Welcome to another edition of the M365FM podcast.
Today we are diving into one of the most critical topics in modern IT, identity security.
As organizations continue moving workloads to Microsoft 365 and Azure, the MTS have become
the new secret perimeter.
Joining me today is Jonathan John Hope, Microsoft MVP, Microsoft C65 solution architect and specialist
in identity and access management.
John Ilay has spent more than the decade designing and operation, large scale infrastructure
environments from enterprise VMware platforms to modern Azure native architectures.
This expertise spans conditional access, Azure security, infrastructure has caught using
bicep, governance and security identity at scale.
Joe has also written extensively about Azure, often overlooked role in identity, protection
and cloud security.
Yeah, Joe, welcome to the M365 podcast.
Hey, thank you, Marko.
Appreciate it.
Thank you for having me on.
Yeah, that was quite an intro.
Yeah, so yeah, no, I mean, a little bit about me.
I do, I come from the managed service space where I worked for an MSP provider here in Virginia
for about 15 years, started my way up from the help desk and worked into modernizing virtual
servers.
I specifically was a VMware engineer who then moved into the Microsoft side because let's
be honest, B-Post was a thing back in the day and everyone wanted to jump on board.
That quickly started to change what I was doing from an identity perspective and understanding
Azure Active Directory, now, and try D. And today, I now work for an organization who sole
focus is basically optimizing that space.
So I work for a company called enforcer and one of the things that I love about is it gives
me an opportunity to talk about things like these such as security identity at scale.
So yeah, no, excited to be here.
Yeah, thank you.
Yeah, you spent many years in working with VM there before moving into Azure.
Any lessons from traditional infrastructure still apply in today's cloud first world?
Yeah, I mean, that's a great point.
So ironically enough, I did actually just write a blog today around groups and the idea
that you talk about a lot, which is governance and how groups can do that.
I think there's a lot of tithers, right?
I mean, the idea of least privilege still pertains on premise to the cloud.
It shifts the structure and how that works, right?
So today, we have to understand that, like, you know, not everything on-prem has to correlate
to exact replica in the cloud.
So we want to start to separate that from a governance standpoint and the idea of being
able to really create kind of a secure structure in the cloud so that lateral movement
isn't a thing where it can replicate back to the on-prem infrastructure.
So there's definitely some cross-ervers, but I will say, you know, I'm trying more and
more to kind of write about things that help people to understand how groups can be
that conduit to get them from on-prem into a cloud first kind of organization.
So yeah?
And what are one point you say, or you realized identity was becoming the new primary
security boundary?
Yeah, no, I mean, I guess the idea, it's funny.
So the company I work for, we tagline, right, the idea of the tenant is the new server.
And for me, I think the realization really hit me around the COVID era, right, 2020.
If we look at, if we look at what happened, I know for me, right?
I came home and one day I was just working remotely every day.
And it was, okay, we need to start leveraging teams more.
You need to start, you know, okay, I need to put these files that I can't get access to
that S&TP file sharing more on-prem.
I need to put them over in one drive.
And what I noticed is that those identities that used to be protected behind a firewall, they
were on-premise.
You set up a new site, you put your AD server on-prem, you get a firewall and place your
good to go, right?
That was no longer relevant.
You move to this cloud-based authentication where the identities were accessible from anywhere,
right?
I could go work from Starbucks.
I could work anywhere.
And so as easy as it is for me to log into it, the idea is if you're not securing those
effectively, you, anyone can log into them from anywhere.
That is the point of cloud-native APIs and the ability to get to this stuff from anywhere.
And so that, for me, I think was the realization that if we're not locking down these identities,
then inevitably, we're just allowing the attackers to get in.
And the one statement I hate hearing from a customer is, we got security defaults.
I'm like, okay, well, let me be honest, Microsoft isn't necessarily secure by default.
They're secure.
They want collaboration.
They don't care.
They do care.
Let's not say they don't care.
They care about security, but if it hinders collaboration, then they choose to go with
collaboration first.
So, yeah.
Yeah.
I see.
Often, it's the, I think companies often think we pay for all these security tools.
So Microsoft time was for us.
Yeah, it's a little bit risky thinking, I think.
Yeah.
No, it is.
I mean, you wouldn't put a server in place and then rely on the Comcast modem from your internet
service provider.
You would get a firewall, right?
You would be precise about the technology.
You would be intentional about what you're doing.
So, same concept applies in the cloud.
You've got to be intentional about it.
And I also see the Steve, yeah, thinking the one time setup idea.
I think that's also a little bit critical.
But when you look back over your career, what are the major shifts that change the way
organization approach security?
What are your ways, organizations?
I mean, I think for me, the concept of what we're talking about today is really one of the
major shifts, right?
I know when I started with B-Post and in getting into the Microsoft realm, conditional
access wasn't necessarily as great as it is today, right?
There were a lot of gaps in how it operated and things you could test, the what if wasn't
really there.
It just wasn't, it wasn't what it is today.
As conditional access is expanded to me, conditional access has almost become the new modern firewall
per se, right?
It makes real time decisions on actual, you know, authorization and can you access the
same, right?
You've authenticated to the identity platform, but do you have the authorization to access
these things?
And if not, it's a real time engine that applies and a lot of people like to apply it like
a firewall.
My network guys used to be like, oh, so it's like a firewall rule.
I'm like, not necessarily.
Firewall rules have a priority and they go one by one.
This is a exact, it challenges every policy all at the same time and it makes a real time
decision on it, right?
