benroberts.io

Write

The dMSA Migration Factory: How Windows Server 2025 Finally Fixed Service Accounts

Jul 9, 202614 min read

Building a Documentation Agent: From Repository Scan to Live Wiki Page

Jun 15, 202619 min read

Just-In-Time Privilege Elevation for Windows Server 2025 dMSAs

Serverless, Passwordless, JIT Elevation using Azure Arc

Jul 13, 202612 min read

Building an Expanded Identity Security Copilot with Azure AI Foundry

Jun 8, 202618 min read

Using A Domain-Joined Jumpbox VM For Legacy PowerShell From Azure Functions

May 4, 20266 min read

Why securing Microsoft Graph Command Line Tools matters

Graph PowerShell is one of the most convenient ways to work with Microsoft Graph. It's also one of the easiest ways to accidentally expand what a user can read or change across your tenant. If you've

Apr 30, 202620 min read

The Path to Success for Governing AI Agents with Microsoft Entra Agent ID

Introduction Most organizations do not wake up one morning and decide to run an agent fleet. It happens in increments. A Copilot appears to summarize meetings. A bot gets introduced to triage requests

Mar 31, 202617 min read

Microsoft Entra Group Source of Authority Conversion with Cloud Sync Writeback

This post explores a specific hybrid identity scenario: taking a group synchronized from Active Directory Domain Services (AD DS), changing its Source of Authority (SOA) to Microsoft Entra, and then u

Mar 13, 202615 min read

Enhance Entra Identity Governance with Azure Event Grid

Microsoft Graph change notifications are a great building block, but the “classic” model (hosting a public HTTPS webhook) tends to get uncomfortable fast and won't make you any friends in the Cybersecurity or Networking/Gateway teams to manage the in...

Feb 1, 202613 min read

Building a Secure Password Reset API with Azure Functions, Easy Auth, and LDAPS

Introduction In my previous infrastructure blog, we built a disposable Active Directory lab: a domain controller in its own subnet, a function app in another, Key Vault for secrets, and just enough networking glue to make it feel like a real hybrid e...

Jan 14, 202610 min read

Workload Identity Risk and Remediation with Microsoft Graph & PowerShell

Introduction Here's a problem you might not be tracking as closely as you should: every workload identity in your Entra ID tenant—the service principals and app registrations powering your automation, CI/CD pipelines, and third-party integrations—is ...

Dec 31, 202522 min read

Command Palette

Latest articles