[{"data":1,"prerenderedAt":1952},["ShallowReactive",2],{"sc:header-data-da":3,"sc:footer-data-da":489,"post-da--posts-2025-12-31-vulnerability-consentfix-c8cd491384b08":519,"authors_data":1367,"content-da-list-7b291c2dd91a4":1718,"authors_data:Christopher Brumm|Fabian Bader|Thomas Naunheim":1947},{"lang":4,"home":5,"navigation":17,"meta":479,"contact":485},"de",{"name":6,"folderSwitch":7,"imgLight":10,"img":11,"languages":12},"home",[8,9],"authors","blog","/logos/gk-Logo-sw.svg","/logos/gk-Logo-rgb.svg",{"da":13},{"title":14,"url":15,"alt":16},"Forside","/da","glueckkanja Logo",[18,127,231,316,395,402],{"name":19,"languages":20,"children":24},"workplace",{"da":21},{"title":22,"description":23},"Workplace","Intelligente, sikre og fleksible arbejdspladser bygget på Microsoft 365, der forener moderne teknologier og identitetstjenester.",[25,55,91],{"name":26,"languages":27,"children":30},"portfolio",{"da":28},{"title":29},"Portfolio",[31,37,43,49],{"name":32,"languages":33},"managed-intune",{"da":34},{"title":35,"url":36},"Managed Intune","/da/entra-intune/managed-intune",{"name":38,"languages":39},"managed-entra",{"da":40},{"title":41,"url":42},"Managed Entra","/da/entra-intune/managed-entra",{"name":44,"languages":45},"managed-workplace",{"da":46},{"title":47,"url":48},"Managed Workplace","/da/workplace/managed-workplace",{"name":50,"languages":51},"consulting-services",{"da":52},{"title":53,"url":54},"Consulting Services","/da/workplace/consulting-services",{"name":56,"languages":57,"children":60},"microsoft-365-endpoint",{"da":58},{"title":59},"Microsoft 365 Endpoint",[61,67,73,79,85],{"name":62,"languages":63},"microsoft-entra-suite",{"da":64},{"title":65,"url":66},"Microsoft Entra Suite","/da/workplace/microsoft-entra-suite",{"name":68,"languages":69},"microsoft-intune",{"da":70},{"title":71,"url":72},"Microsoft Intune","/da/workplace/microsoft-intune",{"name":74,"languages":75},"microsoft-windows",{"da":76},{"title":77,"url":78},"Microsoft Windows","/da/workplace/microsoft-windows",{"name":80,"languages":81},"windows-365-cloud-pc",{"da":82},{"title":83,"url":84},"Windows 365 Cloud PC","/da/workplace/windows365-cloud-pc",{"name":86,"languages":87},"cloud-workplace-foundation",{"da":88},{"title":89,"url":90},"Cloud Workplace Foundation","/da/workplace/cloud-workplace-foundation",{"name":92,"languages":93,"children":96},"microsoft-365-collaboration",{"da":94},{"title":95},"Microsoft 365 Collaboration",[97,103,109,115,121],{"name":98,"languages":99},"microsoft-copilot",{"da":100},{"title":101,"url":102},"Microsoft 365 Copilot","/da/workplace/microsoft-365-copilot",{"name":104,"languages":105},"microsoft-teams",{"da":106},{"title":107,"url":108},"Teams","/da/workplace/microsoft-teams",{"name":110,"languages":111},"sharepoint-powerplatform",{"da":112},{"title":113,"url":114},"SharePoint & Power Platform","/da/workplace/sharepoint-power-platform",{"name":116,"languages":117},"exchange-online",{"da":118},{"title":119,"url":120},"Exchange Online","/da/workplace/exchange-online",{"name":122,"languages":123},"information-protection-compliance",{"da":124},{"title":125,"url":126},"Information Protection & Compliance","/da/workplace/information-protection-compliance",{"name":128,"languages":129,"children":133},"azure",{"da":130},{"title":131,"description":132},"Azure","Sæt gang i væksten med Azure: skær ned på cloudomkostningerne, øg effektiviteten og driv innovationen med IaaS og PaaS.",[134,151,181],{"name":135,"languages":136,"children":138},"azure-portfolio",{"da":137},{"title":29},[139,145],{"name":140,"languages":141},"azure-managed-services",{"da":142},{"title":143,"url":144},"Azure Managed Services","/da/azure/azure-managed-services",{"name":146,"languages":147},"azure-consulting",{"da":148},{"title":149,"url":150},"Azure Consulting","/da/azure/azure-consulting",{"name":152,"languages":153,"children":156},"azure-scenarios",{"da":154},{"title":155},"Scenarier",[157,163,169,175],{"name":158,"languages":159},"plan-your-cloud",{"da":160},{"title":161,"url":162},"Planlæg din cloud","/da/azure/plan-your-cloud",{"name":164,"languages":165},"migrate-to-the-cloud",{"da":166},{"title":167,"url":168},"Migrér til cloud","/da/azure/migrate-to-the-cloud",{"name":170,"languages":171},"innovate-your-business",{"da":172},{"title":173,"url":174},"Forny din forretning","/da/azure/innovate-your-business",{"name":176,"languages":177},"vmware-exit",{"da":178},{"title":179,"url":180},"Gentænk din VMware-strategi","/da/azure/vmware-exit",{"name":182,"languages":183,"children":186},"azure-practices",{"da":184},{"title":185},"Practices",[187,193,199,202,208,213,219,225],{"name":188,"languages":189},"azure-foundation",{"da":190},{"title":191,"url":192},"Azure Foundation","/da/azure/azure-foundation",{"name":194,"languages":195},"azure-ai-foundation",{"da":196},{"title":197,"url":198},"Azure AI Foundation","/da/azure/azure-ai-foundation",{"name":86,"languages":200},{"da":201},{"title":89,"url":90},{"name":203,"languages":204},"azure-data-foundation",{"da":205},{"title":206,"url":207},"Azure Data Foundation","/da/azure/azure-data-foundation",{"name":188,"languages":209},{"da":210},{"title":211,"url":212},"Azure Container Foundation","/da/azure/azure-container-foundation",{"name":214,"languages":215},"dark-tenant",{"da":216},{"title":217,"url":218},"Managed Dark Tenant","/da/azure/managed-dark-tenant",{"name":220,"languages":221},"azure-cloud-adoption-framework",{"da":222},{"title":223,"url":224},"Cloud Adoption Framework","/da/azure/cloud-adoption-framework",{"name":226,"languages":227},"azure-cloud-competence-center",{"da":228},{"title":229,"url":230},"Cloud Competence Center","/da/azure/cloud-competence-center",{"name":232,"languages":233,"children":242},"security",{"da":234},{"title":235,"description":236,"emergency":237},"Sikkerhed","Årvågenhed i clouden med en prisbelønnet 24/7 managed service, incident response og tidssvarende beskyttelse af din infrastruktur.",{"text":238,"href":239,"skin":240,"icon":241},"Under angreb?","/da/security/are-you-under-attack","primary","emergency",[243,268,289],{"name":244,"children":245},"security-security-consulting",[246,252,256,262],{"name":247,"languages":248},"managed-red-tenant",{"da":249},{"title":250,"url":251},"Managed Red Tenant","/da/security/managed-red-tenant",{"name":214,"languages":253},{"da":254},{"title":255,"url":218},"Dark Tenant",{"name":257,"languages":258},"sentinel-data-lake",{"da":259},{"title":260,"url":261},"Sentinel Data Lake","/da/security/sentinel-data-lake",{"name":263,"languages":264},"security-consulting",{"da":265},{"title":266,"url":267},"Security Consulting","/da/security/security-consulting",{"name":269,"children":270},"security-cloud-security-operations-center",[271,277,283],{"name":272,"languages":273},"cloud-security-operations-center",{"da":274},{"title":275,"url":276},"Cloud Security Operations Center","/da/security/cloud-security-operations-center",{"name":278,"languages":279},"global-secure-access",{"da":280},{"title":281,"url":282},"Global Secure Access","/da/security/global-secure-access",{"name":284,"languages":285},"my-work-id",{"da":286},{"title":287,"url":288},"MyWorkID","/da/security/my-work-id",{"name":290,"children":291},"security-preventive-services",[292,298,304,310],{"name":293,"languages":294},"preventive-services",{"da":295},{"title":296,"url":297},"Preventive Services","/da/security/preventive-services",{"name":299,"languages":300},"data-security-services",{"da":301},{"title":302,"url":303},"Data Security Service","/da/security/data-security-service",{"name":305,"languages":306},"security-copilot-agents",{"da":307},{"title":308,"url":309},"Security Copilot Agents","/da/security/security-copilot-agents",{"name":311,"languages":312},"nis2",{"da":313},{"title":314,"url":315},"Implementering af NIS2","/da/security/red-dark-tenant-nis2",{"name":317,"languages":318,"children":322},"products",{"da":319},{"title":320,"description":321},"Produkter","Companion-produkter til et gennemført sikkert, 100 % cloud-native Microsoft-miljø, der styrker samarbejdet, netværksautentificeringen og softwarehåndteringen.",[323,360],{"name":324,"products":325,"children":326},"lorem ipsum 1",true,[327,336,344,352],{"name":328,"img":329,"target":330,"languages":331},"realmjoin","products/realmjoin/realmjoin-nav-logo.svg","_blank",{"da":332},{"title":333,"url":334,"subtitle":335},"RealmJoin","https://www.realmjoin.com","Cloudbaseret softwaredistribution",{"name":337,"img":338,"target":330,"languages":339},"scepman","products/scepman/scepman-nav-logo.svg",{"da":340},{"title":341,"url":342,"subtitle":343},"SCEPman","https://www.scepman.com","Certifikatdistribution fra clouden",{"name":345,"img":346,"target":330,"languages":347},"konnekt","products/konnekt/konnekt-nav-logo.svg",{"da":348},{"title":349,"url":350,"subtitle":351},"KONNEKT","https://www.konnekt.io","Arbejd med dine lokale Office 365-data",{"name":353,"img":354,"target":330,"languages":355},"realmigrator","products/realmigrator/realmigrator-nav-logo.svg",{"da":356},{"title":357,"url":358,"subtitle":359},"RealMigrator","https://www.realmigrator.com","Migrér dine data fra én server til en anden",{"name":361,"products":325,"children":362},"lorem ipsum 2",[363,371,379,387],{"name":364,"img":365,"target":330,"languages":366},"terraprovider","products/terraprovider/terraprovider-nav-logo.svg",{"da":367},{"title":368,"url":369,"subtitle":370},"TerraProvider","https://www.terraprovider.com","Terraform Provider til Microsoft 365",{"name":372,"img":373,"target":330,"languages":374},"radiusaas","products/radius/radius-nav-logo.svg",{"da":375},{"title":376,"url":377,"subtitle":378},"RADIUSaaS","https://www.radius-as-a-service.com","Autentificering til dit netværk",{"name":380,"img":381,"target":330,"languages":382},"unifiedcontacts","products/unified-contacts/unifiedcontact-nav-logo.svg",{"da":383},{"title":384,"url":385,"subtitle":386},"Unified Contacts","https://www.unified-contacts.com","Find kontakter i Microsoft