So there are differences, but I think very similar overlap.
And I think that's one of the bigger things that has changed for me when it comes to securing
the new talent as a chance today.
We are also often here, identity as a new parameter.
What do you think actually mean in practice?
What was the question again that identity?
Yeah, we often heard these, these, I think, phrase identities in a new parameter.
What do you think actually mean in practice?
Identity is a new parameter.
Yeah.
Oh, gosh, yeah, yeah, yeah.
So as far as it being the new parameter, right?
I mean, it is the entry point into everything.
So I specifically, I think I did a post on it called identity as the new parameter and then
data governance is the new blast radius, right?
So the idea is that it ties back into everything that Microsoft reaches from defense and
death to zero trust.
If an identity can be compromised and someone can get claims into the tenant, the new server,
they can sit there, they can lie, they can wait.
That identity can then be used laterally, right?
So I did an article last week on guest identities because it's often so overlooked.
And the idea is guests can act like a Trojan horse.
It's an identity that exists that we oftentimes just overlook, but the ideas are simple.
If you can compromise that guest identity, which you don't have full necessary control around,
and then you can do things like if you have weak guest restrictions, you can do things
like enumerate groups.
You can look at all the members.
You can then look through those members and find someone who may have privileged roles within
the organization.
So it really is the parameter.
You have to protect that because if you don't, that then leads to everything else that can
happen inside the server, which is your data governance, getting access to your SharePoint
sites.
I mean, anything that you can think of inside, right?
A lot of the conversations you have around governance are so critical because the idea is
once they get in the house, what do they actually have access to?
If you've got a really good data governance policy and a really good ability to lock that
down, good to go.
It's going to give the administrators time that they really need to be sure that, okay,
hey, we had a breach.
The identity has been compromised.
Now let's act on to our playbook.
Let's disable the account, revoke all sessions.
Often occasion methods required need to be higher level.
We want fish and resistant things like that.
So, yep.
How do identity, how do identities look like?
How do you check a work in this space?
You're getting more and more sophisticated.
I mean, if you take a look over the past, the two main ways that they've tackled identities,
the biggest one, I think it was a storm 9-0-4-2 or 9-2-4-2.
The most recent one, they leveraged SSPR attack factors.
So, one of the things a lot of companies don't think about is the idea of leveraging SSPR,
something that is meant for good, being used for malicious intent.
So, what they were able to do is, and there's also a very interesting update coming from Microsoft
that I just posted about today on LinkedIn.
Hopefully, everyone takes a look at that as how they're trying to lock that protocol down
a little more.
But the idea there was essentially just continuing to flood users with password reset
requests and then gain access into the identity infrastructure through that.
So, I mean, it's common all over.
I mean, I look at probably one of the last breaches I tackled when I was with the MSP was
specifically around this concept.
It was a company that they were business standard because in the MSP space, we still have
a lot of small mid-sized businesses that don't want, they don't fully understand or see
the value and business premium and the ideas that we talked about with conditional access.
And it was a company that was on business standard and they had, they suffered a business
email compromise.
What happened was, very simple, they sent an email to someone in the organization, that
person clicked on it, they were finished, right?
They put their credentials in, they gave this person access into the organization and
then from there, two things happened.
They had two things.
They registered a malicious enterprise app to give them a foothold into the organization
long term.
They also, then were like, well, they may detect it and we may have to UFA.
So they registered their own SMS authentication method and that's why it's important that
from an authentication method, we disable these things.
But what they did is they put a phone number in and they labeled it free food because
it was, they were not easy to get into.
They had actually been compromised multiple times.
Yeah.
So attackers have a sense of humor.
It turns out.
And I think, yeah, I think, so I was a security, it's, it's, yeah, it's a topic and I think
the old, we all speak about hacking the infrastructure.
But why do, I don't know, if it's really shift, I think for, for, for, no more than 20 years,
we have called a university to, on say, I'm the professor working for the professor to
get free internet access.
Yeah.
So, so I think that's also, can you give the password?
I think it's not so new, but why do attack us target identities before they target the
infrastructure?
I mean, I think they take the, in my opinion, I mean, attackers are targeting the most
susceptible, easiest thing, right?
So humans are very fallible.
They, they, they, they can be fished, right?
They are, they want to believe that people have good intentions at mine.
And it's not to say that everyone doesn't, but there is bad in the world, right?
There are people who want to take advantage of people in that way.
And that's why things like fishing resistance, past keys, all of these things are so critical
to me.
But, because we are, we are faltered, right?
Like, we, we want to assume these things, but at the end of the day, we, I've clicked on,
I was like, poor, not, unintentionally, right?
Like, oh yeah, that does sound extremely relevant to what I'm doing today.
And that's the thing.
And that's what, that's why it's so dangerous with the, you know, the introduction of AI.
Because if you think about, you know, we all joke about the attacks back in the day, right?
The, the crown prince in Africa reaching out to me.
You know, it's like, oh, does he wants to, he needs help for me?
Like, what, you know, these attacks were, were almost laughable back in the day.
But when you introduce something like AI to the mix, which can easily scrape your entire
organization and start to build out a, a flow chart and understand, oh, your CEO is over
at this meeting today.
You know, they can then, in sight, you know, in a sense of urgency in you as a user, because
that's something we have, right?
Our emotions go from zero to 100 very quickly.
And so what they do is they, they incite this urgency, like, hey, it's the CEO.
