Entra.Chat

Most SaaS vendors connect to your tenant with one multitenant app and one credential, shared by every customer. Kelvin Tegelaar, founder of CyberDrain and creator of CIPP (used by well over 10,000 MSPs), sees it from both sides, and his verdict is blunt: “This app is dangerous, period.”
Recorded on 14 October 2026, one day before the ConnectWise Cloud Backup app’s credential was used to sign in to customer tenants (173 confirmed by Huntress).
Key takeaways
The risk: one app, every tenant

* One app registration, a service principal in every tenant. The credentials sit on the vendor’s app registration, so one leaked secret or certificate works in every tenant that consented, with whatever application permissions you granted. For MSP tools, GDAP widens it to every customer behind the partner.
* You can’t put Conditional Access on a vendor’s app. Conditional Access for workload identities covers single-tenant apps only. Watch vendor apps’ sign-ins, ask vendors how they protect their credentials, and know where the Enabled for users to sign-in? switch is so you can disable an app fast.
Fix the credentials

* Retire client secrets; let certificates rotate themselves. Prefer managed identity or federation; otherwise use short-lived certificates. CIPP’s last 30 days and are replaced every two weeks with Microsoft Graph addKey/removeKey, not by granting the app Application.ReadWrite.All.
* Turn on app management policies. Block new client secrets and cap credential lifetimes. The tenant default policy is off until you enable it.
* Lock your app’s service principals. Builders: keep app instance property lock on (the default for new apps since June 2026), so customer tenants can’t add their own credentials to your app.
Fix the architecture

