[{"data":1,"prerenderedAt":1855},["ShallowReactive",2],{"sc:header-data-da":3,"sc:footer-data-da":489,"post-da--posts-2025-01-14-compliant-device-bypass-184506556cb284":519,"authors_data":1269,"authors_data:Christopher Brumm|Fabian Bader|Thomas Naunheim":1620,"content-da-list-7b291c2dd91a4":1625},{"lang":4,"home":5,"navigation":17,"meta":479,"contact":485},"de",{"name":6,"folderSwitch":7,"imgLight":10,"img":11,"languages":12},"home",[8,9],"authors","blog","/logos/gk-Logo-sw.svg","/logos/gk-Logo-rgb.svg",{"da":13},{"title":14,"url":15,"alt":16},"Forside","/da","glueckkanja Logo",[18,127,231,316,395,402],{"name":19,"languages":20,"children":24},"workplace",{"da":21},{"title":22,"description":23},"Workplace","Intelligente, sikre og fleksible arbejdspladser bygget på Microsoft 365, der forener moderne teknologier og identitetstjenester.",[25,55,91],{"name":26,"languages":27,"children":30},"portfolio",{"da":28},{"title":29},"Portfolio",[31,37,43,49],{"name":32,"languages":33},"managed-intune",{"da":34},{"title":35,"url":36},"Managed Intune","/da/entra-intune/managed-intune",{"name":38,"languages":39},"managed-entra",{"da":40},{"title":41,"url":42},"Managed Entra","/da/entra-intune/managed-entra",{"name":44,"languages":45},"managed-workplace",{"da":46},{"title":47,"url":48},"Managed Workplace","/da/workplace/managed-workplace",{"name":50,"languages":51},"consulting-services",{"da":52},{"title":53,"url":54},"Consulting Services","/da/workplace/consulting-services",{"name":56,"languages":57,"children":60},"microsoft-365-endpoint",{"da":58},{"title":59},"Microsoft 365 Endpoint",[61,67,73,79,85],{"name":62,"languages":63},"microsoft-entra-suite",{"da":64},{"title":65,"url":66},"Microsoft Entra Suite","/da/workplace/microsoft-entra-suite",{"name":68,"languages":69},"microsoft-intune",{"da":70},{"title":71,"url":72},"Microsoft Intune","/da/workplace/microsoft-intune",{"name":74,"languages":75},"microsoft-windows",{"da":76},{"title":77,"url":78},"Microsoft Windows","/da/workplace/microsoft-windows",{"name":80,"languages":81},"windows-365-cloud-pc",{"da":82},{"title":83,"url":84},"Windows 365 Cloud PC","/da/workplace/windows365-cloud-pc",{"name":86,"languages":87},"cloud-workplace-foundation",{"da":88},{"title":89,"url":90},"Cloud Workplace Foundation","/da/workplace/cloud-workplace-foundation",{"name":92,"languages":93,"children":96},"microsoft-365-collaboration",{"da":94},{"title":95},"Microsoft 365 Collaboration",[97,103,109,115,121],{"name":98,"languages":99},"microsoft-copilot",{"da":100},{"title":101,"url":102},"Microsoft 365 Copilot","/da/workplace/microsoft-365-copilot",{"name":104,"languages":105},"microsoft-teams",{"da":106},{"title":107,"url":108},"Teams","/da/workplace/microsoft-teams",{"name":110,"languages":111},"sharepoint-powerplatform",{"da":112},{"title":113,"url":114},"SharePoint & Power Platform","/da/workplace/sharepoint-power-platform",{"name":116,"languages":117},"exchange-online",{"da":118},{"title":119,"url":120},"Exchange Online","/da/workplace/exchange-online",{"name":122,"languages":123},"information-protection-compliance",{"da":124},{"title":125,"url":126},"Information Protection & Compliance","/da/workplace/information-protection-compliance",{"name":128,"languages":129,"children":133},"azure",{"da":130},{"title":131,"description":132},"Azure","Sæt gang i væksten med Azure: skær ned på cloudomkostningerne, øg effektiviteten og driv innovationen med IaaS og PaaS.",[134,151,181],{"name":135,"languages":136,"children":138},"azure-portfolio",{"da":137},{"title":29},[139,145],{"name":140,"languages":141},"azure-managed-services",{"da":142},{"title":143,"url":144},"Azure Managed Services","/da/azure/azure-managed-services",{"name":146,"languages":147},"azure-consulting",{"da":148},{"title":149,"url":150},"Azure Consulting","/da/azure/azure-consulting",{"name":152,"languages":153,"children":156},"azure-scenarios",{"da":154},{"title":155},"Scenarier",[157,163,169,175],{"name":158,"languages":159},"plan-your-cloud",{"da":160},{"title":161,"url":162},"Planlæg din cloud","/da/azure/plan-your-cloud",{"name":164,"languages":165},"migrate-to-the-cloud",{"da":166},{"title":167,"url":168},"Migrér til cloud","/da/azure/migrate-to-the-cloud",{"name":170,"languages":171},"innovate-your-business",{"da":172},{"title":173,"url":174},"Forny din forretning","/da/azure/innovate-your-business",{"name":176,"languages":177},"vmware-exit",{"da":178},{"title":179,"url":180},"Gentænk din VMware-strategi","/da/azure/vmware-exit",{"name":182,"languages":183,"children":186},"azure-practices",{"da":184},{"title":185},"Practices",[187,193,199,202,208,213,219,225],{"name":188,"languages":189},"azure-foundation",{"da":190},{"title":191,"url":192},"Azure Foundation","/da/azure/azure-foundation",{"name":194,"languages":195},"azure-ai-foundation",{"da":196},{"title":197,"url":198},"Azure AI Foundation","/da/azure/azure-ai-foundation",{"name":86,"languages":200},{"da":201},{"title":89,"url":90},{"name":203,"languages":204},"azure-data-foundation",{"da":205},{"title":206,"url":207},"Azure Data Foundation","/da/azure/azure-data-foundation",{"name":188,"languages":209},{"da":210},{"title":211,"url":212},"Azure Container Foundation","/da/azure/azure-container-foundation",{"name":214,"languages":215},"dark-tenant",{"da":216},{"title":217,"url":218},"Managed Dark Tenant","/da/azure/managed-dark-tenant",{"name":220,"languages":221},"azure-cloud-adoption-framework",{"da":222},{"title":223,"url":224},"Cloud Adoption Framework","/da/azure/cloud-adoption-framework",{"name":226,"languages":227},"azure-cloud-competence-center",{"da":228},{"title":229,"url":230},"Cloud Competence Center","/da/azure/cloud-competence-center",{"name":232,"languages":233,"children":242},"security",{"da":234},{"title":235,"description":236,"emergency":237},"Sikkerhed","Årvågenhed i clouden med en prisbelønnet 24/7 managed service, incident response og tidssvarende beskyttelse af din infrastruktur.",{"text":238,"href":239,"skin":240,"icon":241},"Under angreb?","/da/security/are-you-under-attack","primary","emergency",[243,268,289],{"name":244,"children":245},"security-security-consulting",[246,252,256,262],{"name":247,"languages":248},"managed-red-tenant",{"da":249},{"title":250,"url":251},"Managed Red Tenant","/da/security/managed-red-tenant",{"name":214,"languages":253},{"da":254},{"title":255,"url":218},"Dark Tenant",{"name":257,"languages":258},"sentinel-data-lake",{"da":259},{"title":260,"url":261},"Sentinel Data Lake","/da/security/sentinel-data-lake",{"name":263,"languages":264},"security-consulting",{"da":265},{"title":266,"url":267},"Security Consulting","/da/security/security-consulting",{"name":269,"children":270},"security-cloud-security-operations-center",[271,277,283],{"name":272,"languages":273},"cloud-security-operations-center",{"da":274},{"title":275,"url":276},"Cloud Security Operations Center","/da/security/cloud-security-operations-center",{"name":278,"languages":279},"global-secure-access",{"da":280},{"title":281,"url":282},"Global Secure Access","/da/security/global-secure-access",{"name":284,"languages":285},"my-work-id",{"da":286},{"title":287,"url":288},"MyWorkID","/da/security/my-work-id",{"name":290,"children":291},"security-preventive-services",[292,298,304,310],{"name":293,"languages":294},"preventive-services",{"da":295},{"title":296,"url":297},"Preventive Services","/da/security/preventive-services",{"name":299,"languages":300},"data-security-services",{"da":301},{"title":302,"url":303},"Data Security Service","/da/security/data-security-service",{"name":305,"languages":306},"security-copilot-agents",{"da":307},{"title":308,"url":309},"Security Copilot Agents","/da/security/security-copilot-agents",{"name":311,"languages":312},"nis2",{"da":313},{"title":314,"url":315},"Implementering af NIS2","/da/security/red-dark-tenant-nis2",{"name":317,"languages":318,"children":322},"products",{"da":319},{"title":320,"description":321},"Produkter","Companion-produkter til et gennemført sikkert, 100 % cloud-native Microsoft-miljø, der styrker samarbejdet, netværksautentificeringen og softwarehåndteringen.",[323,360],{"name":324,"products":325,"children":326},"lorem ipsum 1",true,[327,336,344,352],{"name":328,"img":329,"target":330,"languages":331},"realmjoin","products/realmjoin/realmjoin-nav-logo.svg","_blank",{"da":332},{"title":333,"url":334,"subtitle":335},"RealmJoin","https://www.realmjoin.com","Cloudbaseret softwaredistribution",{"name":337,"img":338,"target":330,"languages":339},"scepman","products/scepman/scepman-nav-logo.svg",{"da":340},{"title":341,"url":342,"subtitle":343},"SCEPman","https://www.scepman.com","Certifikatdistribution fra clouden",{"name":345,"img":346,"target":330,"languages":347},"konnekt","products/konnekt/konnekt-nav-logo.svg",{"da":348},{"title":349,"url":350,"subtitle":351},"KONNEKT","https://www.konnekt.io","Arbejd med dine lokale Office 365-data",{"name":353,"img":354,"target":330,"languages":355},"realmigrator","products/realmigrator/realmigrator-nav-logo.svg",{"da":356},{"title":357,"url":358,"subtitle":359},"RealMigrator","https://www.realmigrator.com","Migrér dine data fra én server til en anden",{"name":361,"products":325,"children":362},"lorem ipsum 2",[363,371,379,387],{"name":364,"img":365,"target":330,"languages":366},"terraprovider","products/terraprovider/terraprovider-nav-logo.svg",{"da":367},{"title":368,"url":369,"subtitle":370},"TerraProvider","https://www.terraprovider.com","Terraform Provider til Microsoft 