I'm over at this, you know, I'm over at, you know, this conference today.
Of course, they're at that conference.
Say, we know they're over at that conference.
Say, right?
It, it, it seems legitimate.
I mean, without, you know, and the fact of the matter is when that urgency level hits,
your, your brain, just that fight or flight mechanism in your brain doesn't necessarily
sometimes go hold on, stop.
Why would they be reaching out to me directly?
Right?
And because of that, that false sense of urgency, you just, you know, I'm, you know,
you just go, oh, I need to help this person.
I need to do this, right?
And I've literally watched financial teams get messages like that.
And next thing I know, they're wiring $10,000 in a wire transfer because they think their
seat, the CEO is actually at the conference.
Everything checked out.
They didn't have the appropriate data governance in place, right?
To put a two gate like, hey, anything over this amount of money, don't wire it unless you
get approval from X and Y instead of just giving them full autonomy to just send a wire
transfer of 10k.
Next thing you know, you're dealing with forensics teams trying to understand why $10,000 was just
wired to someone over in, you know, in Bobway.
So yeah, long-winded answer.
I think we have before we jump in the clouds, we have Active Directory.
Sure.
Active Directory.
So did you think for companies that's also important to look at their identity strategy at AD
or can we handle all of us with the MTA?
Yeah.
I mean, I guess it really depends on the business model, right?
Like what specifically?
So I work for an organization where we had a lot of legacy applications and a lot of need
for legacy AD.
Case in point, you know, I've got extreme experience with Azure.
A part of what I did was I built AVD environments for organizations.
When I started building out Azure environments, unlike this past year where we're now cloud
native and everything can be done cloud native there, there was reliance on Active Directory.
So I couldn't build an Azure Virtual Desktop environment without doing hybrid identities,
meaning and while Interdomain Services is a thing, there's still legacy work.
So there's a lot of different solutions that rely on things like Kerberos, right?
SMTP.
Like we, you know, we, in TFS file shares, there are legitimate needs within the organization.
I do believe in this past year Microsoft has really done an amazing job at pushing the boundary,
at what, to really cause you to have to rethink do I still need Active Directory?
From the introduction to the new features within Intercloud Sync, one of the biggest limitations
that it had was if you think about today, organizations that wanted to hybrid join, meaning they,
they had all their devices, they didn't want to just immediately, you know, join them into,
into, into, only that's a huge up lift.
That's a huge project hour to get rid of that, that old legacy Active Directory join initiative.
They've moved the needle on that and that you can now join directly to, you know, to
into with Intercloud Sync. So you can, you can do that hybrid join, which is a great intermediary
step from on-prem to cloud only.
So I, I do think there are still legacy needs.
I, and I think, you know, understanding Active Directory and the OU structures and, and
really understanding what that is and how to reshape and rethink that with the cloud.
If you look at, if you look at intradd, it's a flat landscape.
There is no, there's no OU structure.
Not the same LDAP kind of category and everything you have there, right?
These are all new protocols, new, new identity structures that exist today.
And I think that, that's why I go back to the idea of why groups are so critical.
A lot of what we try to do with OU's can be accomplished within the group structure and
the group conventions that exist with an intradd today.
So yeah, I think it's extremely critical.
But yeah, I, I do think every organization moving forward from today needs to take a hard
look at, okay, what do we still rely on Active Directory for?
And the post that I released today called groups, the connective tissue, right?
The idea is start to look at how can I use this cloud first approach to start minimizing
my reliance on Active Directory?
Because the trap that we fall in, specifically in the MSP space is that we're like, oh, it's
just, you know, it's easy.
We got to do this.
We'll get rid of this sometime later on.
And then it just sits there.
And no one ever gets rid of it.
So when you start looking at new SaaS apps that you want to introduce, you know, we, we,
the first thing we tackled as an organization was file shares and printers.
We, we moved those, we moved those wholeistically to Azure.
We started using Azure premium files.
We started using, we worked, we tried universal print, but then we found a much better product
called printx that actually was amazing for cloud printing and had a few less limitations
than what universal print had.
The idea was we started leveraging those and moving those needs off from from Active Directory
into the cloud.
And by doing that, then target it with groups, we could then connect those systems directly
into enter ID.
That was then groups and GPOs and other aspects of the on-prem identity that we could start
to diminish and get rid of within the organization.
And then it just easily kept shifting from there to a cloud first world.
And there it's, I think, conditional access for listeners, they are new with the topic.
What exactly is it?
What exactly is conditional access?
Ah, perfect question.
So I have a, I have a GitHub repository that I'm going to give you the, I'm going to give
you the answer from that.
There's a real official, right?
Like a kind of explanation of what it is.
The John Hope explanation.
It's the modern day cloud identity and workload firewall in the modern cloud.
Identity is the server.
It's a control plane that every access request goes through.
So again, I correlate it to the idea of, of a firewall a lot of times, but essentially,
it's a zero trust control plane that makes real-time decisions on authorization.
And do you have access?
So it's an authentication, authorization mechanism that says, okay, you've authenticated.
Do you have the ability to contact this?
Does your device that you're working for have the ability to access this?
So in a labencer, that's, that's my.
That's my explanation of it.
Yeah.
I read, I think it's more on one of your blocks that you say one or, yeah, you consider a
condition like says one of the most powerful security controls in Microsoft 365.
Why, why did you think this?
Why?
Because if you look at it, right?
You, you actually talk about this a lot.
Let me be very clear.
