Author
Danny Vorst
Microsoft 365 Security Specialist
Danny works as a Technical Engineer, advising organizations on their Microsoft 365 environment and translating security findings into concrete changes a service desk can execute. Over ten years of experience with Microsoft 365 and security. His writing covers identity security, Conditional Access, and the attack patterns that show up in real tenants.
LinkedIn- Blog Danny Vorst
Entra Agent ID explained: who gets to create AI agents?
Entra Agent ID gives AI agents their own identity. What blueprints and agent identities are, why the setting 'Users can create agent blueprints' matters, and when to leave it on or switch it off.
- Announcement Danny Vorst
Entra Connect Sync needs version 2.6.84.0 and application-based authentication by April 7, 2027
From April 7, 2027, Entra Connect Sync servers must run 2.6.84.0 or later and use application-based authentication, or synchronization fails. Here is how to check, switch and keep the new certificate rotating.
microsoft 365entra identra connecthybrid identitysecurityidentity securitysynchronization - Announcement Danny Vorst
SSPR stops accepting directory-sourced contact info on November 7
MC1325414: SSPR stops accepting directory-sourced phone numbers and emails on November 7, 2026. Authenticator + OATH count as one method, FIDO2 doesn't count at all, SMS/voice is retiring in 2027.
microsoft 365securityentra idssprmfaidentity securitypassword resetpolicy - Announcement Danny Vorst
Require approved client app is retired on June 30: migrate now
Require approved client app is deprecated June 30. After that date, existing policies stop enforcing. Here is what to configure before the deadline.
microsoft 365securityconditional accessentra idintuneapp protectionmamidentity security - Announcement Danny Vorst
Conditional Access enforcement changes June 15: check your exceptions now
Apps could bypass Conditional Access by requesting minimal sign-in scopes. Non-excluded apps slipped through silently for years. Starting June 15, that stops.
microsoft 365securityconditional accessentra idmfaidentity securitypolicy - Blog Danny Vorst
AiTM Phishing Exposed (2/2): Stop session hijacking
Stop AiTM session hijacking with FIDO2, CAE, and token protection. Microsoft 365 configuration guide with 2 Sentinel queries and 7-step incident response.
- Blog Danny Vorst
AiTM Phishing Exposed (1/2): How session hijacking works
AiTM phishing doesn't bypass MFA. It waits for MFA to succeed, then takes what comes next. This is how the attack works and why standard MFA provides no protection against it.
- Blog Danny Vorst
Shadow AI Exposed (2/2): Building a governance program that actually works
Technical controls catch the visible surface. This part covers what a shadow AI governance program looks like in practice: approved AI catalog, the personal account problem, and a maintenance cycle that doesn't erode.
- Blog Danny Vorst
Social Engineering Exposed (3/3): Defence that works
MFA alone won't stop a helpdesk attack. Here's what actually does: the process changes, Entra ID settings, and monitoring that holds up under pressure.
- Blog Danny Vorst
Shadow AI Exposed (1/2): What organizations don't know about the AI tools their employees use
Most shadow AI incidents start with a legitimate task. What actually ends up in those tools, why security controls miss it, and what the NSW government breach tells us.
- Blog Danny Vorst
Social Engineering Exposed (2/3): The helpdesk attack
Attackers don't break MFA. They call your helpdesk and get it reset. Here's what that looks like in Entra ID, and why most tenants aren't built to catch it.
- Blog Danny Vorst
Shadow AI in Microsoft 365: find and block it with Purview
Shadow AI leaks data without triggering a single alert. Use Entra Internet Access, Defender for Cloud Apps, and Microsoft Purview to find and block it in 4 steps.
- Blog Danny Vorst
Social Engineering Exposed (1/3): How attackers get in without breaking anything
MGM lost $100M. Odido lost 6.2M records. Uber's systems went dark. None required a technical exploit. Just a phone call. Here's how it works.