365",{"name":372,"img":373,"target":330,"languages":374},"radiusaas","products/radius/radius-nav-logo.svg",{"da":375},{"title":376,"url":377,"subtitle":378},"RADIUSaaS","https://www.radius-as-a-service.com","Autentificering til dit netværk",{"name":380,"img":381,"target":330,"languages":382},"unifiedcontacts","products/unified-contacts/unifiedcontact-nav-logo.svg",{"da":383},{"title":384,"url":385,"subtitle":386},"Unified Contacts","https://www.unified-contacts.com","Find kontakter i Microsoft Teams",{"name":388,"img":389,"target":330,"languages":390},"autopilotmonitor","products/autopilot-monitor/AutopilotMonitor-nav-logo.svg",{"da":391},{"title":392,"url":393,"subtitle":394},"Autopilot Monitor","https://www.autopilotmonitor.com","Windows Autopilot-overvågning i realtid",{"name":396,"languages":397},"casestudies",{"da":398},{"title":399,"url":400,"description":401},"Cases","/da/casestudies","Pioner i clouden: din Microsoft-partner til gennemarbejdede cloudløsninger med en blueprint-baseret tilgang og ekspertise i Infrastructure-as-Code.",{"name":403,"languages":404,"children":407},"company",{"da":405},{"title":406,"description":401},"Virksomhed",[408,438,462],{"name":409,"languages":410,"children":413},"company-about-us",{"da":411},{"title":412},"Om os",[414,420,426,432],{"name":415,"languages":416},"company-facts-figures",{"da":417},{"title":418,"url":419},"Fakta og tal","/da/company/facts-and-figures",{"name":421,"languages":422},"company-contact",{"da":423},{"title":424,"url":425},"Kontakt og lokationer","/da/company/contact-and-locations",{"name":427,"languages":428},"switzerland",{"da":429},{"title":430,"url":431},"glueckkanja Schweiz","/da/company/switzerland",{"name":433,"languages":434},"austria",{"da":435},{"title":436,"url":437},"glueckkanja Østrig","/da/company/austria",{"name":439,"languages":440,"children":443},"company-career",{"da":441},{"title":442},"Karriere",[444,450,456],{"name":445,"languages":446},"company-career-overview",{"da":447},{"title":448,"url":449},"Karriereoversigt","/da/career",{"name":451,"languages":452},"company-young-professionals",{"da":453},{"title":454,"url":455},"Young Professionals","/da/young-professionals",{"name":457,"languages":458},"company-jobs",{"da":459},{"title":460,"url":461},"Ledige stillinger","/da/job-offers",{"name":463,"languages":464,"children":467},"company-latest",{"da":465},{"title":466},"Aktuelt",[468,474],{"name":469,"languages":470},"company-blog",{"da":471},{"title":472,"url":473},"Blog","/da/blog",{"name":469,"languages":475},{"da":476},{"title":477,"url":478},"Events","/da/events",[480],{"name":481,"languages":482},"career-meta",{"da":483},{"title":442,"url":449,"active":484},false,{"languages":486},{"da":487},{"title":488,"url":425,"active":484},"Kontakt",{"data":490},{"bgColor":491,"number":492,"mail":493,"brandLogos":494,"logos":495,"links":499,"linksDa":509},"var(--color-gk-mid-blue)","+49 69 4005520","info@glueckkanja.com",null,[496],{"img":10,"alt":16,"url":497,"class":498},"index.html","max-w-19rem",[500,503,506],{"title":501,"url":502},"Datenschutz","/de/privacy",{"title":504,"url":505},"Impressum","/de/imprint",{"title":507,"url":508},"No Cookies","/de/cookies",[510,513,516],{"title":511,"url":512},"Privatlivspolitik","/da/privacy",{"title":514,"url":515},"Juridisk information","/da/imprint",{"title":517,"url":518},"Ingen cookies","/da/cookies",{"id":520,"title":521,"author":522,"body":526,"cta":494,"description":1171,"eventid":494,"extension":1190,"hideInRecent":484,"layout":1191,"meta":1192,"moment":1196,"navigation":325,"path":1261,"seo":1262,"stem":1263,"tags":1264,"webcast":484,"__hash__":1268},"content_da/posts/2025-01-14-compliant-device-bypass.md","Compliant Device Bypass: alt hvad du behøver at vide",[523,524,525],"Fabian Bader","Christopher Brumm","Thomas Naunheim",{"type":527,"value":528,"toc":1170},"minimal",[529,534,538,592,596,598,611,619,630,636,639,643,645,650,653,656,660,726,729,732,736,738,742,744,759,766,769,772,774,777,780,783,791,802,805,807,810,814,816,819,824,828,830,833,836,839,1002,1006,1008,1011,1051,1055,1057,1064,1067,1070,1085,1088,1091,1145,1152,1156,1158,1161,1164,1167],[530,531,533],"h2",{"id":532},"hvad-er-der-sket-indtil-nu","Hvad er der sket indtil nu?",[535,536,537],"p",{},"{: .h3-font-size}",[539,540,541,565,580,589],"ul",{},[542,543,544,545,552,553,558,559,564],"li",{},"I december 2024 holdt ",[546,547,551],"a",{"href":548,"rel":549},"https://x.com/TEMP43487580",[550],"nofollow","Yuya Chudo"," sit foredrag »",[546,554,557],{"href":555,"rel":556},"https://www.blackhat.com/eu-24/briefings/schedule/#unveiling-the-power-of-intune-leveraging-intune-for-breaking-into-your-cloud-and-on-premise-42176",[550],"Unveiling the Power of Intune: Leveraging Intune for Breaking Into Your Cloud and On-Premise","« på konferencen Black Hat Europe. I sessionen viste han, hvordan man misbruger en hårdkodet og sjældent kendt undtagelse for device compliance i Conditional Access (CA) i kombination med den udokumenterede »",[546,560,563],{"href":561,"rel":562},"https://github.com/secureworks/family-of-client-ids-research",[550],"FOCI-feature","« i Entra ID. I foredraget fremlagde han også svaret fra Microsoft MSRC (VULN-123240), nemlig at adfærden er by design og nødvendig, for at nye enheder kan gennemføre Intune Enrollment.",[542,566,567,568,573,574,579],{},"Nogle dage efter konferencen offentliggjorde Sunny Chau proof-of-concept-værktøjet ",[546,569,572],{"href":570,"rel":571},"https://github.com/JumpsecLabs/TokenSmith",[550],"TokenSmith"," sammen med et ",[546,575,578],{"href":576,"rel":577},"https://labs.jumpsec.com/tokensmith-bypassing-intune-compliant-device-conditional-access/",[550],"ledsagende blogindlæg",", hvilket gjorde teknikken tilgængelig for et bredere publikum.",[542,581,582,583,588],{},"Derudover er der offentliggjort en ",[546,584,587],{"href":585,"rel":586},"https://github.com/zh54321/PoCEntraDeviceComplianceBypass/blob/main/poc_entra_compliance_bypass.ps1",[550],"PoC skrevet i PowerShell",".",[542,590,591],{},"Siden slutningen af december har vi hos glueckkanja AG undersøgt, hvordan teknikken kan forhindres og detekteres. I dette blogindlæg deler vi nogle af vores indsigter om angrebet og diskuterer mulighederne for mitigering og detektion.",[530,593,595],{"id":594},"tldr","TL;DR",[535,597,537],{},[535,599,600,601,606,607],{},"Der findes ressourcer med en indbygget undtagelse fra bestemte Grant Controls og betingelser i Conditional Access, som løser bestemte problemer. En af dem er undtagelsen af Company Portal-appen fra device compliance, som løser hønen-og-ægget-problemet med at få enheder enrolleret i Intune, før de betragtes som compliant. Adfærden er ",[546,602,605],{"href":603,"rel":604},"https://learn.microsoft.com/en-us/entra/identity/conditional-access/policy-alt-all-users-compliant-hybrid-or-mfa#:~:text=You%20can%20enroll,Company%20Portal%20application",[550],"dokumenteret her",".\n",[608,609,610],"strong",{},"Det betyder, at du kan få access- og refresh-tokens til denne app fra en unmanaged enhed, selv hvis en CA-politik håndhæver device compliance for »All resources«.",[535,612,613,618],{},[614,615],"img",{"alt":616,"src":617},"image.png","https://res.cloudinary.com/c4a8/image/upload/blog/pics/company-portal-ca-bypass-02.png","{: .post__screenshot}",[535,620,621,622,626,627],{},"Microsoft har implementeret en funktion kaldet Family of Client IDs (FOCI), som gør det muligt for en gruppe af Microsofts OAuth-klientapplikationer at hente access-tokens som enhver anden klient i familien ved hjælp af deres refresh-token. En adfærd, der ellers ikke er tilladt i OAuth2-standarden. Læs ",[546,623,625],{"href":561,"rel":624},[550],"Secureworks' oprindelige arbejde"," for flere detaljer.\n",[608,628,629],{},"Da Company Portal-appen er et »family member«, kan de refresh-tokens, der anmodes om til den, bruges til at hente tokens til andre apps i familien.",[535,631,632,633],{},"FOCI-funktionen er begrænset, og samtykket mellem klient-id og ressource skal være eksplicit konfigureret og givet. For Company Portal-appen er dette samtykke blandt andet givet til adgang til Microsoft Graph med et begrænset scope og til Azure AD Graph API med den aktuelle brugers rettigheder.