Remote

Merill Fernando

@merill@infosec.exchange

mastodon 4.8.0-alpha.3+glitch

Product Manager @microsoft@infosec.exchange | entra.news CxP #identity #entra #graphpowershell
Dad • Dev • He/Him • 🇦🇺 • 🇱🇰 • Wurundjeri Country • Toots are my own. @merill@infosec.exchange on Twitter

1718 Followers

769 Following

50 Posts

Joined November 05, 2022

Website:

https://merill.net/about/

Twitter:

https://twitter.com/merill

LinkedIn:

https://www.linkedin.com/in/merill

GitHub:

https://github.com/merill

Profile:

He/Him

Newsletter:

https://entra.news

Merill Fernando

@merill@infosec.exchange

· 2mo ago

Replying to

Plus a huge personal thank you from me to all the maester.cloud founding sponsors maester.cloud/founders who have helped me go full time on Maester. This release wouldn't have been possible without you. Learn all about this release at https://maester.dev/blog/maester-2-2

2

0

1

0

Merill Fernando

@merill@infosec.exchange

· 2mo ago

Replying to

Ray had some really good tips for Entra admins. We don’t need to become Purview experts but we do need to understand enough of the neighbouring products to ask better questions. → What triggered this policy? → Who should own the alert?

1

4

0

0

Merill Fernando

@merill@infosec.exchange

· 2mo ago

Replying to

Insider Risk can influence Conditional Access. Purview and Global Secure Access can help stop sensitive data moving into unsanctioned AI apps. A policy that looks simple in one portal can involve identity, network, data security, cybersecurity, HR, managers and data owners.

1

1

0

0

Merill Fernando

@merill@infosec.exchange

· 2mo ago

Replying to

If you work in Entra, this episode is an invitation to look over the fence and understand the security products and people you increasingly depend on. Ray is a Principal Security Consultant at Engage Squared and the author of Mastering Microsoft Purview Deployment in the Era of AI.

1

1

0

0

Merill Fernando

@merill@infosec.exchange

· 2mo ago

Replying to

Watch or listen: https://entra.news/p/why-entra-admins-need-microsoft-purview

1

0

0

0

Merill Fernando

@merill@infosec.exchange

· 2mo ago

Replying to

→ Should the response be a block, an investigation or simply some education? → And what will the user actually experience? Ray made a great point: the technical configuration may take 15 minutes, but getting all the right teams aligned is the real work.

1

1

0

0

Merill Fernando

@merill@infosec.exchange

· 2mo ago

Replying to

The conversation also went to some areas that are close to my heart. Ray shared the story of the charity he and his wife started in Nepal, and we spoke openly about burnout, layoffs, gratitude and building a career safety net outside any one employer.

1

2

0

0

Merill Fernando

@merill@infosec.exchange

· 5mo ago

Unboxing my new toy.

Qwen 3.6 here I come!

4

1

0

1

Merill Fernando

@merill@infosec.exchange

· 2mo ago

Replying to

We've added tests for so many new products (and sorry you need to sign in more times because not every Microsoft product uses Graph anymore 🤷‍♀️).

1

9

0

0

Merill Fernando

@merill@infosec.exchange

· 2mo ago

Replying to

Simon Albers, Stephan van Rooij, Thomas Naunheim, Thomas Schmidt, Travis McDade, Truls Dahlsveen (PS Please let me know if I've missed anyone)

1

1

0

0

Merill Fernando

@merill@infosec.exchange

· 5mo ago

👋 Check out this new Microsoft Entra blog post 👇

Passkeys aren’t the finish line: Eliminating fallbacks and fixing recovery

https://techcommunity.microsoft.com/t5/microsoft-entra-blog/passkeys-aren-t-the-finish-line-eliminating-fallbacks-and-fixing/ba-p/3627345

techcommunity.microsoft.com

3

0

0

0

Merill Fernando

@merill@infosec.exchange

· 5mo ago

Fabian Bader asked and here it is.

cybersecpods.com now has links to @pocketcasts and @OvercastFM

Now it's a one-click to add and follow new cyber security podcasts on you favourite podcast players...

2

0

0

0

Merill Fernando

@merill@infosec.exchange

· 5mo ago

👋 Folks cybersecpods.com is live!

It's the home of cyber security podcasts, a place to explore and find podcasts for all of us in cyber.

It's open source and crowd sourced, if I'm missing any please add them.

2

0

1

0

Merill Fernando

@merill@infosec.exchange

· 5mo ago

👋 Check out this new Microsoft Entra blog post 👇

Build a secure identity foundation: 5 webinars to strengthen access management with Microsoft Entra

https://techcommunity.microsoft.com/t5/microsoft-entra-blog/build-a-secure-identity-foundation-5-webinars-to-strengthen/ba-p/4515965

techcommunity.microsoft.com

2

0

0

0

Merill Fernando

@merill@infosec.exchange

· 5mo ago

New Entra Chat episode is out!

AI agents are being created across your tenant...

But who is checking if they are configured securely?