My favorite, my favorite talk if anyone hasn't gone and listened to it is governance is an
illusion that that podcast you did was amazing.
And the, the idea is that if you look at conditional access, you know, you made a point in
there that there isn't necessarily a unified control plane for everything because inside
of him 365, there are aspects that have their own unique identities and, and connections,
right?
And the exchange has the exo command module purview has the IPP session modules.
You've got share point with the SPO modules, right?
They have their own capabilities.
Conditional access is that thing that tries its best to unify security from across the board.
If you think about conditional access, yes, it secures identities and it's, it's main purpose
is to make sure that the identities do have the access it needs.
But on top of that, it hooks into all those other modules.
So into it can look at your device compliance statistics.
It says, well, wait a second.
Is this device still healthy, right?
What does intune say it's still healthy?
Okay.
Cool.
Then we, you know, we have a compliance policy inside of intune that's telling us and giving
those signals back for the conditional access policy to make a real time decision at that
moment.
It hooks into defender for cloud, right?
It hooks into defender period, right?
So we have app and force restrictions.
So if you build policies into defender, it's able to then pass through make a real time
decision.
Are you connected to a third party VPN that you shouldn't be?
Okay.
If you're connected to that, you don't get access into the organization, right?
It's able to make all these decisions per view.
You're able to do authentication contacts and then apply conditional access on top of
it to protect that from accessing, you know, critical sharepoint sites.
There are ways that you can do this natively within each of these tools, but conditional
access is kind of that, in my opinion, that last stop kind of deeded process to ensure
that at the end of the day, all of these aspects are protected.
And when you get a new client, what's the first conditional access policy that you look
if they have deployed it?
Yeah.
So, so hopefully everyone after this goes to my my GitHub repository and I'll, I'll make
sure you have all the links, hopefully you have all the links to that.
So there are six policies in my repository that I consider foundation policies.
So there's not necessarily one policy.
Obviously, if there was one policy, it would just be MFA for all users, regardless of what
you're doing, right?
That is, that is at a clear cut.
That is what security defaults tries to do, but fails horribly at.
As far as like what I recommend to anybody, it is there are six fundamental policies, you
know, not, not looking at your in tune, do you have in tune, right?
Because at the end of the day, one of the, one of the requirements for conditional access
is a P1 license.
So assuming you have 10 users and 10 P1 license in your infrastructure, this is the bare bones
what you could still do to protect that organization, you know, just because you have P1 doesn't
mean you have an in tune plan one license, you can do compliant devices.
And, and I break those down into into those six policies, essentially starting with all
MFA for all users, MFA for all admin roles, typically there, I want to use a stronger authentication
method.
So I want to use something that is fishing resistant if they are in admin or have a privileged
role.
And then there's the two fundamental policies that I believe every tenant should have,
which is blocking device code flow and blocking legacy off.
They are, they are known attack vectors that, you know, very sophisticated nation state,
you know, organizations have attacked and have been, you know, instrumental in gaining access
to the organization's time in time again.
And then I do a two gated process for allowed countries.
And I recommend those for every, every person because the idea is I, if you do one block country
policy inevitably what happens is humans and humans travel.
And then what we do is we say, cool, I'm going to put them as an exclusion because they're
traveling.
And it's like, cool.
Well, now that Bob's in the Bahamas, you just allowed him in from Russia and his account
gets compromised in the Bahamas and he's now accessing everything from Russia.
So there's, there's a very deep dive on why I recommend the way, doing the policies, the
way I do, but I, I highly believe in that concept of you, you have to be intentional on where
people can access specifically on country codes, but understanding that countries aren't
the end all be all right.
Because those bad actors have access to a VPN and to Azure here in the US, right?
But it is, it's kind of a fundamental thing of like, let's stop the low hanging fruit because
it is a vector that people use.
So those would be the six that I would say every company needs regardless of what they're
doing.
Awesome.
Yeah.
That's, that's so funny.
What, what all happened?
But the role of AI, when I look in the intro, for me, I say the co-pilot or AI, a staff looks
more than the human than an application.
Did you think, yeah, this is, yeah, I don't know.
AI is a new vector for a text.
Oh, 100%.
Yeah, yeah, yeah, 100%.
Well, there was actually, I wrote about this one and I'm trying to think what the session was.
There was an amazing session at ignite this past year.
I attended it.
It was essentially the foundation of identity and it was two of the principal architects
from Microsoft talking about how they fundamentally targeted identity inside the organization, right?
One of the, one of the facts that I got from it, to actually two very interesting facts
I got from it.
One was that they were, you know, their entire organization is kind of all in on past keys,
right?
So they're, they're, they're using past keys.
They're, they're eating their own dog food, drinking their own champagne internally.
I think that's amazing.
The other, the other thing was the fact that it was shown on one of the screens that according
to their, you know, data, and I believe they, they, they make this in the digital defense
playbook, is that they're only 80% of administrative level accounts are protected with the
method.
There's a 20% of organization.
And if you look at, if you look at the landscape of what Microsoft sees, that's a lot of companies
out there.
20% is a lot of privileged roles that they're seen without MFA on it.
So if you're one of those companies, please go get it.
They enabled for those account.
But what the, the point of that conversation, the point of that whole session is the idea
of we have to empower AI for good, right?
AI can be used for, for negative things.
It can be used to, to figure out how to, you know, compromise an identity, move louder
really within an organization.
But the idea is that we need to leverage AI for good.