\n",[608,634,635],{},"Det betyder, at et refresh-token fra Company Portal kan bruges til at hente for eksempel access-tokens til Azure AD Graph API med scopet user_impersonation, hvilket giver os mulighed for at gøre en hel del med for eksempel AADInternals eller ROADrecon",[535,637,638],{},"For at udføre angrebet skal angriberen enten have gyldige credentials fra offeret samt mulighed for at gennemføre MFA, hvis Conditional Access kræver det, eller et gyldigt refresh-token.",[530,640,642],{"id":641},"hvilken-risiko-og-blast-radius-er-der","Hvilken risiko og blast radius er der?",[535,644,537],{},[646,647,649],"h3",{"id":648},"hvilke-af-de-mulige-ressourcer-scopes-er-berørt-af-compliance-undtagelsen","Hvilke af de mulige ressourcer (scopes) er berørt af compliance-undtagelsen?",[535,651,652],{},"{: .h4-font-size}",[535,654,655],{},"Angriberen har som allerede beskrevet mulighed for at anmode om tokens til en anden FOCI-applikation. Microsoft har dog kun implementeret et bypass af kravet om device compliance for adgang til tokens til bestemte ressourceapplikationer med forskellige API-permission-scopes. Særligt de følgende delegerede API-rettigheder er følsomme og interessante for angribere:",[657,658,659],"style",{},"\ntable {\n  font-family: arial, sans-serif;\n  border-collapse: collapse;\n  width: 100%;\n}\n\ntd, th {\n  border: 1px solid #dddddd;\n  text-align: left;\n  padding: 8px;\n}\n\ntr:nth-child(even) {\n  background-color: #dddddd;\n}\n",[661,662,663,679],"table",{},[664,665,666],"thead",{},[667,668,669,673,676],"tr",{},[670,671,672],"th",{},"Ressourceapplikation",[670,674,675],{},"Application Id",[670,677,678],{},"Delegeret permission scope",[680,681,682,694,705,716],"tbody",{},[667,683,684,688,691],{},[685,686,687],"td",{},"AADGraph",[685,689,690],{},"00000002-0000-0000-c000-000000000000",[685,692,693],{},"user_impersonation",[667,695,696,699,702],{},[685,697,698],{},"Microsoft Graph API",[685,700,701],{},"00000003-0000-0000-c000-000000000000",[685,703,704],{},"“email\", \"openid\", \"profile\",\"Device.Read.All\", \"DeviceManagementConfiguration.Read.All\", \"DeviceManagementConfiguration.ReadWrite.All\", \"ServicePrincipalEndpoint.Read.All\", \"User.Read”",[667,706,707,710,713],{},[685,708,709],{},"Device Registration Service",[685,711,712],{},"01cb2876-7ebd-4aa4-9cc9-d28bd4d359a9",[685,714,715],{},"adrs_access",[667,717,718,721,724],{},[685,719,720],{},"Windows Azure Service Management API",[685,722,723],{},"797f4846-ba00-4fd7-ba43-dac1f8f63013",[685,725,693],{},[535,727,728],{},"Da de tildelte rettigheder ikke gælder applikationen selv, afhænger konsekvensen af, hvilke privilegier den kaldende part (brugerkontoen) har, og hvilke delegerede permission scopes der er autoriseret til at udføre API-kald inden for scopet.",[535,730,731],{},"Lad os se nærmere på, hvor kritiske de viste delegerede permission scopes er, og hvilken autorisation de potentielt giver til at kalde følsomme API'er.",[530,733,735],{"id":734},"hvilke-privilegier-og-delegerede-scopes-er-kritiske","Hvilke privilegier og delegerede scopes er kritiske?",[535,737,537],{},[646,739,741],{"id":740},"azure-ad-graph-api","Azure AD Graph API",[535,743,652],{},[535,745,746,747,752,753,758],{},"Det gamle programmatiske interface tilbyder mange API'er til at administrere directory-indstillinger og -objekter i Entra ID (Azure AD). Det omfatter Conditional Access-politikker, directory-roller, CRUD på grupper og enheder samt operationer på den indloggede bruger, for eksempel skift af adgangskode. En komplet liste over alle understøttede operationer findes i ",[546,748,751],{"href":749,"rel":750},"https://learn.microsoft.com/en-us/previous-versions/azure/ad/graph/api/api-catalog",[550],"Azure AD Graph API-referencen",". Dette API bliver endeligt udfaset den 30. juni 2025 (ifølge ",[546,754,757],{"href":755,"rel":756},"https://learn.microsoft.com/en-us/graph/migrate-azure-ad-graph-overview",[550],"Microsofts seneste meddelelser",").",[535,760,761,762,765],{},"Det tildelte delegerede scope »user_impersonation« giver applikationen, i dette tilfælde Company Portal, mulighed for at handle på brugerens vegne. Enhver rettighed, som den indloggede bruger har til et Entra-objekt, et scope eller på directory-niveau, kan derfor bruges som autorisation i API-kaldene. Brugeren kan være ejer af et Entra ID-objekt, altså en applikation, en gruppe eller andre objekter, eller have fået tildelt rettigheder gennem Entra ID-rolletildelinger. ",[608,763,764],{},"Ved aktive højt privilegerede rolletildelinger ville det give angriberen mulighed for at ændre objekter eller kompromittere tenanten",". Selv helt uden privilegier kan standardbrugerrettighederne bruges til omfattende rekognoscering og enumerering af directory-objekter i tenanten.",[535,767,768],{},"Scenarierne og konsekvensen af at misbruge Azure AD Graph API afhænger derfor af den berørte brugers aktive eller permanent tildelte privilegier. API'er til adgang til Microsoft 365-tjenester, for eksempel til eksfiltrering af OneDrive, indgår ikke i Azure AD Graph.",[646,770,698],{"id":771},"microsoft-graph-api",[535,773,652],{},[535,775,776],{},"Sammenlignet med Azure AD Graph er det delegerede scope til Microsoft Graph API begrænset til et bestemt omfang. Ved siden af OpenID-scopes (openid, email, profile) er der grundlæggende læseoperationer på brugerens vegne (ServicePrincipalEndpoint.Read.All, User.Read).",[535,778,779],{},"Alle enhedsobjekter kan listes og læses ved at kalde »device«-endpointet i Microsoft Graph med standardrettigheder via »Device.Read.All«. Det kan hjælpe angribere med at få indblik i enhedsobjekter.",[535,781,782],{},"Hvis en kompromitteret bruger er tildelt rollen »Intune Administrator« eller en hvilken som helst delegering i Microsoft Intune RBAC, bør følgende tildelte delegerede API-rettigheder betragtes som problematiske:",[539,784,785,788],{},[542,786,787],{},"»DeviceManagementConfiguration.Read.All«",[542,789,790],{},"»DeviceManagementConfiguration.ReadWrite.All«",[535,792,793],{},[608,794,795,796,801],{},"Disse delegerede rettigheder tillader CRUD-operationer, for eksempel på Device Compliance- og Configuration-politikker, men også udrulning af ",[546,797,800],{"href":798,"rel":799},"https://learn.microsoft.com/en-us/graph/api/intune-shared-devicemanagementscript-create?view=graph-rest-beta",[550],"Management Scripts"," til yderligere ondsindet aktivitet på målenhederne.",[646,803,709],{"id":804},"device-registration-service",[535,806,652],{},[535,808,809],{},"Med denne rettighed kan angriberen joine eller registrere en enhed i Entra ID. Det ville til gengæld give mulighed for at enrollere enheden i Intune og, afhængigt af Intune-konfigurationen, få en gyldig og compliant enhed, der giver adgang til endnu flere beskyttede tjenester.",[646,811,813],{"id":812},"andre-foci-applikationer","Andre FOCI-applikationer",[535,815,652],{},[535,817,818],{},"At anmode om adgang til andre privilegerede interfaces, for eksempel Azure Resource Manager API, ligger inden for FOCI's rækkevidde og er også interessant for angriberen. Denne ressource er dog fortsat beskyttet og ikke undtaget fra Conditional Access-grant-controlet »compliant device«.",[535,820,821],{},[614,822],{"alt":616,"src":823},"https://res.cloudinary.com/c4a8/image/upload/blog/pics/company-portal-ca-bypass-03.png",[530,825,827],{"id":826},"kan-vi-detektere-denne-angrebsteknik","Kan vi detektere denne angrebsteknik?",[535,829,537],{},[535,831,832],{},"Som beskrevet ovenfor kommer den største risiko fra adgang til MS Graph og Azure AD Graph.",[535,834,835],{},"Da applikations-id'et for Microsoft Intune Company Portal-appen altid bruges i dette tilfælde, er hovedopgaven ved at bygge en detektion at udelukke legitim brug som for eksempel enhedsregistreringer. Ifølge vores observationer består forskellen i, hvilke ressourcer der tilgås først i en session → ved et angreb typisk MS Graph eller Azure AD Graph.",[535,837,838],{},"Her er en fungerende detektion, som vi har testet i flere miljøer af forskellig størrelse:",[840,841,843,844,847,848,853,854,858,862,865,866,868,865,872,847,874,876,877,865,881,883,865,886,847,888,890,891,893,865,896,847,898,900,901,904,905,908,909,912,913,847,915,918,919,921,865,924,847,926,904,929,931,932,934,935,937,938,865,941,934,943,946,947,950,951,953,954,918,957,959,865,962,847,964,966,967,847,969,971,972,865,975,977,865,979,847,981,876,983,865,985,987,865,990,847,992,900,994,904,996,908,998,912,1000],"div",{"style":842},"background-color:#000000; font-family: 'Source Code Pro', 'Courier New', monospace; padding: 15px; color: #ffffff","\nAADSignInEventsBeta ",[845,846],"br",{},"\n| ",[849,850,852],"span",{"style":851},"color: #569CD6;","where"," Timestamp > ",[849,855,857],{"style":856},"color: #E6DB74;","ago(",[849,859,861],{"style":860},"color: #A6E22E;","7d",[849,863,864],{"style":856},")"," ",[845,867],{},[849,869,871],{"style":870},"color: #75715E;","// Access to Microsoft Intune Company Portal",[845,873],{},[849,875,852],{"style":851}," ApplicationId == ",[849,878,880],{"style":879},"color: #D69D85;","@\"9ba1a5c7-f17a-4de9-a1f1-6178c8d51223\"",[845,882],{},[849,884,885],{"style":870},"// From non joined/registered device",[845,887],{},[849,889,852],{"style":851}," isempty(AadDeviceId) ",[845,892],{},[849,894,895],{"style":870},"// Used to access resource Microsoft Graph or Windows Azure Active Directory",[845,897],{},[849,899,852],{"style":851}," ResourceId ",[849,902,903],{"style":851},"in"," (",[849,906,907],{"style":879},"\"00000002-0000-0000-c000-000000000000\"",", ",[849,910,911],{"style":879},"\"00000003-0000-0000-c000-000000000000\"",") ",[845,914],{},[849,916,917],{"style":851},"summarize by"," SessionId ",[845,920],{},[849,922,923],{"style":870},"// Find the initial logon event based on the session Id",[845,925],{},[849,927,928],{"style":851},"join kind=inner",[845,930],{},"\n    AADSignInEventsBeta ",[845,933],{},"\n    | ",[849,936,852],{"style":851}," ErrorCode == ",[849,939,940],{"style":860},"0",[845,942],{},[849,944,945],{"style":851},"summarize arg_min(","Timestamp, *",[849,948,949],{"style":851},") by"," SessionId)",[845,952],{},"\n    ",[849,955,956],{"style":851},"on",[845,958],{},[849,960,961],{"style":870},"// Ignore trusted and managed devices",[845,963],{},[849,965,852],{"style":851}," isempty(DeviceTrustType) ",[845,968],{},[849,970,852],{"style":851}," IsManaged != ",[849,973,974],{"style":860},"1",[845,976],{},[849,978,871],{"style":870},[845,980],{},[849,982,852],{"style":851},[849,984,880],{"style":879},[845,986],{},[849,988,989],{"style":870},"// when the first requested resource is Microsoft Graph or Windows Azure Active