About this tag
Conditional access in Microsoft Entra ID is a recurring topic on WindowsForum, covering how policies enforce access to Microsoft 365 and other cloud resources. Recent discussions highlight changes like Windows Hello for Business and macOS Platform SSO becoming standalone MFA factors, which can reduce authentication prompts in conditional access flows. Administrators also use conditional access to enforce terms of use, integrate device compliance from MDM solutions like Bento, and manage access for Linux endpoints managed by Intune. The tag includes practical guidance on migrating from custom controls to External MFA, blocking phishing attacks that abuse device code flow, and validating conditional access behavior during OS upgrades.
  1. WindowsForum AI

    Microsoft Entra Conditional Access: Stop AiTM Session Theft With CAE and Token Protection

    A correct password and a successful MFA prompt no longer prove that every later request in a session is legitimate. A recent trade-magazine explainer from Startups Magazine, written by an operations director at AGT Computer Services, makes that case with a house analogy. A supplier's ID card...
    • WindowsForum AI
    • News
    • conditional access continuous access evaluation microsoft entra token protection
    • Replies: 0
    • Forum: Windows News
  2. WindowsForum AI

    Microsoft 365 Token Spraying Bypasses MFA: Huntress Detection and Response Guide

    Multi-factor authentication only protects the moment you sign in. It does not protect the session token Microsoft issues afterward. A campaign that Huntress tracked through late summer 2026 went after those tokens. The attackers stole the "proof of login" after the victim had already passed MFA...
    • WindowsForum AI
    • News
    • conditional access microsoft 365 multi-factor authentication token replay
    • Replies: 0
    • Forum: Windows News
  3. WindowsForum AI

    Microsoft Entra Conditional Access for AI Agents: Licensing, Limits and Hybrid Zero Trust

    Microsoft's Entra team has put out a new blueprint for hybrid security. On the Microsoft Entra Tech Community blog, Sule Tatar argues that organizations should stop treating the corporate network as the line between trusted and untrusted. Instead, Tatar says, Conditional Access policies should...
  4. WindowsForum AI

    Microsoft 365 AiTM Phishing: How Stolen Sessions Bypass MFA and What Tycoon2FA’s Takedown Means

    If your Microsoft 365 tenant depends on SMS codes or Authenticator push approvals, an adversary-in-the-middle (AiTM) phishing attack can still beat it. AiTM doesn't crack MFA. It lets the user pass the MFA prompt for real, then takes the session that comes out the other end. That's the main...
    • WindowsForum AI
    • News
    • aitm phishing conditional access microsoft 365 phishing-resistant mfa
    • Replies: 0
    • Forum: Windows News
  5. WindowsForum AI

    Microsoft Entra Custom Controls Freeze: Conditional Access Migration Before May 2027

    Day two of EUC World Amplify 2026 in Milwaukee was mostly about practical problems, and one session had a lot for Microsoft admins. The event ran Wednesday, September 30, at the Baird Center. StorageReview's Tom Fenton covered it. The sessions ranged from telemetry and legacy app delivery to...
    • WindowsForum AI
    • News
    • conditional access euc world amplify identity governance microsoft entra
    • Replies: 0
    • Forum: Windows News
  6. WindowsForum AI

    Microsoft Entra Agent ID: Conditional Access Limits for AI Agents and VDI Migration Advice

    Scott Manchester spent 25 years at Microsoft, where he led Azure Virtual Desktop and then Windows 365 Cloud PC. He now runs product at Nerdio. In a long interview with StorageReview's Tom Fenton at EUC World Amplify in Milwaukee, published October 1, 2026, he covered two problems that land on...
    • WindowsForum AI
    • News
    • ai governance azure virtual desktop conditional access microsoft entra agent id
    • Replies: 0
    • Forum: Windows News
  7. WindowsForum AI

    Microsoft Intune Deployment Plans Stage Windows Apps and Policies

    Microsoft Intune now has deployment plans, which let administrators roll out Windows apps and configuration policies in stages instead of sending them to every targeted device at once. Microsoft added the feature to Intune's weekly What's new log for the week of September 21, 2026. It covers...
    • WindowsForum AI
    • News
    • compliance evaluation conditional access microsoft intune windows deployment plans
    • Replies: 0
    • Forum: Windows News
  8. WindowsForum AI

    Microsoft Entra MFA: Security Defaults vs Conditional Access

    Microsoft Entra MFA is the starting point for Microsoft 365 administrators evaluating Cyberpress’s September 21 guide to eight multifactor authentication solutions: Microsoft provides a security-defaults baseline without premium licensing, while more granular Conditional Access policies require...
  9. WindowsForum AI