And I believe what they're trying to do with security co-pilot.
I tested this.
Be careful with that, with that tool.
But yeah, the idea is it's good, right?
Humans make mistakes all the time.
We, we click a button.
We think we have it exactly the same way.
And then we go and try to do it 10 more times and each one looks a little different.
And that's the idea of using AI and automation is to create a standard configuration and
then be able to do that very continuously across each environment, right?
For, for my space, the MSP space where I came from, right?
Remain as you know, 120 different clients.
So you start, you take 10 to 12 conditional access policies across 120 tenants.
There is an exponential amount of errors that can be created if you're manually doing that.
So that's, that's the idea of how AI comes in and it really helps to make it more efficient,
but also catch those, those hidden mistakes that we sometimes overlook as humans.
So yeah.
Well, when I often see that organization separate Azure security from identity security, yeah,
there are, say, interconnected, really interconnected.
But why, why did companies have these kind of thinking, what, what your perspective on this?
So I, you know, it's, it's different across organizations.
I think the mindset of what you're, what you're getting to there fundamentally is an enterprise
mindset of, you know, separation of roles, kind of separation of duties that exists within
an organization.
So I think the idea of like you have your infrastructure team, right?
That's the Azure side.
Their, their primary responsibility is looking at Azure infrastructure in SGs, you know, the
VNet, making sure all these rules are optimized and, and working effectively.
But that is, and I, I will die on this hill that there is a, there is a massive need for
these teams to come together to, to talk and be more efficient.
The, the new introduction of this cloud connected world, these silos can't continue to exist.
And, and there's been some really good conversations, you know, Merrill Fernando on, you know, on
interchette, had a great conversation about this, you know, because he's had a lot of time
and work on the Zero Trust Assessment.
And the idea is like these teams have to come together because it can't continue to be silo.
And, and there's a huge overlap.
And there's a reason why I specifically talk about the, the fundamental role that Azure
plays an identity.
Um, it is far as how those two coexist and I mean, any identity admin who's ever tried to
go figure out what's going on in, in a, you know, whether it's conditional access or just
looking through logs should understand the hardship of doing that manually, right?
And so the idea is if you have Azure infrastructure, you can set up log analytics workspace.
You can set up Sentinel around those workspaces, right?
There's, there's huge opportunities there.
I specifically coming from the Azure side built tons of KQL queries and tons of, tons
of quick ways to check for specific logs and that completely changed the way on how I did
conditional access rollouts.
So, and a lot of people don't, they don't know that.
They don't know about these built in KQL workbooks that exist in Azure that help you deploy
out conditional access for identity.
Yeah.
Um, I think Zero Trust plays, um, yeah.
It's, it's so important topic.
A lot of people hadn't lived a little bit like, yeah, I don't know, like the, uh, thin foil
heads guys, uh, but yeah, what roles plays Zero Trust for you in an Azure architecture?
What roles plays you're trusting in Azure architecture for me?
Um, so me, I want to make sure I, I, I break down that question correctly, right?
I mean, inevitably the, the idea there is just ensuring that, you know, you don't have
master owner roles.
So like when I was deploying out Azure infrastructure, I used by said, I was very explicit on who
had the owner role.
And the idea there is no one gets an owner role, right?
Like other than, you know, me as the, to your point, you have to have someone that owns
it, right?
Who is the responsible party for the organization?
Outside of that, the network, we need to start to minimize what they have and the whole idea
of Zero Trust is, well, if you're just working on the network side of things, then this is
what you need access to.
These are the redeemable roles that you can leverage to then do that.
But I don't want you messing with the Azure files over here, right?
There's always an interconnection between the teams and the roles that are needed, but
the idea is kind of controlling that blast radius, right?
Like if you compromise the identity, but you don't have access to the SharePoint data
that you want, you've contained it, right?
Because you've given your team time back to get in and do the things necessary to remediate
the issue and then fix it before any damage is done before this files are maybe, you know,
corrupted or deleted maliciously before data is exultated and you got to go to a governing
organization and, you know, tell them that there was a data breach in your organization.
That's the whole idea.
And the same thing exists within Azure.
We've got to make sure that we're controlling who has access and then building automation
to alert.
Like I did extensive automation around break glass accounts.
If a break glass account was used, if someone sneezed and they were even thinking of logging
in with the break glass account, I wanted to get notified on it.
Like I knew every time a break glass account was logged in, I had multiple alerts coming
from anything.
And depending on, you know, I had an alert that was like, if the break glass account is
used outside of a country, like outside of my, you know, respected country, let me know.
And then it immediately high critical alert started flashing bells.
You know, I didn't have a siren in the office, but if I did it would have, I would have
figured an automation flow to like, a sound the alarm on the siren like it would, it was,
you know, it was obvious what was going on.
Yeah, awesome.
You said you said by said, so, yeah, let me have to talk about the infrastructure as code.
Oh, yes.
Let me tell you that.
How does for you, for your perspective, I see you are in infrastructure, just codes, improve
security outcomes.
Oh, my God.
It's, it's everything.
So, you know, let me, let me give you a little bit of backstory on why I got to that point.
So I was given a mandate by my previous organization.
I worked at, I needed to move every client that we had hosted in a data center into Azure.
I was very new into Azure architecture.
I was, you know, an A.V.D. specialist.
I had already gotten a cert for that.
I was in my Azure admin days working on the 104 and what I was doing is I was building
out the first client into Azure.
So I am a stickler for if it's not documented, it doesn't exist.