Directory",[845,991],{},[849,993,852],{"style":851},[849,995,903],{"style":851},[849,997,907],{"style":879},[849,999,911],{"style":879},[845,1001],{},[530,1003,1005],{"id":1004},"hvordan-skal-vi-reagere-når-vi-opdager-mistænkelig-aktivitet","Hvordan skal vi reagere, når vi opdager mistænkelig aktivitet?",[535,1007,537],{},[535,1009,1010],{},"Start jeres incident response-proces med en defineret playbook, der indeholder:",[539,1012,1013,1034,1042,1045,1048],{},[542,1014,1015,1016],{},"Hunting efter mistænkelig eller anomal aktivitet fra den kompromitterede bruger\n",[539,1017,1018,1025,1028,1031],{},[542,1019,1020,1021],{},"Oversigt over ikke-interaktive sign-ins til ressourceapplikationer inklusive IP-adresser og UserAgents baseret på ",[1022,1023,1024],"code",{},"sessionId",[542,1026,1027],{},"Kontrol af, om Microsoft Entra Audit Logs viser kritiske operationer fra brugeren eller IP-adresserne, for eksempel tilføjede credentials til ejede app-registreringer",[542,1029,1030],{},"Identifikation af, om brugeren har registreret enheder i den berørte session",[542,1032,1033],{},"Kontrol af Intune audit logs for operationer fra applikationen »Company Portal« og den berørte bruger",[542,1035,1036,1037],{},"Hunting efter relaterede alerts på de berørte entiteter\n",[539,1038,1039],{},[542,1040,1041],{},"Opslag af entiteter i AlertEvidence-tabellen for at identificere andre alerts baseret på SessionId, IP-adresser og bruger",[542,1043,1044],{},"Fastlæggelse af brugerens kritikalitet (ud fra privilegier) i Exposure Management",[542,1046,1047],{},"Gennemgang af hunting-resultaterne og verifikation af, om handlingen var legitim som led i en device enrollment.",[542,1049,1050],{},"Identifikation af den initiale adgangsvektor og nulstilling af brugerens credentials og om nødvendigt enheder.",[530,1052,1054],{"id":1053},"kan-vi-mitigere-angrebet","Kan vi mitigere angrebet?",[535,1056,537],{},[535,1058,1059,1060,1063],{},"Da den konfigurerede undtagelse er nødvendig for Intune enrollment, ",[608,1061,1062],{},"findes der ingen mitigering, som ikke ville ødelægge andre dele af Microsoft 365",". Adgang til Azure AD Graph-ressourcen kan ikke scopes eller blokeres direkte. Enhver Conditional Access-politik med »Block« som grant control vil forhindre adgang, men kan have andre konsekvenser.",[535,1065,1066],{},"Til mitigering er det afgørende at forstå, at dette Conditional Access-bypass ikke er et komplet angreb. Det er en teknik, der som ét skridt muliggør en række angreb.",[535,1068,1069],{},"En angrebssti kunne være",[1071,1072,1073,1076,1079,1082],"ol",{},[542,1074,1075],{},"Kompromittering af konto via phishing og AiTM",[542,1077,1078],{},"Conditional Access-bypass",[542,1080,1081],{},"Rekognoscering med for eksempel ROADrecon, GraphRunner eller AADInternals",[542,1083,1084],{},"Lateral movement, privilege escalation eller persistens gennem en nyregistreret enhed enrolleret i Intune",[535,1086,1087],{},"Da vi ikke kan mitigere dette Conditional Access-bypass uden at ødelægge Intune enrollment, er det mere end rimeligt at implementere mitigeringer i de øvrige skridt af angrebsstien og samtidig etablere fornuftige detektioner.",[535,1089,1090],{},"For at reducere sandsynlighed og konsekvens anbefaler vi at styrke de øvrige kontroller og implementere følgende snarest:",[539,1092,1093,1099,1105,1111,1117,1133,1139],{},[542,1094,1095,1098],{},[608,1096,1097],{},"Håndhæv MFA for »All Users« og »All Cloud Apps« via Conditional Access."," Hvis I kun håndhæver device compliance, er single factor authentication nok med denne teknik.",[542,1100,1101,1104],{},[608,1102,1103],{},"Brug ikke device compliance eller MFA i jeres regelsæt, håndhæv altid begge."," Et OR ville aldrig begrænse al adgang til compliant enheder, fordi et access-token med MFA i scope ville være nok til at tilgå tenanten.",[542,1106,1107,1110],{},[608,1108,1109],{},"Begræns Security Information Registration til compliant enheder, phishing-resistent autentificering eller TAP."," I vores test lykkedes det os ikke at omgå device compliance for Security Info Registration.",[542,1112,1113,1116],{},[608,1114,1115],{},"Kræv phishing-resistent autentificering eller TAP for join eller registrering af enheder."," Uden det vil det være muligt at registrere en enhed med for eksempel AADInternals og denne teknik.",[542,1118,1119,1122,1123],{},[608,1120,1121],{},"Kræv MFA og »Sign-in frequency every time« for Microsoft Intune Enrollment."," Det begrænser det tidsrum, hvor en angriber kan bruge friske credentials til at enrollere en ny enhed i Intune.\n",[1124,1125,1126],"blockquote",{},[535,1127,1128,1129,1132],{},"🚧\n",[608,1130,1131],{},"Bemærk: Sign-in frequency every time = hvert femte minut","\nMicrosoft indregner fem minutters clock skew, når »every time« vælges i en Conditional Access-politik, så brugerne ikke bliver bedt om at logge ind oftere end hvert femte minut.",[542,1134,1135,1138],{},[608,1136,1137],{},"Blokér personligt ejede enheder i Intune Enrollment restrictions."," Uden disse begrænsninger kan en angriber enrollere en ny enhed og få yderligere fodfæste.",[542,1140,1141,1144],{},[608,1142,1143],{},"Sæt device compliance til at fejle, når ingen compliance-politik er tildelt en enhed i Intune."," Som standard betragtes hver enhed som compliant, selv hvis ingen politik reelt er anvendt. Lav det om, og gør en device compliance-politik til et krav.",[535,1146,1147,1148,588],{},"På længere sigt vil vi opfordre jer til at investere i udrulning af password-løs, phishing-resistent autentificering som Windows Hello for Business og passkeys, inklusive Platform Credentials via macOS Platform SSO. Det giver jer mulighed for efterfølgende at håndhæve phishing-resistent autentificering og blokere AiTM-angreb. I stedet for adgangskoder kan I tillade brug af Temporary Access Pass (TAP) i afgrænsede perioder og scenarier, for eksempel onboarding af nye enheder eller medarbejdere. For at understøtte brugen af TAPs i forskellige use cases har vi bygget ",[546,1149,287],{"href":1150,"rel":1151},"https://myworkid.cloud/",[550],[530,1153,1155],{"id":1154},"konklusion","Konklusion",[535,1157,537],{},[535,1159,1160],{},"Conditional Access som Zero Trust-motor for Entra ID er i sig selv allerede kompliceret. Yderligere indbyggede undtagelser i Entras backend fra Microsofts side gør det endnu sværere for mange at forstå konsekvensen af politikker og beskyttelser. Alligevel holder idéen om Zero Trust og defense in depth.",[535,1162,1163],{},"Device compliance-politikken forhindrer de fleste AiTM-angreb, og multifaktorautentificering gør det sværere for enhver angriber at misbruge lækkede eller på anden vis kompromitterede credentials.",[535,1165,1166],{},"Alle disse sikkerhedsforanstaltninger skal bruges sammen og ikke som erstatning for hinanden. Det sikrer et sikkert miljø, selv hvis et af forsvarene manipuleres eller brydes.",[535,1168,1169],{},"Vi anbefaler kraftigt at udrulle den viste detektion i Microsoft Defender XDR, så potentielt misbrug bliver opdaget. Sørg for, at jeres SOC er klar til at undersøge den type hændelser, og udstyr dem med de nødvendige playbooks.",{"title":1171,"searchDepth":1172,"depth":1172,"links":1173},"",2,[1174,1175,1176,1180,1186,1187,1188,1189],{"id":532,"depth":1172,"text":533},{"id":594,"depth":1172,"text":595},{"id":641,"depth":1172,"text":642,"children":1177},[1178],{"id":648,"depth":1179,"text":649},3,{"id":734,"depth":1172,"text":735,"children":1181},[1182,1183,1184,1185],{"id":740,"depth":1179,"text":741},{"id":771,"depth":1179,"text":698},{"id":804,"depth":1179,"text":709},{"id":812,"depth":1179,"text":813},{"id":826,"depth":1172,"text":827},{"id":1004,"depth":1172,"text":1005},{"id":1053,"depth":1172,"text":1054},{"id":1154,"depth":1172,"text":1155},"md","post",{"lang":1193,"seoTitle":1194,"titleClass":1195,"date":1196,"categories":1197,"blogtitlepic":1199,"socialimg":1200,"customExcerpt":1201,"keywords":1202,"contactInContent":1203,"scripts":1260},"da","Compliant Device Bypass i Microsoft Intune: detektion, respons og mitigering","h2-font-size","2025-01-14",[1198],"Security","header-company-portal-ca-bypass","/blog/heads/header-company-portal-ca-bypass.png","I dette blogindlæg samler glueckkanjas MVP Fabian Bader, Chris Brumm og Thomas Naunheim detaljerne om Compliant Device Bypass i Microsoft Intune Company Portal. Efter yderligere research har de fundet en metode til at detektere og reagere på den potentielle trussel. Du finder også vejledning til Conditional Access, som reducerer angrebsfladen, og detaljer om blast radius.","Compliant Device Bypass, Microsoft Intune, Conditional Access, Entra ID, Intune Company Portal, device compliance, CA-undtagelse, TokenSmith PoC, cloud-sikkerhed, PowerShell PoC, Fabian Bader, Christopher Brumm, Thomas Naunheim, sikkerhedstrussel, Black Hat Europe, Intune Enrollment, MSRC-respons, angrebsdetektion, trusselsmitigering, cloud compliance, FOCI-feature",{"quote":484,"infos":1204},{"bgColor":1205,"color":1206,"boxBgColor":1207,"boxColor":1208,"headline":1209,"subline":1210,"level":530,"textStyling":1211,"flush":1212,"person":1213,"form":1225},"var(--color-gk-violet)","var(--color-gk-white)","var(--color-gk-yellow)","var(--color-copy)","Kontakt os nu","Vil du vide mere om Compliant Device Bypass, og hvordan du detekterer og mitigerer den effektivt? Vores eksperter gennemgår gerne vores resultater med dig og støtter jer med gennemprøvede strategier for bedre sikkerhed. Vi glæder os til at høre fra dig.","text-light","justify-content-end",{"image":1214,"cloudinary":325,"alt":1215,"name":1215,"detailsHeader":1216,"details":1217},"/people/people-pam-team.png","Project & Account Management","Vi glæder os til at høre fra dig",[1218,1222],{"text":492,"href":1219,"details":1220,"icon":1221},"tel:+49 69 4005520","Ring nu","site/phone",{"text":493,"href":1223,"icon":1224},"mailto:info@glueckkanja.com","site/mail",{"ctaText":1226,"cta":1227,"method":1191,"action":1229,"fields":1230},"Send",{"skin":1228},"primary on-surface","/send",[1231,1235,1240,1243,1247,1252,1255,1258],{"type":1232,"id":1233,"value":1234},"hidden","_next","successful",{"label":1236,"type":1237,"id":1238,"required":325,"requiredMsg":1239},"Navn*","text","name","Indtast venligst dit navn.",{"label":1241,"type":1237,"id":403,"required":325,"requiredMsg":1242},"Virksomhed*","Indtast venligst din virksomhed.",{"label":1244,"type":1245,"id":1245,"required":325,"requiredMsg":1246},"E-mailadresse*","email","Indtast venligst din e-mailadresse.",{"label":1248,"type":1249,"id":1250,"required":325,"requiredMsg":1251},"Dine data bliver gemt hos os med det formål at behandle og besvare din henvendelse. Du finder flere oplysninger om databeskyttelse i vores \u003Ca href=\"/da/privacy\">privatlivspolitik\u003C/a>.","checkbox","dataprotection","Bekræft venligst",{"type":1232,"id":1253,"value":1254},"_subject","Request Global Secure Access",{"type":1232,"id":1256,"value":1257},"inbox_key","gkgab-contact-form",{"type":1232,"id":1259},"_gotcha",{"slick":325,"form":325},"/posts/2025-01-14-compliant-device-bypass",{"title":521,"description":1171},"posts/2025-01-14-compliant-device-bypass",[1198,1265,1266,1267,281],"Entra","Conditional Access","ITDR","G4P0N_KZ0vKdfqocuGvE40SGWV9bciwB7oLNnjHf-Wg",{"id":1270,"extension":1271,"meta":1272,"stem":8,"__hash__":1619},"authors_data/authors.json","json",{"path":1273,"Fritz Zurhorst":1274,"Alexander Schlindwein":1280,"Sophie Luna":1286,"Nadine Klein":1294,"Karsten Kleinschmidt":1300,"Julian Wendt":1308,"Holger Bunkradt":1313,"Ralf Mania":1319,"Oliver Kieselbach":1325,"Steffen Schwerdtfeger":1331,"Gunnar Winter":1339,"Jan Petersen":1344,"Thorsten Kunzi":1349,"Moritz Pohl":1353,"Thorben Pöschus":1358,"Christoph Hannebauer":1364,"Marco Scheel":1368,"Christopher Brumm":1373,"Florian Klante":1379,"Niklas Bachmann":1384,"Nils Krautkrämer":1389,"Patrick Treptau":1395,"Peter Beckendorf":1400,"Patrick Sobau":1405,"Jörg Wunderlich":1410,"Michael Breither":1414,"Christian Kanja":1419,"Zeba Hoffmann":1425,"Jochen Fröhlich":1430,"Jan Geisbauer":1434,"Gerrit Reinke":1445,"Christian Kordel":1451,"Stephan Wälde":1455,"Carolin Kanja":1460,"Adrian Ritter":1466,"Marvin Bangert":1471,"Thorsten Pickhan":1477,"Christian Lorenz":1483,"Denis Böhm":1488,"Fabian Bader":1493,"Juan Jose Fernandez Perez":1498,"Mahschid Sayyar":1503,"Benjamin Dassow":1508,"Markus Walschburger":1513,"Jonathan Haist":1518,"Daniel Rohregger":1523,"Thomas Naunheim":1528,"Florian Stöckl":1532,"Pascal Asch":1537,"Markus Kättner":1542,"Anna Ulbricht":1549,"Annette Brauns":1556,"body":1562,"title":1618},"/authors",{"display_name":1275,"avatar":1276,"permalink":1277,"linkedin":1278,"imageOffsetTop":1279},"Fritz Zurhorst","people/people-fritz-zurhorst.png","/authors/fritz-zurhorst","friedemann-z","72%",{"display_name":1281,"avatar":1282,"permalink":1283,"twitter":1284,"linkedin":1285},"Alexander Schlindwein","people/people-alexander-rudolph.png","/authors/alexander-schlindwein","AlexanderOnIT","schlindwein-alexander",{"display_name":1287,"avatar":1288,"permalink":1289,"twitter":1290,"linkedin":1291,"imageOffsetLeft":1292,"imageOffsetTop":1293},"Sophie Luna","people/people-sophie-luna.jpg","/authors/sophie-luna","glueckkanjagab","../company/glueckkanja-gab","58%","67%",{"display_name":1295,"avatar":1296,"permalink":1297,"twitter":1298,"linkedin":1299,"imageOffsetTop":1279},"Nadine Klein","people/people-nadine-kern.png","/authors/nadine-kern","nadineausRT","nadine-kern",{"display_name":1301,"avatar":1302,"permalink":1303,"twitter":1304,"linkedin":1305,"imageOffsetTop":1306,"imageOffsetLeft":1307},"Karsten Kleinschmidt","/c_pad,w_800,h_700/people/karsten-kleinschmidt.jpg","/authors/karsten-kleinschmidt","KarstenonIT","karstenkleinschmidt","60%","57%",{"display_name":1309,"avatar":1310,"permalink":1311,"linkedin":1312},"Julian Wendt","people/people-julian-wendt.png","/authors/julian-wendt","julian-wendt",{"display_name":1314,"avatar":1315,"permalink":1316,"linkedin":1317,"twitter":1318},"Holger Bunkradt","people/people-holger-bunkradt.png","/authors/holger-bunkradt","holger-bunkradt-12b5053b","hbunkradt",{"display_name":1320,"avatar":1321,"permalink":1322,"linkedin":1323,"twitter":1324},"Ralf Mania","people/people-ralf-mania.png","/authors/ralf-mania","ralf-mania-146a2757","RaMa1976",{"display_name":1326,"avatar":1327,"permalink":1328,"linkedin":1329,"twitter":1330},"Oliver Kieselbach","people/people-oliver-kieselbach.png","/authors/oliver-kieselbach","oliver-kieselbach-a4a3409","okieselbT",{"display_name":1332,"avatar":1333,"permalink":1334,"linkedin":1335,"twitter":1336,"imageOffsetTop":1337,"imageOffsetLeft":1338},"Steffen Schwerdtfeger","people/people-steffen-schwerdtfeger.png","/authors/steffen-schwerdtfeger","steffen-schwerdtfeger","SteffenAtCloud","79%","51%",{"display_name":1340,"avatar":1341,"permalink":1342,"twitter":1290,"linkedin":1343},"Gunnar Winter","people/people-gunnar-winter.jpg","/authors/gunnar-winter","company/glueckkanja-gab",{"display_name":1345,"avatar":1346,"permalink":1347,"twitter":1290,"linkedin":1348},"Jan Petersen","people/jan-petersen.png","/authors/jan-petersen","jan-petersen-26a901",{"display_name":1350,"avatar":1351,"permalink":1352,"twitter":1290,"linkedin":1343,"imageOffsetTop":1279},"Thorsten Kunzi","people/author-thorsten-kunzi.png","/authors/thorsten-kunzi",{"display_name":1354,"avatar":1355,"permalink":1356,"twitter":1290,"linkedin":1357},"Dr. Moritz Pohl","people/people-moritz-pohl.png","/authors/moritz-pohl","dr-moritz-pohl",{"display_name":1359,"avatar":1360,"permalink":1361,"twitter":1362,"linkedin":1363},"Thorben Pöschus","people/thorben.poeschus.png","/authors/thorben-poeschus","TPO901","thorben-pöschus-624693b7",{"display_name":1365,"avatar":1366,"permalink":1367,"twitter":1290,"linkedin":1343,"imageOffsetTop":1279},"Dr. Christoph Hannebauer","people/people-christoph-hannebauer.png","/authors/christoph-hannebauer",{"display_name":1369,"avatar":1370,"permalink":1371,"twitter":1372,"linkedin":1372},"Marco Scheel","people/people-marco-scheel.png","/authors/marco-scheel","marcoscheel",{"display_name":524,"avatar":1374,"permalink":1375,"twitter":1376,"linkedin":1377,"imageOffsetTop":1378},"people/people-christopher-brumm.jpg","/authors/christopher-brumm","cbrhh","christopherbrumm","66%",{"display_name":1380,"avatar":1381,"permalink":1382,"linkedin":1383,"twitter":1290},"Florian Klante","people/florian-klante.jpg","/authors/florian-klante","florian-klante-6031b31b",{"display_name":1385,"avatar":1386,"permalink":1387,"linkedin":1388,"twitter":1290},"Niklas Bachmann","people/niklas.bachmann.png","/authors/niklas-bachmann","niklas-bachmann-66a863158",{"display_name":1390,"avatar":1391,"permalink":1392,"twitter":1393,"linkedin":1394},"Nils Krautkrämer","people/nils-krautkraemer.png","/authors/nils-krautkraemer","KrauNils","nils-krautkrämer-8b04bb250",{"display_name":1396,"avatar":1397,"permalink":1398,"linkedin":1399,"twitter":1290},"Patrick Treptau","people/people-patrick-treptau.png","/authors/patrick-traptau","ptreptau",{"display_name":1401,"avatar":1402,"permalink":1403,"linkedin":1404,"twitter":1290,"imageOffsetTop":1279},"Peter Beckendorf","people/peter-beckendorf.png","/authors/peter-beckendorf","peter-beckendorf-29a239b1",{"display_name":1406,"avatar":1407,"permalink":1408,"linkedin":1409,"twitter":1290},"Patrick Sobau","people/patrick-sobau.png","/authors/patrick-sobau","patrick-sobau",{"display_name":1411,"avatar":1412,"permalink":1413,"twitter":1290},"Jörg Wunderlich","people/joerg-wunderlich.png","/authors/joerg-wunderlich",{"display_name":1415,"avatar":1416,"permalink":1417,"twitter":1290,"linkedin":1418},"Michael Breither","people/people-michael-breither.jpg","/authors/michael-breither","michaelbreither",{"display_name":1420,"avatar":1421,"permalink":1422,"twitter":1423,"linkedin":1424},"Christian Kanja","people/people-christian-kanja.png","/authors/christian-kanja","cekageka","christian-kanja",{"display_name":1426,"avatar":1427,"permalink":1428,"linkedin":1429,"twitter":1290},"Zeba Hoffmann","people/zeba-hoffmann.png","/authors/zeba-hoffmann","zebahoffmann",{"display_name":1431,"avatar":1432,"permalink":1433,"twitter":1290,"linkedin":1343},"Jochen Fröhlich","people/people-jochen-froehlich.png","/authors/jochen-froehlich",{"display_name":1435,"avatar":1436,"permalink":1437,"twitter":1438,"linkedin":1438,"imageOffsetTop":1279,"socials":1439},"Jan Geisbauer","people/people-jan-geisbauer-csoc.png","/authors/jan-geisbauer","JanGeisbauer",[1440,1442],{"text":472,"href":1441},"https://emptydc.com",{"text":1443,"href":1444},"Podcast","https://hairlessinthecloud.com",{"display_name":1446,"avatar":1447,"permalink":1448,"twitter":1449,"linkedin":1450},"Gerrit Reinke","people/gerrit-reinke.png","/authors/gerrit-reinke","GLWRe","glwr",{"display_name":1452,"avatar":1453,"permalink":1454,"twitter":1290,"linkedin":1343},"Christian Kordel","people/christian-kordel.png","/authors/christian-kordel",{"display_name":1456,"avatar":1457,"permalink":1458,"twitter":1459,"linkedin":1343},"Stephan Wälde","people/people-stephan-waelde.png","/authors/stephan-waelde","stephanwaelde",{"display_name":1461,"avatar":1462,"permalink":1463,"twitter":1464,"linkedin":1465},"Carolin