Identity Protection & RiskMicrosoft Entra ID

Configure gMSA Defender Identity: Step-by-Step Guide

April 30, 2024
Microsoft Defender for Identity Formerly known as Azure Advanced Threat Protection (Azure ATP), Defender for Identity is a cloud-based security solution offered by Microsoft to help organizations in identity monitoring with high security, in both on-premises and hybrid environments. With the modern identity threat detection (ITDR), security operation teams in your organization can now prevent…
Read more
Authentication MethodsExternal IdentitiesMicrosoft Entra IDTenant & Directory Administration

How to setup entra connect and cloud sync with the right sync engine

March 1, 2026
Hybrid identity is no longer a “maybe later” project. It is now the default state for most enterprises: on-premises active directory still runs many core workloads, while microsoft entra id is the control plane for modern access, conditional access, and saas. The connector you choose between those worlds determines whether sign-ins are boring (good) or chaotic (bad). When people say “set up…
Read more
AD Domain ServicesArchitecture & Design

How to detect Golden Ticket attacks

November 14, 2025
How to Detect Golden Ticket Attacks in Active Directory A Golden Ticket attack is one of the most damaging post-compromise techniques in Active Directory: an attacker forges a Kerberos Ticket Granting Ticket (TGT) using the KRBTGT account secret, then impersonates any user (often Domain Admin) to access domain resources while blending into “normal”…
Read more
Automation & ToolingScripts & Templates

Detecting Kerberoasting with PowerShell and logs

November 14, 2025
Detecting Kerberoasting with PowerShell and Logs Kerberoasting is an Active Directory attack technique where an attacker requests Kerberos service tickets (TGS) for accounts that have Service Principal Names (SPNs), then cracks the ticket offline to recover the service account password. Because it uses legitimate Kerberos flows, the key to detection is understanding what…
Read more
AD Domain ServicesAuthentication & Protocols

Identifying unsecure SPN configurations

October 31, 2025
Identifying Insecure SPN Configurations in Active Directory (Detection + Fix Runbook) Service Principal Names (SPNs) are a core part of how Kerberos knows which service you’re trying to reach and which account should decrypt the service ticket. That also makes SPNs a high-signal control point for both security and reliability: weak service-account hygiene, legacy…
Read more