In this episode, Sam Erde and I dig into the Maester 2.1 release

🎙️ https://entra.news/p/how-to-secure-copilot-agents-azure

2

0

0

0

Merill Fernando

@merill@infosec.exchange

· 5mo ago

👋 Check out this new Microsoft Entra blog post 👇

What's New in Microsoft Entra: May 2026

https://techcommunity.microsoft.com/t5/microsoft-entra-blog/what-s-new-in-microsoft-entra-may-2026/ba-p/4517884

techcommunity.microsoft.com

1

0

0

0

Merill Fernando

@merill@infosec.exchange

· 5mo ago

👋 Here's a quick birds eye view of Microsoft Agent 365 licensing

Enjoy!

Disclaimer: I'm not a licensing person. Please refer to the official licensing FAQ for details https://www.microsoft.com/licensing/faqs/122

1

0

0

0

Merill Fernando

@merill@infosec.exchange

· 5mo ago

👋 Have you checked out this week's Entra.News?

Get the latest at https://entra.news/p/entra-news-147-this-week-in-microsoft

1

0

0

0

Merill Fernando

@merill@infosec.exchange

· 5mo ago

Replying to

@vickyjo@mastodon.social @filippo@abyssdomain.expert Cheers. Tx Victoria. That's been my take as well. Synced passkeys are magical

1

0

0

0

Merill Fernando

@merill@infosec.exchange

· 2mo ago

Replying to

Huge thanks to our contributors Artem Borodai, Brian Reid, Christopher Brumm, Christopher Edwards, Fabian Bader, Henrik Piecha, Jan Bakker, Jean-Philippe George, Jon Gross, Jonathan Hope, Loïc Michel, Massimo Mazzariol, Matthias F., Mike Soule, Morten Mynster Kristensen, Ofir Gavish, Sam Erde,

0

1

0

0

Merill Fernando

@merill@infosec.exchange

· 2mo ago

👋 Check out this new Microsoft Entra blog post 👇 Microsoft Entra ID enhances security of branded sign-ins https://techcommunity.microsoft.com/t5/microsoft-entra-blog/microsoft-entra-id-enhances-security-of-branded-sign-ins/ba-p/4537471

techcommunity.microsoft.com

0

0

0

0

Merill Fernando

@merill@infosec.exchange

· 2mo ago

👋 Check out this new Microsoft Entra blog post 👇 Secure AI, web, and private apps with Zero Trust https://techcommunity.microsoft.com/t5/microsoft-entra-blog/secure-ai-web-and-private-apps-with-zero-trust/ba-p/4516387

techcommunity.microsoft.com

0

0

0

0

Merill Fernando

@merill@infosec.exchange

· 2mo ago

Replying to

That includes Copilot config, Dataverse, SharePoint, Github (as more folks move agentic devlops to GitHub this is going to be super important), new Intune and Entra ID checks and so much more. Here are the highlights

0

1

0

0

Merill Fernando

@merill@infosec.exchange

· 2mo ago

👋 Check out this new Microsoft Entra blog post 👇 AI agents are everywhere. Are your access controls ready? https://techcommunity.microsoft.com/t5/microsoft-entra-blog/ai-agents-are-everywhere-are-your-access-controls-ready/ba-p/4531379

techcommunity.microsoft.com

0

0

0

0

Merill Fernando

@merill@infosec.exchange

· 2mo ago

🚧 Folks, we’re planning a major architecture change for Maester 3.0: a native test model with structured metadata, simpler contributions, centralized prerequisite handling, and compatibility for existing Pester tests. We want your feedback before finalizing the design 👇 https://github.com/maester365/maester/discussions/2050

0

0

0

0

Merill Fernando

@merill@infosec.exchange

· 2mo ago

Replying to

BTW Fabian Bader had a great idea. Soon we'll be handing out exclusive badges/credentials to folks who contribute Maester tests.

0

0

0

0

Merill Fernando

@merill@infosec.exchange

· 2mo ago

👋 Check out this new Microsoft Entra blog post 👇 Modernize SAP Identity Management with Microsoft Entra https://techcommunity.microsoft.com/t5/microsoft-entra-blog/modernize-sap-identity-management-with-microsoft-entra/ba-p/4528596

techcommunity.microsoft.com

0

0

0

0

Merill Fernando

@merill@infosec.exchange

· 3mo ago

👋 Folks "passkeys won't save you." Vince Smith, who leads Agent ID at Microsoft Entra, explains why: squeeze one end of the balloon (users) and attackers move to the other 👉 NHI + workloads. New Entra Chat 👇 https://entra.news/p/from-windows-core-to-leading-agent

0

0

0

0

Merill Fernando

@merill@infosec.exchange

· 2mo ago

Replying to

@jerry@infosec.exchange This is just step one, most AitM proxies know how to downgrade. We will only be secure once orgs go 100% phishing resistant.

