Eric Woodruff | MVP | CIDPRO

One compromised Agent ID blueprint can become a multitenant blast radius. @_sigil joined me to explain the trust boundary behind Microsoft Entra Agent ID and what admins should check before agent identities multiply. 🧵

"Your 13-year-old could set up a phishing kit in 20 minutes." That's what @ericonidentity, told me about EvilGinx and modern adversary-in-the-middle attacks. Eric is the Chief Identity Architect at Semperis and a Microsoft MVP who just led something remarkable: taking a 600-person company from scattered MFA to 100% phishing-resistant authentication in just three months. I had to get him on Entra.Chat to share how they did it. THE PASSKEY PLAYBOOK The technical part wasn't what kept Eric up at night. Conditional Access policies? Straightforward. Hello for Business, Platform SSO, and passkeys as the only allowed methods? Done. What made this rollout succeed was the people strategy: They built a self-enrollment system using Power Platform. Employees could opt-in early and become internal champions. By the time they flipped the switch for everyone, half the company was already converted. Leadership went first. When the C-suite was using passkeys, middle management resistance evaporated overnight. They ran office hours. Not webinars, not documentation dumps. Actual humans answering actual questions in real-time. THE UGLY PARTS Not everything worked smoothly. Azure VPN client doesn't support passkeys. Some legacy apps were still using old Internet Explorer DLLs. A handful of Android 13 users couldn't use device-bound passkeys at all. Their solution? Surgical CA policy exceptions for about 5 apps, tracked in a dashboard, with vendors being "encouraged" to fix their implementations. For the Android holdouts, synced passkeys came to the rescue. Are they as secure as device-bound? No. Are they still infinitely better than passwords and push notifications? Absolutely. THE ATTACKS THAT STILL WORK Here's the part that should concern everyone: Even with passkeys deployed, downgrade attacks are a real threat. The only defense? 100% phishing-resistant conditional access policies with no fallback methods. nOAuth AND THE DEVELOPER PROBLEM Eric's security research goes deeper. He walked me through nOAuth, a vulnerability pattern where applications use email claims instead of the subject identifier to identify users. The problem? Email addresses in Entra ID aren't immutable. An attacker can set their email to match a victim's, and vulnerable apps will grant them full access to that account's data. Microsoft has guidance to fix this, but developers keep building apps the wrong way. And there's no easy way for admins to detect which apps in their tenant are vulnerable. BOTTOM LINE Passkey rollouts are 80% organizational change management, 20% technical implementation. Your help desk needs training. Your documentation needs to be bulletproof. And you need executive air cover from day one. The full conversation covers way more: consent phishing, clickfix attacks, reply URL hijacking, and why the Zero Trust Assessment tool takes 24+ hours on large tenants. Listen here: entra.chat #Passkeys #ZeroTrust #CyberSecurity #Infosec