* Build one app per customer tenant. A leak in tenant A then stays in tenant A. It costs some engineering; one central app is “choosing convenience”, which is fine only if you choose it knowingly.
* Keep the apps you ship out of your corporate tenant. Separate tenants for corporate, Azure and the apps you publish, all secured to the same baseline. Decide early: an app registration can’t move between tenants.
Watch the full conversation for how Kelvin built CIPP out of spite, the vendor mistakes he sees most, and why a standard pen test won’t find any of this.
Sponsored by:
Know what’s in your tenant, and keep watching it
Every risk above lives in your own tenant: multitenant vendor apps with powerful permissions, client secrets and certificates that live for years, and app management policies nobody turned on. Maester, the free, open-source security test framework for Microsoft 365, finds them, with tests for long-lived app certificates, expiring credentials, privileged permissions nobody uses and app management restrictions.
Maester Cloud keeps watching after the first scan:
* Continuous monitoring: scheduled runs, each one diffed against the last, with drift alerts sent from your own Microsoft 365 mailbox.
* Assign each failed test to its owner and link a ticket.
* Track the work until it’s fixed: new failures, fixes since the last run and accepted risks, each pinned to a date and run ID.
* Every tenant in one place, switching between customers without signing in again. Unlimited users and tenants.
Self-hosted in your own Azure subscription for $99 a month or $1,188 a year, or through Azure Marketplace on your Azure invoice.
Subscribe with your favorite podcast player or watch on YouTube
About Kelvin Tegelaar
Kelvin Tegelaar is the founder of CyberDrain and the creator of CIPP, the CyberDrain Improved Partner Portal, an open-source, sponsor-funded tool that MSPs use to manage their customers’ Microsoft 365 tenants. He owns and is CTO of Lime Networks, an MSP in the Netherlands, and has been a Microsoft MVP for eight years. A system administrator rather than a developer by trade, he built CIPP in PowerShell and has blogged at CyberDrain.com for years about automating Microsoft 365 for MSPs.
GitHub - https://github.com/KelvinTegelaar
CyberDrain - cyberdrain.com
Related Links
From the conversation:
* Kelvin’s “accidental SaaS” blog post (mentioned at 02:25) - Referenced in the episode, but the blog post could not be found.
* Huntress: Never Just One Termite, 6 months of researching OAuth application attacks (rogue apps) (mentioned at 24:28) - https://www.huntress.com/blog/never-just-one-termite-6-months-of-researching-oauth-application-attacks
* Huntress: Traitorware, how hackers abuse legitimate apps to hijack Microsoft 365 - https://www.huntress.com/resources/traitorware-how-hackers-abuse-legitimate-apps-to-hijack-microsoft-365
* CIPP - cipp.app
* CIPP documentation - docs.cipp.app
* CIPP on GitHub - https://github.com/KelvinTegelaar/CIPP
* CyberDrain - cyberdrain.com
* Automating with PowerShell: making stolen tokens useless with Global Secure Access, by Kelvin Tegelaar - https://cyberdrain.com/automating-with-powershell-making-stolen-tokens-useless-with-global-secure-access/
* Huntress: vendor credential enables unauthorized access (the ConnectWise Cloud Backup incident) - https://www.huntress.com/blog/vendor-credential-enables-unauthorized-access
Multitenant apps and permissions:
* Application and service principal objects in Microsoft Entra ID (mentioned at 17:05) - https://learn.microsoft.com/en-us/entra/identity-platform/app-objects-and-service-principals
* allowedTenantsAudience (restrict a multitenant app to specific tenants, Graph beta) (mentioned at 17:18) - https://learn.microsoft.com/en-us/graph/api/resources/allowedtenantsaudience?view=graph-rest-beta
* How to configure app instance property lock (mentioned at 18:09) - https://learn.microsoft.com/en-us/entra/identity-platform/howto-configure-app-instance-property-locks
* Microsoft Graph permission types: delegated and application (mentioned at 18:48) - https://learn.microsoft.com/en-us/graph/permissions-overview
* Microsoft Graph permissions reference - https://learn.microsoft.com/en-us/graph/permissions-reference
* GDAP and the Secure Application Model (mentioned at 16:32) - https://learn.microsoft.com/en-us/partner-center/developer/gdap-and-secure-application-model
Credentials and rotation:
* Add and manage application credentials (mentioned at 21:00) - https://learn.microsoft.com/en-us/entra/identity-platform/how-to-add-credentials
* application: addKey (mentioned at 31:01) - https://learn.microsoft.com/en-us/graph/api/application-addkey?view=graph-rest-1.0
* Generate proof-of-possession tokens for rolling keys - https://learn.microsoft.com/en-us/graph/application-rollkey-prooftoken
* Configure app management policies (mentioned at 32:23) - https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/configure-app-management-policies
* Managed identities and secretless authentication across tenants (mentioned at 28:21) - https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/secretless-authentication
* Configure an app to trust a managed identity - https://learn.microsoft.com/en-us/entra/workload-id/workload-identity-federation-config-app-trust-managed-identity
Monitoring and response:
* Conditional Access for workload identities (mentioned at 27:38) - https://learn.microsoft.com/en-us/entra/identity/conditional-access/workload-identity
* Disable user sign-in for an application (mentioned at 26:26) - https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/disable-user-sign-in-portal
Tenants:
* Secure Future Initiative: eliminate identity lateral movement (mentioned at 34:32) - https://learn.microsoft.com/en-us/security/zero-trust/sfi/eliminate-identity-lateral-movement
* Microsoft actions following attack by nation state actor Midnight Blizzard (mentioned at 34:32) - https://www.microsoft.com/en-us/msrc/blog/2024/01/microsoft-actions-following-attack-by-nation-state-actor-midnight-blizzard
* Workforce and external tenant configurations (Microsoft Entra External ID) (mentioned at 37:17) - https://learn.microsoft.com/en-us/entra/external-id/tenant-configurations
Related Entra.Chat Episodes
* Stolen Tokens, Agents and Universal CAE: What Global Secure …


Get full access to Entra.News - Your weekly dose of Microsoft Entra at entra.news/subscribe