Teams",{"name":388,"img":389,"target":330,"languages":390},"autopilotmonitor","products/autopilot-monitor/AutopilotMonitor-nav-logo.svg",{"da":391},{"title":392,"url":393,"subtitle":394},"Autopilot Monitor","https://www.autopilotmonitor.com","Windows Autopilot-overvågning i realtid",{"name":396,"languages":397},"casestudies",{"da":398},{"title":399,"url":400,"description":401},"Cases","/da/casestudies","Pioner i clouden: din Microsoft-partner til gennemarbejdede cloudløsninger med en blueprint-baseret tilgang og ekspertise i Infrastructure-as-Code.",{"name":403,"languages":404,"children":407},"company",{"da":405},{"title":406,"description":401},"Virksomhed",[408,438,462],{"name":409,"languages":410,"children":413},"company-about-us",{"da":411},{"title":412},"Om os",[414,420,426,432],{"name":415,"languages":416},"company-facts-figures",{"da":417},{"title":418,"url":419},"Fakta og tal","/da/company/facts-and-figures",{"name":421,"languages":422},"company-contact",{"da":423},{"title":424,"url":425},"Kontakt og lokationer","/da/company/contact-and-locations",{"name":427,"languages":428},"switzerland",{"da":429},{"title":430,"url":431},"glueckkanja Schweiz","/da/company/switzerland",{"name":433,"languages":434},"austria",{"da":435},{"title":436,"url":437},"glueckkanja Østrig","/da/company/austria",{"name":439,"languages":440,"children":443},"company-career",{"da":441},{"title":442},"Karriere",[444,450,456],{"name":445,"languages":446},"company-career-overview",{"da":447},{"title":448,"url":449},"Karriereoversigt","/da/career",{"name":451,"languages":452},"company-young-professionals",{"da":453},{"title":454,"url":455},"Young Professionals","/da/young-professionals",{"name":457,"languages":458},"company-jobs",{"da":459},{"title":460,"url":461},"Ledige stillinger","/da/job-offers",{"name":463,"languages":464,"children":467},"company-latest",{"da":465},{"title":466},"Aktuelt",[468,474],{"name":469,"languages":470},"company-blog",{"da":471},{"title":472,"url":473},"Blog","/da/blog",{"name":469,"languages":475},{"da":476},{"title":477,"url":478},"Events","/da/events",[480],{"name":481,"languages":482},"career-meta",{"da":483},{"title":442,"url":449,"active":484},false,{"languages":486},{"da":487},{"title":488,"url":425,"active":484},"Kontakt",{"data":490},{"bgColor":491,"number":492,"mail":493,"brandLogos":494,"logos":495,"links":499,"linksDa":509},"var(--color-gk-mid-blue)","+49 69 4005520","info@glueckkanja.com",null,[496],{"img":10,"alt":16,"url":497,"class":498},"index.html","max-w-19rem",[500,503,506],{"title":501,"url":502},"Datenschutz","/de/privacy",{"title":504,"url":505},"Impressum","/de/imprint",{"title":507,"url":508},"No Cookies","/de/cookies",[510,513,516],{"title":511,"url":512},"Privatlivspolitik","/da/privacy",{"title":514,"url":515},"Juridisk information","/da/imprint",{"title":517,"url":518},"Ingen cookies","/da/cookies",{"id":520,"title":521,"author":522,"body":526,"cta":494,"description":532,"eventid":494,"extension":1332,"hideInRecent":484,"layout":1333,"meta":1334,"moment":1338,"navigation":325,"path":1360,"seo":1361,"stem":1362,"tags":1363,"webcast":484,"__hash__":1366},"content_da/posts/2025-12-31-vulnerability-consentfix.md","AuthCodeFix aka ConsentFix",[523,524,525],"Fabian Bader","Christopher Brumm","Thomas Naunheim",{"type":527,"value":528,"toc":1309},"minimal",[529,533,536,539,546,549,552,563,568,576,601,604,610,613,616,622,628,633,644,650,653,656,661,664,670,677,680,700,710,714,717,720,723,726,730,733,736,753,762,766,770,791,795,800,811,815,823,827,841,845,856,860,863,871,874,882,885,893,897,900,921,924,990,993,996,999,1002,1005,1011,1014,1055,1059,1074,1078,1082,1096,1099,1102,1107,1110,1121,1125,1132,1136,1142,1147,1161,1167,1173,1179,1190,1193,1199,1202,1227,1236,1240,1260,1266,1269,1275,1279],[530,531,532],"p",{},"Som traditionen byder lige inden årets udgang, dukker der en ny sårbarhed eller en snedig angrebsvektor op, og forsvarerne står tilbage og forsøger at beskytte deres brugere. Imens kigger andre angribere og red teamere nøje med og tilpasser sig.",[530,534,535],{},"I år opdagede PushSecurity et angreb, som de døbte \"ConsentFix\", en videreudvikling af ClickFix-angrebet, der bygger på, at brugeren selv udleverer en URI til angriberen og dermed i praksis rækker nøglen til hele Entra-kongeriget videre. Den metode, der er set i felten, krævede en manuel copy and paste-handling fra brugeren for at fungere. I løbet af få dage udgav John Hammond en video, der demonstrerede en forbedret udgave af angrebet uden behov for copy and paste, hvor brugeren i stedet blot kunne trække og slippe sin auth code over til angriberen.",[530,537,538],{},"Når vi ser på de tekniske detaljer bag, hvorfor angrebet virker og tilsyneladende omgår device compliance og andre Conditional Access-krav, ender vi i OAuth 2.0 authorization code flow.",[530,540,541],{},[542,543],"img",{"alt":544,"src":545},"OAuth 2.0 authorization code flow","https://res.cloudinary.com/c4a8/image/upload/blog/pics/consentfix-img-01.png",[530,547,548],{},"Angriberen laver en Microsoft Entra login-URI, der peger på klienten \"Microsoft Azure CLI\" og ressourcen \"Azure Resource Manager\", og åbner denne URI, når brugeren besøger det ondsindede website.",[530,550,551],{},"Oversat til authorization code flow svarer det til det første trin, som en native public app som Azure CLI normalt ville kalde for at autentificere brugeren. Applikationen opretter en listener på den maskine, den kører på, på en tilfældig høj port. Denne port bruges som en såkaldt reply URI.",[530,553,554,555,562],{},"Du kan nemt reproducere det selv, for eksempel med ",[556,557,561],"a",{"href":558,"rel":559},"https://github.com/f-bader/TokenTacticsV2",[560],"nofollow","TokenTacticsV2"," eller ved at bygge URI'en manuelt.",[530,564,565],{},[542,566],{"alt":561,"src":567},"https://res.cloudinary.com/c4a8/image/upload/blog/pics/consentfix-img-02.png",[530,569,570,571,575],{},"Efter brugeren har logget ind i Entra ID, bliver brugeren omdirigeret til reply-URI'en, f.eks. ",[556,572,573],{"href":573,"rel":574},"http://localhost:3001",[560],". I et normalt scenarie ville Azure CLI nu tage imod kaldet til denne URI og modtage de vigtige og kritiske oplysninger, der er en del af redirectet:",[577,578,579,593],"ul",{},[580,581,582,586,589,590,592],"li",{},[583,584,585],"strong",{},"code",[587,588],"br",{},"\nDette er authorization_code, som applikationen bruger til at anmode om et bearer token, der består af access token, ID token og eventuelt refresh token.",[587,591],{},"\nIfølge dokumentationen er denne code gyldig i omkring 10 minutter og skal indløses inden for dette tidsrum.",[580,594,595,598,600],{},[583,596,597],{},"state",[587,599],{},"\nDette er en valgfri parameter, og applikationen bør verificere, om den er identisk i request og response.",[530,602,603],{},"I angrebsscenariet bliver brugeren også omdirigeret, men da der ikke kører nogen applikation på localhost, løber browseren ind i en fejl.",[530,605,606],{},[542,607],{"alt":608,"src":609},"Browseren løber ind i en fejl","https://res.cloudinary.com/c4a8/image/upload/blog/pics/consentfix-img-03.png",[530,611,612],{},"URI'en indeholder dog stadig de følsomme oplysninger, og det er præcis dem, angriberen vil have brugeren til at udlevere. Hvis brugeren gør det, indløser angriberen tokenmaterialet og kan derefter bruge access token og refresh token til at tilgå ressourcen, i dette tilfælde Azure Resource Manager.",[530,614,615],{},"På dette skærmbillede kan du se, hvordan man henter bearer token ved hjælp af den URI, brugeren har udleveret.",[530,617,618],{},[542,619],{"alt":620,"src":621},"Bearer token ved hjælp af den URI, brugeren har udleveret","https://res.cloudinary.com/c4a8/image/upload/blog/pics/consentfix-img-04.png",[623,624,625],"blockquote",{},[530,626,627],{},"Hvis du vil teste dine detektioner, så sørg for at udføre det sidste trin fra et andet system på et andet netværk.",[629,630,632],"h2",{"id":631},"detektionsartefakter","Detektionsartefakter",[530,634,635,636,639,640,643],{},"Når du reproducerer angrebet og tjekker ",[585,637,638],{},"SigninLogs"," og ",[585,641,642],{},"AADNonInteractiveUserSignInLogs",", vil du se to hændelser for denne ene sign-in-aktivitet. Den første hændelse repræsenterer det egentlige brugerlogin, mens den anden stammer fra angriberens infrastruktur.",[530,645,646],{},[542,647],{"alt":648,"src":649},"Activity Log","https://res.cloudinary.com/c4a8/image/upload/blog/pics/consentfix-img-05.png",[530,651,652],{},"Den store forskel er, at den første hændelse er et interaktivt sign-in, mens den anden er ikke-interaktiv. Det svarer til de to faser i authentication flowet: først brugeren, derefter applikationen eller i vores tilfælde angriberen.",[530,654,655],{},"Normal adfærd for Azure CLI ville være, at begge sign-in-hændelser stammer fra den samme IP-adresse. I vores tilfælde er IP-adresserne forskellige, og de stammer fra forskellige lande. Sidstnævnte er naturligvis ikke en pålidelig indikator, da angriberen kunne opholde sig i det samme land som offeret for at skjule sine spor.",[657,658,660],"h3",{"id":659},"missing-link","Missing link",[530,662,663],{},"Da vi ledte efter en god måde at koble de to hændelser sammen på, var den første naturlige idé at kigge på Unique Token Identifier (UTI). Microsoft bruger dog forskellige værdier for authorization code UTI og bearer token UTI, så den tilgang fungerer ikke som en pålidelig kobling.",[530,665,666],{},[542,667],{"alt":668,"src":669},"Unique Token Identifier","https://res.cloudinary.com/c4a8/image/upload/blog/pics/consentfix-img-06.png",[530,671,672,673,676],{},"Til gengæld er ",[585,674,675],{},"SessionId"," en god kobling mellem de to, om end det er et langtlevende ID, der kan indeholde flere af disse hændelseskombinationer, også legitime.",[530,678,679],{},"Med den ekstra viden om begrænsningerne i auth code flowet samt bruger-id og applikations-id som yderligere koblinger kan du bruge tid som en vigtig