Like if you can't document exactly what you're doing, then the standardization doesn't
exist, right?
I have to be able to document every step of what I'm doing so that I can come back and
repeat said steps.
So if you look, there's actually a, I have a legacy document I bill that I haven't made
public, but I have this document.
It's about 120 some paintings and it's every step that I took in the portal to deploy out
the Azure infrastructure from how the NSG got created to how the Azure file shares were
created to each individual settings.
I had screenshots of all the settings.
I had the private endpoint connection to the Azure file share so they connect correctly
from on print.
I then went back to the beginning of the document and I tried to do it for the next client.
Everything changed.
The speed and the rate at which Microsoft is changing the interface is so fast that there
is no amount of documentation that can keep up with it.
And it was in that moment when I had to start that second project that I said, this is un,
this is unitatable.
I will not be able to maintain this document and this stay relevant long term.
And so when that realization happened, I did two things.
I started looking at Terraform and I started looking at Pysa.
I looked at Terraform.
I liked Terraform.
I didn't love all the requirements around Terraform and some of the, some of the files that
you had to, had to leverage.
And I really took a hard look at, okay, what's my objective here?
And my objective was not necessarily to interconnect with other clouds and not to
necessarily maintain anything on premise.
So I said, I feel like I'm kind of making it harder by looking at Terraform.
Not that I've talked to a ton of Terraform developers.
It's an amazing product.
Highly recommending.
But then I started looking at Pysa and I go, okay, well, what the heck is this Pysa thing?
It's a native DSL, so it's a domain specific language that integrates into Azure.
The underlying, the underlying protocol of ARM Azure Resource Manager is JSON.
And the idea is JSON is extremely complex to look at.
It's extremely complex to modify.
But then you look at something like Bysep, extremely intuitive, very friendly.
Hey, create a resource, resource storage account.
I want it to have these properties.
So started digging in.
I watched all kinds of videos.
I started learning from other developers.
And I was able to build a zero trust-ish architecture, right?
Within Azure, I was able to create custom Azure policies, right?
A lot of people overlook that, but Azure has amazing guardrails built in through the Azure
policy mechanism.
I was able to build all of that out with Bysep.
And I went through it one time and I deployed an entire infrastructure.
What would have taken me three days was dropped down to about a four to six hour time period.
And I was like, oh, this is it.
This is the whole point of what Azure is trying to do, right?
They really don't want you necessarily in the interface.
They have to provide a UI in the interface.
But at the end of the day, those APIs stay the same.
A lot of them are very similar.
Now they may add functionality into it.
And that's why you got to get up to date on what new APIs are available.
What within the Bysep code you can actually modify.
But I have an entire infrastructure built out in Bysep.
As infrastructure is code, I can go to play that today and it still works the same way.
So that is the idea you take a standard configuration and you're able to replicate it effectively across
every tenant.
I did this for tenant after tenant as I moved them.
I just took it.
I had an entire AVD build out.
So everything was built out in Bysep code.
Everything custom script, it would call a custom script.
It would join it to a domain because you're probably doing hybrid at the time.
All of that stuff was just built in and it was the same across every deployment I did.
The naming conventions, the regions, the policies as far as locking it down right.
Like that's one of those vectors you have to look at.
If you leave Azure open up to the world, people are going to come in.
They're going to start crypto mining on your dime.
They're going to build some in-series VMs and just say cool, let me have at it.
The idea is, if you're not deploying in-series VMs that need this intense GPU functionality,
don't deploy them.
Put a gate in, put an Azure policy in place that eliminates their ability to even do
that.
So, yeah, there's a long winded, but it's a much story there.
So we can say, a Bysep is the same what's actually for managing automated task and then Bysep
is then for deploying Azure resources.
Yeah, but it's a desired state configuration protocol, right?
Meaning that it's so two things that Bysep has is desired state and item potent.
So it can be rerun again and again and do the exact same task.
Whereas PowerShell, right?
PowerShell is like, you have to tell it where to go.
And if it hits an issue, it kind of just stops.
It's like telling someone how to get from point A to point B.
There may be three different ways you can get from point A to point B.
Bysep's just like, I don't care the direction you take.
I just want the in-state, the desired state to look like this.
And that's what Bysep does really effectively is it provides what the in-state should look
like and it can be continuously run and evaluated.
Does the in-state still match this?
If someone makes a change, nope, revert it right back.
The in-state should look like this.
And that's the idea.
That's how it standardizes that configuration, which inevitably if you standardize your
configuration, security is going to improve from that from that methodology.
And how do what those roles here, Bysep speed, how good is Bysep when we talk about
version control?
By something we talk about version control.
So as far as version control, I would say that a lot of the Bysep is going to depend
on you.
So as far as version control, a lot of what we handled was within our DevOps repo environment,
Markdown was a great way to keep track of notes.
I will say, version control, you can go in and because it's using Git as the underlying
engine, right?
Like, if you're probably using Git for that, I would hope it's stored in something like
Git of or within Azure DevOps, you can constantly see any of the versions that were created
previously and the modifications that were made with inside the actual code that you're
leveraging.
But just like I said, you know, if you can't document it, I still believe there is a case
for extreme documentation.
You should be very aware of any context that is needed outside of it.
You know, not everyone is using Bysep with the CI/CD pipeline, right?
Like, hopefully some of it you are automating with the CI/CD pipeline, but at the end of
the day, Bysep can be used very manually.
