Skill UI

A comprehensive tool suite for Global Administrators to automate Microsoft 365 tenant setup, user lifecycle management, and security hardening. It provides PowerShell and Python generators for bulk user provisioning, implementing Conditional Access policies (MFA), running security audits, and ensuring compliance across Azure AD, Exchange Online, and Teams.

This script provides a comprehensive security assessment of Microsoft Entra ID (Azure AD) identity configurations. It audits for risky authentication policies, overly permissive role assignments, stale accounts, conditional access gaps, and guest user risks using PowerShell and Graph API. Ideal for compliance audits, security posture review, and post-merger security assessments.

AWS Verified Access is a Zero Trust Network Access (ZTNA) service that provides secure, VPN-less access to internal applications. It uses granular Cedar policies to evaluate user identity (integrating with Okta, IAM Identity Center) and device security posture (CrowdStrike, Jamf) in real-time. Use this guide when replacing traditional VPNs, enforcing strict conditional access controls, or deploying multi-account Verified Access infrastructure across AWS.

This guide details methods for detecting and mitigating OAuth token theft and replay attacks in cloud environments, specifically targeting Microsoft Entra ID (Azure AD). It covers protection against access token theft, Primary Refresh Token (PRT) abuse, and pass-the-cookie attacks. Users can leverage Conditional Access and Token Protection features to cryptographically bind tokens to devices, significantly enhancing cloud identity security and preventing session hijacking.

Configure Microsoft Entra ID (Azure AD) Conditional Access policies to enforce zero trust access control. This skill covers critical areas such as signal-based policy design, device compliance requirements, risk-based authentication, named locations, and session controls, aligning with NIST SP 1800-35. Essential for deploying, hardening, or assessing robust Azure AD security architecture.

This guide details how to implement robust device posture assessment within a Zero Trust Architecture (ZTA). It integrates endpoint health signals from major platforms like CrowdStrike ZTA, Microsoft Intune, and Jamf into conditional access policies. Use this to enforce strict compliance checks (e.g., encryption, patch levels) before granting access to critical corporate resources, significantly hardening the security perimeter.

This skill guides the implementation of continuous, risk-adaptive identity verification crucial for Zero Trust Architecture (ZTA). It covers deploying phishing-resistant MFA (FIDO2/WebAuthn), advanced risk-based conditional access policies, and identity governance strategies. Users learn how to move beyond traditional credentials by leveraging multiple signals—such as device posture, behavioral biometrics, and location context—to dynamically assess and enforce trust levels before granting access.

A comprehensive guide to securing Software as a Service (SaaS) applications (e.g., Microsoft 365, Salesforce) using Zero Trust principles. This skill covers deploying CASB/SSPM solutions, enforcing conditional access policies (MFA, device compliance), governing OAuth permissions, and applying session-level DLP controls to prevent data exfiltration in multi-cloud environments. Ideal for security architects and engineers.

A comprehensive guide to detecting and mitigating advanced Adversary-in-the-Middle (AiTM) phishing attacks, which bypass Multi-Factor Authentication (MFA) using reverse proxies (e.g., Evilginx, EvilProxy). Learn defensive strategies including implementing FIDO2, configuring Conditional Access policies, and monitoring session hijacking indicators in SIEM/Web Proxies.

A comprehensive guide detailing detection and defense strategies against OAuth token theft, session hijacking, and token replay in Microsoft Entra ID (Azure AD). It covers advanced attacks like Primary Refresh Token (PRT) abuse and Adversary-in-the-Middle (AitM) phishing, and provides actionable steps for configuring Conditional Access and Token Protection policies.

This skill covers implementing continuous, risk-adaptive identity verification within a Zero Trust framework. It utilizes phishing-resistant MFA (FIDO2/WebAuthn) and risk-based conditional access policies, ensuring robust and dynamic security controls. Use when designing advanced identity architectures or improving compliance security.

A sophisticated red-teaming tool for authorized security testing, simulating OAuth 2.0 device-code and illicit-consent phishing attacks against Microsoft Entra ID. It demonstrates how attackers can bypass MFA and steal access and refresh tokens by tricking victims into authorizing access via the genuine Microsoft login page. Essential for validating Conditional Access and token protection controls.