Most Conditional Access gaps aren’t exotic. They come from reading policies the wrong way: as firewall rules with an “allow”, as a list of platforms that seems complete, as an MFA exception for the office that made sense years ago. Brandon Colley has reviewed well over a thousand Conditional Access policies in customer assessments, and the same handful of mistakes come up in tenant after tenant.
Once those are fixed, the risk moves. Passkeys, privileged access and Conditional Access put more locks on the front door, the user sign-in. An app that was consented to years ago, holds a client secret and still has a stale redirect URI is a back door that none of those locks cover.
Brandon is a Senior Security Consultant at TrustedSec and a Microsoft Security MVP. He came from systems administration, learned Active Directory security at Trimarc, and now spends his days on cloud and on-premises assessments and the remediation that follows. These are the gaps he checks first, and the app and consent settings he has moved on to.
Security defaults can cover more admins than your policies
The free tier can be stricter than the paid one. Security defaults require MFA for 16 administrator roles. The Microsoft-managed policy “Multifactor authentication for admins accessing Microsoft Admin Portals”, and the “Require MFA for admins” template it mirrors, cover 14. The two extra roles in security defaults are Authentication Policy Administrator and Identity Governance Administrator.
If a small tenant is on security defaults, think hard before switching it off: the moment you do, you lose protections that you then have to rebuild in Conditional Access yourself.
Sponsored by:
ENow Software Introduces New Entra ID App Onboarding Experience
As user requests for SaaS and AI applications increase, Entra ID and M365 teams face a growing volume of security reviews, added hours of manual research, and bottlenecks.
New! ENow App Governance Accelerator 4.0 introduces App Onboarding, helping teams:
* Accelerate app approvals with configurable, multistage workflows.
* Evaluate security risks more efficiently with integrated Microsoft Defender for Cloud Apps risk scores.
* Reduce manual work with centralized requests, reviews, and approvals.
* Improve transparency with a self-service portal for requesters to track status and decisions.
* Control app sprawl with an Internal App Catalog of approved applications.
Go beyond Microsoft’s consent and approval capabilities with customizable, structured application governance, from the initial request through ongoing oversight.
Faster Approvals. Less Admin Work. Better Security Posture.
Learn More About ENow App Governance Accelerator 4.0
See It In Action: Request a Demo
Decide which roles are privileged yourself
“We require MFA on privileged roles” is easy to say in an audit. An assessment asks a harder question: privileged by whose definition? Brandon’s own list is about 36 roles, grouped into tier 0 and tier 1, the same tiering model Active Directory admins used 20 years ago.
Don’t lean on Microsoft’s mandatory MFA either. It covers the Azure portal, the Microsoft Entra admin center, the Intune admin center and the Microsoft 365 admin center, plus create, update and delete operations from Azure CLI, Azure PowerShell, the Azure mobile app and IaC tools. Microsoft Graph APIs are generally not in scope, so in some cases a single-factor sign-in can still reach Graph. Your Conditional Access still has to cover every app and every role you consider privileged.
Every platform is not all platforms
Conditions inside one policy combine with AND. A policy that requires MFA when the user is risky, the sign-in is risky and the location is outside the United States only fires when all three are true at once, so it almost never fires. Put conditions that should act on their own into separate policies.
The device platforms condition has the same trap. Ticking Android, iOS, Windows, macOS and Linux is not the same as “any device”. The platform comes from the user agent string, which isn’t verified and is easy to change, so a sign-in that claims an unknown platform matches none of your platform policies and walks past all of them. Microsoft’s recommended fix is a separate block policy: include Any device, exclude the platforms you support, and set the grant to Block access. Brandon covers how the spoofing works in his Petri article (linked below).
Watch this episode…
Conditional Access has no allow rule
Customers often ask for a policy that will “allow finance access to the finance app”. Conditional Access has no allow rule. A policy is an if-then statement: if the users, target resources and conditions match, then require MFA, a compliant device or another control, or block. Anything the policy doesn’t match passes through untouched.
So every time you narrow the users, the apps or the conditions to describe who should get in, you also shrink what the policy protects. Scope policies broadly and carve out exclusions on purpose.
Testing: ask what a policy doesn’t do
Testing usually covers the happy path: the right user opens the right app and gets an MFA prompt. The gaps are in the paths nobody tried: the user who isn’t in the group, the unmanaged device, the other network. Two locations, managed and unmanaged devices, a few apps and a few user types already make dozens of test cases, and every new condition (insider risk from Microsoft Purview, for example) multiplies them again.
The useful question isn’t “what does this policy do?” but “what doesn’t it do, and does something else cover that?” When you add a role or group to one policy, check whether it should come out of another.
Tools help:
* What If tool: simulate a sign-in for a user, app, device platform and location, and see which policies apply.
* Conditional Access Optimization Agent: Microsoft Security Copilot reviews your policies and suggests new policies (created in report-only mode) and changes for you to approve. It needs Microsoft Entra ID P1 and security compute units.
* AI with sanitized data: as a consultant, Brandon often can’t run tools inside a customer’s tenant. He exports the policies as JSON, removes tenant names, group names and IDs, and asks an AI model to explain a specific coverage question. Challenge the answers and verify them; don’t take them on trust.
User actions and device code flow
Two gaps Brandon still finds often:
* User actions. Conditional Access can target Register security information and Register or join devices. Without a policy on these, registering an MFA method or a device is protected only by whatever the sign-in itself required.
* Device code flow. Microsoft deploys a managed policy that blocks it in some tenants, but Brandon has seen it deployed only about three times. Check whether you need it: filter the sign-in logs by authentication protocol for device code and see who uses it. Legitimate users are usually input-constrained devices such as Teams phones and Teams Rooms. At one customer, the single device code sign-in turned out to be their own penetration test. Then block it with an authentication flows policy and exclude only what genuinely needs it.
Trusted locations: the exception that switches MFA off
A common policy reads: require strong authentication for all users, all apps, everywhere, except trusted locations. It was best practice once. In effect it means single-factor sign-in at the office, and it often survives after the rest of the policy has been modernized.
On Microsoft Entra joined and hybrid joined Windows devices you don’t need the exception for single sign-on. The primary refresh token (PRT) provides SSO to apps and carries the MFA claim. The exception only lets users skip strong authentication.
Flip how you use locations. Instead of using them to relax MFA, use them to lock down the accounts that can’t do MFA, such as service accounts, shared accounts and kiosk accounts, so they only work from specific IP ranges and devices.
While you’re there:
* MFA trusted IPs in the legacy MFA service settings ar…


