and broken single sign-on (SSO). In this blog post, I’ll break down the architectural reality of Android container sandboxing, uncover the hidden identity dependencies, and detail the exact Conditional Access exclusions you need to m...
Post a Comment
Read more

Protect bowser-based work on un-managed Windows Devices - Part 1 Intune App Protection Policies for Edge (The Container Layer)

-
Image
Historically, safeguarding proprietary information mandated total control over the physical hardware. However, with the shift toward SaaS-based apps and the rise of remote work, the paradigm has moved toward securing the data itself rather than the device. Staff and external partners are no longer restricted to corporate-owned and managed Windows devices, thanks to the robust controls available within Microsoft 365. Organizations can now focus on a versatile strategy that closes visibility gaps without overstepping onto personal or third-party hardware. Microsoft is bolstering the defensive features within   Edge for Business, Entra, Intune, and Purview . Recent enhancements to profile handling and authentication now enable firms to insulate browser-centric tasks on PCs governed by other entities. These advancements synchronize Purview’s real-time data oversight with Intune’s structured deployment frameworks, allowing administrators to deploy a unified security blanket rather ...
Post a Comment
Read more

Microsoft Defender Live Response - The last line of defence!

-
Image
Ever been in a situation when the state of the device is so bad, so unusable that it feels like you have exhausted all options and there is no hope? I think it is safe to say that most of us in the world of endpoint management, would have such days at some point in our lives. I recently delt with a device that was in a deadlock state. To give some more context, here is a snapshot of what I was dealing with - 1. The device reset had failed from Microsoft Intune and as part of the process was also deleted from the admin portal. 2. To make matters worse, the device object was deleted from Entra ID as well. (Don't ask why, it's just the way it is.:-) ). 3. The enrolled user had standard permissions and in order to elevate the permissions, one would need either a GA role or LAPS. While LAPS was configured, due to step 2, there was no way to retrieve the password, even through Graph. 4. GA wouldn't work as well as the device had lost trust with Entra ID. 5. Even if you rebooted i...
Post a Comment
Read more

Bringing Automation in Attack Simulation Training and Security Preset together

-
Image
                                      While utilizing Preset Security Policies in Microsoft Defender for Office 365, that focuses on a "set-and-forget" security posture, organizations can leverage automation in Attack Simulation Training (AST) to further strengthen the security directly through the end users (aka human firewall) by carrying out recurring, randomized testing. In other words, Preset Security Policies help in handling technical blocks (Safe Links, Safe Attachments) while Simulation Automations target the human element. I tested the Automation feature back in December 2025, but never got to blogging about it, and so decided to put a quick read together. Automation in Attack Simulation Training is a closed-loop system which allows organizations to - - Send simulated phishing emails - Observe user behavior - Automatically train users who fail - Repeat at a defined frequency - Track ...
Post a Comment
Read more