0

0

0

0

Merill Fernando

@merill@infosec.exchange

· 2mo ago

Insider Risk Is a Business Decision - Bring HR In Early

0

0

0

0

Merill Fernando

@merill@infosec.exchange

· 2mo ago

Replying to

Have questions on the SMS retirement and passkeys as default? I’ll be sitting down with the Microsoft Entra PM behind this change to get your questions answered. Post your questions here → https://entra.userjot.com/board/p/passkeys-by-default-sms-retired-it-s-happening-what-do-you 2/3

entra.userjot.com

0

0

0

0

Merill Fernando

@merill@infosec.exchange

· 2mo ago

I was explaining how Microsoft Entra Staged Rollout works and realised it would make a great video especially the under-the-hood details that aren’t in the docs. A quick 7-minute walkthrough is coming soon. What would you like me to cover? 👇

0

0

0

0

Merill Fernando

@merill@infosec.exchange

· 2mo ago

Replying to

🔥 12 new SharePoint Online checks across the CIS and CISA baselines, now cross-platform with PnP.PowerShell 🔥 5 CIS GitHub organization controls and first-class GitHub connectivity

0

6

0

0

Merill Fernando

@merill@infosec.exchange

· 2mo ago

Replying to

🔥 9 Global Secure Access checks for Private Access, forwarding profiles, Compliant Network, and Internet Access 🔥 4 Intune endpoint security checks for LAPS, attack surface reduction, App Control for Business, and Managed Installer

0

1

0

0

Merill Fernando

@merill@infosec.exchange

· 1w ago

Folks, phishers have figured out rage bait. Got this today from "SendGrid HR". They're adding a trans youth message to my email footer this month. Don't want it? Just click the button to remove it. Sender is noreply@billkill.no Rage is the new urgency. Attackers don't care about your politics. They just want the click.

0

1

1

0

Merill Fernando

@merill@infosec.exchange

· 2mo ago

👋 Check out this new Microsoft Entra blog post 👇 What's New in Microsoft Entra: July 2026 https://techcommunity.microsoft.com/t5/microsoft-entra-blog/what-s-new-in-microsoft-entra-july-2026/ba-p/4534631

techcommunity.microsoft.com

0

0

0

0

Merill Fernando

@merill@infosec.exchange

· 2mo ago

👋 Check out this new Microsoft Entra blog post 👇 Plan your Azure AD B2C migration with the Migration Policy Analyzer https://techcommunity.microsoft.com/t5/microsoft-entra-blog/plan-your-azure-ad-b2c-migration-with-the-migration-policy/ba-p/4532874

techcommunity.microsoft.com

0

0

0

0

Merill Fernando

@merill@infosec.exchange

· 2mo ago

🚨 Entra Conditional Access gotcha from Andres Canello Selecting every device platform ≠ “Any device.” An attacker can spoof the browser user-agent, get no platform match, and that CA policy condition won’t apply. Watch Entra.Chat with for more nuggets 👇 https://entra.news/p/the-ultimate-microsoft-entra-global

0

0

0

0

Merill Fernando

@merill@infosec.exchange

· 2mo ago

Me teaching Entra Workload ID Federation to Sol. Fable made the same mistake too. All those badly coded auth code is tripping up the LLMs. For reference this is the article I linked to https://devblogs.microsoft.com/identity/access-cloud-resources-across-tenants-without-secrets/

devblogs.microsoft.com

0

0

0

0

Merill Fernando

@merill@infosec.exchange

· 2mo ago

Replying to

🔥 269 Active Directory checks across identity, policy, infrastructure, DNS, trusts, replication, and access control 🔥 5 Microsoft Purview checks to get your data security foundations ready for Copilot and AI

0

1

0

0

Merill Fernando

@merill@infosec.exchange

· 2mo ago

We just sent out the latest Entra News for the week. Check it out! https://entra.news/p/entra-news-159-this-week-in-microsoft

0

1

0

0

Merill Fernando

@merill@infosec.exchange

· 2mo ago

Replying to

The biggest news is support for Active Directory is now in preview thanks to Mike Soule and we have some really cool plans for Active Directory with @PrzemyslawKlys and his awesome TestimoX AD suite. Stay tuned on this.

0

1

0

0

Merill Fernando

@merill@infosec.exchange

· 2mo ago

Replying to

🔥 Contributor credits across maester.dev, so the people writing these tests get the recognition they deserve

0

1

0

0

Merill Fernando

@merill@infosec.exchange

· 2mo ago

One compromised Agent ID blueprint can become a multitenant blast radius. That is the most important idea in my latest conversation with Katie Knowles, Senior Security Researcher at Datadog, about her three-part security analysis of Microsoft Entra Agent ID. Watch or listen: https://entra.chat

0

0

0

0

Merill Fernando

@merill@infosec.exchange

· 2mo ago

Replying to

🔥 New Entra ID checks covering agent risk, directory sync safeguards, Conditional Access gaps, legacy MSOnline, and privileged first-party apps 🔥 A sharper report with markdown summaries, per-test durations, and critical findings sorted first

0

4

0

0

Merill Fernando

@merill@infosec.exchange

· 3mo ago

👋 We just sent out this week's Entra newsletter. Check it out at https://entra.news/p/entra-news-156-this-week-in-microsoft

0

0

0

0