detektionsfaktor:",[577,681,682,685,688,691,694,697],{},[580,683,684],{},"Begge hændelser deler det samme SessionId",[580,686,687],{},"Begge hændelser deler det samme ApplicationId",[580,689,690],{},"Begge hændelser deler det samme UserId",[580,692,693],{},"Den anden hændelse skal ligge efter den første hændelse",[580,695,696],{},"Den anden hændelse skal ligge inden for et vindue på cirka 10 minutter efter den første hændelse. Du bør ikke bruge præcis 10 minutter, da Microsoft skriver \"[...] they expire after about 10 minutes\"",[580,698,699],{},"Du bør kun se på den allerførste efterfølgende hændelse, ikke på de senere",[623,701,702],{},[530,703,704,707,709],{},[583,705,706],{},"Fun fact",[587,708],{},"\nResourceIdentity er ikke en god kobling, da angriberen kan skifte ressource, fordi den ikke er bundet til auth code. Det målrettede applikations-id kan ikke ændres.",[629,711,713],{"id":712},"reducer-støjen","Reducer støjen",[530,715,716],{},"Denne viden gav os allerede en velfungerende detektion, men der var også benign positives i blandingen. Moderne udviklere bruger cloudressourcer, der fremstår som lokale instanser, men resulterer i uregelmæssige loginmønstre i loggene.",[530,718,719],{},"Den afgørende forskel er tidskomponenten. Hvor angrebet kræver brugerinteraktion i form af copy and paste eller drag and drop af URI'en, er det GitHub Codespace-scenarie, vi identificerede som kilden til de benigne alarmer, fuldt automatiseret og indløser auth code inden for få sekunder.",[530,721,722],{},"At filtrere alt fra, der gennemfører denne authentication-dans på få sekunder, kan altså med stor sandsynlighed fjernes som benignt.",[530,724,725],{},"En anden kilde til støj kan være skiftende egress-punkter for din internettrafik, især i SD-WAN-, ZTNA- eller Secure Web Gateway-scenarier.",[629,727,729],{"id":728},"berørte-first-party-applikationer","Berørte first-party-applikationer",[530,731,732],{},"Selvom den oprindelige rapport peger på \"Microsoft Azure CLI\" som den misbrugte applikation, findes der en lang række forskellige Microsoft first-party-apps med pre-consent i hver eneste tenant, som tilbyder localhost som redirect. Og det er ikke kun dem, der er et mål. Angriberen kunne også misbruge test- og dev-reply-URL'er, der ikke kan slås op offentligt.",[530,734,735],{},"Her er en liste over de mest bemærkelsesværdige applikationer, som samtidig har høje pre-consentede permissions på ressourcer.",[577,737,738,741,744,747,750],{},[580,739,740],{},"Microsoft Azure CLI (04b07795-8ddb-461a-bbee-02f9e1bf7b46)",[580,742,743],{},"Microsoft Azure PowerShell (1950a258-227b-4e31-a9cf-717495945fc2)",[580,745,746],{},"Visual Studio (04f0c124-f2bc-4f59-8241-bf6df9866bbd)",[580,748,749],{},"Visual Studio Code (aebc6443-996d-45c2-90f0-388ff96faa56)",[580,751,752],{},"MS Teams PowerShell Cmdlets (12128f48-ec9e-42f0-b203-ea49fb6af367)",[530,754,755,756,761],{},"En komplet liste over disse apps er nu inkluderet i ",[556,757,760],{"href":758,"rel":759},"https://entrascopes.com/?authcodeFix=true",[560],"EntraScopes.com"," af vores kollega Fabian Bader.",[629,763,765],{"id":764},"mitigering-og-beskyttelse","Mitigering og beskyttelse",[657,767,769],{"id":768},"begræns-angrebsfladen-og-målgruppen","Begræns angrebsfladen og målgruppen",[771,772,775,778,779,781,784,785,787,790],"div",{"className":773},[774],"option-block",[583,776,777],{},"Implementeringsindsats:"," Lav til høj (afhænger af indsatsen for at identificere legitime brugere)",[587,780],{},[583,782,783],{},"Mitigering:"," Middel (reducerer den potentielle målgruppe for angrebet)",[587,786],{},[583,788,789],{},"Omfang:"," begrænset\n",[657,792,794],{"id":793},"mulighed-1-kræv-user-assignment","Mulighed 1: Kræv User Assignment",[796,797,799],"h4",{"id":798},"forudsætninger","Forudsætninger:",[577,801,802,805,808],{},[580,803,804],{},"Tilføj service principal for de berørte first-party-apps via Microsoft Graph API eller PowerShell",[580,806,807],{},"Anvend kravet om user assignment på service principal-objektet via Microsoft Graph API eller PowerShell",[580,809,810],{},"Etablér en proces til at tildele brugere efter anmodning via Access Packages, PIM-for-Groups (til just-in-time-adgang) eller en kombination af begge.",[812,813,814],"style",{},"\n.code-block {\n  background-color: #f6f8fa;\n  padding: 0 16px 16px 16px;\n  border-radius: 6px;\n  font-family: Menlo, Consolas, Monaco, \"Courier New\", monospace;\n  font-size: 14px;\n  line-height: 1.5;\n  overflow-x: auto;\n  white-space: pre;\n  border: 1px solid #d0d7de;\n}\n",[816,817,820],"pre",{"className":818},[819],"code-block",[585,821,822],{},"\n// Example for Microsoft Graph PowerShell\nConnect-MgGraph -Identity\n$AppId = \"04b07795-8ddb-461a-bbee-02f9e1bf7b46\" // Microsoft Azure CLI\n$sp = Get-MgServicePrincipal -Filter \"appId eq '$AppId'\"\nUpdate-MgServicePrincipal -ServicePrincipalId $sp.Id -AppRoleAssignmentRequired:$false\n",[796,824,826],{"id":825},"fordel","Fordel:",[577,828,829,832,835,838],{},[580,830,831],{},"Gør det muligt at styre user assignments via Access Packages eller manuelt gruppemedlemskab og dermed begrænse eksponeringen for denne angrebsteknik.",[580,833,834],{},"Mulighed for just-in-time-adgang kombineret med eligible gruppemedlemskab, hvilket giver midlertidig adgang til CLI-værktøjer og yderligere reducerer angrebsfladen.",[580,836,837],{},"Anvendes, før Conditional Access-politikker evalueres.",[580,839,840],{},"Begrænser også angrebsfladen i andre scenarier.",[796,842,844],{"id":843},"ulempe","Ulempe:",[577,846,847,850,853],{},[580,848,849],{},"Kan kun scopes til bestemte brugere og ikke kombineres med andre krav som brug af bestemte enheder",[580,851,852],{},"Alle legitime brugere af CLI-værktøjer skal identificeres",[580,854,855],{},"Sideeffekter og organisatorisk påvirkning skal vurderes grundigt ved at gennemgå tidligere sign-ins.",[657,857,859],{"id":858},"mulighed-2-blokér-adgang-med-conditional-access-politikker","Mulighed 2: Blokér adgang med Conditional Access-politikker",[796,861,799],{"id":862},"forudsætninger-1",[577,864,865,868],{},[580,866,867],{},"Opret en Conditional Access-politik, der blokerer adgang til CLI-værktøjer med undtagelse af legitime brugere, ved at målrette mod \"Microsoft Graph Command Line Tools\" og \"Windows Azure Service Management API\"",[580,869,870],{},"Håndtér undtagelser via gruppemedlemskab, enten manuelt eller gennem entitlement management (f.eks. Access Packages).",[796,872,826],{"id":873},"fordel-1",[577,875,876,879],{},[580,877,878],{},"Forhindrer tokenudstedelse til ikke-legitime eller ikke-privilegerede brugere.",[580,880,881],{},"Giver mulighed for granulær scoping ud fra yderligere betingelser som enhed eller netværk.",[796,883,844],{"id":884},"ulempe-1",[577,886,887,890],{},[580,888,889],{},"Alle legitime brugere af CLI-værktøjer skal identificeres og undtages.",[580,891,892],{},"Sideeffekter og organisatorisk påvirkning skal vurderes grundigt ved at gennemgå tidligere sign-ins og evaluere politikken i report-only-tilstand.",[657,894,896],{"id":895},"blokér-tokenudstedelse-via-authorization-code-flow","Blokér tokenudstedelse via authorization code flow",[812,898,899],{},"\n.option-block {\n  background-color: #f6f8fa;\n  padding: 16px;\n  margin-bottom:2rem;\n  border-radius: 6px;\n  overflow-x: auto;\n  border: 1px solid #d0d7de;\n}\n",[771,901,903,906,907,909,911,912,914,911,916,918,920],{"className":902},[774],[583,904,905],{},"Mulighed:"," Kræv Token Protection",[587,908],{},[583,910,777],{}," Høj",[587,913],{},[583,915,783],{},[587,917],{},[583,919,789],{}," Meget begrænset\n",[796,922,799],{"id":923},"forudsætninger-2",[577,925,926,929,932,952],{},[580,927,928],{},"Microsoft Entra ID P1-licenser",[580,930,931],{},"Entra ID Registered Devices, hybrid- eller Entra ID-joinede enheder på Windows-platformen",[580,933,934,935,940,941,639,946,951],{},"Aktivér Web Account Manager (WAM) i ",[556,936,939],{"href":937,"rel":938},"https://learn.microsoft.com/en-us/cli/azure/authenticate-azure-cli-interactively?view=azure-cli-latest#sign-in-with-web-account-manager-wam-on-windows",[560],"Azure CLI",", ",[556,942,945],{"href":943,"rel":944},"https://learn.microsoft.com/en-us/powershell/azure/configure-global-settings?view=azps-15.1.0#web-account-manager-wam",[560],"Azure PowerShell",[556,947,950],{"href":948,"rel":949},"https://learn.microsoft.com/en-us/powershell/module/microsoft.graph.authentication/set-mggraphoption?view=graph-powershell-1.0#set-web-account-manager-support",[560],"Microsoft Graph PowerShell"," (standard i de nyeste versioner)",[580,953,954,955],{},"Konfigurér Conditional Access-målretning:\n",[577,956,957,971,979],{},[580,958,959,960],{},"Cloud App-målretning mod følgende apps:\n",[577,961,962,965,968],{},[580,963,964],{},"Office 365 Exchange Online",[580,966,967],{},"Office 365 SharePoint Online",[580,969,970],{},"Microsoft Teams Services",[580,972,973,974,978],{},"Client apps under ",[975,976,977],"em",{},"Mobile apps and desktop clients"," skal kræve Token Protection.",[580,980,981,982,985,986,989],{},"Vælg ",[975,983,984],{},"Windows"," som ",[975,987,988],{},"device platform"," for målretning af politikken",[796,991,826],{"id":992},"fordel-2",[530,994,995],{},"Microsoft Entras token protection kræver proof‑of‑possession (PoP), som kun kan håndhæves, når klienten kommunikerer direkte med en betroet token broker som Web Account Manager (WAM) på Windows. Fordi browsere ikke kan etablere denne sikre kanal, blokeres et authorization code flow, der er startet i en browser, under token protection-politikker.",[530,997,998],{},"Når politikken håndhæver token protection med krav om broker‑styret PoP, kan den authorization code, der returneres til en browser, ikke indløses, fordi browseren ikke kan producere det påkrævede broker‑signerede bevis under udvekslingen fra code til token",[530,1000,1001],{},"I dette tilfælde er angreb med AuthCodeFix fuldt mitigeret, så længe applikationen kan beskyttes med Token Protection.",[530,1003,1004],{},"Som