Kanja","people/people-carolin-kanja.jpg","/authors/carolin-kanja","fraukanja","carolin-kanja",{"display_name":1467,"avatar":1468,"permalink":1469,"twitter":1470,"linkedin":1470},"Adrian Ritter","people/people-adrian-ritter.png","/authors/adrian-ritter","adrianritter",{"display_name":1472,"avatar":1473,"permalink":1474,"twitter":1475,"linkedin":1476},"Marvin Bangert","people/people-marvin-bangert.png","/authors/marvin-bangert","marvinbangert","marvin-bangert",{"display_name":1478,"avatar":1479,"permalink":1480,"twitter":1481,"linkedin":1482},"Thorsten Pickhan","people/people-thorsten-pickhan.png","/authors/thorsten-pickhan","tpickhan","thorsten-pickhan",{"display_name":1484,"avatar":1485,"permalink":1486,"linkedin":1487,"twitter":1290},"Christian Lorenz","people/people-christian-lorenz.png","/authors/christian-lorenz","christianlorenz95",{"display_name":1489,"avatar":1490,"permalink":1491,"linkedin":1492,"twitter":1290},"Denis Böhm","people/people-denis-boehm.png","/authors/denis-boehm","denis-böhm-3bb834135",{"display_name":523,"avatar":1494,"permalink":1495,"linkedin":1496,"twitter":1497},"people/people-fabian-bader.jpg","/authors/fabian-bader","fabianbader","fabian_bader",{"display_name":1499,"avatar":1500,"permalink":1501,"linkedin":1502},"Juan Jose Fernandez Perez","people/people-juan-jose-fernandez.jpg","/authors/juan-jose-fernandez-perez","juan-jose-fernandez-perez-8016055",{"display_name":1504,"avatar":1505,"permalink":1506,"linkedin":1507},"Mahschid Sayyar","people/people-mahschid-sayyar.jpg","/authors/mahschid-sayyar","mahschid-sayyar-97544463",{"display_name":1509,"avatar":1510,"permalink":1511,"linkedin":1512},"Benjamin Dassow","people/people-benjamin-dassow.jpg","/authors/benjamin-dassow","benjamin-dassow",{"display_name":1514,"avatar":1515,"permalink":1516,"linkedin":1517},"Markus Walschburger","people/people-markus-walschburger.jpg","/authors/markus-walschburger","markus-walschburger",{"display_name":1519,"avatar":1520,"permalink":1521,"linkedin":1522,"imageOffsetTop":1279},"Jonathan Haist","people/people-jonathan-haist.jpg","/authors/jonathan-haist","jonathanhaist",{"display_name":1524,"avatar":1525,"permalink":1526,"linkedin":1527,"imageOffsetTop":1279},"Daniel Rohregger","people/people-daniel-rohregger.jpg","/authors/daniel-rohregger","drohregger",{"display_name":525,"avatar":1529,"permalink":1530,"linkedin":1531,"imageOffsetTop":1378},"people/people-thomas-naunheim.jpg","/authors/thomas-naunheim","thomasnaunheim",{"display_name":1533,"avatar":1534,"permalink":1535,"linkedin":1536,"imageOffsetTop":1378},"Florian Stöckl","people/people-florian-stoeckl.jpg","/authors/florian-stoeckl","florianstoeckl",{"display_name":1538,"avatar":1539,"permalink":1540,"linkedin":1541,"imageOffsetTop":1378},"Pascal Asch","people/Pascal.Asch.648.jpg","/authors/pascal-asch","pascal-asch",{"display_name":1543,"avatar":1544,"permalink":1545,"linkedin":1546,"imageOffsetTop":1547,"imageOffsetLeft":1548},"Markus Kättner","people/markus-kaettner.jpg","/authors/markus-kaettner","markus-kättner-b600119","62%","63%",{"display_name":1550,"avatar":1551,"permalink":1552,"linkedin":1553,"imageOffsetTop":1554,"imageOffsetLeft":1555},"Anna Ulbricht","people/anna-katharina.ulbricht-09.png","/authors/anna-ulbricht","anna-katharina-u-a67702199","70%","50%",{"display_name":1557,"avatar":1558,"permalink":1559,"linkedin":1560,"imageOffsetTop":1561,"imageOffsetLeft":1306},"Annette Brauns","people/Annette-Brauns-8.jpg","/authors/annette-brauns","annette-brauns","95%",{"Fritz Zurhorst":1563,"Alexander Schlindwein":1564,"Sophie Luna":1565,"Nadine Klein":1566,"Karsten Kleinschmidt":1567,"Julian Wendt":1568,"Holger Bunkradt":1569,"Ralf Mania":1570,"Oliver Kieselbach":1571,"Steffen Schwerdtfeger":1572,"Gunnar Winter":1573,"Jan Petersen":1574,"Thorsten Kunzi":1575,"Moritz Pohl":1576,"Thorben Pöschus":1577,"Christoph Hannebauer":1578,"Marco Scheel":1579,"Christopher Brumm":1580,"Florian Klante":1581,"Niklas Bachmann":1582,"Nils Krautkrämer":1583,"Patrick Treptau":1584,"Peter Beckendorf":1585,"Patrick Sobau":1586,"Jörg Wunderlich":1587,"Michael Breither":1588,"Christian Kanja":1589,"Zeba Hoffmann":1590,"Jochen Fröhlich":1591,"Jan Geisbauer":1592,"Gerrit Reinke":1596,"Christian Kordel":1597,"Stephan Wälde":1598,"Carolin Kanja":1599,"Adrian Ritter":1600,"Marvin Bangert":1601,"Thorsten Pickhan":1602,"Christian Lorenz":1603,"Denis Böhm":1604,"Fabian Bader":1605,"Juan Jose Fernandez Perez":1606,"Mahschid Sayyar":1607,"Benjamin Dassow":1608,"Markus Walschburger":1609,"Jonathan Haist":1610,"Daniel Rohregger":1611,"Thomas Naunheim":1612,"Florian Stöckl":1613,"Pascal Asch":1614,"Markus Kättner":1615,"Anna Ulbricht":1616,"Annette Brauns":1617},{"display_name":1275,"avatar":1276,"permalink":1277,"linkedin":1278,"imageOffsetTop":1279},{"display_name":1281,"avatar":1282,"permalink":1283,"twitter":1284,"linkedin":1285},{"display_name":1287,"avatar":1288,"permalink":1289,"twitter":1290,"linkedin":1291,"imageOffsetLeft":1292,"imageOffsetTop":1293},{"display_name":1295,"avatar":1296,"permalink":1297,"twitter":1298,"linkedin":1299,"imageOffsetTop":1279},{"display_name":1301,"avatar":1302,"permalink":1303,"twitter":1304,"linkedin":1305,"imageOffsetTop":1306,"imageOffsetLeft":1307},{"display_name":1309,"avatar":1310,"permalink":1311,"linkedin":1312},{"display_name":1314,"avatar":1315,"permalink":1316,"linkedin":1317,"twitter":1318},{"display_name":1320,"avatar":1321,"permalink":1322,"linkedin":1323,"twitter":1324},{"display_name":1326,"avatar":1327,"permalink":1328,"linkedin":1329,"twitter":1330},{"display_name":1332,"avatar":1333,"permalink":1334,"linkedin":1335,"twitter":1336,"imageOffsetTop":1337,"imageOffsetLeft":1338},{"display_name":1340,"avatar":1341,"permalink":1342,"twitter":1290,"linkedin":1343},{"display_name":1345,"avatar":1346,"permalink":1347,"twitter":1290,"linkedin":1348},{"display_name":1350,"avatar":1351,"permalink":1352,"twitter":1290,"linkedin":1343,"imageOffsetTop":1279},{"display_name":1354,"avatar":1355,"permalink":1356,"twitter":1290,"linkedin":1357},{"display_name":1359,"avatar":1360,"permalink":1361,"twitter":1362,"linkedin":1363},{"display_name":1365,"avatar":1366,"permalink":1367,"twitter":1290,"linkedin":1343,"imageOffsetTop":1279},{"display_name":1369,"avatar":1370,"permalink":1371,"twitter":1372,"linkedin":1372},{"display_name":524,"avatar":1374,"permalink":1375,"twitter":1376,"linkedin":1377,"imageOffsetTop":1378},{"display_name":1380,"avatar":1381,"permalink":1382,"linkedin":1383,"twitter":1290},{"display_name":1385,"avatar":1386,"permalink":1387,"linkedin":1388,"twitter":1290},{"display_name":1390,"avatar":1391,"permalink":1392,"twitter":1393,"linkedin":1394},{"display_name":1396,"avatar":1397,"permalink":1398,"linkedin":1399,"twitter":1290},{"display_name":1401,"avatar":1402,"permalink":1403,"linkedin":1404,"twitter":1290,"imageOffsetTop":1279},{"display_name":1406,"avatar":1407,"permalink":1408,"linkedin":1409,"twitter":1290},{"display_name":1411,"avatar":1412,"permalink":1413,"twitter":1290},{"display_name":1415,"avatar":1416,"permalink":1417,"twitter":1290,"linkedin":1418},{"display_name":1420,"avatar":1421,"permalink":1422,"twitter":1423,"linkedin":1424},{"display_name":1426,"avatar":1427,"permalink":1428,"linkedin":1429,"twitter":1290},{"display_name":1431,"avatar":1432,"permalink":1433,"twitter":1290,"linkedin":1343},{"display_name":1435,"avatar":1436,"permalink":1437,"twitter":1438,"linkedin":1438,"imageOffsetTop":1279,"socials":1593},[1594,1595],{"text":472,"href":1441},{"text":1443,"href":1444},{"display_name":1446,"avatar":1447,"permalink":1448,"twitter":1449,"linkedin":1450},{"display_name":1452,"avatar":1453,"permalink":1454,"twitter":1290,"linkedin":1343},{"display_name":1456,"avatar":1457,"permalink":1458,"twitter":1459,"linkedin":1343},{"display_name":1461,"avatar":1462,"permalink":1463,"twitter":1464,"linkedin":1465},{"display_name":1467,"avatar":1468,"permalink":1469,"twitter":1470,"linkedin":1470},{"display_name":1472,"avatar":1473,"permalink":1474,"twitter":1475,"linkedin":1476},{"display_name":1478,"avatar":1479,"permalink":1480,"twitter":1481,"linkedin":1482},{"display_name":1484,"avatar":1485,"permalink":1486,"linkedin":1487,"twitter":1290},{"display_name":1489,"avatar":1490,"permalink":1491,"linkedin":1492,"twitter":1290},{"display_name":523,"avatar":1494,"permalink":1495,"linkedin":1496,"twitter":1497},{"display_name":1499,"avatar":1500,"permalink":1501,"linkedin":1502},{"display_name":1504,"avatar":1505,"permalink":1506,"linkedin":1507},{"display_name":1509,"avatar":1510,"permalink":1511,"linkedin":1512},{"display_name":1514,"avatar":1515,"permalink":1516,"linkedin":1517},{"display_name":1519,"avatar":1520,"permalink":1521,"linkedin":1522,"imageOffsetTop":1279},{"display_name":1524,"avatar":1525,"permalink":1526,"linkedin":1527,"imageOffsetTop":1279},{"display_name":525,"avatar":1529,"permalink":1530,"linkedin":1531,"imageOffsetTop":1378},{"display_name":1533,"avatar":1534,"permalink":1535,"linkedin":1536,"imageOffsetTop":1378},{"display_name":1538,"avatar":1539,"permalink":1540,"linkedin":1541,"imageOffsetTop":1378},{"display_name":1543,"avatar":1544,"permalink":1545,"linkedin":1546,"imageOffsetTop":1547,"imageOffsetLeft":1548},{"display_name":1550,"avatar":1551,"permalink":1552,"linkedin":1553,"imageOffsetTop":1554,"imageOffsetLeft":1555},{"display_name":1557,"avatar":1558,"permalink":1559,"linkedin":1560,"imageOffsetTop":1561,"imageOffsetLeft":1306},"Authors","1csawlkJxRljy93GTOnXEkwLqAv9Lcj-apxRvoodAOY",{"id":1270,"extension":1271,"meta":1621,"stem":8,"__hash__":1619},{"Christopher