There is no excerpt because this is a protected post.
(Mis)understanding Software OATH token in Entra
Just me, overcomplicating something that is supposed to be easy: migrating to Authentication methods policy in Entra. Yes, I’m late to the party and I probably did not read all the documentation*, but wanted to share my journey with Software OATH tokens. * I indeed did not read enough documentation TL;DR So, the Automated migration […]
Posted by Daniel Kovacs on September 26, 2026
https://f12.hu/2026/09/26/misunderstanding-software-oath-token-in-entra/
Prevent disabling passkeys on Windows
I recently read an article from Dr. Emin Huseynov about the toggle in Windows settings that disables passkeys for every user. While there can be specific circumstances where an organization may intentionally disable passkey usage, I – passkey fan – want to make sure it is enabled. I did not find any official solution to […]
Posted by Daniel Kovacs on April 18, 2026
https://f12.hu/2026/04/18/prevent-disabling-passkeys-on-windows/
Delegating LAPS password retrieval at device level
Poor man’s EPM – delegate access to the LAPS password on a device basis.
(this alternative title is inspired by Jan Bakker’s “Poor man’s IGA” blog series)
Posted by Daniel Kovacs on February 22, 2026
https://f12.hu/2026/02/22/delegating-laps-password-retrieval-at-device-level/
Entra App instance property lock vs SAML signing certificate – an uncommon way of self-sabotage
Recently I tried to set up ClaimXRay NG with the guidance of DSInternals, learned things, failed here and there and stumbled upon a totally-not-helpful error message: “There was an error in the uploading the private certificate and password. Please try again or contact support.” To cut to the chase: This message appeared when I was […]
Posted by Daniel Kovacs on January 29, 2026
https://f12.hu/2026/01/29/entra-app-instance-property-lock-vs-saml-signing-certificate-an-uncommon-way-of-self-sabotage/
Multitenant organization “cheat” to add group(s) to the default sync scope
Back in the days when M365 MTO was in preview, it was possible to add group(s) to the default sync scope – today, the documentation states that if you want to sync groups, “you must configure cross-tenant synchronization directly in Microsoft Entra ID”. It doesn’t say “it is impossible to add groups to the default […]
Posted by Daniel Kovacs on January 12, 2026
https://f12.hu/2026/01/12/multitenant-organization-cheat-to-add-groups-to-the-default-sync-scope/
Find personal Microsoft accounts with corporate email address
Personal Microsoft accounts registered with corporate email address can cause end-user confusion and probably some headaches for IT admins. Let’s find these users before they find you.
Posted by Daniel Kovacs on December 16, 2025
https://f12.hu/2025/12/16/find-personal-microsoft-accounts-with-corporate-email-address/
Disabling Entra Seamless SSO – some extra notes
Disabling Entra Seamless SSO is simple – or you can get lost in the details.
Posted by Daniel Kovacs on October 31, 2025
https://f12.hu/2025/10/31/disabling-entra-seamless-sso-some-extra-notes/
Quicknote: Hybrid Exchange mailbox migration account vs. modern authentication policy
Recently, I came across an uncommon issue while disabling legacy authentication in a hybrid Exchange environment. Since I did not find any exact solutions, I thought I share my story about modern authentication in on-premises Exchange server and how it affects the mailbox migration account. Spoiler: it breaks the mailbox migration TL;DR– Exchange Online uses […]
Posted by Daniel Kovacs on September 25, 2025
https://f12.hu/2025/09/25/quicknote-hybrid-exchange-mailbox-migration-account-vs-modern-authentication-policy/
Powershell with Entra CBA – unattended access to Defender portal when Graph API or Application permission does not fit
One of my previous posts covered a “basic” way to track secure score changes using Graph API with application permissions. While I still prefer application permissions (over service accounts) for unattended access to certain resources, sometimes it is not possible – for example when you want to access resources which are behind the Defender portal’s […]
Posted by Daniel Kovacs on May 2, 2025
https://f12.hu/2025/05/02/powershell-with-entra-cba-unattended-access-to-defender-portal-when-graph-api-or-application-permission-does-not-fit/