vist på skærmbilledet nedenfor mitigerer Token Protection med succes indløsningen af det authorization code flow, som offeret har startet via en phishing-handling.",[530,1006,1007],{},[542,1008],{"alt":1009,"src":1010},"Token Protection mitigerer med succes indløsningen af authorization code flowet","https://res.cloudinary.com/c4a8/image/upload/blog/pics/consentfix-img-07.png",[796,1012,844],{"id":1013},"ulempe-2",[577,1015,1016,1046,1049,1052],{},[580,1017,1018,1019],{},"Kun følgende ressourcer er officielt understøttet:\n",[577,1020,1021,1023,1025],{},[580,1022,964],{},[580,1024,967],{},[580,1026,970,1027,1029,1031,1032,639,1035,1039,1040,1045],{},[587,1028],{},[587,1030],{},"\nMicrosoft Graph API er indirekte dækket af de ovennævnte ressourcer, og Microsoft Graph PowerShell er anført som en understøttet klient. Vi kunne i vores test verificere, at angrebet i dette scenarie bliver mitigeret. “Windows Azure Service Management API\" er ikke anført som en understøttet ressource. Begge CLI-klienter (",[556,1033,939],{"href":937,"rel":1034},[560],[556,1036,945],{"href":1037,"rel":1038},"https://learn.microsoft.com/en-us/powershell/azure/authenticate-interactive?view=azps-15.1.0#benefits-of-wam",[560],") understøtter WAM, som er et krav på klientsiden for at kunne bruge Token Protection. Microsoft har ",[556,1041,1044],{"href":1042,"rel":1043},"https://techcommunity.microsoft.com/blog/microsoft-entra-blog/how-to-break-the-token-theft-cyber-attack-chain/4062700",[560],"i et blogindlæg"," annonceret en udvidelse af token protection-funktionaliteten til Azure-managementscenarier.",[580,1047,1048],{},"Nogle fejl i Microsoft Graph PowerShell tvinger dig til midlertidigt at deaktivere WAM-integrationen",[580,1050,1051],{},"Sideeffekter og organisatorisk påvirkning skal vurderes grundigt ved at gennemgå tidligere sign-ins og evaluere politikken i report-only-tilstand. Cloud app-målretningen vil også påvirke den produktive adgang til Microsoft 365.",[580,1053,1054],{},"Begrænset omfang på grund af tilgængeligheden på understøttede platforme og Entra ID-integrerede enheder.",[657,1056,1058],{"id":1057},"blokér-yderligere-tokenudstedelse-via-compliant-network-check-eller-trusted-network","Blokér yderligere tokenudstedelse via compliant network check eller trusted network",[771,1060,1062,1064,1065,1067,1064,1069,1071,1073],{"className":1061},[774],[583,1063,777],{}," Middel",[587,1066],{},[583,1068,783],{},[587,1070],{},[583,1072,789],{}," Bredt\n",[657,1075,1077],{"id":1076},"mulighed-blokér-adgang-uden-for-compliant-network-med-global-secure-access","Mulighed: Blokér adgang uden for Compliant network med Global Secure Access",[796,1079,1081],{"id":1080},"forudsætning","Forudsætning:",[577,1083,1084,1087,1090,1093],{},[580,1085,1086],{},"Entra ID P1-licens",[580,1088,1089],{},"Entra ID Registered Devices, hybrid- eller Entra ID-joinede enheder på Windows-, macOS-, Android- og iOS-platformen",[580,1091,1092],{},"Global Secure Access Client på alle berørte klienter og aktiveret Entra Internet Access for M365 Traffic Profile",[580,1094,1095],{},"Conditional Access-politik til at håndhæve network compliant check bør anvendes på alle cloud apps",[796,1097,826],{"id":1098},"fordel-3",[530,1100,1101],{},"Blokér yderligere tokenudstedelse ved at håndhæve en trusted network check. Denne mitigering sikrer, at angribere ikke kan hente nye tokens med refresh token fra authorization code flowet. Den forhindrer dog ikke den indledende indløsning af authorization code eller udstedelsen af det første access token, som forbliver gyldigt uden for det compliant netværk, fordi det oprindeligt blev anmodet af offeret.",[623,1103,1104],{},[530,1105,1106],{},"At håndhæve GSA med Compliant Network-betingelsen blokerer også andre Token Replay-scenarier og tilføjer yderligere logs, som kan være meget nyttige til detektioner og hunting.",[796,1108,844],{"id":1109},"ulempe-3",[577,1111,1112,1115,1118],{},[580,1113,1114],{},"Kun anvendeligt for brugere og enheder med udrullet Global Secure Access-klient",[580,1116,1117],{},"Begrænset omfang på grund af tilgængeligheden på Entra ID-integrerede enheder",[580,1119,1120],{},"Håndhævelse af Compliant Networks via CA kræver nogle undtagelser som Intune for at undgå hønen-og-ægget-problemer. Grundig test er nødvendig før udrulning",[629,1122,1124],{"id":1123},"hunting-forespørgsler","Hunting-forespørgsler",[530,1126,1127,1128,1131],{},"Når alle forudsætninger for mitigering af tokentyveri er på plads, herunder udrulning af GSA-klienten (inklusive ingestion af ",[585,1129,1130],{},"NetworkAccessTraffic","-logs) og udnyttelse af WAM-authentication, får vi yderligere muligheder for threat hunting og verifikation.",[657,1133,1135],{"id":1134},"brug-af-gsa-logs-og-wam-authentication-til-hunting-eller-til-at-verificere-konfidensen-i-detektionsresultater","Brug af GSA-logs og WAM-authentication til hunting eller til at verificere konfidensen i detektionsresultater",[530,1137,1138,1139,1141],{},"Denne hunting-forespørgsel bruger ",[585,1140,1130],{},"-logs fra Global Secure Access (GSA), som indeholder den initierende proces for kommunikationen med Microsoft Entras token endpoint. Det hjælper med at afgøre, om en tokenanmodning kom direkte fra en browser, og om der blev foretaget yderligere tokenanmodninger uden for GSA-netværket.",[623,1143,1144],{},[530,1145,1146],{},"Denne forespørgsel virker og leverer kun pålidelige resultater, når forudsætningerne er opfyldt. Ellers fører den til en høj false-positive-rate.",[530,1148,1149,1152,1153,1156,1157,1160],{},[583,1150,1151],{},"Hvorfor det betyder noget:"," Når man logger ind via CLI eller PowerShell-moduler med Web Account Manager (WAM) på Windows-enheder, involverer flowet ikke en browserbaseret authorization code. Denne sign-in-adfærd er standard i den nyeste version. Hvis den initierende proces er en browser-eksekverbar (f.eks. ",[585,1154,1155],{},"msedge.exe","), er det derfor en stærk indikator på mistænkelig aktivitet. På macOS initieres processen af Company Portal-appen (",[585,1158,1159],{},"com.microsoft.CompanyPortalMac.ssoextension","), når Platform SSO anvendes.",[530,1162,1163,1166],{},[583,1164,1165],{},"Token Binding og PoP:"," WAM-authentication binder typisk tokens til enheden ved at håndhæve Proof-of-Possession (PoP). Angribere kan ikke udstede yderligere bundne tokens uden PoP, så et ubundet refresh token er endnu en stærk indikator.",[530,1168,1169,1172],{},[583,1170,1171],{},"Begrænsninger:"," Alle de nævnte signaler er kun tilgængelige, når den tilgående enhed er registreret hos eller joinet til Microsoft Entra ID.",[530,1174,1175,1178],{},[583,1176,1177],{},"Logikken bag confidence score:"," Forespørgslen kombinerer flere signaler til at beregne en confidence score:",[577,1180,1181,1184,1187],{},[580,1182,1183],{},"Tilstedeværelsen af en browserproces, der initierer tokenanmodninger.",[580,1185,1186],{},"Detektion af og nedgradering til ubundne tokens.",[580,1188,1189],{},"Skift af netværksudbyder (inklusive fra compliant til non-compliant) mellem sign-ins.",[530,1191,1192],{},"Disse signaler kan bruges i forespørgslen til at hunte efter aktivitet eller til at udlede en confidence score i tilfælde af en hændelse på baggrund af den forudgående detektion.",[530,1194,1195],{},[542,1196],{"alt":1197,"src":1198},"Signaler til hunting-forespørgslen","https://res.cloudinary.com/c4a8/image/upload/blog/pics/consentfix-img-08.png",[530,1200,1201],{},"Følgende scoring vises afhængigt af betingelserne:",[530,1203,1204,1207,1208,1210,1211,1213,1215,1218,1219,1221,1223,1226],{},[583,1205,1206],{},"En meget høj confidence score"," vises, når ",[585,1209,1130],{},"-logs peger på en kendt browserproces som initiator af en tokenanmodning, og der er registreret en nedgradering til et ubundet token.",[587,1212],{},[587,1214],{},[583,1216,1217],{},"En høj confidence score"," vises, når login sker fra en anden netværksudbyder (ASN) og et non-compliant netværk med ubundne tokens involveret.",[587,1220],{},[587,1222],{},[583,1224,1225],{},"En middel confidence score"," vises, når der kun konstateres et skift af netværksudbyder og et compliant netværk sammen med et skift i den anvendte tokentype.",[530,1228,1229,1230,1235],{},"Du finder den nyeste version af hunting-forespørgslen på ",[556,1231,1234],{"href":1232,"rel":1233},"https://github.com/Cloud-Architekt/AzureSentinel/blob/main/Hunting%20Queries/EID-Authentication/ConsentFix-HuntingConfidenceOnTokenAndNetworkSignals.kusto",[560],"GitHub",".",[657,1237,1239],{"id":1238},"hunting-efter-aktiviteter-med-udstedte-tokens","Hunting efter aktiviteter med udstedte tokens",[530,1241,1242,1243,1248,1249,1252,1253,1255,1256,1259],{},"Du bør overveje at udvide din undersøgelse ud over sign-in-hændelser, så den også omfatter aktiviteter udført med tokens udstedt af angriberen. Vores kollega Thomas Naunheim har ",[556,1244,1247],{"href":1245,"rel":1246},"https://github.com/Cloud-Architekt/AzureSentinel/blob/main/Hunting%20Queries/EID-TokenHunting/MicrosoftCloudActivity.func",[560],"offentliggjort en KQL-funktion"," ved navn ",[585,1250,1251],{},"MicrosoftCloudActivity",", som kan hjælpe i denne udvidede hunting-proces. Derudover kan det berørte ",[585,1254,675],{}," korreleres med mistænkelige ",[585,1257,1258],{},"UniqueId","-værdier fundet under tidligere hunts til en dybere analyse.",[530,1261,1262],{},[542,1263],{"alt":1264,"src":1265},"KQL-funktion","https://res.cloudinary.com/c4a8/image/upload/blog/pics/consentfix-img-09.png",[530,1267,1268],{},"I dette eksempel brugte angriberen det refresh token, der blev opnået under angrebet, til at udstede et access token til Microsoft Graph API. Dette token blev derefter brugt til at opretholde vedvarende adgang og lateral movement ved at tilføje en client secret til en applikation ejet af offeret. Forespørgslen giver detaljer om Graph API-operationen, herunder token protection-status og om operationen fandt sted uden for Global Secure