Get full access to Entra.News - Your weekly dose of Microsoft Entra at entra.news/subscribe

Most tenants have the same problem: hundreds of app registrations and service principals, client secrets that were set to expire in a hundred years, permission grants nobody remembers approving, and test tenants that were never cleaned up. It’s tempting to start fixing the scariest app on the list. Jeff Sakowicz argues for a different order: stop the problem from growing first, then remove the debt that gives you the most risk reduction for the least disruption.
Jeff isn’t describing someone else’s product. He has spent most of his 14 years at Microsoft as a product leader on the Entra application platform, shaping the application and service principal model and the OAuth permissions and consent model that every Entra tenant runs on today. Publisher verification and risk-based step-up consent came out of that work, and he now leads part of the team building the platform behind Microsoft Entra Agent ID. Inside Microsoft, he’s the person teams call when an app incident needs untangling. This is his playbook for securing non-human identities, from client secret burndown and unused apps to consent phishing and the protections Microsoft runs in every tenant by default.

Prevention starts with policy
The best medicine is prevention. Before you clean anything up, go through the policy controls you already have and set them to block insecure configuration that doesn’t fit your organization’s risk tolerance. This is a balance, not a switch. “If you want the most secure system in the world, unplug the server, bury it underground. Your job is done.” Lock things down too hard and developers and end users will find other ways to get work done, especially now that they have agents to help them. Shadow IT is almost always less secure than what you stopped. So whenever a control blocks self-service, make sure people know what to do next and how to get unblocked quickly.
Treat high-value apps as production infrastructure
Microsoft runs customer-facing apps in tenants separate from its corporate tenant. Tenant-level isolation is a useful form of segmentation, and some large organizations do the same for their production assets. But a second tenant brings its own operational overhead, and a tenant that falls into chaos can leave you worse off than before.
Whatever you decide, treat your multitenant apps and high-value line-of-business apps as production infrastructure, the same way you would protect a database or a high-value Azure subscription. A good middle ground is to keep a close eye on the owners and sponsors of your high-value apps and agent identities. They are the people who can change those identities’ authentication configuration, so their accounts need good hygiene.
The easier win is test, demo and staging. If they still live in your productivity or production tenant, move them out. Midnight Blizzard showed how small dominoes lead to big consequences: Microsoft’s own write-up describes a password spray against a legacy, non-production test tenant account, followed by a legacy test OAuth application that had elevated access to the corporate environment.

Sponsored by
Many of the app and consent problems in this episode are exactly what Maester checks for: it runs security tests against your Microsoft Entra and Microsoft 365 configuration and tells you what passed and what failed.
Maester Cloud turns those results into a workflow your team can run every day:
* Assign an owner to each finding and link it to a ticket, instead of tracking remediation in a spreadsheet.
* See what got fixed since the last run, and record accepted risks.
* Catch drift with daily history and alerts when a setting changes.
* Every tenant in one place, without switching sign-ins.