You can build a Bysep file and manually deploy it and it still does ABC just like you want.
So the idea is using something like Markdown to help document any context that's needed
around the Bysep.
The day all the version is maintained within the Git repos that you're hopefully storing
your Bysep files in.
And how do you convince traditional infrastructure teams to adapt infrastructure as a code?
That's a great question, right?
You know, I feel like the answer is always it depends on technology, right?
Like, legacy infrastructure teams, you got the guys that just want to sit in front of
the server and do the manual steps, right?
So that's going to be a harder sell.
But then you got the guys that are like, no, I don't want to do that.
I want to save time, right?
So they're building power shell scripts.
So I think for those power shell gurus, it's an easy sell, right?
What if I told you there was power shell, but even more verbose and you didn't have to
be as explicit?
I think it's an easy sell, right?
Let's start seeing how we can use that same automation capabilities to maintain that
adherence to the security configuration.
Now as far as the people that aren't necessarily looking at infrastructure as code, I would say
that it is time to start looking at that, right?
That's going to be a harder sell because there are people who just get scared by the fact
of automation and things of that nature.
But I think when you look at what AI is doing in the industry and where the industry is
going, it's going to become more and more pertinent that every organization is looking at
infrastructure as code.
You know, that is what AI is doing at the end of the day, right?
And like use the tools, if you look at some of the new Microsoft models, they have M.A.I.
1.1 code, right?
Like it's a coding model.
It's, we're trying to demystify how hard coding is and break it down into, hey, what is
it that you want to do?
Tell me what you're trying to do.
I'll build you the script to do that, right?
And so that is the idea.
I think that's really where the conversation is going to lead to is like, it's not something
to be afraid of.
It's something that we have to embrace to become more efficient as an organization.
That is also, I think, not the really new topic, but the, yeah, a lot of people now talking
about policy as code.
Can you a little bit explain what is it and how it fits into a broader governance picture?
I can definitely take a stab at it.
I mean, so if I look at policy as code, right?
I mean, I have a ton of things that exist within that policy as code around the organization
I work for in Forcer, right?
That we are kind of policy as code.
We are a wrapper on top of the graph API.
So the idea is if you look at identity specifically, right?
Conditional access as code, you know, it's, there's graph APIs.
There's things that wrap around it to be able to then bring that into a consistent manner.
And that's one of the things we try to do.
If you look at Azure as code, right?
I talked about Azure policy.
It's one thing that gets overlooked completely, but it shouldn't, right?
From a governance and a compliance standpoint, you know, one of the, one of the policies
that I built out is I worked with a lot of medical companies.
So we had to look at, if you look at Azure, there's a 476 HIPAA, you know, high, a, a, a
line policy for governance of HIPAA organizations.
So now I'm going to be honest.
I looked through all 470 of those.
There's a lot.
There's some that are processes and procedures when it comes to the medical space, a lot of
it relies on processes and procedures and how you're doing things as the human identity
inside the organization.
There are technical things that there's auditing capabilities.
You know, you have to be able to go back at any point in time and pull the logs and look
at, okay, did they have access from this, right?
So did your NSGs or did your vNets have logging enabled on them?
Did your storage accounts have logging enabled on them?
All of that is critical.
And that kind of ties into the full concept and the full picture of why bicep this code,
while policy is code is such an important concept because in order to enforce those policies,
you have to have those configuration set.
So the policy has to ensure that there's a technical prerequisite that's being met.
Okay, cool.
Our policy is to ensure that we have logging for eight months.
Cool.
There's a technical configuration that has to be in place to ensure that logging is being
held.
We need a fill safe loop that goes back and says, cool, do we have those configurations
in place and is the policy correct?
Awesome.
And at the end of the day, who's the human that's accountable for all of that, right?
And that's who the owner of said governance needs to be.
Yeah, I think a lot of companies have these, I don't know, misconception.
We are, yeah, we are compliant.
We have policies.
So we are secure.
Yeah, but we also have to do a, I think another podcast, we talk about he far and healthcare,
I think it's also an interesting topic.
I came from for Mittek.
I have worked years in Mittek.
So this is really, really, yeah, assumption yes, I don't know, remove them.
Yeah, but yeah, let's, let's look a little bit in the future.
Okay.
And there it's, yeah, you are a MVP.
So I think you were in Redmond on the MVP summit.
So I just got my MVP status very recently.
I missed the summit this year.
My buddy, Louis Berry is also an MVP.
He did go.
So I, I heard about all the good times had and I've talked to a lot of the identity architects
that were there.
So I'm, I'm really excited for the next one.
But yeah, I know, very new.
I've been doing a lot in a space for a while, but very new to the MVP side of things.
So I'm really excited to be here.
Then I'm for us congratulations.
Thank you.
Yeah, yeah, yeah, that's really cool.
And, but then, then it's, it's cool.
So you can talk a little bit about what did you see in the future in the Microsoft secure
queue road map and what excited you there most?
Yeah.
I, I'm going to be honest, the thing that excites me the most with Microsoft security these days
is just how they're advancing conditional access and, and the idea of PASKIES as a whole.
I, I think Microsoft is doing a lot.
I mean, if you look at the recent announcements over the past few months, right?
You know, the, the SSPR, you know, instance that we talked about, they're, they're doing
a lot around walking these things down.
They're doing a lot around agents in general as far as bringing those agents and creating
this frontier model where agents are able to connect into every aspect of what you're doing
across the Microsoft stack and provide real time value back.