Access-netværket.",[530,1270,1271],{},[542,1272],{"alt":1273,"src":1274},"Skærmbillede af Graph API-operation","https://res.cloudinary.com/c4a8/image/upload/blog/pics/consentfix-img-10.png",[629,1276,1278],{"id":1277},"yderligere-læsning","Yderligere læsning",[577,1280,1281,1288,1295,1302],{},[580,1282,1283],{},[556,1284,1287],{"href":1285,"rel":1286},"https://pushsecurity.com/blog/consentfix",[560],"ConsentFix: Analysing a browser-native ClickFix-style attack that hijacks OAuth consent grants - PushSecurity",[580,1289,1290],{},[556,1291,1294],{"href":1292,"rel":1293},"https://youtu.be/AAiiIY-Soak",[560],"Hacking Endpoint to Identity (Microsoft 365): \"ConsentFix\" - YouTube",[580,1296,1297],{},[556,1298,1301],{"href":1299,"rel":1300},"https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-auth-code-flow",[560],"Microsoft identity platform and OAuth 2.0 authorization code flow",[580,1303,1304],{},[556,1305,1308],{"href":1306,"rel":1307},"https://entrascopes.com/?appId=04b07795-8ddb-461a-bbee-02f9e1bf7b46",[560],"Microsoft Azure CLI on entrascpes.com",{"title":1310,"searchDepth":1311,"depth":1311,"links":1312},"",2,[1313,1317,1318,1319,1327,1331],{"id":631,"depth":1311,"text":632,"children":1314},[1315],{"id":659,"depth":1316,"text":660},3,{"id":712,"depth":1311,"text":713},{"id":728,"depth":1311,"text":729},{"id":764,"depth":1311,"text":765,"children":1320},[1321,1322,1323,1324,1325,1326],{"id":768,"depth":1316,"text":769},{"id":793,"depth":1316,"text":794},{"id":858,"depth":1316,"text":859},{"id":895,"depth":1316,"text":896},{"id":1057,"depth":1316,"text":1058},{"id":1076,"depth":1316,"text":1077},{"id":1123,"depth":1311,"text":1124,"children":1328},[1329,1330],{"id":1134,"depth":1316,"text":1135},{"id":1238,"depth":1316,"text":1239},{"id":1277,"depth":1311,"text":1278},"md","post",{"lang":1335,"seoTitle":1336,"titleClass":1337,"date":1338,"categories":1339,"blogtitlepic":1341,"socialimg":1342,"customExcerpt":1343,"keywords":1344,"scripts":1345,"asideNav":1346,"maxContent":325,"published":325},"da","ConsentFix: Hvordan et nyt OAuth-angreb omgår Microsoft Entra Conditional Access","h2-font-size","2025-12-31",[1340],"Security","head-consentfix","/blog/heads/head-consentfix.jpg","Lige inden årsskiftet dukker ConsentFix op: et snedigt OAuth-baseret angreb, der misbruger legitime authentication flows til at stjæle authorization code og dermed reelt udleverer nøglerne til Microsoft Entra. Vi gennemgår, hvorfor det virker på trods af Conditional Access, hvilke signaler det efterlader i loggene, og hvordan forsvarere kan opdage og stoppe det, før der sker rigtig skade.","ConsentFix-angreb, tyveri af OAuth authorization code, Microsoft Entra OAuth-angreb, misbrug af Azure CLI-tokens, omgåelse af Entra ID Conditional Access, phishing med authorization code, token replay-angreb i Azure, Proof of Possession-tokens, sikkerhed ved WAM-authentication, analyse af Azure sign-in-logs, opdag OAuth-angreb i Entra, threat hunting på Azure-identiteter, Global Secure Access token protection, Microsoft Entra sikkerhedsdetektion",{"slick":325,"form":325},{"menuItems":1347},[1348,1350,1352,1354,1356,1358],{"href":1349,"text":632},"#detektionsartefakter",{"href":1351,"text":713},"#reducer-støjen",{"href":1353,"text":729},"#berørte-first-party-applikationer",{"href":1355,"text":765},"#mitigering-og-beskyttelse",{"href":1357,"text":1124},"#hunting-forespørgsler",{"href":1359,"text":1278},"#yderligere-læsning","/posts/2025-12-31-vulnerability-consentfix",{"title":521,"description":532},"posts/2025-12-31-vulnerability-consentfix",[1364,1365,281],"OAuth 2.0","Microsoft Entra ID","6omVtOefKkJLAXT9rlO0BqA1RKB4dnIm_iRygxuwOGk",{"id":1368,"extension":1369,"meta":1370,"stem":8,"__hash__":1717},"authors_data/authors.json","json",{"path":1371,"Fritz Zurhorst":1372,"Alexander Schlindwein":1378,"Sophie Luna":1384,"Nadine Klein":1392,"Karsten Kleinschmidt":1398,"Julian Wendt":1406,"Holger Bunkradt":1411,"Ralf Mania":1417,"Oliver Kieselbach":1423,"Steffen Schwerdtfeger":1429,"Gunnar Winter":1437,"Jan Petersen":1442,"Thorsten Kunzi":1447,"Moritz Pohl":1451,"Thorben Pöschus":1456,"Christoph Hannebauer":1462,"Marco Scheel":1466,"Christopher Brumm":1471,"Florian Klante":1477,"Niklas Bachmann":1482,"Nils Krautkrämer":1487,"Patrick Treptau":1493,"Peter Beckendorf":1498,"Patrick Sobau":1503,"Jörg Wunderlich":1508,"Michael Breither":1512,"Christian Kanja":1517,"Zeba Hoffmann":1523,"Jochen Fröhlich":1528,"Jan Geisbauer":1532,"Gerrit Reinke":1543,"Christian Kordel":1549,"Stephan Wälde":1553,"Carolin Kanja":1558,"Adrian Ritter":1564,"Marvin Bangert":1569,"Thorsten Pickhan":1575,"Christian Lorenz":1581,"Denis Böhm":1586,"Fabian Bader":1591,"Juan Jose Fernandez Perez":1596,"Mahschid Sayyar":1601,"Benjamin Dassow":1606,"Markus Walschburger":1611,"Jonathan Haist":1616,"Daniel Rohregger":1621,"Thomas Naunheim":1626,"Florian Stöckl":1630,"Pascal Asch":1635,"Markus Kättner":1640,"Anna Ulbricht":1647,"Annette Brauns":1654,"body":1660,"title":1716},"/authors",{"display_name":1373,"avatar":1374,"permalink":1375,"linkedin":1376,"imageOffsetTop":1377},"Fritz Zurhorst","people/people-fritz-zurhorst.png","/authors/fritz-zurhorst","friedemann-z","72%",{"display_name":1379,"avatar":1380,"permalink":1381,"twitter":1382,"linkedin":1383},"Alexander Schlindwein","people/people-alexander-rudolph.png","/authors/alexander-schlindwein","AlexanderOnIT","schlindwein-alexander",{"display_name":1385,"avatar":1386,"permalink":1387,"twitter":1388,"linkedin":1389,"imageOffsetLeft":1390,"imageOffsetTop":1391},"Sophie Luna","people/people-sophie-luna.jpg","/authors/sophie-luna","glueckkanjagab","../company/glueckkanja-gab","58%","67%",{"display_name":1393,"avatar":1394,"permalink":1395,"twitter":1396,"linkedin":1397,"imageOffsetTop":1377},"Nadine Klein","people/people-nadine-kern.png","/authors/nadine-kern","nadineausRT","nadine-kern",{"display_name":1399,"avatar":1400,"permalink":1401,"twitter":1402,"linkedin":1403,"imageOffsetTop":1404,"imageOffsetLeft":1405},"Karsten Kleinschmidt","/c_pad,w_800,h_700/people/karsten-kleinschmidt.jpg","/authors/karsten-kleinschmidt","KarstenonIT","karstenkleinschmidt","60%","57%",{"display_name":1407,"avatar":1408,"permalink":1409,"linkedin":1410},"Julian Wendt","people/people-julian-wendt.png","/authors/julian-wendt","julian-wendt",{"display_name":1412,"avatar":1413,"permalink":1414,"linkedin":1415,"twitter":1416},"Holger Bunkradt","people/people-holger-bunkradt.png","/authors/holger-bunkradt","holger-bunkradt-12b5053b","hbunkradt",{"display_name":1418,"avatar":1419,"permalink":1420,"linkedin":1421,"twitter":1422},"Ralf Mania","people/people-ralf-mania.png","/authors/ralf-mania","ralf-mania-146a2757","RaMa1976",{"display_name":1424,"avatar":1425,"permalink":1426,"linkedin":1427,"twitter":1428},"Oliver Kieselbach","people/people-oliver-kieselbach.png","/authors/oliver-kieselbach","oliver-kieselbach-a4a3409","okieselbT",{"display_name":1430,"avatar":1431,"permalink":1432,"linkedin":1433,"twitter":1434,"imageOffsetTop":1435,"imageOffsetLeft":1436},"Steffen Schwerdtfeger","people/people-steffen-schwerdtfeger.png","/authors/steffen-schwerdtfeger","steffen-schwerdtfeger","SteffenAtCloud","79%","51%",{"display_name":1438,"avatar":1439,"permalink":1440,"twitter":1388,"linkedin":1441},"Gunnar Winter","people/people-gunnar-winter.jpg","/authors/gunnar-winter","company/glueckkanja-gab",{"display_name":1443,"avatar":1444,"permalink":1445,"twitter":1388,"linkedin":1446},"Jan Petersen","people/jan-petersen.png","/authors/jan-petersen","jan-petersen-26a901",{"display_name":1448,"avatar":1449,"permalink":1450,"twitter":1388,"linkedin":1441,"imageOffsetTop":1377},"Thorsten Kunzi","people/author-thorsten-kunzi.png","/authors/thorsten-kunzi",{"display_name":1452,"avatar":1453,"permalink":1454,"twitter":1388,"linkedin":1455},"Dr. Moritz Pohl","people/people-moritz-pohl.png","/authors/moritz-pohl","dr-moritz-pohl",{"display_name":1457,"avatar":1458,"permalink":1459,"twitter":1460,"linkedin":1461},"Thorben Pöschus","people/thorben.poeschus.png","/authors/thorben-poeschus","TPO901","thorben-pöschus-624693b7",{"display_name":1463,"avatar":1464,"permalink":1465,"twitter":1388,"linkedin":1441,"imageOffsetTop":1377},"Dr. Christoph Hannebauer","people/people-christoph-hannebauer.png","/authors/christoph-hannebauer",{"display_name":1467,"avatar":1468,"permalink":1469,"twitter":1470,"linkedin":1470},"Marco Scheel","people/people-marco-scheel.png","/authors/marco-scheel","marcoscheel",{"display_name":524,"avatar":1472,"permalink":1473,"twitter":1474,"linkedin":1475,"imageOffsetTop":1476},"people/people-christopher-brumm.jpg","/authors/christopher-brumm","cbrhh","christopherbrumm","66%",{"display_name":1478,"avatar":1479,"permalink":1480,"linkedin":1481,"twitter":1388},"Florian Klante","people/florian-klante.jpg","/authors/florian-klante","florian-klante-6031b31b",{"display_name":1483,"avatar":1484,"permalink":1485,"linkedin":1486,"twitter":1388},"Niklas Bachmann","people/niklas.bachmann.png","/authors/niklas-bachmann","niklas-bachmann-66a863158",{"display_name":1488,"avatar":1489,"permalink":1490,"twitter":1491,"linkedin":1492},"Nils Krautkrämer","people/nils-krautkraemer.png","/authors/nils-krautkraemer","KrauNils","nils-krautkrämer-8b04bb250",{"display_name":1494,"avatar":1495,"permalink":1496,"linkedin":1497,"twitter":1388},"Patrick Treptau","people/people-patrick-treptau.png","/authors/patrick-traptau","ptreptau",{"display_name":1499,"avatar":1500,"permalink":1501,"linkedin":1502,"twitter":1388,"imageOffsetTop":1377},"Peter Beckendorf","people/peter-beckendorf.png","/authors/peter-beckendorf","peter-beckendorf-29a239b1",{"display_name":1504,"avatar":1505,"permalink":1506,"linkedin":1507,"twitter":1388},"Patrick Sobau","people/patrick-sobau.png","/authors/patrick-sobau","patrick-sobau",{"display_name":1509,"avatar":1510,"permalink":1511,"twitter":1388},"Jörg Wunderlich","people/joerg-wunderlich.png","/authors/joerg-wunderlich",{"display_name":1513,"avatar":1514,"permalink":1515,"twitter":1388,"linkedin":1516},"Michael