Brumm":1622,"Fabian Bader":1623,"Thomas Naunheim":1624},{"display_name":524,"avatar":1374,"permalink":1375,"twitter":1376,"linkedin":1377,"imageOffsetTop":1378},{"display_name":523,"avatar":1494,"permalink":1495,"linkedin":1496,"twitter":1497},{"display_name":525,"avatar":1529,"permalink":1530,"linkedin":1531,"imageOffsetTop":1378},{"list":1626,"authors":1842},[1627,1644,1658,1672,1688,1701,1714,1727,1739,1755,1769,1784,1802,1813,1826],{"id":1628,"title":1629,"author":1630,"cta":494,"description":1171,"hideInRecent":484,"layout":1191,"meta":1631,"moment":1636,"path":1637,"stem":1638,"tags":1639,"webcast":484},"content_da/posts/2026-09-22-end-of-mfa-sms.md","Enden på MFA-SMS",[1301],{"lang":1193,"date":1632,"categories":1633,"blogtitlepic":1634,"customExcerpt":1635},"2026-09-21",[1198],"head-conditional-access.jpg","Hvorfor virksomheder nu bør skifte til phishing-resistente og så vidt muligt passwordløse loginmetoder.","2026-09-22","/posts/2026-09-22-end-of-mfa-sms","posts/2026-09-22-end-of-mfa-sms",[1198,1640,1641,1642,1643],"Authentication","Microsoft Entra ID","MFA","Passkeys",{"id":1645,"title":1646,"author":1647,"cta":494,"description":1171,"hideInRecent":484,"layout":1191,"meta":1648,"moment":1632,"path":1652,"stem":1653,"tags":1654,"webcast":484},"content_da/posts/2026-09-21-clickfix-prevent-detect.md","ClickFix. Når brugeren er exploiten, og hvordan I stopper det",[1275,1295],{"lang":1193,"date":1632,"categories":1649,"blogtitlepic":1650,"customExcerpt":1651},[1198],"head-clickfix.jpg","ClickFix gør brugere til deres egen angriber: et falsk CAPTCHA, en copy-paste, og skadekoden kører i hukommelsen, uden at noget lander på disken. Hvordan Microsoft Defender opdager angrebet, hvor detektionen når sine grænser, og hvordan I lukker hullet med et RunMRU-hunt og fire beskyttelseslag.","/posts/2026-09-21-clickfix-prevent-detect","posts/2026-09-21-clickfix-prevent-detect",[1655,1656,1657],"Defender","SOC","Endpoint Security",{"id":1659,"title":1660,"author":1661,"cta":494,"description":1171,"hideInRecent":484,"layout":1191,"meta":1662,"moment":1632,"path":1666,"stem":1667,"tags":1668,"webcast":484},"content_da/posts/2026-09-21-red-tenant-dark-tenant-cio.md","Admin og hverdag på samme computer? Game Over.",[1435],{"lang":1193,"date":1632,"categories":1663,"blogtitlepic":1664,"customExcerpt":1665},[1198],"head-game-over-en.jpg","Hvorfor én tenant ikke rækker for CIO'er, og hvorfor den anden sjældent bliver tænkt med. Managed Red Tenant adskiller arkitektonisk det administrative arbejde fra kontormiljøet, Managed Dark Tenant holder virksomheden handlekraftig, hvis forsvaret alligevel falder. Hvad det betyder for driftsmodellen, SOC-signalet og dokumentationspligterne efter NISG 2026.","/posts/2026-09-21-red-tenant-dark-tenant-cio","posts/2026-09-21-red-tenant-dark-tenant-cio",[1198,1669,1670,1671],"Privileged Access","Zero Trust","NIS2",{"id":1673,"title":1674,"author":1675,"cta":494,"description":1676,"hideInRecent":484,"layout":1191,"meta":1677,"moment":1678,"path":1683,"stem":1684,"tags":1685,"webcast":484},"content_da/posts/2026-08-08-isg-germany-2026.md","Fire gange Leader. glueckkanja i ISG-undersøgelsen Tyskland 2026",[1461],"ISG har omdøbt sin undersøgelse i år. Microsoft Cloud Ecosystem blev til Microsoft AI and Cloud Ecosystem, og med navnet har målestokken flyttet sig: Det, der vurderes, er ikke længere, hvem der indfører Microsoft-platforme, men hvem der driver Copilot, agenter og AI-workloads kontrollerbart. Den nye målestok har ikke ændret noget ved vores position. ISG Provider Lens®-undersøgelsen Tyskland 2026 positionerer os som Leader i fire kvadranter: Microsoft Productivity and Business Process Services og Azure Managed Services, hver gang i både Large Market og Mid Market. Efter 2021, 2023, 2024 og 2025 er det den femte Leader-placering i Tyskland, i Schweiz kom springet ind i Leader-kvadranten to uger tidligere.",{"lang":1193,"date":1678,"categories":1679,"blogtitlepic":1681,"customExcerpt":1682},"2026-08-08",[1680],"Corporate","head-isg-de-2026.png","ISG Provider Lens®-undersøgelsen 2026 positionerer glueckkanja i Tyskland som Leader i fire kvadranter: Microsoft Productivity and Business Process Services og Azure Managed Services, hver gang i både Large og Mid Market. Undersøgelsen hedder nu Microsoft AI and Cloud Ecosystem, og målestokken har flyttet sig: Det, der vurderes, er, hvem der driver AI- og agent-workloads kontrollerbart.","/posts/2026-08-08-isg-germany-2026","posts/2026-08-08-isg-germany-2026",[1686,1687],"Award","ISG",{"id":1689,"title":1690,"author":1691,"cta":494,"description":1692,"hideInRecent":484,"layout":1191,"meta":1693,"moment":1694,"path":1698,"stem":1699,"tags":1700,"webcast":484},"content_da/posts/2026-07-31-isg-switzerland-2026.md","Fra Rising Star til Leader. glueckkanja i ISG-undersøgelsen Schweiz 2026",[1461],"I 2024 stiftede vi glueckkanja Switzerland AG og flyttede ind i et kontor i zentroom på Bahnhofplatz 10b i Bern. I 2025 placerede ISG os som Rising Star på det schweiziske marked, som den leverandør, analytikerne tror kan tage springet ind i Leader-kvadranten. Nu er springet dokumenteret: ISG Provider Lens®-undersøgelsen 2026 positionerer os i Schweiz som Leader i kvadranten Microsoft AI and Cloud Ecosystem, inden for områderne Azure Managed Services og Microsoft Productivity and Business Process Services.",{"lang":1193,"date":1694,"categories":1695,"blogtitlepic":1696,"customExcerpt":1697},"2026-07-31",[1680],"head-isg-ch-2026.png","ISG Provider Lens®-undersøgelsen 2026 positionerer glueckkanja i Schweiz som Leader i kvadranten Microsoft AI and Cloud Ecosystem, inden for områderne Azure Managed Services og Microsoft Productivity and Business Process Services. To år efter markedsindtrædelsen i Bern, et år efter Rising Star-udmærkelsen.","/posts/2026-07-31-isg-switzerland-2026","posts/2026-07-31-isg-switzerland-2026",[1686,1687],{"id":1702,"title":1703,"author":1704,"cta":494,"description":1171,"hideInRecent":484,"layout":1191,"meta":1705,"moment":1706,"path":1710,"stem":1711,"tags":1712,"webcast":484},"content_da/posts/2026-07-24-outbreak-openai-hugging-face.md","Outbreak. Hvad OpenAI/Hugging-Face-hændelsen afslører, og hvad den ikke gør",[1435],{"lang":1193,"date":1706,"categories":1707,"blogtitlepic":1708,"customExcerpt":1709},"2026-07-24",[1198],"head-outbreak.jpg","En AI-agent bryder ud af sit testmiljø, finder en zero-day og hacker en anden virksomhed. Det lyder som et filmmanuskript, men skete faktisk i juli 2026. Tid til en nøgtern placering: med lidt psykologi, to security-veteraner og spørgsmålet om, hvad det betyder for jeres forsvar.","/posts/2026-07-24-outbreak-openai-hugging-face","posts/2026-07-24-outbreak-openai-hugging-face",[1713,1656,1670],"AI",{"id":1715,"title":1716,"author":1717,"cta":494,"description":1718,"hideInRecent":484,"layout":1191,"meta":1719,"moment":1720,"path":1724,"stem":1725,"tags":1726,"webcast":484},"content_da/posts/2026-07-22-isg-cybersecurity-2026.md","Leader og Rising Star. glueckkanja i ISG's Cybersecurity-undersøgelse 2026",[1461],"Ny i kvadranten og straks Leader: ISG Provider Lens®-undersøgelsen \"Cybersecurity – Services and Solutions 2026\" positionerer glueckkanja som Leader inden for Next-Gen SOC/MDR Services for mellemstore virksomheder i Tyskland. I det samlede marked for Next-Gen SOC/MDR Services udnævner ISG os til Rising Star, altså den leverandør, som analytikerne tror kan tage springet ind i Leader-kvadranten inden for de næste 12 til 24 måneder.",{"lang":1193,"date":1720,"categories":1721,"blogtitlepic":1722,"customExcerpt":1723},"2026-07-22",[1680],"head-isg-cybersecurity-2026.png","ISG Provider Lens®-undersøgelsen Cybersecurity 2026 udnævner glueckkanja til Leader i kvadranten Next-Gen SOC/MDR Services (Midmarket). I det samlede marked for Next-Gen SOC/MDR Services er vi Rising Star. ISG fremhæver vores vækst over gennemsnittet, vores dybe Microsoft-security-ekspertise og et 24/7-SOC drevet fra Tyskland.","/posts/2026-07-22-isg-cybersecurity-2026","posts/2026-07-22-isg-cybersecurity-2026",[1686,1687,1198],{"id":1728,"title":1729,"author":1730,"cta":494,"description":1731,"hideInRecent":484,"layout":1191,"meta":1732,"moment":1733,"path":1736,"stem":1737,"tags":1738,"webcast":484},"content_da/posts/2026-07-06-the-holy-trinity.md","The Holy Trinity: Hvad AI virkelig skal have for at kunne arbejde",[1461],"En produktionsvirksomhed vil vide, hvilke af dens 14.000 SKU'er der faktisk er profitable. Svaret ligger i tre systemer, der aldrig har udvekslet et enkelt datapunkt med hinanden. Indtil for kort tid siden kostede det tre afdelinger, to uger og en del god vilje at få det. Siden begyndelsen af 2026 kan en AI besvare det spørgsmål på minutter: søge data igennem, skabe sammenhænge, producere en anbefaling. Forudsat at den har adgang.",{"lang":1193,"date":1733,"categories":1734,"blogtitlepic":1735},"2026-07-06",[131],"head-the-holy-trinity","/posts/2026-07-06-the-holy-trinity","posts/2026-07-06-the-holy-trinity",[1713,131],{"id":1740,"title":1741,"author":1742,"cta":494,"description":1743,"hideInRecent":484,"layout":1191,"meta":1744,"moment":1745,"path":1749,"stem":1750,"tags":1751,"webcast":484},"content_da/posts/2026-07-01-onboarding-process.md","Kontrakten er skrevet under: Sådan forløber din onboarding hos os",[1550],"Hvordan forløber jeres onboarding egentlig? Det