Security research and technical deep-dives into IAM, PAM, Azure, Microsoft Entra, Intune and more. For how-to guides and field notes, see the Modern 42 blog.
VULN-154544: how a Conditional Access resource exclusion let a stolen password reach Microsoft 365 data across the tenant through first-party OAuth clients, with root cause, detection, and the fourteen-month MSRC disclosure.
For engineers: the WebAuthn assertion field by field, the BE and BS flags, why synced passkeys can't be attested, discoverable credentials and the hybrid QR flow.
VULN-172966: how a self-attested Intune MAM enrolment satisfies Entra ID's 'require app protection policy' Conditional Access grant, with root cause and fixes.
A technical deep-dive into Microsoft Intune's Mobile Application Management (MAM) that reveals what App Protection Policies actually protect and what they don't.
We keep bypassing Conditional Access device filters on engagements using browser DevTools and a VM. This post covers the three bypass patterns we see most often (User Agent spoofing, the null property problem, and the bait-and-switch), plus how to build policies that actually hold up.
Stay up to date with the latest in identity security, PAM, and IAM engineering from the team at Modern 42.
We use cookies and similar technologies to help personalise content, measure the performance of our site, and provide a better experience. By clicking Accept, you consent to the use of all cookies.
Learn more.