Breither","people/people-michael-breither.jpg","/authors/michael-breither","michaelbreither",{"display_name":1518,"avatar":1519,"permalink":1520,"twitter":1521,"linkedin":1522},"Christian Kanja","people/people-christian-kanja.png","/authors/christian-kanja","cekageka","christian-kanja",{"display_name":1524,"avatar":1525,"permalink":1526,"linkedin":1527,"twitter":1388},"Zeba Hoffmann","people/zeba-hoffmann.png","/authors/zeba-hoffmann","zebahoffmann",{"display_name":1529,"avatar":1530,"permalink":1531,"twitter":1388,"linkedin":1441},"Jochen Fröhlich","people/people-jochen-froehlich.png","/authors/jochen-froehlich",{"display_name":1533,"avatar":1534,"permalink":1535,"twitter":1536,"linkedin":1536,"imageOffsetTop":1377,"socials":1537},"Jan Geisbauer","people/people-jan-geisbauer-csoc.png","/authors/jan-geisbauer","JanGeisbauer",[1538,1540],{"text":472,"href":1539},"https://emptydc.com",{"text":1541,"href":1542},"Podcast","https://hairlessinthecloud.com",{"display_name":1544,"avatar":1545,"permalink":1546,"twitter":1547,"linkedin":1548},"Gerrit Reinke","people/gerrit-reinke.png","/authors/gerrit-reinke","GLWRe","glwr",{"display_name":1550,"avatar":1551,"permalink":1552,"twitter":1388,"linkedin":1441},"Christian Kordel","people/christian-kordel.png","/authors/christian-kordel",{"display_name":1554,"avatar":1555,"permalink":1556,"twitter":1557,"linkedin":1441},"Stephan Wälde","people/people-stephan-waelde.png","/authors/stephan-waelde","stephanwaelde",{"display_name":1559,"avatar":1560,"permalink":1561,"twitter":1562,"linkedin":1563},"Carolin Kanja","people/people-carolin-kanja.jpg","/authors/carolin-kanja","fraukanja","carolin-kanja",{"display_name":1565,"avatar":1566,"permalink":1567,"twitter":1568,"linkedin":1568},"Adrian Ritter","people/people-adrian-ritter.png","/authors/adrian-ritter","adrianritter",{"display_name":1570,"avatar":1571,"permalink":1572,"twitter":1573,"linkedin":1574},"Marvin Bangert","people/people-marvin-bangert.png","/authors/marvin-bangert","marvinbangert","marvin-bangert",{"display_name":1576,"avatar":1577,"permalink":1578,"twitter":1579,"linkedin":1580},"Thorsten Pickhan","people/people-thorsten-pickhan.png","/authors/thorsten-pickhan","tpickhan","thorsten-pickhan",{"display_name":1582,"avatar":1583,"permalink":1584,"linkedin":1585,"twitter":1388},"Christian Lorenz","people/people-christian-lorenz.png","/authors/christian-lorenz","christianlorenz95",{"display_name":1587,"avatar":1588,"permalink":1589,"linkedin":1590,"twitter":1388},"Denis Böhm","people/people-denis-boehm.png","/authors/denis-boehm","denis-böhm-3bb834135",{"display_name":523,"avatar":1592,"permalink":1593,"linkedin":1594,"twitter":1595},"people/people-fabian-bader.jpg","/authors/fabian-bader","fabianbader","fabian_bader",{"display_name":1597,"avatar":1598,"permalink":1599,"linkedin":1600},"Juan Jose Fernandez Perez","people/people-juan-jose-fernandez.jpg","/authors/juan-jose-fernandez-perez","juan-jose-fernandez-perez-8016055",{"display_name":1602,"avatar":1603,"permalink":1604,"linkedin":1605},"Mahschid Sayyar","people/people-mahschid-sayyar.jpg","/authors/mahschid-sayyar","mahschid-sayyar-97544463",{"display_name":1607,"avatar":1608,"permalink":1609,"linkedin":1610},"Benjamin Dassow","people/people-benjamin-dassow.jpg","/authors/benjamin-dassow","benjamin-dassow",{"display_name":1612,"avatar":1613,"permalink":1614,"linkedin":1615},"Markus Walschburger","people/people-markus-walschburger.jpg","/authors/markus-walschburger","markus-walschburger",{"display_name":1617,"avatar":1618,"permalink":1619,"linkedin":1620,"imageOffsetTop":1377},"Jonathan Haist","people/people-jonathan-haist.jpg","/authors/jonathan-haist","jonathanhaist",{"display_name":1622,"avatar":1623,"permalink":1624,"linkedin":1625,"imageOffsetTop":1377},"Daniel Rohregger","people/people-daniel-rohregger.jpg","/authors/daniel-rohregger","drohregger",{"display_name":525,"avatar":1627,"permalink":1628,"linkedin":1629,"imageOffsetTop":1476},"people/people-thomas-naunheim.jpg","/authors/thomas-naunheim","thomasnaunheim",{"display_name":1631,"avatar":1632,"permalink":1633,"linkedin":1634,"imageOffsetTop":1476},"Florian Stöckl","people/people-florian-stoeckl.jpg","/authors/florian-stoeckl","florianstoeckl",{"display_name":1636,"avatar":1637,"permalink":1638,"linkedin":1639,"imageOffsetTop":1476},"Pascal Asch","people/Pascal.Asch.648.jpg","/authors/pascal-asch","pascal-asch",{"display_name":1641,"avatar":1642,"permalink":1643,"linkedin":1644,"imageOffsetTop":1645,"imageOffsetLeft":1646},"Markus Kättner","people/markus-kaettner.jpg","/authors/markus-kaettner","markus-kättner-b600119","62%","63%",{"display_name":1648,"avatar":1649,"permalink":1650,"linkedin":1651,"imageOffsetTop":1652,"imageOffsetLeft":1653},"Anna Ulbricht","people/anna-katharina.ulbricht-09.png","/authors/anna-ulbricht","anna-katharina-u-a67702199","70%","50%",{"display_name":1655,"avatar":1656,"permalink":1657,"linkedin":1658,"imageOffsetTop":1659,"imageOffsetLeft":1404},"Annette Brauns","people/Annette-Brauns-8.jpg","/authors/annette-brauns","annette-brauns","95%",{"Fritz Zurhorst":1661,"Alexander Schlindwein":1662,"Sophie Luna":1663,"Nadine Klein":1664,"Karsten Kleinschmidt":1665,"Julian Wendt":1666,"Holger Bunkradt":1667,"Ralf Mania":1668,"Oliver Kieselbach":1669,"Steffen Schwerdtfeger":1670,"Gunnar Winter":1671,"Jan Petersen":1672,"Thorsten Kunzi":1673,"Moritz Pohl":1674,"Thorben Pöschus":1675,"Christoph Hannebauer":1676,"Marco Scheel":1677,"Christopher Brumm":1678,"Florian Klante":1679,"Niklas Bachmann":1680,"Nils Krautkrämer":1681,"Patrick Treptau":1682,"Peter Beckendorf":1683,"Patrick Sobau":1684,"Jörg Wunderlich":1685,"Michael Breither":1686,"Christian Kanja":1687,"Zeba Hoffmann":1688,"Jochen Fröhlich":1689,"Jan Geisbauer":1690,"Gerrit Reinke":1694,"Christian Kordel":1695,"Stephan Wälde":1696,"Carolin Kanja":1697,"Adrian Ritter":1698,"Marvin Bangert":1699,"Thorsten Pickhan":1700,"Christian Lorenz":1701,"Denis Böhm":1702,"Fabian Bader":1703,"Juan Jose Fernandez Perez":1704,"Mahschid Sayyar":1705,"Benjamin Dassow":1706,"Markus Walschburger":1707,"Jonathan Haist":1708,"Daniel Rohregger":1709,"Thomas Naunheim":1710,"Florian Stöckl":1711,"Pascal Asch":1712,"Markus Kättner":1713,"Anna Ulbricht":1714,"Annette Brauns":1715},{"display_name":1373,"avatar":1374,"permalink":1375,"linkedin":1376,"imageOffsetTop":1377},{"display_name":1379,"avatar":1380,"permalink":1381,"twitter":1382,"linkedin":1383},{"display_name":1385,"avatar":1386,"permalink":1387,"twitter":1388,"linkedin":1389,"imageOffsetLeft":1390,"imageOffsetTop":1391},{"display_name":1393,"avatar":1394,"permalink":1395,"twitter":1396,"linkedin":1397,"imageOffsetTop":1377},{"display_name":1399,"avatar":1400,"permalink":1401,"twitter":1402,"linkedin":1403,"imageOffsetTop":1404,"imageOffsetLeft":1405},{"display_name":1407,"avatar":1408,"permalink":1409,"linkedin":1410},{"display_name":1412,"avatar":1413,"permalink":1414,"linkedin":1415,"twitter":1416},{"display_name":1418,"avatar":1419,"permalink":1420,"linkedin":1421,"twitter":1422},{"display_name":1424,"avatar":1425,"permalink":1426,"linkedin":1427,"twitter":1428},{"display_name":1430,"avatar":1431,"permalink":1432,"linkedin":1433,"twitter":1434,"imageOffsetTop":1435,"imageOffsetLeft":1436},{"display_name":1438,"avatar":1439,"permalink":1440,"twitter":1388,"linkedin":1441},{"display_name":1443,"avatar":1444,"permalink":1445,"twitter":1388,"linkedin":1446},{"display_name":1448,"avatar":1449,"permalink":1450,"twitter":1388,"linkedin":1441,"imageOffsetTop":1377},{"display_name":1452,"avatar":1453,"permalink":1454,"twitter":1388,"linkedin":1455},{"display_name":1457,"avatar":1458,"permalink":1459,"twitter":1460,"linkedin":1461},{"display_name":1463,"avatar":1464,"permalink":1465,"twitter":1388,"linkedin":1441,"imageOffsetTop":1377},{"display_name":1467,"avatar":1468,"permalink":1469,"twitter":1470,"linkedin":1470},{"display_name":524,"avatar":1472,"permalink":1473,"twitter":1474,"linkedin":1475,"imageOffsetTop":1476},{"display_name":1478,"avatar":1479,"permalink":1480,"linkedin":1481,"twitter":1388},{"display_name":1483,"avatar":1484,"permalink":1485,"linkedin":1486,"twitter":1388},{"display_name":1488,"avatar":1489,"permalink":1490,"twitter":1491,"linkedin":1492},{"display_name":1494,"avatar":1495,"permalink":1496,"linkedin":1497,"twitter":1388},{"display_name":1499,"avatar":1500,"permalink":1501,"linkedin":1502,"twitter":1388,"imageOffsetTop":1377},{"display_name":1504,"avatar":1505,"permalink":1506,"linkedin":1507,"twitter":1388},{"display_name":1509,"avatar":1510,"permalink":1511,"twitter":1388},{"display_name":1513,"avatar":1514,"permalink":1515,"twitter":1388,"linkedin":1516},{"display_name":1518,"avatar":1519,"permalink":1520,"twitter":1521,"linkedin":1522},{"display_name":1524,"avatar":1525,"permalink":1526,"linkedin":1527,"twitter":1388},{"display_name":1529,"avatar":1530,"permalink":1531,"twitter":1388,"linkedin":1441},{"display_name":1533,"avatar":1534,"permalink":1535,"twitter":1536,"linkedin":1536,"imageOffsetTop":1377,"socials":1691},[1692,1693],{"text":472,"href":1539},{"text":1541,"href":1542},{"display_name":1544,"avatar":1545,"permalink":1546,"twitter":1547,"linkedin":1548},{"display_name":1550,"avatar":1551,"permalink":1552,"twitter":1388,"linkedin":1441},{"display_name":1554,"avatar":1555,"permalink":1556,"twitter":1557,"linkedin":1441},{"display_name":1559,"avatar":1560,"permalink":1561,"twitter":1562,"linkedin":1563},{"display_name":1565,"avatar":1566,"permalink":1567,"twitter":1568,"linkedin":1568},{"display_name":1570,"avatar":1571,"permalink":1572,"twitter":1573,"linkedin":1574},{"display_name":1576,"avatar":1577,"permalink":1578,"twitter":1579,"linkedin":1580},{"display_name":1582,"avatar":1583,"permalink":1584,"linkedin":1585,"twitter":1388},{"display_name":1587,"avatar":1588,"permalink":1589,"linkedin":1590,"twitter":1388},{"display_name":523,"avatar":1592,"permalink":1593,"linkedin":1594,"twitter":1595},{"display_name":1597,"avatar":1598,"permalink":1599,"linkedin":1600},{"display_name":1602,"avatar":1603,"permalink":1604,"linkedin":1605},{"display_name":1607,"avatar":1608,"permalink":1609,"linkedin":1610},{"display_name":1612,"avatar":1613,"permalink":1614,"linkedin":1615},{"display_name":1617,"avatar":1618,"permalink":1619,"linkedin":1620,"imageOffsetTop":1377},{"display_name":1622,"avatar":1623,"permalink":1624,"linkedin":1625,"imageOffsetTop":1377},{"display_name":525,"avatar":1627,"permalink":1628,"linkedin":1629,"imageOffsetTop":1476},{"display_name":1631,"avatar":1632,"permalink":1633,"linkedin":1634,"imageOffsetTop":1476},{"display_name":1636,"avatar":1637,"permalink":1638,"linkedin":1639,"imageOffsetTop":1476},{"display_name":1641,"avatar":1642,"permalink":1643,"linkedin":1644,"imageOffsetTop":1645,"imageOffsetLeft":1646},{"display_name":1648,"avatar":1649,"permalink":1650,"linkedin":1651,"imageOffsetTop":1652,"imageOffsetLeft":1653},{"display_name":1655,"avatar":1656,"permalink":1657,"linkedin":1658,"imageOffsetTop":1659,"imageOffsetLeft":1404},"Authors","1csawlkJxRljy93GTOnXEkwLqAv9Lcj-apxRvoodAOY",{"list":1719,"authors":1934},[1720,1736,1750,1764,1780,1793,1806,1819,1831,1847,1861,1876,1894,1905,1918],{"id":1721,"title":1722,"author":1723,"cta":494,"description":1310,"hideInRecent":484,"layout":1333,"meta":1724,"moment":1729,"path":1730,"stem":1731,"tags":1732,"webcast":484},"content_da/posts/2026-09-22-end-of-mfa-sms.md","Enden