PM @Microsoft - Helping build tech to secure endpoints - thoughts here are mine and are not always based in reality
New York, USA
- Tweets 1,758
- Following 174
- Followers 3,087
- Likes 2,366
Thanks for having me @mmsmoa and look forward to the next time!
There’s a lot of interest for @DeviceDeploy and @KrysOnTheNet session. So many want to hear what they have to say about “Intune Internals: Extreme Deep Dive”.
#MMSFlamingo #MMSMOA
20
1,870
Come see us at this afternoon at @wpninjasummit sched.co/1i3Pl
2
1
13
1,453
Great read…
Why we are on the topic of token theft. Lets talk for a second around session hijacking with AiTM and 3rd party products like Fortinet and Palo Alto's.
Incredible advice here that you all should read and bookmark. Detection engineering in Sentinel is a hobby of mine and I love sharing advice.
techcommunity.microsoft.com/…
4
1,596
We can certainly work to update it. Likely it was added or created after the AV profile was created.
1
2
129
Not tracking anything. Maybe @IntuneSuppTeam is….
Seen this sort of behavior in the past when someone is tinkering with RBAC… but never been able to root cause it…
3
275
lol. The definitions we use come directly from the platform. We’ve tried various efforts to make them better with mixed results.
2
35
You’re right. I don’t love auto elevate based on reputation, but I do love reputation as a attribute to allow/deny elevation. Working on it… :)
3
123
Every time I deal with this I have to relearn it. 4 days doesn’t seem right, we should do better there. Two things I do see get in the way all the time (Besides no firmware license): PRT Acquisition and All Cloud Apps CA policy. Make sure you’re getting a PRT and if you use All Cloud Apps make sure the CA policy isn’t blocking you.
There’s activation log somewhere (my search fu is failing) which lets you know some helpful stuff…maybe I can find it in a bit…
1
3
169