Thomas Naunheim

AzureAD-Attack-Defense. This publication is a collection of various common attack scenarios on Microsoft Entra ID (formerly known as Azure Active Directory) and how they can be mitigated or detected.

EntraOps. Community project to classify, identify and protect your privileges based on Enterprise Access Model (EAM)

AzureSentinel. Sharing my KQL queries for Azure Sentinel

AzurePrivilegedIAM. Docs and samples for privileged identity and access management in Microsoft Azure and Microsoft Entra.

meetups. All slides from my meetup talks

ADOPipelinesSecInfo. PowerShell module to collect information about service connections and (release) pipelines in Azure DevOps.

EntraSecurityWorkshop. Labs and other resources for Microsoft Entra Security Workshop

AzSentinelQueries. Repository with Sentinel Analytics Rules and Hunting Queries

EntraIDAuditLogToMicrosoftGraph. A list of Entra ID (Azure AD) Audit event names and the corresponding Microsoft Graph Request Uri

arm-templates. Some samples of Azure Resource Manager (ARM) templates

AzADServicePrincipalInsights. Insights and change tracking on Azure Active Directory Service Principals (Enterprise Applications and Applications)