på MFA-SMS",[1399],{"lang":1335,"date":1725,"categories":1726,"blogtitlepic":1727,"customExcerpt":1728},"2026-09-21",[1340],"head-conditional-access.jpg","Hvorfor virksomheder nu bør skifte til phishing-resistente og så vidt muligt passwordløse loginmetoder.","2026-09-22","/posts/2026-09-22-end-of-mfa-sms","posts/2026-09-22-end-of-mfa-sms",[1340,1733,1365,1734,1735],"Authentication","MFA","Passkeys",{"id":1737,"title":1738,"author":1739,"cta":494,"description":1310,"hideInRecent":484,"layout":1333,"meta":1740,"moment":1725,"path":1744,"stem":1745,"tags":1746,"webcast":484},"content_da/posts/2026-09-21-clickfix-prevent-detect.md","ClickFix. Når brugeren er exploiten, og hvordan I stopper det",[1373,1393],{"lang":1335,"date":1725,"categories":1741,"blogtitlepic":1742,"customExcerpt":1743},[1340],"head-clickfix.jpg","ClickFix gør brugere til deres egen angriber: et falsk CAPTCHA, en copy-paste, og skadekoden kører i hukommelsen, uden at noget lander på disken. Hvordan Microsoft Defender opdager angrebet, hvor detektionen når sine grænser, og hvordan I lukker hullet med et RunMRU-hunt og fire beskyttelseslag.","/posts/2026-09-21-clickfix-prevent-detect","posts/2026-09-21-clickfix-prevent-detect",[1747,1748,1749],"Defender","SOC","Endpoint Security",{"id":1751,"title":1752,"author":1753,"cta":494,"description":1310,"hideInRecent":484,"layout":1333,"meta":1754,"moment":1725,"path":1758,"stem":1759,"tags":1760,"webcast":484},"content_da/posts/2026-09-21-red-tenant-dark-tenant-cio.md","Admin og hverdag på samme computer? Game Over.",[1533],{"lang":1335,"date":1725,"categories":1755,"blogtitlepic":1756,"customExcerpt":1757},[1340],"head-game-over-en.jpg","Hvorfor én tenant ikke rækker for CIO'er, og hvorfor den anden sjældent bliver tænkt med. Managed Red Tenant adskiller arkitektonisk det administrative arbejde fra kontormiljøet, Managed Dark Tenant holder virksomheden handlekraftig, hvis forsvaret alligevel falder. Hvad det betyder for driftsmodellen, SOC-signalet og dokumentationspligterne efter NISG 2026.","/posts/2026-09-21-red-tenant-dark-tenant-cio","posts/2026-09-21-red-tenant-dark-tenant-cio",[1340,1761,1762,1763],"Privileged Access","Zero Trust","NIS2",{"id":1765,"title":1766,"author":1767,"cta":494,"description":1768,"hideInRecent":484,"layout":1333,"meta":1769,"moment":1770,"path":1775,"stem":1776,"tags":1777,"webcast":484},"content_da/posts/2026-08-08-isg-germany-2026.md","Fire gange Leader. glueckkanja i ISG-undersøgelsen Tyskland 2026",[1559],"ISG har omdøbt sin undersøgelse i år. Microsoft Cloud Ecosystem blev til Microsoft AI and Cloud Ecosystem, og med navnet har målestokken flyttet sig: Det, der vurderes, er ikke længere, hvem der indfører Microsoft-platforme, men hvem der driver Copilot, agenter og AI-workloads kontrollerbart. Den nye målestok har ikke ændret noget ved vores position. ISG Provider Lens®-undersøgelsen Tyskland 2026 positionerer os som Leader i fire kvadranter: Microsoft Productivity and Business Process Services og Azure Managed Services, hver gang i både Large Market og Mid Market. Efter 2021, 2023, 2024 og 2025 er det den femte Leader-placering i Tyskland, i Schweiz kom springet ind i Leader-kvadranten to uger tidligere.",{"lang":1335,"date":1770,"categories":1771,"blogtitlepic":1773,"customExcerpt":1774},"2026-08-08",[1772],"Corporate","head-isg-de-2026.png","ISG Provider Lens®-undersøgelsen 2026 positionerer glueckkanja i Tyskland som Leader i fire kvadranter: Microsoft Productivity and Business Process Services og Azure Managed Services, hver gang i både Large og Mid Market. Undersøgelsen hedder nu Microsoft AI and Cloud Ecosystem, og målestokken har flyttet sig: Det, der vurderes, er, hvem der driver AI- og agent-workloads kontrollerbart.","/posts/2026-08-08-isg-germany-2026","posts/2026-08-08-isg-germany-2026",[1778,1779],"Award","ISG",{"id":1781,"title":1782,"author":1783,"cta":494,"description":1784,"hideInRecent":484,"layout":1333,"meta":1785,"moment":1786,"path":1790,"stem":1791,"tags":1792,"webcast":484},"content_da/posts/2026-07-31-isg-switzerland-2026.md","Fra Rising Star til Leader. glueckkanja i ISG-undersøgelsen Schweiz 2026",[1559],"I 2024 stiftede vi glueckkanja Switzerland AG og flyttede ind i et kontor i zentroom på Bahnhofplatz 10b i Bern. I 2025 placerede ISG os som Rising Star på det schweiziske marked, som den leverandør, analytikerne tror kan tage springet ind i Leader-kvadranten. Nu er springet dokumenteret: ISG Provider Lens®-undersøgelsen 2026 positionerer os i Schweiz som Leader i kvadranten Microsoft AI and Cloud Ecosystem, inden for områderne Azure Managed Services og Microsoft Productivity and Business Process Services.",{"lang":1335,"date":1786,"categories":1787,"blogtitlepic":1788,"customExcerpt":1789},"2026-07-31",[1772],"head-isg-ch-2026.png","ISG Provider Lens®-undersøgelsen 2026 positionerer glueckkanja i Schweiz som Leader i kvadranten Microsoft AI and Cloud Ecosystem, inden for områderne Azure Managed Services og Microsoft Productivity and Business Process Services. To år efter markedsindtrædelsen i Bern, et år efter Rising Star-udmærkelsen.","/posts/2026-07-31-isg-switzerland-2026","posts/2026-07-31-isg-switzerland-2026",[1778,1779],{"id":1794,"title":1795,"author":1796,"cta":494,"description":1310,"hideInRecent":484,"layout":1333,"meta":1797,"moment":1798,"path":1802,"stem":1803,"tags":1804,"webcast":484},"content_da/posts/2026-07-24-outbreak-openai-hugging-face.md","Outbreak. Hvad OpenAI/Hugging-Face-hændelsen afslører, og hvad den ikke gør",[1533],{"lang":1335,"date":1798,"categories":1799,"blogtitlepic":1800,"customExcerpt":1801},"2026-07-24",[1340],"head-outbreak.jpg","En AI-agent bryder ud af sit testmiljø, finder en zero-day og hacker en anden virksomhed. Det lyder som et filmmanuskript, men skete faktisk i juli 2026. Tid til en nøgtern placering: med lidt psykologi, to security-veteraner og spørgsmålet om, hvad det betyder for jeres forsvar.","/posts/2026-07-24-outbreak-openai-hugging-face","posts/2026-07-24-outbreak-openai-hugging-face",[1805,1748,1762],"AI",{"id":1807,"title":1808,"author":1809,"cta":494,"description":1810,"hideInRecent":484,"layout":1333,"meta":1811,"moment":1812,"path":1816,"stem":1817,"tags":1818,"webcast":484},"content_da/posts/2026-07-22-isg-cybersecurity-2026.md","Leader og Rising Star. glueckkanja i ISG's Cybersecurity-undersøgelse 2026",[1559],"Ny i kvadranten og straks Leader: ISG Provider Lens®-undersøgelsen \"Cybersecurity – Services and Solutions 2026\" positionerer glueckkanja som Leader inden for Next-Gen SOC/MDR Services for mellemstore virksomheder i Tyskland. I det samlede marked for Next-Gen SOC/MDR Services udnævner ISG os til Rising Star, altså den leverandør, som analytikerne tror kan tage springet ind i Leader-kvadranten inden for de næste 12 til 24 måneder.",{"lang":1335,"date":1812,"categories":1813,"blogtitlepic":1814,"customExcerpt":1815},"2026-07-22",[1772],"head-isg-cybersecurity-2026.png","ISG Provider Lens®-undersøgelsen Cybersecurity 2026 udnævner glueckkanja til Leader i kvadranten Next-Gen SOC/MDR Services (Midmarket). I det samlede marked for Next-Gen SOC/MDR Services er vi Rising Star. ISG fremhæver vores vækst over gennemsnittet, vores dybe Microsoft-security-ekspertise og et 24/7-SOC drevet fra Tyskland.","/posts/2026-07-22-isg-cybersecurity-2026","posts/2026-07-22-isg-cybersecurity-2026",[1778,1779,1340],{"id":1820,"title":1821,"author":1822,"cta":494,"description":1823,"hideInRecent":484,"layout":1333,"meta":1824,"moment":1825,"path":1828,"stem":1829,"tags":1830,"webcast":484},"content_da/posts/2026-07-06-the-holy-trinity.md","The Holy Trinity: Hvad AI virkelig skal have for at kunne arbejde",[1559],"En produktionsvirksomhed vil vide, hvilke af dens 14.000 SKU'er der faktisk er profitable. Svaret ligger i tre systemer, der aldrig har udvekslet et enkelt datapunkt med hinanden. Indtil for kort tid siden kostede det tre afdelinger, to uger og en del god vilje at få det. Siden begyndelsen af 2026 kan en AI besvare det spørgsmål på minutter: søge data igennem, skabe sammenhænge, producere en anbefaling. Forudsat at den har adgang.",{"lang":1335,"date":1825,"categories":1826,"blogtitlepic":1827},"2026-07-06",[131],"head-the-holy-trinity","/posts/2026-07-06-the-holy-trinity","posts/2026-07-06-the-holy-trinity",[1805,131],{"id":1832,"title":1833,"author":1834,"cta":494,"description":1835,"hideInRecent":484,"layout":1333,"meta":1836,"moment":1837,"path":1841,"stem":1842,"tags":1843,"webcast":484},"content_da/posts/2026-07-01-onboarding-process.md","Kontrakten er skrevet under: Sådan forløber