er et spørgsmål, vi støder på igen og igen i samtaler med ansøgere, for mange har oplevet, at en onboarding kan gå hakkende. Derfor er det så meget desto vigtigere for os, at du får en god fornemmelse helt fra begyndelsen.",{"lang":1193,"date":1745,"categories":1746,"blogtitlepic":1747,"customExcerpt":1748},"2026-07-01",[1680],"Onboarding_Blogheader","Kontrakten er skrevet under, det første store skridt er taget. Men hvad sker der nu? Vi tager dig med bag kulisserne i vores onboarding, fra PreBoarding til den første uge i teamet.","/posts/2026-07-01-onboarding-process","posts/2026-07-01-onboarding-process",[1752,1753,1754],"Employer Branding","Onboarding","Unternehmenskultur",{"id":1756,"title":1757,"author":1758,"cta":494,"description":1759,"hideInRecent":484,"layout":1191,"meta":1760,"moment":1761,"path":1765,"stem":1766,"tags":1767,"webcast":484},"content_da/posts/2026-06-26-frontier-partner.md","Microsoft Frontier Partner: vi er blandt de få",[1461],"I Microsofts partner-økosystem findes der en lang række anerkendelser, og alligevel skiller Frontier Partner Badge sig ud fra de øvrige udmærkelser i sin anlæg. Man kan ikke ansøge om det, det tildeles på Microsofts eget initiativ til en eksklusiv kreds af partnere, som skal overbevise i flere discipliner parallelt i stedet for at brillere i en enkelt. Microsoft vurderer dokumenteret kompetence inden for Cloud & AI Platforms, AI Business Solutions og Security i lige høj grad og henvender sig dermed til virksomheder, der ikke opfatter AI som en påbygning på eksisterende IT, men som resultatet af en gennemgående arkitektur, der bærer fra identiteten over endpointet og helt ind i produktiv AI-drift.",{"lang":1193,"date":1761,"categories":1762,"blogtitlepic":1763,"customExcerpt":1764},"2026-06-26",[1680],"head-frontier-partner-badge.jpg","Microsoft AI Cloud Partner Program har for nylig fået en ny topudmærkelse, Frontier Partner Badge. Microsoft tildeler den udelukkende til en eksklusiv kreds af partnere verden over, som leverer bæredygtige AI-projekter på hele Microsoft-stakken, fra arbejdspladsen over cloud-platformen og security og helt ind i selve AI-anvendelsen, og som har dokumenteret det i praksis. I DACH-området tæller den gruppe kun en håndfuld virksomheder, og vi er en af dem.","/posts/2026-06-26-frontier-partner","posts/2026-06-26-frontier-partner",[1686,1768,1713],"Microsoft Partner",{"id":1770,"title":1771,"author":1772,"cta":494,"description":1773,"hideInRecent":484,"layout":1191,"meta":1774,"moment":1775,"path":1779,"stem":1780,"tags":1781,"webcast":484},"content_da/posts/2026-06-09-vair-run.md","160 kilometer for en god sag",[1557],"Søndag morgen, klokken 8:30, Holbeinsteg ved Main. Elleve kolleger i ens NinjaCat-shirts, klar til Frankfurter Runden. Regn, lyn og torden inklusive. At løbe for en god sag var motivation nok til at snøre løbeskoene på trods af det dårlige vejr.",{"lang":1193,"date":1775,"categories":1776,"blogtitlepic":1777,"customExcerpt":1778},"2026-06-08",[1680],"frankfurter-runden.png","Elleve kolleger, 16 omgange, 160 kilometer, et tordenvejr og en podieplacering: glueckkanja var med til Frankfurter Runden 2026 og donerede for hver løbet omgang til VAIR e.V., der bygger en inkluderende sports- og kulturpark i Offenbach.","/posts/2026-06-09-vair-run","posts/2026-06-09-vair-run",[1782,1752,1783],"Top Arbeitgeber","Soziales Engagement",{"id":1785,"title":1786,"author":1787,"cta":494,"description":1788,"hideInRecent":484,"layout":1191,"meta":1789,"moment":1790,"path":1794,"stem":1795,"tags":1796,"webcast":484},"content_da/posts/2026-04-10-incident-to-intelligence.md","Anatomien af en ukendt AMOS Stealer: fra alert til immunitet på timer",[1538],"Når en alert udløses i vores SOC, begynder uret at løbe: ikke kun for den berørte kunde, men for alle organisationer under vores beskyttelse. Det farligste øjeblik i det moderne trusselslandskab er Intelligence Gap, tidsvinduet mellem den første anvendelse af en ny malwarevariant og den dag, branchen hører om den.",{"lang":1193,"date":1790,"categories":1791,"blogtitlepic":1792,"customExcerpt":1793},"2026-04-10",[1198],"head-amos-stealer.png","En hidtil udokumenteret AMOS Stealer-variant kompromitterede et macOS-endpoint. Ingen kendte hashes, ingen C2-data i offentlige databaser. Vores SOC skilte seks obfuskeringslag ad, udtrak alle indikatorer og rullede beskyttelsen ud til alle SOC-kunder inden for timer, endnu før branchen overhovedet havde set samplet.","/posts/2026-04-10-incident-to-intelligence","posts/2026-04-10-incident-to-intelligence",[1797,1798,1799,1800,1801],"Threat Intelligence","Incident Response","macOS Security","Malware Analysis","Cyber Security Operations Center",{"id":1803,"title":1804,"author":1805,"cta":494,"description":1806,"hideInRecent":484,"layout":1191,"meta":1807,"moment":1808,"path":1811,"stem":1812,"tags":494,"webcast":484},"content_da/posts/2026-03-21-microsoft-edge-corporate-browser.md","Derfor bør Edge være jeres eneste corporate browser",[1332],"Valget af browser er en strategisk beslutning i virksomhedsmiljøer, fordi det direkte påvirker, hvor meget sikkerhed og hvor stort et administrationsarbejde I reelt har. Google Chrome var længe den nærliggende mulighed, men Microsoft Edge har udviklet sig til en browser, der griber direkte ind i den eksisterende stak, især når Microsoft 365 er i brug, og administrationen kører gennem Intune.",{"lang":1193,"date":1808,"blogtitlepic":1809,"customExcerpt":1810},"2026-03-21","head-microsoft-edge-default-browser.jpg","Ingen virksomhed har for alvor valgt Chrome; den var der bare, med sin egen sync-logik, sin egen kontohåndtering og sin egen politikflade. Microsoft Edge griber derimod direkte ind i den infrastruktur, der alligevel kører: Entra ID, Intune, Defender. Dette indlæg viser, hvordan skiftet ser ud, hvordan Chrome omdirigeres til en landingpage via en Intune-politik, og hvad der falder væk, når man holder op med at drive to browsere parallelt.","/posts/2026-03-21-microsoft-edge-corporate-browser","posts/2026-03-21-microsoft-edge-corporate-browser",{"id":1814,"title":1815,"author":1816,"cta":494,"description":1817,"hideInRecent":484,"layout":1191,"meta":1818,"moment":1819,"path":1823,"stem":1824,"tags":1825,"webcast":484},"content_da/posts/2026-03-20-stryker-attack-intune-privilege.md","Én admin-konto var alt, hvad der skulle til.",[1435],"Onsdag den 11. marts 2026. Medarbejdere på Stryker-kontorer i 79 lande tændte deres computere og fandt dem tomme. Login-skærme erstattet af et logo. Firmabærbare, arbejdstelefoner, private enheder tilmeldt virksomhedens BYOD-program, alle slettet samtidig, natten over. Ingen ransomware, ingen malware-signaturer, intet, som et endpoint-detection-værktøj kunne have opdaget.",{"lang":1193,"date":1819,"categories":1820,"blogtitlepic":1821,"customExcerpt":1822},"2026-03-20",[1198],"head-stryker.jpg","Den 11. marts 2026 slettede Handala enheder i 79 lande, og alt, hvad der skulle til, var en kompromitteret Intune-admin-konto. Ingen malware, ingen exploit, kun legitime management-værktøjer vendt mod deres ejere. Hvad der skete, hvorfor det virkede, og hvilke to arkitektoniske huller der skal lukkes.","/posts/2026-03-20-stryker-attack-intune-privilege","posts/2026-03-20-stryker-attack-intune-privilege",[71,1669,1670],{"id":1827,"title":1828,"author":1829,"cta":494,"description":1830,"hideInRecent":484,"layout":1191,"meta":1831,"moment":1832,"path":1836,"stem":1837,"tags":1838,"webcast":484},"content_da/posts/2026-03-16-ai-agent-hackathon.md","Seks agenter. Fire uger. Rigtig drift.",[1461],"Hvor mange timer bruger jeres IT-afdeling om ugen på opgaver, som en agent kunne klare på minutter?",{"lang":1193,"date":1832,"categories":1833,"blogtitlepic":1834,"customExcerpt":1835},"2026-03-16",[1680],"head-ai-agent-hackathon.jpg","Seks virksomheder, fire ugers byggefase, seks fungerende AI Agents. Det var den første glueckkanja AI Agent Hackathon. Kiekert, Dr. Oetker, Eckes-Granini, igefa og lila logistik har bygget agenter i Copilot Studio, som kører produktivt i dag. Her er, hvad der kom ud af det, og hvordan formatet fungerer.","/posts/2026-03-16-ai-agent-hackathon","posts/2026-03-16-ai-agent-hackathon",[1713,1839,1840,1841],"Copilot Studio","Hackathon","AI Agents",{"Karsten Kleinschmidt":1843,"Fritz Zurhorst":1844,"Nadine Klein":1845,"Jan Geisbauer":1846,"Carolin Kanja":1850,"Anna Ulbricht":1851,"Annette Brauns":1852,"Pascal Asch":1853,"Steffen Schwerdtfeger":1854},{"display_name":1301,"avatar":1302,"permalink":1303,"twitter":1304,"linkedin":1305,"imageOffsetTop":1306,"imageOffsetLeft":1307},{"display_name":1275,"avatar":1276,"permalink":1277,"linkedin":1278,"imageOffsetTop":1279},{"display_name":1295,"avatar":1296,"permalink":1297,"twitter":1298,"linkedin":1299,"imageOffsetTop":1279},{"display_name":1435,"avatar":1436,"permalink":1437,"twitter":1438,"linkedin":1438,"imageOffsetTop":1279,"socials":1847},[1848,1849],{"text":472,"href":1441},{"text":1443,"href":1444},{"display_name":1461,"avatar":1462,"permalink":1463,"twitter":1464,"linkedin":1465},{"display_name":1550,"avatar":1551,"permalink":1552,"linkedin":1553,"imageOffsetTop":1554,"imageOffsetLeft":1555},{"display_name":1557,"avatar":1558,"permalink":1559,"linkedin":1560,"imageOffsetTop":1561,"imageOffsetLeft":1306},{"display_name":1538,"avatar":1539,"permalink":1540,"linkedin":1541,"imageOffsetTop":1378},{"display_name":1332,"avatar":1333,"permalink":1334,"linkedin":1335,"twitter":1336,"imageOffsetTop":1337,"imageOffsetLeft":1338},1791383906599]