So I look at, I look at what they're doing with the security copilot agent and then, you
know, conditional access as a whole, right?
Like there are issues.
Every conditional access deployment is not pristine the way it exists, right?
And so being able to use AI to evaluate it and then being able to use the AI to then provide
responses back where someone can communicate easily, right?
Do a chat agent and go, okay, we'll wait a second.
Why is that policy not working correctly?
And then be able to dig into the Microsoft side, right?
If we look at some of the changes, app and force restrictions have changed.
If you look at recent updates, you know, there used to be, I, I did when I did conditional
access, I would go check Fabian batter's introscopes every time.
There's some low level scopes that got removed by default.
If you excluded any service principle, well, you know, Microsoft has made changes in that
area.
So now those four same low level scopes that would get excluded by default are no longer.
That was an update as of March this past year.
Microsoft is continuing to push the limits on what they are doing when it comes to identity
security.
Two of the things that I guess, exactly the most are how, you know, much they are pushing
the idea of pass keys and fight a two fishing resistant authentication.
If you look at over the past few months, right, the introduction of synced pass keys is an
amazing way to start bridging the gap between technical requirements and usability from a
human perspective, right?
The idea of if I can go to someone, it doesn't make sense.
If I show them how a pass key works, they're going to fall asleep, right?
If I go, yeah, well, you just take your phone.
You see on this QR code, there's AL3, AL3, you know, encryption authentication, PK, let
me tell you how public and private keys work, right?
They don't care how PKI works.
What they care about is they like their iPhone.
They like to scan their face and get in.
So if I can explain to them, we can replicate that exact same behavior, whether it's a Mac
or Windows device.
We've got Windows Hello for Business, which is going to use that same fishing resistant
authentication, Macs with the platform.
So using the secure enclave, touch ID, so you just click it and you're in your device,
right?
If they can get that same type of iPhone-like experience with all of their enterprise tools,
it's a huge addition to being able to start to bring the average user into the ecosystem
where fishing resistance becomes a tangible thing for a lot of people that otherwise wouldn't
have adopted it.
I think that's a huge point that I'm excited to see how it continues to advance.
The new registration campaigns are pushing that and incentivizing that behavior, which I
think is amazing for Microsoft's end.
The other aspect is, while I have not gotten to play with it as much as I would have liked,
is kind of a play on with the verified ID and then the account recovery process, right?
That was a really cool implication or new technology that they added so that when you
do get that new phone, you're not necessarily done.
You don't have sync pass keys, but you have account recovery.
So now if you get that new phone, you lose your phone, whatever the case may be, you can
go in.
If your organization has this setup, you can use another identity provider to go, "Okay,
nope, yep, I see your government issued ID.
That is you.
Okay, cool.
I'm going to generate a tap for you.
You're going to use that tap to then bootstrap the process into getting your new fishing
resistant credential setup.
You never had to contact the help desk.
You never had to get any of that done."
That one's super exciting.
The problem is I don't have a third party provider right now set up in my tenant because
I'm broke and everybody, one is a real thing.
I do need to get that going so I can do some testing there, but yeah.
Yeah, a while, I think, two weeks, three weeks, I have started the synthetic market and it's
around, and it's, I think, 1,300 companies between one and 1,000 users and it's run from
the, I call it, I was the name, the gold standard, all Azure information and it's now, it's
placed different characters or different employees and then it's learnt where security
issues come from.
That's what a really, really fun project.
That's awesome.
I got some 150,000 ad renders for free so I can't check that out.
Oh man.
That's awesome.
That was really fun.
Yeah, but that's really interesting and I think that comes a lot of new stuff and yeah.
So yeah, let's just jump in the quick fire round.
I say some things and you say what's come first on your mind.
So pass, pass, versus pass keys, pass keys, as a policy or conditional access, oh, conditional
access all day security or productivity security.
Most on the right is Microsoft security feature.
Most on the right Microsoft security feature defender defender.
And when you got, when you get one day at Microsoft CEO position and you can say one thing Microsoft
should develop tomorrow, what, what should it be?
A true multi tenant interface.
They, they need one.
It's, it's hard.
It's very, it's all very separate still and it's obvious.
And coffee, tea or energy through red TV?
Coffee.
They literally have my Starbucks in hand right now.
And is that one, your, your biggest security met?
Biggest security met security, security defaults are secure by default.
It's a crazy math that exists.
They are not.
Yeah.
Okay.
Now my closing question is if you, if every listener should call, implement just one change
this week.
And that would dramatically improve their security posture.
What showed the B and Y?
Interesting.
I would say that would be authentication methods.
I think they should look at their existing authentication methods.
And if they have email, TOTP or SMS, they need to look at getting those cut off.
I think using the, the higher privilege, the more secure, I've got an article on authentication
methods on conditional access dot tech.
Hope everyone will look at that article and kind of guide some, some context to why I'm saying
that.
But I think that's a critical component that's often ever worked.
Yeah.
So Jonathan, thank you for, for joining us today and sharing your experience on identity,
security, conditional access, Azure governance and infrastructure as a code.
Yeah.
And I will say, remember in the cloud, first world security, security, identity isn't just
a part of security is security.
I think that's my little link for today.
And yeah, thank you for listening to MC64 guys.
And thank you, Jonathan for being here.
And I hope we have another session and we talk about you and healthcare.
Yeah.
I love that.
Awesome.
Thanks, Marco, for having me.
Appreciate it.
[indistinct]