Microsoft Entra ID

One of the most common anti-patterns in identity security is giving SOC analysts Global Administrator access — or User Administrator — because they need to disable accounts or revoke sessions during an incident. Those roles carry far more permission than incident response actually requires. Microsoft added the Entra SOC Identity Responder role to address exactly this. It is a privileged built-in role designed for one specific job: identity containment during active security incidents from the Microsoft Defender portal. ...

On August 20, 2026, Microsoft disclosed CVE-2026-69836 — a remote code execution vulnerability in Microsoft Entra ID with a CVSS score of 10.0. The maximum possible. Then it got complicated. What the vulnerability is The root cause is CWE-502: deserialization of untrusted data. Entra ID was processing attacker-supplied input and converting it into active object structures without sufficient validation. The CVSS vector is about as bad as it gets: Network-reachable — no physical or local access needed No authentication required No user interaction — fully automated exploitation possible Low attack complexity High impact on confidentiality, integrity, and availability An attacker who successfully exploited this could execute arbitrary code within Microsoft’s Entra ID infrastructure — meaning potential access to token issuance logic, service principal configurations, and federation trusts. ...

Found this while browsing: EntraFalcon by Compass Security. A lightweight PowerShell tool that scans your Microsoft Entra ID tenant and generates an interactive HTML report covering privileged objects and role assignments, risky or misconfigured service principals, guest user exposure, Conditional Access gaps, and general identity posture findings. No extra app registration needed — it uses your existing authenticated session via Microsoft Graph PowerShell. That makes it quick to run in environments where creating new app registrations requires approval. ...