Subscribe with your favorite podcast player or watch on YouTube
Map your surface area, then think in three dimensions
Before buying a new inventory tool, use the one you already have. If your organization already tracks production assets or other identities, bring your non-human identities into that system instead of running a parallel process. Then answer three questions: how many of these do I have, what categories of identity are in the portfolio, and what are the big categories of risk?
Jeff looks at risk in three dimensions:
* Active threats. Priority zero. Hand them to the SOC immediately.
* Posture. Surface area from misconfiguration, or configuration that was state of the art five years ago, such as the implicit flow for a single-page app. Weak credentials, insecure redirect URIs, unused identities and legacy protocols all live here.
* Blast radius. How much privilege each identity has, whether it’s used or not.
Most organizations end up with a huge list of high-privilege apps and posture issues. You will never get every risk to zero at that scale, so the job is to prioritise by risk and by return on effort.
Burn down secrets: stop the bleeding first
Say you’ve read the Solorigate reports and want to get client secrets off your non-human identities. Step one is to stop the bleeding: create an app management policy that blocks new password credentials from being added. App management policies can take an enforcement date, so only apps created after that date are affected and your hundreds of existing apps keep working while you fix them. There is no equivalent for user authentication methods.
Before you switch it on, find out how disruptive it will be. One new app a month that uses a password credential is easy to absorb. A hundred a day could grind the organization to a halt. Have the guidance and the exception process ready, and move the enforcement date if you need to.
Once the problem has stopped growing, turn to the debt. Split it into categories and start with the two ends of the spectrum:
* The most privileged. Apps with existing passwords that have app-only access to read all mailboxes or read and write all user profiles go to the top of the list. Move them to a stronger credential and check whether they need that access at all.
* The wholly unused. More on this below.
The end goal is system-managed credentials, using a managed identity or workload identity federation with a federated identity credential (FIC). You can argue a certificate’s private key is harder to leak than a secret, but as Jeff says, “a bad copy-paste is a bad copy-paste.” System-managed credentials also remove a big source of toil for developers, which helps when you need people to move.
Why mail is the flag
Mail permissions can look less frightening than broad directory permissions, but for many attacks mail is the goal. “Mail’s often the flag that the attacker’s trying to capture.” Other access is often just a way to move laterally or elevate privilege. Mail, Teams chats and files can be the end goal, and that is what most historical consent phishing attacks went after. A mailbox is also a good lateral movement tool: it can hold credentials and bank details, and it gives an attacker what they need to craft a convincing social engineering attack against everyone the victim emails or chats with every day.
Lost secrets make this worse. A secret that is valid for years, used by apps nobody can name, gives an attacker a way in without adding a new credential, so there’s no new event for you to trace.
Unused identities: the highest return on effort
A wholly unused identity is the highest-ROI bucket. “If you get rid of an unused identity, you might be knocking an item off of seven lists.” In one move you can remove a weak password, an insecure redirect URI, overprivileged access and some legacy protocol usage. Do your due diligence first, because some apps only run once a year at tax season. But removing something that is truly unused doesn’t disrupt anyone, and it can be done as a central action by a single team without engaging every app owner. That high-leverage central action is what Microsoft leaned into for its Secure Future Initiative work.
Then look at low-usage identities. They hide in plain sight: an identity with an automated runner that wakes up every day to run a test…


Get full access to Entra.News - Your weekly dose of Microsoft Entra at entra.news/subscribe