din onboarding hos os",[1648],"Hvordan forløber jeres onboarding egentlig? Det er et spørgsmål, vi støder på igen og igen i samtaler med ansøgere, for mange har oplevet, at en onboarding kan gå hakkende. Derfor er det så meget desto vigtigere for os, at du får en god fornemmelse helt fra begyndelsen.",{"lang":1335,"date":1837,"categories":1838,"blogtitlepic":1839,"customExcerpt":1840},"2026-07-01",[1772],"Onboarding_Blogheader","Kontrakten er skrevet under, det første store skridt er taget. Men hvad sker der nu? Vi tager dig med bag kulisserne i vores onboarding, fra PreBoarding til den første uge i teamet.","/posts/2026-07-01-onboarding-process","posts/2026-07-01-onboarding-process",[1844,1845,1846],"Employer Branding","Onboarding","Unternehmenskultur",{"id":1848,"title":1849,"author":1850,"cta":494,"description":1851,"hideInRecent":484,"layout":1333,"meta":1852,"moment":1853,"path":1857,"stem":1858,"tags":1859,"webcast":484},"content_da/posts/2026-06-26-frontier-partner.md","Microsoft Frontier Partner: vi er blandt de få",[1559],"I Microsofts partner-økosystem findes der en lang række anerkendelser, og alligevel skiller Frontier Partner Badge sig ud fra de øvrige udmærkelser i sin anlæg. Man kan ikke ansøge om det, det tildeles på Microsofts eget initiativ til en eksklusiv kreds af partnere, som skal overbevise i flere discipliner parallelt i stedet for at brillere i en enkelt. Microsoft vurderer dokumenteret kompetence inden for Cloud & AI Platforms, AI Business Solutions og Security i lige høj grad og henvender sig dermed til virksomheder, der ikke opfatter AI som en påbygning på eksisterende IT, men som resultatet af en gennemgående arkitektur, der bærer fra identiteten over endpointet og helt ind i produktiv AI-drift.",{"lang":1335,"date":1853,"categories":1854,"blogtitlepic":1855,"customExcerpt":1856},"2026-06-26",[1772],"head-frontier-partner-badge.jpg","Microsoft AI Cloud Partner Program har for nylig fået en ny topudmærkelse, Frontier Partner Badge. Microsoft tildeler den udelukkende til en eksklusiv kreds af partnere verden over, som leverer bæredygtige AI-projekter på hele Microsoft-stakken, fra arbejdspladsen over cloud-platformen og security og helt ind i selve AI-anvendelsen, og som har dokumenteret det i praksis. I DACH-området tæller den gruppe kun en håndfuld virksomheder, og vi er en af dem.","/posts/2026-06-26-frontier-partner","posts/2026-06-26-frontier-partner",[1778,1860,1805],"Microsoft Partner",{"id":1862,"title":1863,"author":1864,"cta":494,"description":1865,"hideInRecent":484,"layout":1333,"meta":1866,"moment":1867,"path":1871,"stem":1872,"tags":1873,"webcast":484},"content_da/posts/2026-06-09-vair-run.md","160 kilometer for en god sag",[1655],"Søndag morgen, klokken 8:30, Holbeinsteg ved Main. Elleve kolleger i ens NinjaCat-shirts, klar til Frankfurter Runden. Regn, lyn og torden inklusive. At løbe for en god sag var motivation nok til at snøre løbeskoene på trods af det dårlige vejr.",{"lang":1335,"date":1867,"categories":1868,"blogtitlepic":1869,"customExcerpt":1870},"2026-06-08",[1772],"frankfurter-runden.png","Elleve kolleger, 16 omgange, 160 kilometer, et tordenvejr og en podieplacering: glueckkanja var med til Frankfurter Runden 2026 og donerede for hver løbet omgang til VAIR e.V., der bygger en inkluderende sports- og kulturpark i Offenbach.","/posts/2026-06-09-vair-run","posts/2026-06-09-vair-run",[1874,1844,1875],"Top Arbeitgeber","Soziales Engagement",{"id":1877,"title":1878,"author":1879,"cta":494,"description":1880,"hideInRecent":484,"layout":1333,"meta":1881,"moment":1882,"path":1886,"stem":1887,"tags":1888,"webcast":484},"content_da/posts/2026-04-10-incident-to-intelligence.md","Anatomien af en ukendt AMOS Stealer: fra alert til immunitet på timer",[1636],"Når en alert udløses i vores SOC, begynder uret at løbe: ikke kun for den berørte kunde, men for alle organisationer under vores beskyttelse. Det farligste øjeblik i det moderne trusselslandskab er Intelligence Gap, tidsvinduet mellem den første anvendelse af en ny malwarevariant og den dag, branchen hører om den.",{"lang":1335,"date":1882,"categories":1883,"blogtitlepic":1884,"customExcerpt":1885},"2026-04-10",[1340],"head-amos-stealer.png","En hidtil udokumenteret AMOS Stealer-variant kompromitterede et macOS-endpoint. Ingen kendte hashes, ingen C2-data i offentlige databaser. Vores SOC skilte seks obfuskeringslag ad, udtrak alle indikatorer og rullede beskyttelsen ud til alle SOC-kunder inden for timer, endnu før branchen overhovedet havde set samplet.","/posts/2026-04-10-incident-to-intelligence","posts/2026-04-10-incident-to-intelligence",[1889,1890,1891,1892,1893],"Threat Intelligence","Incident Response","macOS Security","Malware Analysis","Cyber Security Operations Center",{"id":1895,"title":1896,"author":1897,"cta":494,"description":1898,"hideInRecent":484,"layout":1333,"meta":1899,"moment":1900,"path":1903,"stem":1904,"tags":494,"webcast":484},"content_da/posts/2026-03-21-microsoft-edge-corporate-browser.md","Derfor bør Edge være jeres eneste corporate browser",[1430],"Valget af browser er en strategisk beslutning i virksomhedsmiljøer, fordi det direkte påvirker, hvor meget sikkerhed og hvor stort et administrationsarbejde I reelt har. Google Chrome var længe den nærliggende mulighed, men Microsoft Edge har udviklet sig til en browser, der griber direkte ind i den eksisterende stak, især når Microsoft 365 er i brug, og administrationen kører gennem Intune.",{"lang":1335,"date":1900,"blogtitlepic":1901,"customExcerpt":1902},"2026-03-21","head-microsoft-edge-default-browser.jpg","Ingen virksomhed har for alvor valgt Chrome; den var der bare, med sin egen sync-logik, sin egen kontohåndtering og sin egen politikflade. Microsoft Edge griber derimod direkte ind i den infrastruktur, der alligevel kører: Entra ID, Intune, Defender. Dette indlæg viser, hvordan skiftet ser ud, hvordan Chrome omdirigeres til en landingpage via en Intune-politik, og hvad der falder væk, når man holder op med at drive to browsere parallelt.","/posts/2026-03-21-microsoft-edge-corporate-browser","posts/2026-03-21-microsoft-edge-corporate-browser",{"id":1906,"title":1907,"author":1908,"cta":494,"description":1909,"hideInRecent":484,"layout":1333,"meta":1910,"moment":1911,"path":1915,"stem":1916,"tags":1917,"webcast":484},"content_da/posts/2026-03-20-stryker-attack-intune-privilege.md","Én admin-konto var alt, hvad der skulle til.",[1533],"Onsdag den 11. marts 2026. Medarbejdere på Stryker-kontorer i 79 lande tændte deres computere og fandt dem tomme. Login-skærme erstattet af et logo. Firmabærbare, arbejdstelefoner, private enheder tilmeldt virksomhedens BYOD-program, alle slettet samtidig, natten over. Ingen ransomware, ingen malware-signaturer, intet, som et endpoint-detection-værktøj kunne have opdaget.",{"lang":1335,"date":1911,"categories":1912,"blogtitlepic":1913,"customExcerpt":1914},"2026-03-20",[1340],"head-stryker.jpg","Den 11. marts 2026 slettede Handala enheder i 79 lande, og alt, hvad der skulle til, var en kompromitteret Intune-admin-konto. Ingen malware, ingen exploit, kun legitime management-værktøjer vendt mod deres ejere. Hvad der skete, hvorfor det virkede, og hvilke to arkitektoniske huller der skal lukkes.","/posts/2026-03-20-stryker-attack-intune-privilege","posts/2026-03-20-stryker-attack-intune-privilege",[71,1761,1762],{"id":1919,"title":1920,"author":1921,"cta":494,"description":1922,"hideInRecent":484,"layout":1333,"meta":1923,"moment":1924,"path":1928,"stem":1929,"tags":1930,"webcast":484},"content_da/posts/2026-03-16-ai-agent-hackathon.md","Seks agenter. Fire uger. Rigtig drift.",[1559],"Hvor mange timer bruger jeres IT-afdeling om ugen på opgaver, som en agent kunne klare på minutter?",{"lang":1335,"date":1924,"categories":1925,"blogtitlepic":1926,"customExcerpt":1927},"2026-03-16",[1772],"head-ai-agent-hackathon.jpg","Seks virksomheder, fire ugers byggefase, seks fungerende AI Agents. Det var den første glueckkanja AI Agent Hackathon. Kiekert, Dr. Oetker, Eckes-Granini, igefa og lila logistik har bygget agenter i Copilot Studio, som kører produktivt i dag. Her er, hvad der kom ud af det, og hvordan formatet fungerer.","/posts/2026-03-16-ai-agent-hackathon","posts/2026-03-16-ai-agent-hackathon",[1805,1931,1932,1933],"Copilot Studio","Hackathon","AI Agents",{"Karsten Kleinschmidt":1935,"Fritz Zurhorst":1936,"Nadine Klein":1937,"Jan Geisbauer":1938,"Carolin Kanja":1942,"Anna Ulbricht":1943,"Annette Brauns":1944,"Pascal Asch":1945,"Steffen Schwerdtfeger":1946},{"display_name":1399,"avatar":1400,"permalink":1401,"twitter":1402,"linkedin":1403,"imageOffsetTop":1404,"imageOffsetLeft":1405},{"display_name":1373,"avatar":1374,"permalink":1375,"linkedin":1376,"imageOffsetTop":1377},{"display_name":1393,"avatar":1394,"permalink":1395,"twitter":1396,"linkedin":1397,"imageOffsetTop":1377},{"display_name":1533,"avatar":1534,"permalink":1535,"twitter":1536,"linkedin":1536,"imageOffsetTop":1377,"socials":1939},[1940,1941],{"text":472,"href":1539},{"text":1541,"href":1542},{"display_name":1559,"avatar":1560,"permalink":1561,"twitter":1562,"linkedin":1563},{"display_name":1648,"avatar":1649,"permalink":1650,"linkedin":1651,"imageOffsetTop":1652,"imageOffsetLeft":1653},{"display_name":1655,"avatar":1656,"permalink":1657,"linkedin":1658,"imageOffsetTop":1659,"imageOffsetLeft":1404},{"display_name":1636,"avatar":1637,"permalink":1638,"linkedin":1639,"imageOffsetTop":1476},{"display_name":1430,"avatar":1431,"permalink":1432,"linkedin":1433,"twitter":1434,"imageOffsetTop":1435,"imageOffsetLeft":1436},{"id":1368,"extension":1369,"meta":1948,"stem":8,"__hash__":1717},{"Christopher Brumm":1949,"Fabian Bader":1950,"Thomas Naunheim":1951},{"display_name":524,"avatar":1472,"permalink":1473,"twitter":1474,"linkedin":1475,"imageOffsetTop":1476},{"display_name":523,"avatar":1592,"permalink":1593,"linkedin":1594,"twitter":1595},{"display_name":525,"avatar":1627,"permalink":1628,"linkedin":1629,"imageOffsetTop":1476},1791383908991]