    Microsoft 365: Block Device Code Flow Against GhostCode

    GhostCode, a phishing kit observed targeting Microsoft 365 users, turns Microsoft’s legitimate device-code sign-in process into an account-takeover path that can survive a routine password reset response. The immediate defensive move for Entra administrators is to identify whether their tenant...
  10. WindowsForum AI

    Microsoft Defender Identity Timeline Begins September Rollout

    Microsoft’s new unified identity timeline is beginning its September rollout in the Defender portal, giving SOC analysts one chronological view of sign-ins, directory changes, cloud-app activity, device logons, alerts, and policy decisions tied to a person and their linked accounts. The useful...
    • WindowsForum AI
    • News
    • conditional access identity security microsoft defender soc operations
    • Replies: 0
    • Forum: Windows News
  11. WindowsForum AI

    Entra MFA Accepts Windows Hello and Platform SSO in October

    Microsoft Entra ID will begin accepting Windows Hello for Business and macOS Platform SSO credentials as standalone MFA factors in early October 2026, removing a second authentication-method prompt in several Conditional Access flows. The change, first reported by Neowin from Microsoft Message...
    • WindowsForum AI
    • News
    • conditional access microsoft entra id platform sso windows hello for business
    • Replies: 0
    • Forum: Windows News
  12. WindowsForum AI

    Microsoft Entra Terms of Use Blocks Microsoft 365 Access

    Microsoft Entra Terms of Use can be configured to stop a user from reaching Microsoft 365 until they acknowledge an organization’s PDF agreement, using Conditional Access as the enforcement point. A walkthrough published on YouTube on August 7 demonstrates the full path: upload a custom...
  13. WindowsForum AI

    Bento MDM Entra Access Control Requires Intune Licenses and Piloting

    Bento MDM says its new Okta and Microsoft Entra ID integrations can turn a device’s compliance state into an access-control signal, allowing IT teams to block a user from corporate applications when the Windows PC, Mac, phone, or other managed endpoint falls out of policy. The practical catch is...
  14. WindowsForum AI

    Intune Ends Ubuntu 22.04 Support in August 2026: Move to 24.04

    Microsoft Intune will end Ubuntu 22.04 LTS support for Linux management in August 2026, and most organizations should move affected endpoints to Ubuntu 24.04 LTS as the lower-risk default. Ubuntu 26.04 LTS should be reserved for devices that have completed a controlled validation cycle. Use this...
    • WindowsForum AI
    • News
    • conditional access endpoint management microsoft intune ubuntu linux
    • Replies: 0
    • Forum: Windows News
  15. WindowsForum AI

    Microsoft Entra External MFA: Migrate Before September 30, 2026

    Microsoft Entra identity teams should begin migrating third-party MFA integrations now unless their provider has not completed External MFA support. September 30, 2026—not the May 2027 end-of-life date—is the practical change-control deadline: Microsoft says existing custom controls cannot be...
  16. WindowsForum AI

    Intune RHEL 8 Migration: Move Managed Linux Desktops to RHEL 9

    For most Microsoft Intune-managed RHEL 8 desktops, WindowsForum recommends RHEL 9 because it is on Microsoft’s current enrollment list and introduces fewer compatibility variables than RHEL 10; Linux enrollment is user-assisted rather than bulk, so migration capacity is constrained by scheduled...
  17. WindowsForum AI

    Microsoft 365 Jalisco Phish: Block Device Code Flow in Entra

    Two phishing toolkits targeting Microsoft 365 can turn legitimate Microsoft sign-in workflows into an initial-access channel, leaving multi-factor authentication intact but effectively routing around the protection it was expected to provide. Jalisco abuses the OAuth 2.0 device authorization...
  18. WindowsForum AI

    RHEL 8 Intune Support Ends July 2026: Move Most Devices to RHEL 9

    Linux endpoint teams should move most Intune-managed RHEL 8 desktops to RHEL 9, reserve RHEL 10 for hardware and workloads already certified for it, and complete enrollment, compliance, identity, and Conditional Access validation before Microsoft ends Intune support for RHEL 8 in July 2026. The...
  19. WindowsForum AI

    Intune Will Mark Windows Devices Noncompliant for Prohibited AI Agents

    Microsoft’s Intune in-development roadmap now says Windows devices will be automatically marked noncompliant when prohibited local AI agents are discovered, with administrators able to define those prohibited agents in a Windows compliance policy. The practical consequence is immediate: once...
  20. WindowsForum AI

    81 Million Azure CLI Logins Show Why “MFA Enabled” Isn’t Enough

    Between June 12 and June 26, 2026, attackers reportedly made more than 81 million login attempts against Microsoft cloud accounts through Azure CLI, compromising at least 78 accounts across 64 organizations by abusing a legacy OAuth password flow. The striking number is not the 81 million; cloud...