A phished and stolen refresh token is one of the most useful things an attacker can take from your tenant. It is a long-term artifact, which is why so many phishing attempts go after it. Alex Pavlovsky’s answer to that attack is a feature every Entra ID P1 tenant already owns.
Compliant network is part of Global Secure Access, and, like source IP restoration, it comes with Entra ID P1. Put the GSA client on your devices, add one Conditional Access policy that blocks access from anywhere outside the All Compliant Network locations named location, and a stolen refresh token or PRT cookie no longer works from the attacker’s own machine. As Alex puts it, the token itself does not become bound, but your use of it is gated by being on your organization’s compliant network.
Merill is joined by two former colleagues who are Microsoft Entra PMs: Alexander (Alex) Pavlovsky from the Global Secure Access feature team, and Marilee Turscak, who works on helping customers adopt AI safely. They explain why Microsoft built networking into identity, walk through the compliant network policy and a BYOD sign-in with no client installed, and demo a network policy that stops an agent from deleting a file its user is allowed to delete.
Why a stolen token stops working
For phishing itself, Alex is clear that the main line of defence is still stronger credentials that do not involve passwords. Compliant network helps with what comes after: the newer attack patterns where refresh tokens are stolen and replayed.
If your tenant-wide policy says you can only authenticate from a compliant network, you can also only replay refresh tokens from a compliant network. PRTs become unusable unless they are used from a device that has GSA, which means your organization’s device. Alex says the same applies to ROADtools-style attacks with PRT cookies: none of that works with compliant network in place. The signal is also tenant-specific. A GSA device in tenant B satisfies compliant network in tenant B and nowhere else.
In the demo, Alex builds the policy in a few clicks: all users, all resources (so the primary refresh token, Entra ID itself and Microsoft Graph are covered), any network except compliant network locations, then block. Start it in report-only mode, watch who is not coming through compliant network, pilot with a smaller group and expand. You do not need the advanced GSA licences for this, but you do need the GSA client on your devices or a remote network sending the traffic.
And exclude your break glass accounts. Alex has taken many panicked customer calls from admins who forgot, and Marilee locked herself out of a test tenant this way recently.
One engine for identity and network
When Merill joined Microsoft, he couldn’t see why networking belonged to the identity team. Alex explains the reasoning. When identity picks up a signal that a user, session or token is at risk, the network has to hear about it quickly, and passing those signals between separate systems through traditional APIs is too slow at this scale. So Microsoft made the identity engine and the network engine one engine.
That design shows up in source IP restoration. Behind a typical proxy or security service edge, every user looks like they signed in from the provider’s shared IP range. GSA sends the user’s original source IP to Entra securely, so sign-in logs are accurate, Conditional Access can evaluate the user’s own IP, and Identity Protection’s location and impossible travel detections work again. It is also why compliant network works at all: the GSA edge shares a security engine with Entra ID, so it can tell Entra that this is a legitimate GSA device from a specific tenant, and Entra can trust that signal.
The network can tell agents from users
“Agents are super deterministic. They are very resourceful. They do not give up.” Alex also argues that saying no to agents means falling behind your competitors, so the question becomes how to protect their use.
GSA can detect when network access comes from an agent, and its policy rules can match on the HTTP method, the destination and whether a user or an agent is acting. Marilee’s baseline recommendation is to block sensitive actions by agents. In her demo, the Zava helper agent tries to remove a document from Dropbox and gets an “agent is not authorized” error, because a policy called “block agents from destructive actions” blocks the DELETE method for agents only. The user checkbox is left clear, so the person can still delete the file themselves. The logs show the same attribution, which Alex says is valuable even before you apply any policy.
Alex also describes Copilot Studio agents running through GSA with no client anywhere. A Copilot Studio admin checks one box to enable the GSA integration, and with Internet Access and a policy in place, that agent traffic flows through GSA and your policies apply.
BYOD without the client
Marilee shows a user on a personal device with no GSA client. When she signs in, she is prompted to switch to her work browser profile, and from then on Explicit Forward Proxy sends that profile’s traffic through GSA. When she tries to open Facebook, she is blocked inside the work profile and nowhere else on her device. Alex sees the managed Edge profile becoming a sandbox with secure network access and Purview DLP, which could reduce the need for remote browser isolation. The full client still gets the most features, including agent detection, and remote networks are a third way to send traffic through GSA.
Universal CAE now acts on device state
Continuous access evaluation used to depend on applications that understood it, which mostly meant SharePoint, Teams and Exchange. Send an app’s traffic through GSA and it becomes CAE-aware too, including private apps. If an admin is on an SSH session over GSA and Entra flags their identity, Alex says the session is dead within about two to five minutes, even if their token is good for another 90 minutes.
The week before recording, Microsoft added device state support. If Intune or a third-party MDM marks a device non-compliant in Entra ID, GSA asks the user to bring it back into compliance or lose network connectivity. User risk changes and device deletion or disablement also trigger it now. If you already run GSA, you get this without changing anything, which is Merill’s favourite kind of feature.
If you have Entra ID P1 and have never deployed the GSA client, compliant network is the place to start.

