🚨 Global Secure Access ≠ “replace VPN and done.”

I just published a new podcast with Chris Brum where we break down real-world Microsoft GSA deployments 🧵👇

#ConsentFix is a great way for attackers to work around some protective layers but not all. @naunheim.cloud , @cbrhh.bsky.social and I wrote a blog post on detection and mitigations. Hope you find it useful and can adapt it to your environment.

www.glueckkanja.com/de/posts/202...

Take a look at the article I linked. It says: "Microsoft Entra Internet Access for Microsoft services capabilities are included in a Microsoft Entra ID P1 or Microsoft Entra ID P2 license."

Compliant Device Bypass in Microsoft Intune – Detection, Response & Mitigation In this blog post, glueckkanja's MVP Fabian Bader, Chris Brumm and Thomas Naunheim gather details about the Compliant Device Bypass in Microsoft Intune Company Portal. After additional research, they ...

@fabian.bader.cloud, @naunheim.cloud and I have also looked into the topic of TokenSmith and are describing the Blue Team perspective (including an effective detection) in this blog:
www.glueckkanja.com/blog/securit...

TokenSmith Meets Evilginx: Token Theft Combined with Entra Conditional Access Bypass YouTube video by SYNACK Time

Unfortunately, that was only a matter of time!

This video combines two of the most dangerous tools at the moment associated with phishing - and it's surprisingly simple!
www.youtube.com/watch?v=Dp1z...

Do we have defense options? Read on 👇

Continuous access evaluation in Microsoft Entra - Microsoft Entra ID Responding to changes in user state faster with continuous access evaluation in Microsoft Entra

A Compliant Network behaves like a Named Location and triggers the Continuous Access Evaluation trigger.
This will force the user to reauthenticate if the token is CAE enabled (and the Service is SharePoint Online).
-> learn.microsoft.com/en-us/entra/...
-> learn.microsoft.com/en-us/entra/...

4/4

Enable Compliant Network Check with Conditional Access - Global Secure Access Learn how to require known compliant network locations in order to connect to your secured resources with Conditional Access.

Why should you do this?

You get the option to protect your resources behind the compliant network control by configuring a Conditional Access policy
-> learn.microsoft.com/en-us/entra/...

This policy is regarding to my tests really powerful to protect against replayed tokens.

3/4

The Global Secure Access Client for Windows - Global Secure Access The Global Secure Access client secures network traffic at the end-user device. This article describes how to download and install the Windows client.

Means: you can install the Global Secure Access Client on all your clients and route the traffic to all the Microsoft Endpoints through GSA.
-> learn.microsoft.com/en-us/entra/...

The client is available for Windows, Mac, Android and iOS and it is really easy to deploy.

2/4

What is Global Secure Access? - Global Secure Access Learn how Microsoft's Security Service Edge (SSE) solution, Global Secure Access, provides network access control and visibility to users and devices inside and outside a traditional office.

Global Secure Access and Token Replay - a thread...

Did you know that "Microsoft Entra Internet Access for Microsoft" is included in your Entra ID P1 license?
-> learn.microsoft.com/en-us/entra/...

1/4

Use Defender XDR advanced hunting query capabilities to detect possible device compliance bypass attacks for Entra ID Conditional Access according to the vulnerability disclosed by Yuya Chudo (https:/... Use Defender XDR advanced hunting query capabilities to detect possible device compliance bypass attacks for Entra ID Conditional Access according to the vulnerability disclosed by Yuya Chudo (http...

gist.github.com/CloudProtect...

This one does a very good job because it considers if the device is joined/registered any only looks at the AADGraph. For this resource its not normal that a non-registered device is accessing it

Any tips? That's a really strange coincidence - ours needs to be replaced too...

I hope every SOC is monitoring incoming emails for signs of anomalous incoming mail amounts to your users. If this happens the execution of any RMM by the target user is a high alert you should follow up on.

🔊 @cbrhh and I will be part of this year's Experts Live DK with our session: The state of passkey in 2025

#ELDK2025

conference.expertsli...

Great news! 🎉

I have the opportunity to speak in March at the #eldk2025 in Copenhagen!

I will do a comparison of Entra Private Access and a classic VPN solution and show why Global Secure Access is much closer to my understanding of Zero Trust Network Access.

Hope to see you there!