About Alexander Pavlovsky
Alexander Pavlovsky is a Product Manager on the Microsoft Entra Global Secure Access feature team. He has been at Microsoft for 22 years. He started in Microsoft Consulting, installing domain controllers and Exchange servers for customers from CDs, then moved to the identity product team as a customer-facing PM in the Entra GTP (Get To Production) team, later CXE (Customer Experience), helping organizations adopt Azure AD.
LinkedIn - https://linkedin.com/in/alexpav
About Marilee Turscak
Marilee Turscak is a Product Manager on the Microsoft Security team focusing on Microsoft Entra. For the past two years she has focused on getting customers deployed across the Microsoft Entra Suite, and she now works on helping customers adopt AI safely and securely.
LinkedIn - https://linkedin.com/in/marilee-turscak
Related Links
* What is Global Secure Access? - overview and the licensing table for each feature (mentioned at 10:08) - https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access
* Source IP restoration (mentioned at 15:07) - https://learn.microsoft.com/en-us/entra/global-secure-access/how-to-source-ip-restoration
* Universal Conditional Access (mentioned at 15:26) - https://learn.microsoft.com/en-us/entra/global-secure-access/concept-universal-conditional-access
* Universal Tenant Restrictions (mentioned at 15:26) - https://learn.microsoft.com/en-us/entra/global-secure-access/how-to-universal-tenant-restrictions
* Compliant network check with Conditional Access (mention…


Get full access to Entra.News - Your weekly dose of Microsoft Entra at entra.news/subscribe

Ask a coding agent to build something that talks to another service and watch what it does. It creates a client secret. Then another one. As Arturo Lucatero puts it, next thing you know you have ten secrets that were created without you knowing about it. At the speed AI is moving, he thinks we could be cleaning up a few million new secrets within six months.
That would undo a lot of hard work. Under Microsoft’s Secure Future Initiative, Microsoft spent years removing secrets from its own estate and helping customers do the same with managed identities and workload identity federation. The agent era is the window to make secretless the default before the habit sets in.
Arturo is a Principal Product Manager on Microsoft Entra Agent ID, and he helped launch Managed Service Identity, the feature we now call Managed Identities for Azure resources. In this episode he and Merill trace the whole path: why secrets break, how managed identity takes them away inside Azure, how workload identity federation extends that to AWS, GCP, Azure Arc and now AI vendors like Anthropic, and what that means for agents.
Secrets work until they don’t
A service principal with a client secret works. It works right up to the moment it gets leaked, expires in the middle of an important job, or turns out to have no clear owner, no rotation plan and no one who knows where it is stored. Managed identity moves that whole burden to the platform. The secret still exists, but the developer never sees it. The admin’s job shrinks to control-plane questions: which resource, which identity, and what it can access. Arturo also hints at what comes next: binding managed identity tokens to the resource so a leaked token is useless anywhere else.
Beyond Azure
Not every workload or data source lives in Azure. Workload identity federation lets a workload present a token from an identity provider you already trust, such as AWS, Google Cloud, GitHub or Kubernetes, and exchange it for an Entra token with no secret involved. Azure Arc brings managed identity to servers outside Azure, including the one under your desk, which raised a hard design question for the team: what happens to the secret when the machine is in someone’s basement?
Coding agents default to secrets
Coding agents learned from years of examples full of client secrets and Key Vault plumbing, so that is what they produce. Merill has to push his own agents back towards workload identity federation every time. Arturo hit the same problem from the inside: when he asked a coding agent to build with Agent ID, it created a plain service principal and named it “blueprint”. The fix was rewriting documentation and shipping agent skills that teach coding agents the right pattern.
Why agent identities still allow client secrets
Merill asks the obvious question. If secrets are this bad, why can an agent identity have one? Arturo’s answer is compatibility. Agent identities already authenticate through a federated identity credential flow under the hood, but many places that call agents cannot obtain an OIDC token yet. Without secrets or certificates as a fallback, people would simply keep using app registrations.
Open standards are the way out
Agents now cross identity providers and clouds every day. Entra is leaning on open standards so they can do that without secrets or interrupting users: SPIFFE identities that can be exchanged for Entra tokens, and ID-JAG, which lets admins pre-consent so an agent can reach a service like GitHub or Slack without prompting the user.
Arturo’s advice for anyone building today is simple: whatever you can do to avoid having a secret, do it.

Is Each App in Entra ID Still Worth Governing?
App registrations and enterprise applications accumulate. Owners change. Projects and pilots end. Credentials linger. And stale or unused apps and their permissions can continue adding risk and governance overhead long after their purpose is gone.
ENow App Governance Accelerator helps you understand and act on:
* What is in your Entra ID application estate
* Who owns business and technical decisions and management?
* Which apps, permissions, and credentials need attention?
* What can be safely cleaned up to reduce your attack surface on a continuous basis as your tenant grows and changes?
Get the visibility and automated workflows you need to investigate application lifecycles at scale, clear out stale apps, and stop wasting time governing applications that shouldn’t still be there in the first place.
See it in Action
Subscribe with your favorite podcast player or watch on YouTube
About Arturo Lucatero
Arturo Lucatero is a Principal Product Manager at Microsoft working on Microsoft Entra Agent ID, where he focuses on giving agents a strong, governable identity and on the developer experience for building with it, including skills that teach coding agents to use Agent ID correctly. He joined Microsoft’s identity team after a re-org moved him there from Power BI, worked on Connect Health, and then helped Stuart Kwan launch Managed Service Identity, now managed identities for Azure resources. Most of his career has been spent modernising non-human identities, from managed identity and Azure Arc to workload identity federation.
LinkedIn - https://www.linkedin.com/in/arturo-lucatero/
Related Links
* Microsoft Entra Agent ID skill for coding agents, in GitHub Copilot for Azure (mentioned at 32:52) - https://github.com/microsoft/GitHub-Copilot-for-Azure/blob/main/plugins/azure-skills/skills/entra-agent-id/SKILL.md
* AI-guided setup for Microsoft Entra Agent ID, using the skill with GitHub Copilot (mentioned at 32:52) - https://learn.microsoft.com/en-us/entra/agent-id/agent-id-ai-guided-setup
* Ben Reader: Access Azure Key Vault from a local Kubernetes cluster with Azure Arc workload identity (mentioned at 22:32) - https://powers-hell.com/2026/08/26/access-azure-key-vault-from-a-local-kubernetes-cluster-with-azure-arc-workload-identity
* Ben Reader: Run a PowerShell workload on a local Kubernetes cluster that talks to Microsoft Graph (mentioned at 22:32) - https://powers-hell.com/2026/09/08/run-a-powershell-workload-on-a-local-kubernetes-cluster-that-talks-to-microsoft-graph
* Managed identities for Azure resources, formerly Managed Service Identity (mentioned at 04:50) - https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/overview
* Workload identity federation (mentioned at 15:18) - https://learn.microsoft.com/en-us/entra/workload-id/workload-identity-federation
* Workload Identity Federation for the Claude API (mentioned at 16:27) - https://platform.claude.com/docs/en/manage-claude/workload-identity-federation
* Agent identity blueprints in Microsoft Entra Agent ID (mentioned at 20:35) - https://learn.microsoft.com/en-us/entra/agent-id/agent-blueprint
* Access Azure resources with managed identity on Azure Arc-enabled servers (mentioned at 23:09) - https://learn.microsoft.com/en-us/azure/azure-arc/servers/managed-identity-authentication
* SPIFFE and SPIRE (mentioned at 27:41) - https://spiffe.io/
* Federate a SPIFFE/SPIRE workload identity with Microsoft Entra ID (mentioned at 29:25) - https://learn.microsoft.com/en-us/entra/workload-id/workload-identity-federation-spiffe-spire
* Pieter Kasselman: SPIFFE at the BotAuth BoF, IETF 123 (mentioned at 29:53) - https://datatracker.ietf.org/meeting/123/materials/slides-123-webbotauth-spiffe-at-the-botauth-bof-pieter-kasselman-00
* Identity Assertion JWT Authorization Grant (ID-JAG), IETF draft (mentioned at 30:21) - https://datatracker.ietf.org/doc/draft-ietf-oauth-identity-assertion-authz-grant/
* Microsoft Secure Future Initiative (mentioned at 06:30) - https://www.microsoft.com/en-us/trust-center/security/secure-future-initiative
Related Entra.Chat Episodes
* One Compromised Agent ID Blueprint Can Cross Tenant Boundaries - https://entra.news/p/one-compromised-agent-id-blueprint
* From Windows Core to Leading Agent ID: Vince Smith’s Microsoft Story - https://entra.news/p/from-windows-core-to-leading-agent
* Attackers Are Targeting the AI Ecosy…


Get full access to Entra.News - Your weekly dose of Microsoft Entra at entra.news/subscribe